nrf_security: drivers: cracen: Add workaround for ikg issues on 54l09/54l20

Add workaround to handle freezing issue on CRACEN Lite  devices.
Add compile time error for building with CRACEN Lite and not 54l09/54l20
As the developers should make a decisions if the workaround is needed.

This issue stems from the PKE-IKG interrupt not being cleared.
To handle this sx_pk_wait is changed to use polling and
the PKE-IKG interrupt is disabled except for when in PK mode.
In PK mode the interrupt can be cleared by hardware, which means it
can be used there.

Ref DLT-4048

Signed-off-by: Dag Erik Gjørvad <dag.erik.gjorvad@nordicsemi.no>

Author: degjorva

subsys/nrf_security/src/drivers/cracen/silexpk/target/baremetal_ba414e_with_ik/pk_baremetal.c

@@ -23,6 +23,11 @@
 #include <security/cracen.h>
 #include <nrf_security_mutexes.h>
 
+#if CONFIG_CRACEN_HW_VERSION_LITE && !CONFIG_SOC_NRF54L20 && !CONFIG_SOC_NRF54L09
+#error Check to see if the current board needs the IKG-PKE interrupt workaround or not, \
+then update this error
+#endif
+
 #ifndef ADDR_BA414EP_REGS_BASE
 #define ADDR_BA414EP_REGS_BASE CRACEN_ADDR_BA414EP_REGS_BASE
 #endif
@@ -92,9 +97,15 @@ int read_status(sx_pk_req *req)
 int sx_pk_wait(sx_pk_req *req)
 {
 	do {
+#ifndef CONFIG_CRACEN_HW_VERSION_LITE
+		/* In CRACEN Lite the PKE-IKG interrupt is only active when in PK mode.
+		 * This is to work around a hardware issue where the interrupt is never cleared.
+		 * Therefore sx_pk_wait needs to use polling and not interrupts for CRACEN Lite.
+		 */
 		if (!sx_pk_is_ik_cmd(req)) {
 			cracen_wait_for_pke_interrupt();
 		}
+#endif
 	} while (is_busy(req));
 
 	return read_status(req);
@@ -196,7 +207,13 @@ struct sx_pk_acq_req sx_pk_acquire_req(const struct sx_pk_cmd_def *cmd)
 	req.req->cnx = &silex_pk_engine;
 
 	cracen_acquire();
+#ifndef CONFIG_CRACEN_HW_VERSION_LITE
+	/* In CRACEN Lite the PKE-IKG interrupt is only active when in PK mode.
+	 * This is to work around a hardware issue where the interrupt is never cleared.
+	 * Therefore it is not enabled here for Cracen Lite.
+	 */
 	nrf_cracen_int_enable(NRF_CRACEN, NRF_CRACEN_INT_PKE_IKG_MASK);
+#endif
 
 	/* Wait until initialized. */
 	while (ba414ep_is_busy(req.req) || ik_is_busy(req.req)) {

subsys/nrf_security/src/drivers/cracen/silexpk/target/hw/ik/ikhardware.c

@@ -18,6 +18,9 @@
 #include "regs_addr.h"
 #include <silexpk/ec_curves.h>
 #include <silexpk/ik.h>
+#ifdef CONFIG_CRACEN_HW_VERSION_LITE
+#include "hal/nrf_cracen.h"
+#endif
 
 int cracen_prepare_ik_key(const uint8_t *user_data);
 
@@ -48,6 +51,16 @@ void sx_pk_run(sx_pk_req *req)
 	if (sx_pk_is_ik_cmd(req)) {
 		sx_pk_wrreg(&req->regs, IK_REG_PK_CONTROL,
 			    IK_PK_CONTROL_START_OP | IK_PK_CONTROL_CLEAR_IRQ);
+#ifdef CONFIG_CRACEN_HW_VERSION_LITE
+		/* Workaround to handle IKG freezing on CRACEN lite.
+		 * THE PKE-IKG interrupt can not be cleared from software, but can
+		 * be cleared by hardware when in PK mode.
+		 * So the interrupt is disabled after leaving PK mode and enabled when entering.
+		 */
+		if (req->cmd != SX_PK_CMD_IK_EXIT) {
+			nrf_cracen_int_enable(NRF_CRACEN, CRACEN_INTENCLR_PKEIKG_Msk);
+		}
+#endif
 	} else {
 		sx_pk_wrreg(&req->regs, PK_REG_CONTROL,
 			    PK_RB_CONTROL_START_OP | PK_RB_CONTROL_CLEAR_IRQ);
@@ -75,11 +88,18 @@ int sx_pk_list_ik_inslots(sx_pk_req *req, unsigned int key, struct sx_pk_slot *i
 	const struct sx_pk_capabilities *caps;
 
 	if (req->cmd->cmdcode == PK_OP_IK_EXIT) {
+#ifdef CONFIG_CRACEN_HW_VERSION_LITE
+		/* Workaround to handle IKG freezing on CRACEN lite.
+		 * THE PKE-IKG interrupt can not be cleared from software, but can
+		 * be cleared by hardware when in PK mode.
+		 * so the interrupt is disabled after leaving PK mode and enabled when entering.
+		 */
+		nrf_cracen_int_disable(NRF_CRACEN, CRACEN_INTENCLR_PKEIKG_Msk);
+#endif
 		req->ik_mode = 0;
 	} else {
 		if (!req->ik_mode) {
 			int status = cracen_prepare_ik_key((uint8_t *)&key);
-
 			if (status != SX_OK) {
 				sx_pk_release_req(req);
 				return SX_ERR_INVALID_PARAM;