TI C2000: hardware AES accelerator and oscillator-jitter entropy source

[dgarske]

Add TI C2000 AESA hardware AES port and fix CHAR_BIT!=8 AES defects brings up the on-chip AESA accelerator (a TI EIP-120t) for ECB/CBC/CTR at 128/192/256 bits as a crypto-callback device gated on WOLFSSL_C2000_AES, so software AES stays compiled in, one image can run identical NIST vectors through both paths and compare, and anything unsupported returns CRYPTOCB_UNAVAILABLE. Measured 5.2x-7.3x on ECB/CBC and 3.6x-4.4x on CTR. Two device behaviours are worth a look, both documented inline: octet packing is done explicitly (driverlib takes uint32_t*, and staging deliberately uses uint32_t rather than word32, which is only 32-bit under WC_16BIT_CPU), and CTR is driven through hardware ECB with a software counter because the block's own counter does not carry across octet boundaries the way IncrementAesCounter() does. The commit also fixes four CHAR_BIT != 8 defects that all reproduce in a pure software build with no device registered and are no-ops at CHAR_BIT == 8: counter carry never propagating (if (++inOutCtr[i]) sees 0xFF + 1 as truthy 0x100) across five increment helpers plus DecrementKeyWrapCounter, shiftLeftArray() letting CFB1 feedback cells exceed 0xFF, FlattenSzInBits() building the GCM length block at 16 bits because sizeof counts cells, and roll_auth() putting oversized cells into the CCM CBC-MAC input.

Add TI C2000 oscillator-jitter entropy source and harden wc_RNG_TestSeed for wide bytes replaces the dev-only seed. The part has no TRNG, so the noise bit is the LSB of a Dual-Clock Comparator measurement -- PLL edges counted inside a window of INTOSC cycles, i.e. the relative phase drift of two independent oscillators -- measured on hardware at 0.924 bits of min-entropy per bit (SP800-90B 6.3.1 MCV with bias and correlation screening, not a full non-IID assessment), oversampled about 4x and fed to the existing Hash-DRBG. Almost none of that is C2000-specific, so the reusable half is a new platform-agnostic module in random.c behind WOLFSSL_NOISE_SRC: a port supplies one wc_NoiseSampleCb returning a raw octet plus a config struct, and wc_NoiseSrc_* owns the SP800-90B 4.3 startup test, the 4.4.1/4.4.2 continuous tests, the entropy budget, the SHA-256 conditioner and the latched fail-closed state, with no mallocs and no locks. Only test verdicts latch, not sampler errors. The payoff is that those failure paths, which previously only fired on broken silicon, now run on every host build via noisesrc_test() with synthetic stuck, biased, sampler-error and periodic sources. Also fixes wc_RNG_TestSeed(), which indexes a 256-entry array with a byte cell that can exceed 255 where CHAR_BIT != 8 -- unreachable until a real entropy source returns unmasked values, which is exactly what this commit adds. Verified with make check at --enable-all, again with -DWOLFSSL_NOISE_SRC, and again with --enable-smallstack (the C2000 config); IDE/C2000/compile.sh compiles both port files and random.c with the entropy gate under cl2000 at CHAR_BIT == 16; on-hardware runs cover 14 HW-vs-SW AES cross-KATs and the entropy startup, liveness and DRBG checks, though they predate the wc_NoiseSrc_* refactor and a re-run is queued.

[Copilot]

Pull request overview

This PR adds TI C2000 (C28x) platform support in wolfCrypt by introducing a hardware AES accelerator backend (AESA/EIP-120t) via crypto callbacks, a new generic SP800-90B-style “noise source” conditioning layer with a C2000 oscillator-jitter entropy port, and several fixes for CHAR_BIT != 8 correctness defects (notably affecting AES counter handling and seed testing) so the same codepaths behave correctly on wide-byte targets.

Changes:

• Add TI C2000 AESA hardware AES offload through WOLF_CRYPTO_CB (ECB/CBC/CTR) plus build/docs scaffolding.
• Add a generic wc_NoiseSrc_* module (startup/continuous health tests + SHA-256 conditioning) and a TI C2000 DCC-based oscillator-jitter entropy implementation gated by WOLFSSL_C2000_ENTROPY.
• Fix multiple CHAR_BIT != 8 issues in AES/GCM/CCM and RNG seed testing, and add a host-side synthetic test (noisesrc_test) to exercise failure paths.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
wolfssl/wolfcrypt/random.h	Declares the generic wc_NoiseSrc_* API and config, and enables WOLFSSL_NOISE_SRC implicitly for the C2000 entropy port.
wolfssl/wolfcrypt/port/ti/ti-c2000.h	Public header for C2000 AESA crypto-callback integration (devId, locking requirements, base addresses).
wolfssl/wolfcrypt/port/ti/ti-c2000-entropy.h	Public header/config for C2000 DCC oscillator-jitter entropy and its tuning/health-test parameters.
wolfssl/wolfcrypt/include.am	Adds the new TI C2000 public headers to the build system.
wolfcrypt/test/test.c	Adds noisesrc_test() to exercise the new noise-source layer on host builds.
wolfcrypt/src/random.c	Implements wc_NoiseSrc_*, wires in the C2000 entropy-backed wc_GenerateSeed branch, and hardens wc_RNG_TestSeed for wide bytes.
wolfcrypt/src/port/ti/ti-c2000-entropy.c	Implements the C2000 DCC sampling hardware backend and configures a global wc_NoiseSrc instance.
wolfcrypt/src/port/ti/ti-c2000-aes.c	Implements AESA offload for ECB/CBC/CTR via crypto callbacks with explicit octet packing for wide-byte C28x.
wolfcrypt/src/include.am	Adds the new C2000 port .c files to EXTRA_DIST.
wolfcrypt/src/aes.c	Fixes multiple CHAR_BIT != 8 issues (counter increments, GCM length flattening, CCM auth length encode, CFB1 feedback shifting, keywrap decrement).
IDE/C2000/user_settings.h	Updates the C2000 template to correctly set WC_16BIT_CPU sizing and enable crypto callbacks in the guard build.
IDE/C2000/README.md	Adds detailed documentation for the AESA offload and the entropy design/configuration/characterization.
IDE/C2000/compile.sh	Adjusts include order for user_settings.h, compiles cryptocb, and adds guard legs for noise-src and optional driverlib-backed ports.
.wolfssl_known_macro_extras	Registers the newly introduced/used build macros.

Suppressed comments (1)

wolfcrypt/src/random.c:4351

• In wc_NoiseSrc_GenerateSeed, an uncredited source is dropped (src->degraded |= ...) on any non-zero ret, including sampler errors from NoiseSrc_Gather. The header comment states sampler errors should propagate (retryable) and only health-test/self-test verdicts should cause a persistent degradation. Dropping the source on a transient gather error is both a behavior/documentation mismatch and can mask flaky hardware/clocking issues by silently reducing the configured noise-source set.

            ret = NoiseSrc_Gather(src, raw, src->rawPerSrc, i);
            if (ret == 0) {
                ret = NoiseSrc_HealthTest(src, raw, src->rawPerSrc, i);
            }
            if (ret != 0) {

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.