Enable crypto HW acceleration for STM32F437xG platforms #4898

RobMeades · 2017-08-14T10:48:53Z

Enable crypto HW acceleration for STM43F437xG platforms, i.e. ublox C030 family boards.

mbed-os-example-tls/benchmark/ before:

  SHA-256                  :       2936 KB/s
  SHA-512                  :        886 KB/s
  AES-CBC-128              :       2315 KB/s
  AES-CBC-192              :       2031 KB/s
  AES-CBC-256              :       1810 KB/s
  AES-GCM-128              :        708 KB/s
  AES-GCM-192              :        679 KB/s
  AES-GCM-256              :        652 KB/s
  AES-CCM-128              :        957 KB/s
  AES-CCM-192              :        857 KB/s
  AES-CCM-256              :        776 KB/s
  CTR_DRBG (NOPR)          :       1922 KB/s
  CTR_DRBG (PR)            :       1361 KB/s
  HMAC_DRBG SHA-256 (NOPR) :        337 KB/s
  HMAC_DRBG SHA-256 (PR)   :        296 KB/s
  RSA-2048                 :      20 ms/ public
  RSA-2048                 :     782 ms/private
  RSA-4096                 :      68 ms/ public
  RSA-4096                 :    4160 ms/private
  ECDHE-secp384r1          :     696 ms/handshake
  ECDHE-secp256r1          :     461 ms/handshake
  ECDHE-Curve25519         :     386 ms/handshake
  ECDH-secp384r1           :     343 ms/handshake
  ECDH-secp256r1           :     232 ms/handshake
  ECDH-Curve25519          :     192 ms/handshake

....and after:

  SHA-256                  :      15081 KB/s
  SHA-512                  :        886 KB/s
  AES-CBC-128              :      31542 KB/s
  AES-CBC-192              :      31542 KB/s
  AES-CBC-256              :      31542 KB/s
  AES-GCM-128              :        913 KB/s
  AES-GCM-192              :        913 KB/s
  AES-GCM-256              :        903 KB/s
  AES-CCM-128              :       2172 KB/s
  AES-CCM-192              :       2172 KB/s
  AES-CCM-256              :       2170 KB/s
  CTR_DRBG (NOPR)          :       8512 KB/s
  CTR_DRBG (PR)            :       5244 KB/s
  HMAC_DRBG SHA-256 (NOPR) :        470 KB/s
  HMAC_DRBG SHA-256 (PR)   :        411 KB/s
  RSA-2048                 :      20 ms/ public
  RSA-2048                 :     781 ms/private
  RSA-4096                 :      68 ms/ public
  RSA-4096                 :    4054 ms/private
  ECDHE-secp384r1          :     692 ms/handshake
  ECDHE-secp256r1          :     461 ms/handshake
  ECDHE-Curve25519         :     385 ms/handshake
  ECDH-secp384r1           :     339 ms/handshake
  ECDH-secp256r1           :     232 ms/handshake
  ECDH-Curve25519          :     199 ms/handshake

Test results for mbed-os-tests-mbedtls-selftest:

+-------------------------+-----------------+--------------------------------+---------------------------+--------+--------+--------+--------------------+
| target                  | platform_name   | test suite                     | test case                 | passed | failed | result | elapsed_time (sec) |
+-------------------------+-----------------+--------------------------------+---------------------------+--------+--------+--------+--------------------+
| UBLOX_C030_U201-GCC_ARM | UBLOX_C030_U201 | mbed-os-tests-mbedtls-selftest | mbedtls_entropy_self_test | 1      | 0      | OK     | 0.06               |
| UBLOX_C030_U201-GCC_ARM | UBLOX_C030_U201 | mbed-os-tests-mbedtls-selftest | mbedtls_sha256_self_test  | 1      | 0      | OK     | 0.11               |
| UBLOX_C030_U201-GCC_ARM | UBLOX_C030_U201 | mbed-os-tests-mbedtls-selftest | mbedtls_sha512_self_test  | 1      | 0      | OK     | 1.98               |
+-------------------------+-----------------+--------------------------------+---------------------------+--------+--------+--------+--------------------+

NOTE: this should only be merged once PR #5018 (which fixes an AES HW crypto driver issue) has been merged.

…030 family).

theotherjimmy · 2017-08-14T16:05:19Z

retest uvisor

theotherjimmy · 2017-08-14T16:05:44Z

@yanesca Could you review

0xc0170 · 2017-08-15T07:25:21Z

retest uvisor

0xc0170 · 2017-08-15T07:26:25Z

@RonEld @andresag01 please review tihs addition

RonEld

@0xc0170

andresag01

@RobMeades: Thanks for your contribution! The changes look good.

0xc0170 · 2017-08-17T14:55:43Z

retest uvisor

andresag01 · 2017-08-18T16:08:42Z

@yanesca, @0xc0170: There was a recent bug report for AES hardware acceleration on STM32F439xI: #4928. This PR looks good to me, but given that STM32F439xI and STM32F437xG share the same aes_alt.h and aes_alt.c in this folder I suggest we test the change using the tls-client before merging.

0xc0170 · 2017-08-21T10:56:14Z

@yanesca, @0xc0170: There was a recent bug report for AES hardware acceleration on STM32F439xI: #4928. This PR looks good to me, but given that STM32F439xI and STM32F437xG share the same aes_alt.h and aes_alt.c in this folder I suggest we test the change using the tls-client before merging.

@RobMeades Can you confirm ?

0xc0170 · 2017-08-21T10:56:49Z

retest uvisor

RobMeades · 2017-08-21T12:19:07Z

@0xc0170 I only ran the benchmarks from within mbed-os-example-tls and these seemed to run as expected. I can confirm, though, that the HW crypto source files are shared between all STM32F4 devices, so if there's an issue it should be common.

RobMeades · 2017-08-21T12:35:49Z

@andresag01 , @yanesca, @0xc0170 : I've just tried running the tls-client example on this code and, with the change in #4934 not included, it returns:

Using Ethernet LWIP
Client IP Address is 10.38.20.108
Connecting with developer.mbed.org
Starting the TLS handshake...
TLS connection to developer.mbed.org established
Server certificate:

    cert. version     : 3
    serial number     : 65:7B:6D:8D:15:A5:B6:86:87:6B:5E:BC
    issuer name       : C=BE, O=GlobalSign nv-sa, CN=GlobalSign Organization Validation CA - SHA256 - G2
    subject name      : C=GB, ST=Cambridgeshire, L=Cambridge, O=ARM Ltd, CN=*.mbed.com
    issued  on        : 2017-04-03 13:54:02
    expires on        : 2018-05-06 10:31:02
    signed using      : RSA with SHA-256
    RSA key size      : 2048 bits
    basic constraints : CA=false
    subject alt name  : *.mbed.com, mbed.org, *.mbed.org, mbed.com
    key usage         : Digital Signature, Key Encipherment
    ext key usage     : TLS Web Server Authentication, TLS Web Client Authentication
Certificate verification passed

HTTPS: Received 438 chars from server
HTTPS: Received 200 OK status ... [OK]
HTTPS: Received 'Hello world!' status ... [OK]
HTTPS: Received message:

HTTP/1.1 200 OK
Server: nginx/1.11.12
Date: Mon, 21 Aug 2017 12:32:28 GMT
Content-Type: text/plain
Content-Length: 14
Connection: keep-alive
Last-Modified: Fri, 27 Jul 2012 13:30:34 GMT
Accept-Ranges: bytes
Cache-Control: max-age=36000
Expires: Mon, 21 Aug 2017 22:32:28 GMT
X-Upstream-L3: 172.17.0.4:80
X-Upstream-L2: developer-sjc-cyan-1-nginx
Strict-Transport-Security: max-age=31536000; includeSubdomains

Hello world!

This looks correct to me...?

theotherjimmy · 2017-08-21T15:30:00Z

retest uvisor

theotherjimmy · 2017-08-21T15:30:21Z

/morph test-nightly

mbed-bot · 2017-08-22T02:18:48Z

Result: SUCCESS

Your command has finished executing! Here's what you wrote!

/morph test-nightly

Output

mbed Build Number: 1064

All builds and test passed!

yanesca · 2017-08-22T10:57:04Z

My current estimate is that I can start looking at this by the end of next week.

0xc0170 · 2017-08-23T05:06:41Z

retest uvisor

0xc0170 · 2017-09-01T11:07:58Z

@yanesca, @0xc0170: There was a recent bug report for AES hardware acceleration on STM32F439xI: #4928. This PR looks good to me, but given that STM32F439xI and STM32F437xG share the same aes_alt.h and aes_alt.c in this folder I suggest we test the change using the tls-client before merging.

@RobMeades Is that correct? You above test says otherwise. We are currently disabling AES for those platform until it's fixed. If they share the implementation, how come this one does not fail?

@andresag01 I noticed you are happy with testing above, thus approved this addition?

RobMeades · 2017-09-01T11:47:11Z

The HW crypto source files are certainly shared between all STM32F4 devices and I was able to pass the test. Maybe there is some other factor involved in causing the failure?

0xc0170 · 2017-09-01T13:14:39Z

The HW crypto source files are certainly shared between all STM32F4 devices and I was able to pass the test. Maybe there is some other factor involved in causing the failure?

that is what is unknown to me. To be certain, I would like to have one more test run on this target. @andresag01 @yanesca @RonEld What is your stand? Can you run quickly the test above on this platform to confirm the passing the test to accept this addition

yanesca · 2017-09-01T13:28:03Z

I am sorry, but I still need to review this before we can accept it and I am even more sorry that I couldn't review this yet. Unfortunately at this point I have no estimate when can I do the review, but I will do it as soon as I can!

@RobMeades When you say that this has passed the test, do you mean compiling and successfully running on target the tls-client application from the https://github.com/ARMmbed/mbed-os-example-tls repository?

RobMeades · 2017-09-01T13:49:49Z

@yanesca: yes, that's correct, with the change in #4934 removed so I am using HW crypto. I'll try it again from scratch on Monday just to be sure.

RobMeades · 2017-09-04T09:45:05Z

Well, it seems I was wrong. I've retrieved the latest https://github.com/ARMmbed/mbed-os-example-tls, made sure that tls-client has the latest mbed-os, added this change and then compiled and run the tls-client example on my STM32F437 target. If I have HW crypto on for AES it reports:

Using Ethernet LWIP
Client IP Address is 10.38.20.210
Connecting with developer.mbed.org
Starting the TLS handshake...
mbedtls_ssl_handshake() failed: -0x7780 (-30592): SSL - A fatal alert message was received from our peer

...and stops, while if I switch off HW crypto for AES it reports:

Using Ethernet LWIP
Client IP Address is 10.38.20.210
Connecting with developer.mbed.org
Starting the TLS handshake...
TLS connection to developer.mbed.org established
.etc...

...and ends with "Hello world!"

So I guess this is the issue reported in #4928. Over in #4928 I see that Martin comments: "The fix will get CI once CI is back running", but I can't see anything in the comments to indicate that there is a fix. If there is one in the pipeline, this PR can wait for it. If there is not, I will re-submit this PR with MBEDTLS_AES_ALT left out.

RobMeades · 2017-09-05T11:36:32Z

I suggest that we only merge this change once #5018 has been merged, I will update the description to clarify that.

ciarmcom · 2017-09-07T19:50:38Z

ARM Internal Ref: IOTSSL-1720

0xc0170 · 2017-09-28T12:37:54Z

I suggest that we only merge this change once #5018 has been merged, I will update the description to clarify that.

That PR was merged. What is remaining here?

andresag01 · 2017-09-28T12:44:33Z

@0xc0170: We should wait for @yanesca to approve the changes as well before merging.

yanesca

Looks good to me!

0xc0170 · 2017-10-10T12:07:36Z

@RobMeades All good with this one, to trigger CI?

RobMeades · 2017-10-10T12:08:30Z

Yup, should be no other dependencies.

mbed-ci · 2017-10-10T12:33:52Z

Build : FAILURE

Build number : 54
Build artifacts/logs : http://mbed-os.s3-website-eu-west-1.amazonaws.com/?prefix=builds/4898/

0xc0170 · 2017-10-11T12:12:48Z

/morph build

mbed-ci · 2017-10-11T14:32:32Z

Build : SUCCESS

Build number : 118
Build artifacts/logs : http://mbed-os.s3-website-eu-west-1.amazonaws.com/?prefix=builds/4898/

Triggering tests

/test mbed-os

mbed-ci · 2017-10-12T13:23:42Z

Test : SUCCESS

Build number : 58
Test logs :http://mbed-os-logs.s3-website-us-west-1.amazonaws.com/?prefix=logs/4898/58

0xc0170 · 2017-10-12T13:53:32Z

This patch is now ready for integration

Enable crypto HW acceleration for STM32F437xG platforms (i.e. ublox C…

410a345

…030 family).

theotherjimmy added the needs: review label Aug 14, 2017

RonEld approved these changes Aug 15, 2017

View reviewed changes

andresag01 approved these changes Aug 16, 2017

View reviewed changes

0xc0170 added needs: CI and removed needs: review labels Aug 17, 2017

adbridge requested a review from yanesca August 24, 2017 11:15

adbridge added needs: review and removed needs: CI labels Aug 24, 2017

0xc0170 added needs: clarification and removed needs: review labels Sep 1, 2017

adbridge added component: security tracking labels Sep 7, 2017

ciarmcom added the mirrored label Sep 7, 2017

theotherjimmy added the needs: preceding PR label Sep 14, 2017

0xc0170 removed the needs: preceding PR label Sep 28, 2017

yanesca approved these changes Oct 10, 2017

View reviewed changes

0xc0170 removed the needs: clarification label Oct 10, 2017

0xc0170 added the needs: CI label Oct 10, 2017

0xc0170 added ready for merge and removed needs: CI labels Oct 12, 2017

theotherjimmy merged commit 2f652be into ARMmbed:master Oct 13, 2017

theotherjimmy added release-version: 5.6.3 and removed ready for merge labels Oct 13, 2017

ciarmcom added the closed_in_jira label Oct 13, 2017

Enable crypto HW acceleration for STM32F437xG platforms #4898

Enable crypto HW acceleration for STM32F437xG platforms #4898

Uh oh!

Conversation

RobMeades commented Aug 14, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

theotherjimmy commented Aug 14, 2017

Uh oh!

theotherjimmy commented Aug 14, 2017

Uh oh!

0xc0170 commented Aug 15, 2017

Uh oh!

0xc0170 commented Aug 15, 2017

Uh oh!

RonEld left a comment

Choose a reason for hiding this comment

Uh oh!

andresag01 left a comment

Choose a reason for hiding this comment

Uh oh!

0xc0170 commented Aug 17, 2017

Uh oh!

andresag01 commented Aug 18, 2017

Uh oh!

0xc0170 commented Aug 21, 2017

Uh oh!

0xc0170 commented Aug 21, 2017

Uh oh!

RobMeades commented Aug 21, 2017

Uh oh!

RobMeades commented Aug 21, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

theotherjimmy commented Aug 21, 2017

Uh oh!

theotherjimmy commented Aug 21, 2017

Uh oh!

mbed-bot commented Aug 22, 2017

Result: SUCCESS

Output

Uh oh!

yanesca commented Aug 22, 2017

Uh oh!

0xc0170 commented Aug 23, 2017

Uh oh!

0xc0170 commented Sep 1, 2017

Uh oh!

RobMeades commented Sep 1, 2017

Uh oh!

0xc0170 commented Sep 1, 2017

Uh oh!

yanesca commented Sep 1, 2017

Uh oh!

RobMeades commented Sep 1, 2017

Uh oh!

RobMeades commented Sep 4, 2017 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

RobMeades commented Sep 5, 2017

Uh oh!

ciarmcom commented Sep 7, 2017

Uh oh!

0xc0170 commented Sep 28, 2017

Uh oh!

andresag01 commented Sep 28, 2017

Uh oh!

yanesca left a comment

Choose a reason for hiding this comment

Uh oh!

0xc0170 commented Oct 10, 2017

Uh oh!

RobMeades commented Oct 10, 2017

Uh oh!

mbed-ci commented Oct 10, 2017

Build : FAILURE

Uh oh!

0xc0170 commented Oct 11, 2017

Uh oh!

mbed-ci commented Oct 11, 2017

RobMeades commented Aug 14, 2017 •

edited

Loading

RobMeades commented Aug 21, 2017 •

edited

Loading

RobMeades commented Sep 4, 2017 •

edited

Loading