TI C2000: hardware AES accelerator and oscillator-jitter entropy source - #11202
TI C2000: hardware AES accelerator and oscillator-jitter entropy source#11202dgarske wants to merge 2 commits into
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds TI C2000 (C28x) platform support in wolfCrypt by introducing a hardware AES accelerator backend (AESA/EIP-120t) via crypto callbacks, a new generic SP800-90B-style “noise source” conditioning layer with a C2000 oscillator-jitter entropy port, and several fixes for CHAR_BIT != 8 correctness defects (notably affecting AES counter handling and seed testing) so the same codepaths behave correctly on wide-byte targets.
Changes:
- Add TI C2000 AESA hardware AES offload through
WOLF_CRYPTO_CB(ECB/CBC/CTR) plus build/docs scaffolding. - Add a generic
wc_NoiseSrc_*module (startup/continuous health tests + SHA-256 conditioning) and a TI C2000 DCC-based oscillator-jitter entropy implementation gated byWOLFSSL_C2000_ENTROPY. - Fix multiple
CHAR_BIT != 8issues in AES/GCM/CCM and RNG seed testing, and add a host-side synthetic test (noisesrc_test) to exercise failure paths.
Reviewed changes
Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
wolfssl/wolfcrypt/random.h |
Declares the generic wc_NoiseSrc_* API and config, and enables WOLFSSL_NOISE_SRC implicitly for the C2000 entropy port. |
wolfssl/wolfcrypt/port/ti/ti-c2000.h |
Public header for C2000 AESA crypto-callback integration (devId, locking requirements, base addresses). |
wolfssl/wolfcrypt/port/ti/ti-c2000-entropy.h |
Public header/config for C2000 DCC oscillator-jitter entropy and its tuning/health-test parameters. |
wolfssl/wolfcrypt/include.am |
Adds the new TI C2000 public headers to the build system. |
wolfcrypt/test/test.c |
Adds noisesrc_test() to exercise the new noise-source layer on host builds. |
wolfcrypt/src/random.c |
Implements wc_NoiseSrc_*, wires in the C2000 entropy-backed wc_GenerateSeed branch, and hardens wc_RNG_TestSeed for wide bytes. |
wolfcrypt/src/port/ti/ti-c2000-entropy.c |
Implements the C2000 DCC sampling hardware backend and configures a global wc_NoiseSrc instance. |
wolfcrypt/src/port/ti/ti-c2000-aes.c |
Implements AESA offload for ECB/CBC/CTR via crypto callbacks with explicit octet packing for wide-byte C28x. |
wolfcrypt/src/include.am |
Adds the new C2000 port .c files to EXTRA_DIST. |
wolfcrypt/src/aes.c |
Fixes multiple CHAR_BIT != 8 issues (counter increments, GCM length flattening, CCM auth length encode, CFB1 feedback shifting, keywrap decrement). |
IDE/C2000/user_settings.h |
Updates the C2000 template to correctly set WC_16BIT_CPU sizing and enable crypto callbacks in the guard build. |
IDE/C2000/README.md |
Adds detailed documentation for the AESA offload and the entropy design/configuration/characterization. |
IDE/C2000/compile.sh |
Adjusts include order for user_settings.h, compiles cryptocb, and adds guard legs for noise-src and optional driverlib-backed ports. |
.wolfssl_known_macro_extras |
Registers the newly introduced/used build macros. |
Suppressed comments (1)
wolfcrypt/src/random.c:4351
- In
wc_NoiseSrc_GenerateSeed, an uncredited source is dropped (src->degraded |= ...) on any non-zeroret, including sampler errors fromNoiseSrc_Gather. The header comment states sampler errors should propagate (retryable) and only health-test/self-test verdicts should cause a persistent degradation. Dropping the source on a transient gather error is both a behavior/documentation mismatch and can mask flaky hardware/clocking issues by silently reducing the configured noise-source set.
ret = NoiseSrc_Gather(src, raw, src->rawPerSrc, i);
if (ret == 0) {
ret = NoiseSrc_HealthTest(src, raw, src->rawPerSrc, i);
}
if (ret != 0) {
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
retest this please |
|
|
Jenkins retest this please |
|
Jenkins retest this please |
|
Jenkins retest this please. History lost (so lame) |
|
Retest this please. (no logs) |
dgarske
changed the title
dgarske
changed the title
58e516c to
38f4585
Compare
There was a problem hiding this comment.
🔵 Needs a closer look
It introduces substantial security-sensitive RNG and cryptographic offload logic (plus wide-byte correctness fixes) that warrants final maintainer review beyond automated assessment.
Review details
- Files reviewed: 14/14 changed files
- Comments generated: 1
- Review effort level: Lite
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11202
Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
…eed for wide bytes
38f4585 to
5a204a6
Compare
|
Jenkins retest this please |
There was a problem hiding this comment.
🟡 Changes recommended
The new wc_NoiseSrc gather path should octet-mask samples after sampleCb on wide-byte targets to avoid hashing unintended high bits and to keep “octet” semantics consistent.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 14/14 changed files
- Comments generated: 2
- Review effort level: Lite
| for (i = 0; i < len; i++) { | ||
| ret = src->sampleCb(src->ctx, srcIdx, &out[i]); | ||
| if (ret != 0) { | ||
| return ret; | ||
| } | ||
| } |
| static void c2000_clkEnable(uint32_t base) | ||
| { | ||
| if (base == DCC0_BASE) { | ||
| SysCtl_enablePeripheral(SYSCTL_PERIPH_CLK_DCC0); | ||
| } | ||
| else { | ||
| SysCtl_enablePeripheral(SYSCTL_PERIPH_CLK_DCC1); | ||
| } | ||
| } | ||
| static void c2000_clkDisable(uint32_t base) | ||
| { | ||
| if (base == DCC0_BASE) { | ||
| SysCtl_disablePeripheral(SYSCTL_PERIPH_CLK_DCC0); | ||
| } | ||
| else { | ||
| SysCtl_disablePeripheral(SYSCTL_PERIPH_CLK_DCC1); | ||
| } | ||
| } |
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #11202
Scan targets checked: wolfcrypt-bugs, wolfcrypt-port-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src
Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
| { | ||
| /* Not gated on inited: a startup-test failure returns before that is set, | ||
| * and the clocks are already on by then. */ | ||
| DCC_disableModule(WOLFSSL_C2000_ENTROPY_SRC0_DCC); |
There was a problem hiding this comment.
wc_c2000_Entropy_Free() writes DCC registers with the peripheral clock gated · Resource leaks on error paths
wc_c2000_Entropy_Init() guards the clock enable with c2000_clkOn, but _Free() has no matching guard: a second _Free(), or a _Free() with no prior _Init(), executes DCC_disableModule() and SysCtl_disablePeripheral() while the DCC peripheral clock is already gated off.
Fix: Return early from wc_c2000_Entropy_Free() when c2000_clkOn is 0 (or track a separate configured flag), making the teardown idempotent.
| return WC_TEST_RET_ENC_NC; | ||
| if (wc_NoiseSrc_Init(&src) != WC_NO_ERR_TRACE(ENTROPY_RT_E)) | ||
| return WC_TEST_RET_ENC_NC; | ||
| if (wc_NoiseSrc_GenerateSeed(&src, seed1, (word32)sizeof(seed1)) != |
There was a problem hiding this comment.
Post-startup health-test failure and seed wipe in wc_NoiseSrc_GenerateSeed are never exercised · Missing edge-case coverage on a function the PR also changed
Every synthetic bad source in noisesrc_test() fails inside wc_NoiseSrc_Init, so the continuous-test branch in wc_NoiseSrc_GenerateSeed (random.c:4354-4362), its gather-error path (4351) and the ForceZero(outStart, outLen) seed wipe (4408) are unreachable by the suite. The module's central fail-closed guarantee ships untested.
Fix: Add a sampler mode that turns stuck/erroring only after startupOctets samples, then assert wc_NoiseSrc_GenerateSeed returns the health error, zeroes the output buffer, and degrades source 1 rather than failing.
b6d3958 to
5a204a6
Compare
Add TI C2000 AESA hardware AES port and fix CHAR_BIT!=8 AES defectsbrings up the on-chip AESA accelerator (a TI EIP-120t) for ECB/CBC/CTR at 128/192/256 bits as a crypto-callback device gated onWOLFSSL_C2000_AES, so software AES stays compiled in, one image can run identical NIST vectors through both paths and compare, and anything unsupported returnsCRYPTOCB_UNAVAILABLE. Measured 5.2x-7.3x on ECB/CBC and 3.6x-4.4x on CTR. Two device behaviours are worth a look, both documented inline: octet packing is done explicitly (driverlib takesuint32_t*, and staging deliberately usesuint32_trather thanword32, which is only 32-bit underWC_16BIT_CPU), and CTR is driven through hardware ECB with a software counter because the block's own counter does not carry across octet boundaries the wayIncrementAesCounter()does. The commit also fixes fourCHAR_BIT != 8defects that all reproduce in a pure software build with no device registered and are no-ops atCHAR_BIT == 8: counter carry never propagating (if (++inOutCtr[i])sees0xFF + 1as truthy0x100) across five increment helpers plusDecrementKeyWrapCounter,shiftLeftArray()letting CFB1 feedback cells exceed0xFF,FlattenSzInBits()building the GCM length block at 16 bits becausesizeofcounts cells, androll_auth()putting oversized cells into the CCM CBC-MAC input.Add TI C2000 oscillator-jitter entropy source and harden wc_RNG_TestSeed for wide bytesreplaces the dev-only seed. The part has no TRNG, so the noise bit is the LSB of a Dual-Clock Comparator measurement -- PLL edges counted inside a window of INTOSC cycles, i.e. the relative phase drift of two independent oscillators -- measured on hardware at 0.924 bits of min-entropy per bit (SP800-90B 6.3.1 MCV with bias and correlation screening, not a full non-IID assessment), oversampled about 4x and fed to the existing Hash-DRBG. Almost none of that is C2000-specific, so the reusable half is a new platform-agnostic module inrandom.cbehindWOLFSSL_NOISE_SRC: a port supplies onewc_NoiseSampleCbreturning a raw octet plus a config struct, andwc_NoiseSrc_*owns the SP800-90B 4.3 startup test, the 4.4.1/4.4.2 continuous tests, the entropy budget, the SHA-256 conditioner and the latched fail-closed state, with no mallocs and no locks. Only test verdicts latch, not sampler errors. The payoff is that those failure paths, which previously only fired on broken silicon, now run on every host build vianoisesrc_test()with synthetic stuck, biased, sampler-error and periodic sources. Also fixeswc_RNG_TestSeed(), which indexes a 256-entry array with a byte cell that can exceed 255 whereCHAR_BIT != 8-- unreachable until a real entropy source returns unmasked values, which is exactly what this commit adds. Verified withmake checkat--enable-all, again with-DWOLFSSL_NOISE_SRC, and again with--enable-smallstack(the C2000 config);IDE/C2000/compile.shcompiles both port files andrandom.cwith the entropy gate under cl2000 atCHAR_BIT == 16; on-hardware runs cover 14 HW-vs-SW AES cross-KATs and the entropy startup, liveness and DRBG checks, though they predate thewc_NoiseSrc_*refactor and a re-run is queued.