Skip to content

Commit 2e89e46

Browse files
JacobBarthelmehJacobBarthelmeh
authored
Merge pull request #6990 from gojimmypi/PR-Espressif-C3-C6-S2-HW
Espressif ESP32-C3 ESP32-C6 ESP32-S2 Hardware Acceleration
2 parents 5b3f549 + 2da8811 commit 2e89e46

18 files changed

Lines changed: 3723 additions & 794 deletions

File tree

‎IDE/Espressif/ESP-IDF/README.md‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,40 @@ Including the following examples:
2121

2222
1. [ESP-IDF development framework](https://docs.espressif.com/projects/esp-idf/en/latest/get-started/)
2323

24-
## Setup for Linux
24+
## wolfSSL as an Espressif component
25+
26+
There are various methods available for using wolfSSL as a component:
27+
28+
* Managed Component - easiest to get started.
29+
* Local component directory - best for development.
30+
* Install locally - least flexible, but project is fully self-contained.
31+
32+
## Espressif Managed Components
33+
34+
Visit https://components.espressif.com/components/wolfssl/wolfssl and see the instructions. Typically:
35+
36+
```
37+
idf.py add-dependency "wolfssl/wolfssl^5.6.0-stable"
38+
```
39+
40+
## Standard local component:
41+
42+
See the [template example](./examples/template/README.md). Simply created a `wolfssl` directory in the
43+
local project `components` directory and place the [CMakeLists.txt](./examples/template/components/CMakeLists.txt)
44+
file there. Then add a `components/wolfssl/include` directory and place the [user_settings.h](/examples/template/components/wolfssl/include/user_settings.h)
45+
file there. If wolfSSL is in a structure such as `./workspace/wolfssl` with respect to your project at `./workspace/wolfssl`,
46+
then the cmake file should automatically find the wolfSSL source code. Otherwise set the cmake `WOLFSSL_ROOT` variable
47+
in the top-level CMake file. Examples:
48+
49+
```cmake
50+
set(WOLFSSL_ROOT "C:/some-path/wolfssl")
51+
set(WOLFSSL_ROOT "c:/workspace/wolfssl-[username]")
52+
set(WOLFSSL_ROOT "/mnt/c/somepath/wolfssl")
53+
```
54+
55+
See the specific examples for additional details.
56+
57+
## Setup for Linux (wolfSSL local copy)
2558

2659
1. Run `setup.sh` at _/path/to_`/wolfssl/IDE/Espressif/ESP-IDF/` to deploy files into ESP-IDF tree
2760
2. Find Wolfssl files at _/path/to/esp_`/esp-idf/components/wolfssl/`

‎IDE/Espressif/ESP-IDF/user_settings.h‎

Lines changed: 120 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
#define WOLFSSL_AES_DIRECT
8484
#endif
8585

86-
/* when you want to use aes counter mode */
86+
/* when you want to use AES counter mode */
8787
/* #define WOLFSSL_AES_DIRECT */
8888
/* #define WOLFSSL_AES_COUNTER */
8989

@@ -102,10 +102,17 @@
102102
/* Define USE_FAST_MATH and SMALL_STACK */
103103
#define ESP32_USE_RSA_PRIMITIVE
104104
/* threshold for performance adjustment for HW primitive use */
105+
106+
/* NOTE HW unreliable for small values on older original ESP32!*/
107+
/* threshold for performance adjustment for HW primitive use */
105108
/* X bits of G^X mod P greater than */
106-
#define EPS_RSA_EXPT_XBTIS 36
109+
#undef ESP_RSA_EXPT_XBITS
110+
#define ESP_RSA_EXPT_XBITS 32
111+
107112
/* X and Y of X * Y mod P greater than */
108-
#define ESP_RSA_MULM_BITS 2000
113+
#undef ESP_RSA_MULM_BITS
114+
#define ESP_RSA_MULM_BITS 16
115+
109116
#endif
110117

111118
/* debug options */
@@ -123,46 +130,129 @@
123130
/* adjust wait-timeout count if you see timeout in RSA HW acceleration */
124131
#define ESP_RSA_TIMEOUT_CNT 0x249F00
125132

133+
/* Default is HW enabled unless turned off.
134+
** Uncomment these lines to force SW instead of HW acceleration */
135+
126136
#if defined(CONFIG_IDF_TARGET_ESP32)
127-
/* when you want not to use HW acceleration on ESP32 (below for S3, etc */
128-
/* #define NO_ESP32_CRYPT */
129-
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
130-
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
131-
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
137+
/* wolfSSL HW Acceleration supported on ESP32. Uncomment to disable: */
138+
/* #define NO_ESP32_CRYPT */
139+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
140+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
141+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
142+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
143+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
144+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
145+
146+
/* These are defined automatically in esp32-crypt.h, here for clarity: */
147+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA224 /* no SHA224 HW on ESP32 */
148+
/* end CONFIG_IDF_TARGET_ESP32 */
149+
#undef ESP_RSA_MULM_BITS
150+
#define ESP_RSA_MULM_BITS 16 /* TODO add compile-time warning */
151+
/***** END CONFIG_IDF_TARGET_ESP32 *****/
152+
132153
#elif defined(CONFIG_IDF_TARGET_ESP32S2)
133-
/* ESP32-S2 disabled by default; not implemented */
134-
#define NO_ESP32_CRYPT
135-
#define NO_WOLFSSL_ESP32_CRYPT_HASH
136-
#define NO_WOLFSSL_ESP32_CRYPT_AES
137-
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
154+
/* wolfSSL HW Acceleration supported on ESP32-S2. Uncomment to disable: */
155+
/* #define NO_ESP32_CRYPT */
156+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
157+
/* Note: There's no AES192 HW on the ESP32-S2; falls back to SW */
158+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
159+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
160+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
161+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
162+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
163+
/***** END CONFIG_IDF_TARGET_ESP32S2 *****/
164+
138165
#elif defined(CONFIG_IDF_TARGET_ESP32S3)
139-
/* when you want not to use HW acceleration on ESP32-S3 */
140-
/* #define NO_ESP32_CRYPT */
141-
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
142-
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
143-
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
166+
/* wolfSSL HW Acceleration supported on ESP32-S3. Uncomment to disable: */
167+
/* #define NO_ESP32_CRYPT */
168+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
169+
/* Note: There's no AES192 HW on the ESP32-S3; falls back to SW */
170+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
171+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
172+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
173+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
174+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
175+
/***** END CONFIG_IDF_TARGET_ESP32S3 *****/
176+
144177
#elif defined(CONFIG_IDF_TARGET_ESP32C3)
145-
/* ESP32-C3 disabled by default, not implemented */
146-
#define NO_ESP32_CRYPT
147-
#define NO_WOLFSSL_ESP32_CRYPT_HASH
148-
#define NO_WOLFSSL_ESP32_CRYPT_AES
149-
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
178+
/* wolfSSL HW Acceleration supported on ESP32-C2. Uncomment to disable: */
179+
180+
/* #define NO_ESP32_CRYPT */
181+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */ /* to disable all SHA HW */
182+
183+
/* These are defined automatically in esp32-crypt.h, here for clarity: */
184+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA384 /* no SHA384 HW on C6 */
185+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA512 /* no SHA512 HW on C6 */
186+
187+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
188+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
189+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
190+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
191+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
192+
/***** END CONFIG_IDF_TARGET_ESP32C3 *****/
193+
150194
#elif defined(CONFIG_IDF_TARGET_ESP32C6)
151-
/* ESP32-C6 disabled by default, not implemented */
152-
#define NO_ESP32_CRYPT
153-
#define NO_WOLFSSL_ESP32_CRYPT_HASH
154-
#define NO_WOLFSSL_ESP32_CRYPT_AES
155-
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
195+
/* wolfSSL HW Acceleration supported on ESP32-C6. Uncomment to disable: */
196+
197+
/* #define NO_ESP32_CRYPT */
198+
/* #define NO_WOLFSSL_ESP32_CRYPT_HASH */
199+
/* These are defined automatically in esp32-crypt.h, here for clarity: */
200+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA384 /* no SHA384 HW on C6 */
201+
#define NO_WOLFSSL_ESP32_CRYPT_HASH_SHA512 /* no SHA512 HW on C6 */
202+
203+
/* #define NO_WOLFSSL_ESP32_CRYPT_AES */
204+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI */
205+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MP_MUL */
206+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_MULMOD */
207+
/* #define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI_EXPTMOD */
208+
/***** END CONFIG_IDF_TARGET_ESP32C6 *****/
209+
156210
#elif defined(CONFIG_IDF_TARGET_ESP32H2)
157-
/* ESP32-H2 disabled by default, not implemented */
211+
/* wolfSSL Hardware Acceleration not yet implemented */
158212
#define NO_ESP32_CRYPT
159213
#define NO_WOLFSSL_ESP32_CRYPT_HASH
160214
#define NO_WOLFSSL_ESP32_CRYPT_AES
161215
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
216+
/***** END CONFIG_IDF_TARGET_ESP32H2 *****/
217+
162218
#else
163-
/* anything else unknown will have HW disabled by default */
219+
/* Anything else encountered, disable HW accleration */
164220
#define NO_ESP32_CRYPT
165221
#define NO_WOLFSSL_ESP32_CRYPT_HASH
166222
#define NO_WOLFSSL_ESP32_CRYPT_AES
167223
#define NO_WOLFSSL_ESP32_CRYPT_RSA_PRI
224+
#endif /* CONFIG_IDF_TARGET Check */
225+
226+
/* optional SM4 Ciphers. See https://github.com/wolfSSL/wolfsm
227+
#define WOLFSSL_SM2
228+
#define WOLFSSL_SM3
229+
#define WOLFSSL_SM4
230+
*/
231+
232+
#if defined(WOLFSSL_SM2) || defined(WOLFSSL_SM3) || defined(WOLFSSL_SM4)
233+
#include <wolfssl/certs_test_sm.h>
234+
#define CTX_CA_CERT root_sm2
235+
#define CTX_CA_CERT_SIZE sizeof_root_sm2
236+
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_PEM
237+
#define CTX_SERVER_CERT server_sm2
238+
#define CTX_SERVER_CERT_SIZE sizeof_server_sm2
239+
#define CTX_SERVER_CERT_TYPE WOLFSSL_FILETYPE_PEM
240+
#define CTX_SERVER_KEY server_sm2_priv
241+
#define CTX_SERVER_KEY_SIZE sizeof_server_sm2_priv
242+
#define CTX_SERVER_KEY_TYPE WOLFSSL_FILETYPE_PEM
243+
244+
#undef WOLFSSL_BASE16
245+
#define WOLFSSL_BASE16
246+
#else
247+
#define USE_CERT_BUFFERS_2048
248+
#define USE_CERT_BUFFERS_256
249+
#define CTX_CA_CERT ca_cert_der_2048
250+
#define CTX_CA_CERT_SIZE sizeof_ca_cert_der_2048
251+
#define CTX_CA_CERT_TYPE WOLFSSL_FILETYPE_ASN1
252+
#define CTX_SERVER_CERT server_cert_der_2048
253+
#define CTX_SERVER_CERT_SIZE sizeof_server_cert_der_2048
254+
#define CTX_SERVER_CERT_TYPE WOLFSSL_FILETYPE_ASN1
255+
#define CTX_SERVER_KEY server_key_der_2048
256+
#define CTX_SERVER_KEY_SIZE sizeof_server_key_der_2048
257+
#define CTX_SERVER_KEY_TYPE WOLFSSL_FILETYPE_ASN1
168258
#endif

‎wolfcrypt/src/aes.c‎

Lines changed: 38 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -483,7 +483,7 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
483483
#undef WOLFSSL_AES_DIRECT
484484
#define WOLFSSL_AES_DIRECT
485485

486-
/* If we choose to never have a fallback to SW: */
486+
/* Encrypt: If we choose to never have a fallback to SW: */
487487
#if !defined(NEED_AES_HW_FALLBACK) && (defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT))
488488
static WARN_UNUSED_RESULT int wc_AesEncrypt( /* calling this one when NO_AES_192 is defined */
489489
Aes* aes, const byte* inBlock, byte* outBlock)
@@ -501,7 +501,7 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
501501
}
502502
#endif
503503

504-
/* If we choose to never have a fallback to SW */
504+
/* Decrypt: If we choose to never have a fallback to SW: */
505505
#if !defined(NEED_AES_HW_FALLBACK) && (defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_DIRECT))
506506
static WARN_UNUSED_RESULT int wc_AesDecrypt(
507507
Aes* aes, const byte* inBlock, byte* outBlock)
@@ -882,10 +882,9 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
882882
#ifdef NEED_AES_TABLES
883883

884884
#ifndef WC_AES_BITSLICED
885-
#if (!defined(WOLFSSL_SILABS_SE_ACCEL) && \
886-
!defined(WOLFSSL_ESP32_CRYPT_RSA_PRI) \
887-
) || \
888-
(defined(WOLFSSL_ESP32_CRYPT_RSA_PRI) && defined(NEED_AES_HW_FALLBACK))
885+
#if !defined(WOLFSSL_SILABS_SE_ACCEL) || \
886+
defined(NO_ESP32_CRYPT) || defined(NO_WOLFSSL_ESP32_CRYPT_AES) || \
887+
defined(NEED_AES_HW_FALLBACK)
889888
static const FLASH_QUALIFIER word32 rcon[] = {
890889
0x01000000, 0x02000000, 0x04000000, 0x08000000,
891890
0x10000000, 0x20000000, 0x40000000, 0x80000000,
@@ -1535,8 +1534,8 @@ static WARN_UNUSED_RESULT word32 inv_col_mul(
15351534
byte t0 = t9 ^ tb ^ td;
15361535
return t0 ^ AES_XTIME(AES_XTIME(AES_XTIME(t0 ^ te) ^ td ^ te) ^ tb ^ te);
15371536
}
1538-
#endif
1539-
#endif
1537+
#endif /* HAVE_AES_CBC || WOLFSSL_AES_DIRECT */
1538+
#endif /* WOLFSSL_AES_SMALL_TABLES */
15401539
#endif
15411540

15421541
#if defined(HAVE_AES_CBC) || defined(WOLFSSL_AES_DIRECT) || \
@@ -3894,8 +3893,29 @@ static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir)
38943893
XMEMCPY(rk, key, keySz);
38953894
#if defined(LITTLE_ENDIAN_ORDER) && !defined(WOLFSSL_PIC32MZ_CRYPT) && \
38963895
(!defined(WOLFSSL_ESP32_CRYPT) || defined(NO_WOLFSSL_ESP32_CRYPT_AES))
3897-
ByteReverseWords(rk, rk, keySz);
3898-
#endif
3896+
/* Always reverse words when using only SW */
3897+
{
3898+
ByteReverseWords(rk, rk, keySz);
3899+
}
3900+
#else
3901+
/* Sometimes reverse words when using supported HW */
3902+
#if defined(WOLFSSL_ESPIDF)
3903+
/* Some platforms may need SW fallback (e.g. AES192) */
3904+
#if defined(NEED_AES_HW_FALLBACK)
3905+
{
3906+
ESP_LOGV(TAG, "wc_AesEncrypt fallback check");
3907+
if (wc_esp32AesSupportedKeyLen(aes)) {
3908+
/* don't reverse for HW supported key lengths */
3909+
}
3910+
else {
3911+
ByteReverseWords(rk, rk, keySz);
3912+
}
3913+
}
3914+
#else
3915+
/* If we don't need SW fallback, don't need to reverse words. */
3916+
#endif /* NEED_AES_HW_FALLBACK */
3917+
#endif /* WOLFSSL_ESPIDF */
3918+
#endif /* LITTLE_ENDIAN_ORDER, etc */
38993919

39003920
switch (keySz) {
39013921
#if defined(AES_MAX_KEY_SIZE) && AES_MAX_KEY_SIZE >= 128 && \
@@ -4345,13 +4365,20 @@ static void AesSetKey_C(Aes* aes, const byte* key, word32 keySz, int dir)
43454365
return wc_AesSetKey_for_ESP32(aes, userKey, keylen, iv, dir);
43464366
}
43474367
else {
4368+
#if defined(WOLFSSL_HW_METRICS)
4369+
/* It is interesting to know how many times we could not complete
4370+
* AES in hardware due to unsupported lengths. */
4371+
wc_esp32AesUnupportedLengthCountAdd();
4372+
#endif
43484373
#ifdef DEBUG_WOLFSSL
43494374
ESP_LOGW(TAG, "wc_AesSetKey HW Fallback, unsupported keylen = %d",
43504375
keylen);
43514376
#endif
43524377
}
4353-
#endif
4378+
#endif /* WOLFSSL_ESPIDF && NEED_AES_HW_FALLBACK */
4379+
43544380
return wc_AesSetKeyLocal(aes, userKey, keylen, iv, dir, 1);
4381+
43554382
} /* wc_AesSetKey() */
43564383

43574384
#if defined(WOLFSSL_AES_DIRECT) || defined(WOLFSSL_AES_COUNTER)

0 commit comments

Comments
 (0)