Add Silicon Labs EFR32xG25 Secure Element crypto callback port

[dgarske]

Summary

Adds WOLFSSL_SILABS_CRYPTOCB, a crypto callback port for the EFR32 Series 2 Secure Element. Unlike the existing direct-hook WOLFSSL_SILABS_SE_ACCEL port, operations route by devId and anything the SE cannot do falls back to software instead of failing. Both ports share one set of SE Manager helpers.

New crypto callback support

Two algorithms gain crypto callback dispatch in the core framework. Neither had it before, and both are available to any callback device, not just this one.

• ChaCha20-Poly1305. New wc_Chacha_SetKey_ex() and wc_ChaCha20Poly1305_Init_ex() bind a devId to the cipher object, and wc_ChaCha20Poly1305_Encrypt_ex() / _Decrypt_ex() dispatch on it. That is the API the TLS record layer uses, so a connection can offload its ChaCha records. The legacy one-shot entry points carry no key object and stay in software.
• PBKDF2. New WC_KDF_TYPE_PBKDF2, dispatched from wc_PBKDF2_ex() on the caller's devId.

Both follow the existing _ex(..., void* heap, int devId) idiom. No public signature changes.

Features

• AES ECB/CBC/CTR/GCM/CCM, AES-CMAC, ChaCha20-Poly1305
• SHA-1/224/256, TRNG, HKDF, PBKDF2
• ECDSA sign/verify, ECDH, key generation
• Secure Vault High keys: wrapped keys and built-in slots - the SE uses the key, the application never sees the material
• Per-engine selection: offload a subset, the rest stays in software
• Host compile test (--enable-silabs-cryptocb): builds and passes make check with no Simplicity SDK installed

Testing

EFR32FG25B222F1920IM56, Secure Vault High, SE firmware 2.2.0: wolfcrypt_test full PASS. Because WOLFSSL_SILABS_CRYPTOCB sets WC_USE_DEVID, every algorithm the port claims runs on the SE, so the pass is direct evidence against the known-answer vectors.

	HW vs SW
AES-256-GCM	9.4x
AES-CCM	5.3x
AES-256-ECB / CTR	4.3x
AES-256-CBC	4.2x
AES-256-CMAC	4.1x
ECDSA verify	3.9x
SHA-256	3.0x
ECDH agree	2.7x
ECDSA sign	2.6x

Full per-algorithm table in wolfcrypt/src/port/silabs/README.md. Both columns come from a single benchmark run on one part: the stock benchmark measures each algorithm twice and labels the rows HW and SW.

TLS 1.3 handshake and record layer, both peers on the device, pass for TLS13-AES128-GCM-SHA256, TLS13-AES256-GCM-SHA384 and TLS13-CHACHA20-POLY1305-SHA256. That last one is what exercises the new ChaCha dispatch through the record layer.

Host: --enable-all --enable-cryptocb and --enable-silabs-cryptocb both make check clean, plus Secure Vault Mid, single-engine, async, and a staged make install consumer compile. check-source-text clean.

Notes

• No RSA engine - Series 2 has no RSA hardware. No HMAC engine - wolfCrypt HMAC gives its inner and outer hash contexts the Hmac's own devId, so every block already runs on the SE through the hash engine.
• SHA-384/512 are always left to software. wc_ShaXXXGetHash() copies the context and finalizes the copy, which the SE context does not survive.
• AES-CTR offloads only whole blocks on a block boundary; the SE and wolfCrypt track the keystream remainder differently. Under WOLFSSL_ARMASM CTR is left entirely to software, since the Thumb2 remainder and the SE's do not line up.
• Binding an SE-resident key onto an ecc_key scrubs any software scalar it held. The object stays typed ECC_PRIVATEKEY, so without the scrub a caller could export the secret the object held before the bind.
• Session tickets are not offloaded. The AES-GCM ticket variants deliberately use wc_AesInit(aes, NULL, INVALID_DEVID), so threading a devId into the ChaCha variant alone would be inconsistent.
• Fixes latent bugs in the shared SiLabs code, including pubkey.z never set after SE key generation and CCM reporting AES_GCM_AUTH_E.
• The worked example lives in wolfssl-examples: EFR32xG25 Secure Element example wolfssl-examples#627

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Adds a Silicon Labs EFR32 Series 2 Secure Element crypto callback port (WOLFSSL_SILABS_CRYPTOCB) that routes operations by devId and falls back to software when the SE declines, while sharing SE Manager helper code with the existing direct-hook port.

Changes:

• Introduces SiLabs crypto-callback port sources/headers, host shim, and build-system integration (--enable-silabs-cryptocb).
• Extends crypto callback framework to dispatch ChaCha20-Poly1305 one-shot and PBKDF2.
• Refactors shared SiLabs SE helper code and settings gating (WOLFSSL_SILABS_SE_TYPES), plus documentation and example project.

Reviewed changes

Copilot reviewed 50 out of 50 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
wolfssl/wolfcrypt/types.h	Adds PBKDF2 to KDF type enum for callback dispatch.
wolfssl/wolfcrypt/sha512.h	Switches SiLabs hash header gating to WOLFSSL_SILABS_SE_TYPES.
wolfssl/wolfcrypt/sha256.h	Adds SiLabs SE hash context member for cryptocb fallback model.
wolfssl/wolfcrypt/sha.h	Adds SiLabs SE hash context member for cryptocb fallback model.
wolfssl/wolfcrypt/settings.h	Adds WOLFSSL_SILABS_SE_TYPES umbrella and includes silabs_settings.h for cryptocb.
wolfssl/wolfcrypt/port/silabs/silabs_settings.h	New macro-only settings header for engine selection and WC_USE_DEVID mapping.
wolfssl/wolfcrypt/port/silabs/silabs_random.h	Switches to WOLFSSL_SILABS_SE_TYPES and includes settings.
wolfssl/wolfcrypt/port/silabs/silabs_hash.h	Updates SiLabs hash types gating, adds host shim support, and status-returning helpers.
wolfssl/wolfcrypt/port/silabs/silabs_ecc.h	Updates SiLabs ECC type gating and host shim support.
wolfssl/wolfcrypt/port/silabs/silabs_cryptocb.h	New public header for registering device + wrapped/built-in key APIs + engine entry points.
wolfssl/wolfcrypt/port/silabs/silabs_aes.h	Updates SiLabs AES type gating, adds shared SE helpers and key-set tracking.
wolfssl/wolfcrypt/include.am	Installs new SiLabs cryptocb headers in build metadata.
wolfssl/wolfcrypt/ecc.h	Embeds SE manager ECC fields under WOLFSSL_SILABS_SE_TYPES and adds silabsKeySet.
wolfssl/wolfcrypt/cryptocb.h	Extends wc_CryptoInfo for ChaCha20-Poly1305 + PBKDF2 and exposes wc_CryptoCb_GetDevIdAtIndex for tests.
wolfssl/wolfcrypt/aes.h	Embeds SE manager AES fields under WOLFSSL_SILABS_SE_TYPES.
wolfcrypt/test/test.c	Adds cryptocb tests for ChaCha20-Poly1305 and PBKDF2 dispatch paths.
wolfcrypt/src/wc_port.c	Autoregisters SiLabs cryptocb device in wolfCrypt_Init() and unifies SE init gating/message.
wolfcrypt/src/sha512.c	Updates SiLabs hash copy fixups to use WOLFSSL_SILABS_SE_TYPES.
wolfcrypt/src/sha256.c	Updates SiLabs hash copy fixups to use WOLFSSL_SILABS_SE_TYPES.
wolfcrypt/src/sha.c	Updates SiLabs hash copy fixups to use WOLFSSL_SILABS_SE_TYPES.
wolfcrypt/src/random.c	Updates SiLabs RNG include gating to WOLFSSL_SILABS_SE_TYPES.
wolfcrypt/src/pwdbased.c	Adds PBKDF2 crypto-callback dispatch before software implementation.
wolfcrypt/src/port/silabs/silabs_shim.h	New host compile-test shim for SE Manager APIs and device feature macros.
wolfcrypt/src/port/silabs/silabs_random.c	Adds host shim support and includes error codes; updates gating to WOLFSSL_SILABS_SE_TYPES.
wolfcrypt/src/port/silabs/silabs_key.c	New wrapped/built-in key management implementation for cryptocb port.
wolfcrypt/src/port/silabs/silabs_hash.c	Refactors hash helpers to expose raw SE status and gates direct-replacement code to direct port only.
wolfcrypt/src/port/silabs/silabs_ecc.c	Adds missing pubkey.z initialization after SE keygen and enables host-shim builds.
wolfcrypt/src/port/silabs/silabs_cryptocb.c	New SiLabs cryptocb device registration and algorithm dispatcher.
wolfcrypt/src/port/silabs/silabs_cb_rng.c	New SE TRNG crypto-callback engine.
wolfcrypt/src/port/silabs/silabs_cb_pk.c	New ECC crypto-callback engine (ECDH/ECDSA/keygen) with SE constraints.
wolfcrypt/src/port/silabs/silabs_cb_kdf.c	New Secure Vault High HKDF/PBKDF2 crypto-callback engine.
wolfcrypt/src/port/silabs/silabs_cb_hash.c	New hash crypto-callback engine with lazy SE-context start and fallback behavior.
wolfcrypt/src/port/silabs/silabs_cb_cmac.c	New AES-CMAC crypto-callback engine with multipart state and free-callback cleanup.
wolfcrypt/src/port/silabs/silabs_cb_cipher.c	New cipher crypto-callback engine for AES modes and ChaCha20-Poly1305.
wolfcrypt/src/port/silabs/silabs_aes.c	Splits shared AES SE descriptor + ECB/CBC helpers from direct-replacement AES hooks; fixes CCM auth error code.
wolfcrypt/src/port/silabs/README.md	Documents direct vs cryptocb ports, engines, host test, wrapped keys, and benchmark results.
wolfcrypt/src/include.am	Adds SiLabs cryptocb sources and shim to Automake build targets.
wolfcrypt/src/ecc.c	Scrubs SiLabs SE key_raw buffer on ecc_key free.
wolfcrypt/src/cryptocb.c	Adds ChaCha20-Poly1305 one-shot and PBKDF2 crypto-callback dispatch implementations.
wolfcrypt/src/chacha20_poly1305.c	Adds crypto-callback boundary for ChaCha20-Poly1305 one-shot APIs.
configure.ac	Adds --enable-silabs-cryptocb host compile-test option and build conditional.
IDE/SimplicityStudio/xg25/wolfcrypt_test.slcp	Adds headless Simplicity Studio project definition for xG25.
IDE/SimplicityStudio/xg25/user_settings.h	Adds example user settings enabling cryptocb port and algorithms for xG25.
IDE/SimplicityStudio/xg25/flash.sh	Adds headless flashing script.
IDE/SimplicityStudio/xg25/build.sh	Adds headless generation/build script using slc-cli + GNU Arm.
IDE/SimplicityStudio/xg25/app.c	Adds embedded entrypoint printing SE info and running wolfcrypt_test/benchmark.
IDE/SimplicityStudio/xg25/README.md	Documents headless build/flash workflow and expected output/results.
IDE/SimplicityStudio/xg25/.gitignore	Ignores generated build output directory.
IDE/SimplicityStudio/README.md	Points to xG25 headless project for cryptocb port.
.github/scripts/check-headers.sh	Stops excluding silabs_aes.h from header checks.

Suppressed comments (2)

wolfssl/wolfcrypt/cryptocb.h:1

• wc_CryptoCb_GetDevIdAtIndex was previously WOLFSSL_LOCAL and is now declared with WOLFSSL_TEST_VIS in a public header. This risks unintentionally exporting an internal symbol (ABI surface growth) and also relies on WOLFSSL_TEST_VIS being defined consistently in all consumer builds. A more robust approach is to keep this declaration behind a dedicated test-only compile gate (e.g., #if defined(WOLFSSL_TEST) / existing unit-test macro) or provide a separate test header so production builds don't gain a new exported-ish entry point.
  wolfssl/wolfcrypt/sha256.h:1
• This hunk introduces a preprocessor #endif inside struct wc_Sha256 immediately before adding the WOLFSSL_SILABS_CRYPTOCB member. As shown, there is no matching #if in the immediate hunk, making it easy to accidentally unbalance conditionals or close the wrong block and break compilation under certain feature combinations. Please double-check the surrounding conditional structure and, if needed, refactor so the software members remain properly guarded and the SiLabs context is added without relying on a fragile close/reopen pattern.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 187,260 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 783,844 B / 1,048,576 B, total: 75% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 302,216 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 332,960 B / 1,048,576 B, total: 32% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 242,703 B / 262,144 B, total: 93% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 303,112 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 242,703 B / 262,144 B, total: 93% used)

linuxkm-pie

• Data: __patchable_function_entries +40 B (+0.1%, 27,080 B)

linuxkm-standard

• Data: __patchable_function_entries +40 B (+0.1%, 49,888 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7
• stm32-sim-stm32h753

[dgarske]

Jenkins retest this please. History lost

[dgarske]

retest this please

[aidangarske]

Skoll Code Review

Scan type: review

Overall recommendation: REQUEST_CHANGES
Findings: 15 total — 15 posted, 0 skipped
15 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Critical] SiLabs ECC buffers inherit another backend's smaller maximum — wolfcrypt/src/port/silabs/silabs_cb_pk.c:128-130
• [High] Resident ECC keys cannot be used for signing — wolfcrypt/src/port/silabs/silabs_cb_pk.c:209-216
• [High] AES key rebinding can silently select stale key material — wolfcrypt/src/port/silabs/silabs_key.c:226-241
• [High] ECC key rebinding can use a different key than requested — wolfcrypt/src/port/silabs/silabs_key.c:409-426
• [High] CMAC callback violates output-length and pointer contracts — wolfcrypt/src/port/silabs/silabs_cb_cmac.c:153-187
• [High] KDF callbacks reject valid zero-length inputs — wolfcrypt/src/port/silabs/silabs_cb_kdf.c:70-106
• [High] Optional SHA-384/512 offload knowingly returns incorrect digests — wolfcrypt/src/port/silabs/silabs_cb_hash.c:39-45
• [High] Host compile-test configuration disables usable entropy — wolfcrypt/src/random.c:4471-4482
• [High] AES helper error translation prevents software fallback — wolfcrypt/src/port/silabs/silabs_cb_cipher.c:218-238
• [High] ECC helper error translation prevents software fallback — wolfcrypt/src/port/silabs/silabs_cb_pk.c:167-168
• [Medium] ECDH callback bypasses the public API's key validation — wolfcrypt/src/port/silabs/silabs_cb_pk.c:171-187
• [Medium] ChaCha async test assumes its callback owns slot zero — tests/api/test_async.c:695-705
• [Medium] Legacy ChaCha API dispatches through an unrelated global device — wolfcrypt/src/cryptocb.c:2114-2116
• [Medium] Vault Mid headers advertise functions that are not linked — wolfssl/wolfcrypt/port/silabs/silabs_cryptocb.h:38-43
• [Medium] Host gate does not execute the new SiLabs handlers — wolfssl/wolfcrypt/port/silabs/silabs_settings.h:115-123

Review generated by Skoll

[aidangarske]

Skoll Code Review

Scan type: review

Overall recommendation: REQUEST_CHANGES
Findings: 10 total — 10 posted, 0 skipped
10 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [High] Fresh hash contexts can skip Secure Element initialization — wolfcrypt/src/port/silabs/silabs_cb_hash.c:95-108
• [High] One-shot CMAC can free an uninitialized device context — wolfcrypt/src/port/silabs/silabs_cb_cmac.c:88-91
• [High] Hash fallback loses data after the SE acquires the context — wolfcrypt/src/port/silabs/silabs_cb_hash.c:145-160
• [High] CMAC fallback is invalid after hardware initialization succeeds — wolfcrypt/src/port/silabs/silabs_cb_cmac.c:184-212
• [High] Resident-key APIs succeed when their callback engine is disabled — wolfcrypt/src/port/silabs/silabs_key.c:245-247
• [High] The new configure profile installs unusable public headers — wolfssl/wolfcrypt/include.am:124-129
• [High] Unvalidated BUILD_DIR can erase arbitrary directories — IDE/SimplicityStudio/xg25/build.sh:8-35
• [Medium] Secure Vault public APIs have no behavioral coverage — wolfcrypt/src/port/silabs/silabs_key.c:136-487
• [Medium] TLS mode leaves a wolfSSL initialization reference outstanding — IDE/SimplicityStudio/xg25/app.c:170-192
• [Medium] ChaCha callback test does not verify output zeroization — wolfcrypt/test/test.c:84097-84106

Review generated by Skoll

[aidangarske]

Skoll Code Review

Scan type: review-security

Overall recommendation: COMMENT
Findings: 1 total — 1 posted, 0 skipped
1 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] Resident ECC binding leaves the prior software private key exportable — wolfcrypt/src/port/silabs/silabs_key.c:428-446

Review generated by Skoll

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Copilot reviewed 49 out of 49 changed files in this pull request and generated 4 comments.