From 01b9d0784d13ee9a908651fe4cffd621a7927b16 Mon Sep 17 00:00:00 2001 From: Martin Velay Date: Tue, 22 Oct 2024 15:40:13 +0000 Subject: [PATCH] [hmac,sw] Workaround after hang - Implement a workaround in C cryptolib as HW is hanged after a stop in certain conditions. - Refer to issue #24767 Signed-off-by: Martin Velay --- sw/device/lib/crypto/drivers/BUILD | 1 + sw/device/lib/crypto/drivers/hmac.c | 104 +++++++++++++++++++++++++--- 2 files changed, 97 insertions(+), 8 deletions(-) diff --git a/sw/device/lib/crypto/drivers/BUILD b/sw/device/lib/crypto/drivers/BUILD index 0fe8705302d425..96ac47c3eca6c4 100644 --- a/sw/device/lib/crypto/drivers/BUILD +++ b/sw/device/lib/crypto/drivers/BUILD @@ -183,6 +183,7 @@ cc_library( "//sw/device/lib/base:macros", "//sw/device/lib/base:memory", "//sw/device/lib/crypto/impl:status", + "//sw/device/lib/runtime:log", ], ) diff --git a/sw/device/lib/crypto/drivers/hmac.c b/sw/device/lib/crypto/drivers/hmac.c index 3d10c2d962f6e2..3de4b9de3ce6db 100644 --- a/sw/device/lib/crypto/drivers/hmac.c +++ b/sw/device/lib/crypto/drivers/hmac.c @@ -9,6 +9,7 @@ #include "sw/device/lib/base/hardened.h" #include "sw/device/lib/base/memory.h" #include "sw/device/lib/crypto/impl/status.h" +#include "sw/device/lib/runtime/log.h" #include "hmac_regs.h" // Generated. #include "hw/top_earlgrey/sw/autogen/top_earlgrey.h" @@ -77,28 +78,42 @@ enum { * * TODO(#23191): It might be beneficial to have a timeout value for the polling. * - * @return Result of the operation. + * @param[out] status of the operation. + * @param[out] ctx Context to which values are written. + * @param[out] hw_recovered If HW has been recovered after a hang. */ -OT_WARN_UNUSED_RESULT -static status_t hmac_idle_wait(void) { +static void hmac_idle_wait( + status_t *status, hmac_ctx_t *ctx, bool *hw_recovered) { // Verify that HMAC HWIP is idle. // Initialize `status_reg = 0` so that the loop starts with the assumption // that HMAC HWIP is not idle. + // TODO: should be removed when issue #24767 will be solved in the HW + // | At max 4 clock cycles are required to perform a read access to the + // | register. As it should take less than 64 clock cycles in SHA2-256 and + // | 80 clock cycles in SHA2-384/512, let's take some margin and consider + // | that 50 loops are a way enough to see IDLE status. Otherwise we can + // | start to attempt to recover the HW. uint32_t status_reg = 0; + uint32_t attempt_cnt = 0; while (bitfield_bit32_read(status_reg, HMAC_STATUS_HMAC_IDLE_BIT) == 0) { status_reg = abs_mmio_read32(kHmacBaseAddr + HMAC_STATUS_REG_OFFSET); + attempt_cnt++; + if (attempt_cnt == 50) { + recover_hw_after_stop(ctx); + hw_recovered = true; + } } // Verify that HMAC HWIP raises `hmac_done` bit. uint32_t intr_reg = abs_mmio_read32(kHmacBaseAddr + HMAC_INTR_STATE_REG_OFFSET); if (bitfield_bit32_read(intr_reg, HMAC_INTR_STATE_HMAC_DONE_BIT) == 0) { - return OTCRYPTO_FATAL_ERR; + status = OTCRYPTO_FATAL_ERR; } // Clear the interrupt by writing 1, because `INTR_STATE` is rw1c type. abs_mmio_write32(kHmacBaseAddr + HMAC_INTR_STATE_REG_OFFSET, intr_reg); - return OTCRYPTO_OK; + status = OTCRYPTO_OK; } /** @@ -256,6 +271,72 @@ static void msg_fifo_write(const uint8_t *message, size_t message_len) { } } +/** + * Recover HW after a stop has been triggered too long after the block boundary + * + * Temporary workaround linked to issue #24767 + * This function make the HW going into different states to move back on a + * working state. This is required when the stop has been issued later than the + * HW requires to compute the HASH. This duration is equivalent to 64 clock + * cycles in SHA2-256 and 80 clock cycles in SHA2-384/512. + * + * @param[out] ctx Context to which values are written. + */ +static void recover_hw_after_stop(hmac_ctx_t *ctx) { + // Save current context as it it updated after each block even if stop is not + // triggered + context_save(ctx); + + // Store if HMAC is enabled of not + uint32_t cfg_reg = abs_mmio_read32(kHmacBaseAddr + HMAC_CFG_REG_OFFSET); + uint32_t hmac_en = bitfield_field32_read(cfg_reg, HMAC_CFG_HMAC_EN_BIT); + + // Disable the HMAC to trigger sha_hash_continue_o based on the register + // reg_hash_continue from hmac_core.sv + cfg_reg = bitfield_bit32_write(cfg_reg, HMAC_CFG_HMAC_EN_BIT, false); + abs_mmio_write32(kHmacBaseAddr + HMAC_CFG_REG_OFFSET, cfg_reg); + + // Trigger HASH continue to move from StIdle state to StFifoReceive from + // prim_sha2_pad.sv this will enable us to trigger shaf_rvalid_o later, this + // will unlock us from the state fifo_st_q==FifoLoadFromFifo in the block + // prim_sha2.sv. + cmd_reg = abs_mmio_read32(kHmacBaseAddr + HMAC_CMD_REG_OFFSET); + cmd_reg = bitfield_bit32_write(cmd_reg, HMAC_CMD_HASH_CONTINUE_BIT, true); + abs_mmio_write32(kHmacBaseAddr + HMAC_CMD_REG_OFFSET, cmd_reg); + + // Get the current message length to know how much words we need to write to + // fall on the block boundary and trigger digest_on_blk to be able to move + // into done_state_d==DoneAwaitCmd in hmac.sv this will then lead to trigger + // hash_done_event and be back in a stable state on all the FSMs. + msg_len = abs_mmio_read32(kHmacBaseAddr + HMAC_MSG_LENGTH_LOWER_REG_OFFSET); + uint32_t digest_size = + bitfield_field32_read(cfg_reg, HMAC_CFG_DIGEST_SIZE_FIELD); + + // Compute next block boundary + uint32_t msg_length_to_wr; + // SHA2-256 mode + if (digest_size == 1) { + msg_length_to_wr = kHmacSha256BlockBits - msg_len % kHmacSha256BlockBits; + } else { + msg_length_to_wr = kHmacSha512BlockBits - msg_len % kHmacSha512BlockBits; + } + + // Write a dummy message into the message FIFO to trigger shaf_rvalid_o + // from prim_sha2_pad.sv + for (int i=0; i