Add Silicon Labs EFR32xG25 Secure Element crypto callback port - #11267
Open
dgarske wants to merge 1 commit into
Open
Add Silicon Labs EFR32xG25 Secure Element crypto callback port#11267dgarske wants to merge 1 commit into
dgarske wants to merge 1 commit into
Conversation
|
Can one of the admins verify this patch? |
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Adds a Silicon Labs EFR32 Series 2 Secure Element crypto callback port (WOLFSSL_SILABS_CRYPTOCB) that routes operations by devId and falls back to software when the SE declines, while sharing SE Manager helper code with the existing direct-hook port.
Changes:
- Introduces SiLabs crypto-callback port sources/headers, host shim, and build-system integration (
--enable-silabs-cryptocb). - Extends crypto callback framework to dispatch ChaCha20-Poly1305 one-shot and PBKDF2.
- Refactors shared SiLabs SE helper code and settings gating (
WOLFSSL_SILABS_SE_TYPES), plus documentation and example project.
Reviewed changes
Copilot reviewed 50 out of 50 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfssl/wolfcrypt/types.h | Adds PBKDF2 to KDF type enum for callback dispatch. |
| wolfssl/wolfcrypt/sha512.h | Switches SiLabs hash header gating to WOLFSSL_SILABS_SE_TYPES. |
| wolfssl/wolfcrypt/sha256.h | Adds SiLabs SE hash context member for cryptocb fallback model. |
| wolfssl/wolfcrypt/sha.h | Adds SiLabs SE hash context member for cryptocb fallback model. |
| wolfssl/wolfcrypt/settings.h | Adds WOLFSSL_SILABS_SE_TYPES umbrella and includes silabs_settings.h for cryptocb. |
| wolfssl/wolfcrypt/port/silabs/silabs_settings.h | New macro-only settings header for engine selection and WC_USE_DEVID mapping. |
| wolfssl/wolfcrypt/port/silabs/silabs_random.h | Switches to WOLFSSL_SILABS_SE_TYPES and includes settings. |
| wolfssl/wolfcrypt/port/silabs/silabs_hash.h | Updates SiLabs hash types gating, adds host shim support, and status-returning helpers. |
| wolfssl/wolfcrypt/port/silabs/silabs_ecc.h | Updates SiLabs ECC type gating and host shim support. |
| wolfssl/wolfcrypt/port/silabs/silabs_cryptocb.h | New public header for registering device + wrapped/built-in key APIs + engine entry points. |
| wolfssl/wolfcrypt/port/silabs/silabs_aes.h | Updates SiLabs AES type gating, adds shared SE helpers and key-set tracking. |
| wolfssl/wolfcrypt/include.am | Installs new SiLabs cryptocb headers in build metadata. |
| wolfssl/wolfcrypt/ecc.h | Embeds SE manager ECC fields under WOLFSSL_SILABS_SE_TYPES and adds silabsKeySet. |
| wolfssl/wolfcrypt/cryptocb.h | Extends wc_CryptoInfo for ChaCha20-Poly1305 + PBKDF2 and exposes wc_CryptoCb_GetDevIdAtIndex for tests. |
| wolfssl/wolfcrypt/aes.h | Embeds SE manager AES fields under WOLFSSL_SILABS_SE_TYPES. |
| wolfcrypt/test/test.c | Adds cryptocb tests for ChaCha20-Poly1305 and PBKDF2 dispatch paths. |
| wolfcrypt/src/wc_port.c | Autoregisters SiLabs cryptocb device in wolfCrypt_Init() and unifies SE init gating/message. |
| wolfcrypt/src/sha512.c | Updates SiLabs hash copy fixups to use WOLFSSL_SILABS_SE_TYPES. |
| wolfcrypt/src/sha256.c | Updates SiLabs hash copy fixups to use WOLFSSL_SILABS_SE_TYPES. |
| wolfcrypt/src/sha.c | Updates SiLabs hash copy fixups to use WOLFSSL_SILABS_SE_TYPES. |
| wolfcrypt/src/random.c | Updates SiLabs RNG include gating to WOLFSSL_SILABS_SE_TYPES. |
| wolfcrypt/src/pwdbased.c | Adds PBKDF2 crypto-callback dispatch before software implementation. |
| wolfcrypt/src/port/silabs/silabs_shim.h | New host compile-test shim for SE Manager APIs and device feature macros. |
| wolfcrypt/src/port/silabs/silabs_random.c | Adds host shim support and includes error codes; updates gating to WOLFSSL_SILABS_SE_TYPES. |
| wolfcrypt/src/port/silabs/silabs_key.c | New wrapped/built-in key management implementation for cryptocb port. |
| wolfcrypt/src/port/silabs/silabs_hash.c | Refactors hash helpers to expose raw SE status and gates direct-replacement code to direct port only. |
| wolfcrypt/src/port/silabs/silabs_ecc.c | Adds missing pubkey.z initialization after SE keygen and enables host-shim builds. |
| wolfcrypt/src/port/silabs/silabs_cryptocb.c | New SiLabs cryptocb device registration and algorithm dispatcher. |
| wolfcrypt/src/port/silabs/silabs_cb_rng.c | New SE TRNG crypto-callback engine. |
| wolfcrypt/src/port/silabs/silabs_cb_pk.c | New ECC crypto-callback engine (ECDH/ECDSA/keygen) with SE constraints. |
| wolfcrypt/src/port/silabs/silabs_cb_kdf.c | New Secure Vault High HKDF/PBKDF2 crypto-callback engine. |
| wolfcrypt/src/port/silabs/silabs_cb_hash.c | New hash crypto-callback engine with lazy SE-context start and fallback behavior. |
| wolfcrypt/src/port/silabs/silabs_cb_cmac.c | New AES-CMAC crypto-callback engine with multipart state and free-callback cleanup. |
| wolfcrypt/src/port/silabs/silabs_cb_cipher.c | New cipher crypto-callback engine for AES modes and ChaCha20-Poly1305. |
| wolfcrypt/src/port/silabs/silabs_aes.c | Splits shared AES SE descriptor + ECB/CBC helpers from direct-replacement AES hooks; fixes CCM auth error code. |
| wolfcrypt/src/port/silabs/README.md | Documents direct vs cryptocb ports, engines, host test, wrapped keys, and benchmark results. |
| wolfcrypt/src/include.am | Adds SiLabs cryptocb sources and shim to Automake build targets. |
| wolfcrypt/src/ecc.c | Scrubs SiLabs SE key_raw buffer on ecc_key free. |
| wolfcrypt/src/cryptocb.c | Adds ChaCha20-Poly1305 one-shot and PBKDF2 crypto-callback dispatch implementations. |
| wolfcrypt/src/chacha20_poly1305.c | Adds crypto-callback boundary for ChaCha20-Poly1305 one-shot APIs. |
| configure.ac | Adds --enable-silabs-cryptocb host compile-test option and build conditional. |
| IDE/SimplicityStudio/xg25/wolfcrypt_test.slcp | Adds headless Simplicity Studio project definition for xG25. |
| IDE/SimplicityStudio/xg25/user_settings.h | Adds example user settings enabling cryptocb port and algorithms for xG25. |
| IDE/SimplicityStudio/xg25/flash.sh | Adds headless flashing script. |
| IDE/SimplicityStudio/xg25/build.sh | Adds headless generation/build script using slc-cli + GNU Arm. |
| IDE/SimplicityStudio/xg25/app.c | Adds embedded entrypoint printing SE info and running wolfcrypt_test/benchmark. |
| IDE/SimplicityStudio/xg25/README.md | Documents headless build/flash workflow and expected output/results. |
| IDE/SimplicityStudio/xg25/.gitignore | Ignores generated build output directory. |
| IDE/SimplicityStudio/README.md | Points to xG25 headless project for cryptocb port. |
| .github/scripts/check-headers.sh | Stops excluding silabs_aes.h from header checks. |
Suppressed comments (2)
wolfssl/wolfcrypt/cryptocb.h:1
wc_CryptoCb_GetDevIdAtIndexwas previouslyWOLFSSL_LOCALand is now declared withWOLFSSL_TEST_VISin a public header. This risks unintentionally exporting an internal symbol (ABI surface growth) and also relies onWOLFSSL_TEST_VISbeing defined consistently in all consumer builds. A more robust approach is to keep this declaration behind a dedicated test-only compile gate (e.g.,#if defined(WOLFSSL_TEST)/ existing unit-test macro) or provide a separate test header so production builds don't gain a new exported-ish entry point.
wolfssl/wolfcrypt/sha256.h:1- This hunk introduces a preprocessor
#endifinsidestruct wc_Sha256immediately before adding theWOLFSSL_SILABS_CRYPTOCBmember. As shown, there is no matching#ifin the immediate hunk, making it easy to accidentally unbalance conditionals or close the wrong block and break compilation under certain feature combinations. Please double-check the surrounding conditional structure and, if needed, refactor so the software members remain properly guarded and the SiLabs context is added without relying on a fragile close/reopen pattern.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+75
to
+80
| if (aes->ctx.keySet) { | ||
| return 0; | ||
| } | ||
| if (aes->keylen <= 0 || (word32)aes->keylen > sizeof(aes->devKey)) { | ||
| return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE); | ||
| } |
Comment on lines
+118
to
+119
| * import. */ | ||
| if (key->silabsKeySet) { |
Comment on lines
+199
to
+202
| if (!silabs_pk_digest_ok(info->pk.eccsign.key, | ||
| info->pk.eccsign.inlen)) { | ||
| return WC_NO_ERR_TRACE(CRYPTOCB_UNAVAILABLE); | ||
| } |
Comment on lines
+3807
to
+3808
| AC_MSG_NOTICE([--enable-silabs-cryptocb also enables AES-ECB build-wide (HAVE_AES_ECB)]) | ||
| AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SILABS_CRYPTOCB -DWOLFSSL_SILABS_HOST_TEST -DHAVE_AES_ECB" |
dgarske
force-pushed
the
silabs_cryptocb
branch
3 times, most recently
from
August 25, 2026 22:47
a5d331b to
9d1267f
Compare
|
dgarske
force-pushed
the
silabs_cryptocb
branch
from
August 26, 2026 23:15
9d1267f to
6783e51
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
WOLFSSL_SILABS_CRYPTOCB, a crypto callback port for the EFR32 Series 2 Secure Element. Unlike the existing direct-hookWOLFSSL_SILABS_SE_ACCELport, operations route bydevIdand anything the SE cannot do falls back to software instead of failing. Both ports share one set of SE Manager helpers.Features
--enable-silabs-cryptocb): builds and passesmake checkwith no Simplicity SDK installedIDE/SimplicityStudio/xg25:slc-cli+ GNU Arm, no GUIAlso adds ChaCha20-Poly1305 and PBKDF2 crypto callback dispatch to the core framework - neither existed before.
Testing
EFR32FG25B222F1920IM56, Secure Vault High, SE firmware 2.2.0:
wolfcrypt_testfull PASS.Full per-algorithm table in
wolfcrypt/src/port/silabs/README.mdandIDE/SimplicityStudio/xg25/README.md. Both columns come from a single benchmark run on one part:WOLFSSL_SILABS_CRYPTOCBsetsWC_USE_DEVID, so the stock benchmark measures each algorithm twice and labels the rows HW and SW.Host:
--enable-all --enable-cryptocband--enable-silabs-cryptocbbothmake checkclean,check-headers232/0,check-source-textclean.Reviewer note
The one-shot ChaCha20-Poly1305 API has no key object and therefore no
devId, so it dispatches to whichever device holds callback slot 0 - the same keyless pathwc_CryptoCb_RandomBlock()uses for a NULL rng. Existing crypto-callback devices must returnCRYPTOCB_UNAVAILABLEfor cipher one-shots they do not handle. Worth deciding whether this should instead be opt-in.Notes
WOLFSSL_SILABS_CRYPTOCB_SHA512_HW): no measured gain, and a wrong digest throughwc_ShaXXXGetHash().pubkey.znever set after SE key generation and CCM reportingAES_GCM_AUTH_E.