Enable hardware acceleration for AES on PSoC6.

wolfcrypt/src/aes.c

@@ -93,6 +93,11 @@ block cipher mechanism that uses n-bit binary string parameter key with 128-bits
     #include <wolfcrypt/src/port/ti/ti-aes.c>
 #else
 
+
+#if defined(WOLFSSL_PSOC6_CRYPTO)
+    #include <wolfssl/wolfcrypt/port/cypress/psoc6_crypto.h>
+#endif /* WOLFSSL_PSOC6_CRYPTO */
+
 #ifdef NO_INLINE
     #include <wolfssl/wolfcrypt/misc.h>
 #else
@@ -1118,6 +1123,24 @@ static WARN_UNUSED_RESULT int wc_AesDecrypt(Aes* aes, const byte* inBlock,
 #elif defined(WOLFSSL_SILABS_SE_ACCEL)
 /* implemented in wolfcrypt/src/port/silabs/silabs_aes.c */
 
+#elif defined(WOLFSSL_PSOC6_CRYPTO)
+
+    #if (defined(HAVE_AESGCM) || defined(WOLFSSL_AES_DIRECT))
+        static WARN_UNUSED_RESULT int wc_AesEncrypt(
+            Aes* aes, const byte* inBlock, byte* outBlock)
+        {
+            return wc_Psoc6_Aes_Encrypt(aes, inBlock, outBlock);
+        }
+    #endif
+
+    #if defined(HAVE_AES_DECRYPT) && defined(WOLFSSL_AES_DIRECT)
+        static WARN_UNUSED_RESULT int wc_AesDecrypt(
+            Aes* aes, const byte* inBlock, byte* outBlock)
+        {
+            return wc_Psoc6_Aes_Decrypt(aes, inBlock, outBlock);
+        }
+
+    #endif
 #else
 
     /* using wolfCrypt software implementation */
@@ -4405,6 +4428,22 @@ static WARN_UNUSED_RESULT int wc_AesDecrypt(
         return AesSetKey(aes, userKey, keylen, iv, dir);
     }
     #endif /* WOLFSSL_AES_DIRECT || WOLFSSL_AES_COUNTER */
+
+#elif defined(WOLFSSL_PSOC6_CRYPTO)
+
+    int wc_AesSetKey(Aes* aes, const byte* userKey, word32 keylen,
+        const byte* iv, int dir)
+    {
+        return wc_Psoc6_Aes_SetKey(aes, userKey, keylen, iv, dir);
+    }
+
+    #if defined(WOLFSSL_AES_DIRECT)
+        int wc_AesSetKeyDirect(Aes* aes, const byte* userKey, word32 keylen,
+                            const byte* iv, int dir)
+        {
+            return wc_AesSetKey(aes, userKey, keylen, iv, dir);
+        }
+    #endif /* WOLFSSL_AES_DIRECT */
 #else
     #define NEED_SOFTWARE_AES_SETKEY
 #endif
@@ -6108,6 +6147,20 @@ int wc_AesSetIV(Aes* aes, const byte* iv)
 #elif defined(WOLFSSL_HAVE_PSA) && !defined(WOLFSSL_PSA_NO_AES)
     /* implemented in wolfcrypt/src/port/psa/psa_aes.c */
 
+#elif defined(WOLFSSL_PSOC6_CRYPTO)
+
+    int wc_AesCbcEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+    {
+        return wc_Psoc6_Aes_CbcEncrypt(aes, out, in, sz);
+    }
+
+    #if defined(HAVE_AES_DECRYPT)
+    int wc_AesCbcDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+    {
+        return wc_Psoc6_Aes_CbcDecrypt(aes, out, in, sz);
+    }
+    #endif /* HAVE_AES_DECRYPT */
+
 #else
     /* Reminder: Some HW implementations may also define this as needed.
      * (e.g. for unsupported key length fallback)  */
@@ -7237,7 +7290,7 @@ int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
     }
     else
 #endif
-#if !defined(FREESCALE_LTC_AES_GCM)
+#if !defined(FREESCALE_LTC_AES_GCM) && !defined(WOLFSSL_PSOC6_CRYPTO)
     if (ret == 0) {
         VECTOR_REGISTERS_PUSH;
         /* AES-NI code generates its own H value, but generate it here too, to
@@ -7275,7 +7328,7 @@ int wc_AesGcmSetKey(Aes* aes, const byte* key, word32 len)
         }
 #endif /* GCM_TABLE || GCM_TABLE_4BIT */
     }
-#endif /* FREESCALE_LTC_AES_GCM */
+#endif /* !FREESCALE_LTC_AES_GCM && !WOLFSSL_PSOC6_CRYPTO */
 #endif
 
 #if defined(WOLFSSL_XILINX_CRYPT) || defined(WOLFSSL_AFALG_XILINX_AES)
@@ -9380,6 +9433,11 @@ int wc_AesGcmEncrypt(Aes* aes, byte* out, const byte* in, word32 sz,
         authTag, authTagSz, authIn, authInSz);
 #endif /* STM32_CRYPTO_AES_GCM */
 
+#if defined(WOLFSSL_PSOC6_CRYPTO)
+    return wc_Psoc6_Aes_GcmEncrypt(aes, out, in, sz, iv, ivSz, authTag,
+                                   authTagSz, authIn, authInSz);
+#endif /* WOLFSSL_PSOC6_CRYPTO */
+
     VECTOR_REGISTERS_PUSH;
 
 #if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
@@ -10060,6 +10118,11 @@ int wc_AesGcmDecrypt(Aes* aes, byte* out, const byte* in, word32 sz,
         authTag, authTagSz, authIn, authInSz);
 #endif /* STM32_CRYPTO_AES_GCM */
 
+#if defined(WOLFSSL_PSOC6_CRYPTO)
+    return wc_Psoc6_Aes_GcmDecrypt(aes, out, in, sz, iv, ivSz, authTag,
+                                   authTagSz, authIn, authInSz);
+#endif /* WOLFSSL_PSOC6_CRYPTO */
+
     VECTOR_REGISTERS_PUSH;
 
 #if !defined(__aarch64__) && defined(WOLFSSL_ARMASM)
@@ -13100,6 +13163,30 @@ int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     return AES_ECB_decrypt(aes, in, out, sz);
 }
 
+#elif defined(WOLFSSL_PSOC6_CRYPTO)
+
+int wc_AesEcbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    if ((in == NULL) || (out == NULL) || (aes == NULL))
+        return BAD_FUNC_ARG;
+
+    return wc_Psoc6_Aes_EcbEncrypt(aes, out, in, sz);
+}
+
+#define _AesEcbEncrypt(aes, out, in, sz) wc_AesEcbEncrypt(aes, out, in, sz)
+
+#ifdef HAVE_AES_DECRYPT
+int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    if ((in == NULL) || (out == NULL) || (aes == NULL))
+        return BAD_FUNC_ARG;
+
+    return wc_Psoc6_Aes_EcbDecrypt(aes, out, in, sz);
+}
+
+#define _AesEcbDecrypt(aes, out, in, sz) wc_AesEcbDecrypt(aes, out, in, sz)
+#endif /* HAVE_AES_DECRYPT */
+
 #else
 
 /* Software AES - ECB */
@@ -13264,6 +13351,22 @@ int wc_AesEcbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
 #endif /* HAVE_AES_ECB */
 
 #if defined(WOLFSSL_AES_CFB)
+
+#if defined(WOLFSSL_PSOC6_CRYPTO)
+
+int wc_AesCfbEncrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    return wc_Psoc6_Aes_CfbEncrypt(aes, out, in, sz);
+}
+
+#ifdef HAVE_AES_DECRYPT
+int wc_AesCfbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
+{
+    return wc_Psoc6_Aes_CfbDecrypt(aes, out, in, sz);
+}
+#endif /* HAVE_AES_DECRYPT */
+
+#else
 /* Feedback AES mode
  *
  * aes structure holding key to use for encryption
@@ -13456,6 +13559,7 @@ int wc_AesCfbDecrypt(Aes* aes, byte* out, const byte* in, word32 sz)
     return AesCfbDecrypt_C(aes, out, in, sz, AES_CFB_MODE);
 }
 #endif /* HAVE_AES_DECRYPT */
+#endif /* WOLFSSL_PSOC6_CRYPTO */
 
 #ifndef WOLFSSL_NO_AES_CFB_1_8
 /* shift the whole WC_AES_BLOCK_SIZE array left by 8 or 1 bits */

wolfcrypt/src/port/cypress/README.md

@@ -1,6 +1,6 @@
 # PSoC6 Hardware Crypto Port for wolfSSL
 
-This directory provides a hardware-accelerated cryptography port for Cypress PSoC6 devices, integrating the PSoC6 hardware crypto block with the wolfSSL cryptography library. The implementation leverages the PSoC6 hardware to accelerate various cryptographic hash and ECC operations, improving performance and reducing CPU load.
+This directory provides a hardware-accelerated cryptography port for Cypress PSoC6 devices, integrating the PSoC6 hardware crypto block with the wolfSSL cryptography library. The implementation leverages the PSoC6 hardware to accelerate various cryptographic operations including hash functions, AES encryption/decryption, and ECC verification, improving performance and reducing CPU load.
 
 ## Implemented Features
 
@@ -21,68 +21,126 @@ The following hash algorithms are implemented using the PSoC6 hardware crypto bl
 
 All hash operations are offloaded to the PSoC6 hardware, with mutex protection for thread safety.
 
-### 2. Hardware-Accelerated ECDSA Verification
+### 2. Hardware-Accelerated AES Functions
+
+The following AES cipher modes are implemented using the PSoC6 hardware crypto block:
+
+- **AES Block Operations**
+  - Single-block encryption/decryption: `wc_Psoc6_Aes_Encrypt`, `wc_Psoc6_Aes_Decrypt`
+  - Direct AES operations: `wc_Psoc6_Aes_EncryptDirect`, `wc_Psoc6_Aes_DecryptDirect` (enabled with `WOLFSSL_AES_DIRECT`)
+  - Supports AES-128, AES-192, and AES-256 key sizes
+
+- **AES-ECB (Electronic Codebook) Mode**
+  - Multi-block encryption: `wc_Psoc6_Aes_EcbEncrypt`
+  - Multi-block decryption: `wc_Psoc6_Aes_EcbDecrypt`
+  - Enabled with `HAVE_AES_ECB`
+
+- **AES-CBC (Cipher Block Chaining) Mode**
+  - Multi-block encryption with IV chaining: `wc_Psoc6_Aes_CbcEncrypt`
+  - Multi-block decryption with IV chaining: `wc_Psoc6_Aes_CbcDecrypt`
+  - Automatically enabled with `HAVE_AES_CBC`
+
+- **AES-CFB (Cipher Feedback) Mode**
+  - Stream encryption: `wc_Psoc6_Aes_CfbEncrypt`
+  - Stream decryption: `wc_Psoc6_Aes_CfbDecrypt`
+  - Enabled with `WOLFSSL_AES_CFB`
+
+- **AES-GCM (Galois/Counter Mode)**
+  - Authenticated encryption: `wc_Psoc6_Aes_GcmEncrypt`
+  - Authenticated decryption with tag verification: `wc_Psoc6_Aes_GcmDecrypt`
+  - Provides both confidentiality and authenticity
+  - Enabled with `HAVE_AESGCM`
+
+All AES operations are offloaded to the PSoC6 hardware with mutex protection for thread safety.
+### 3. Hardware-Accelerated ECDSA Verification
 
 - **ECDSA Signature Verification**
   - Function: `psoc6_ecc_verify_hash_ex`
   - Uses PSoC6 hardware to verify ECDSA signatures for supported curves (up to secp521r1).
   - Enabled when `HAVE_ECC` is defined.
 
-### 3. Crypto Block Initialization and Resource Management
+### 4. Crypto Block Initialization and Resource Management
 
 - **Initialization**
   - Function: `psoc6_crypto_port_init`
   - Enables the PSoC6 crypto hardware block.
 - **Resource Cleanup**
-  - Function: `wc_Psoc6_Sha_Free`
-  - Clears and synchronizes the hardware register buffer.
+  - Hash functions: `wc_Psoc6_Sha_Free` — Clears and synchronizes the hardware register buffer
+  - AES functions: `wc_Psoc6_Aes_Free` — Frees internal AES buffers and state
 
 ## Enable Hardware Acceleration
 
-To enable PSoC6 hardware crypto acceleration for hash and ECC algorithms, ensure the following macros are defined:
+To enable PSoC6 hardware crypto acceleration, ensure the following macros are defined:
+
+### Core Macro
+- `WOLFSSL_PSOC6_CRYPTO` — Enables the PSoC6 hardware crypto port (required for all features)
 
-- `WOLFSSL_PSOC6_CRYPTO` — Enables the PSoC6 hardware crypto port.
+### Hash Function Macros
 - The following are defined in `psoc6_crypto.h` and control which hardware hash accelerations are available:
-  - `PSOC6_HASH_SHA1` — Enables SHA-1 hardware acceleration.
-  - `PSOC6_HASH_SHA2` — Enables SHA-2 family (SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256) hardware acceleration.
-  - `PSOC6_HASH_SHA3` — Enables SHA-3 family hardware acceleration.
-- To enable the corresponding algorithms in wolfSSL, define the following macros as needed (typically in your `wolfssl/wolfcrypt/settings.h` or build system):
-  - `WOLFSSL_SHA224` — Enable SHA-224 support.
-  - `WOLFSSL_SHA384` — Enable SHA-384 support.
-  - `WOLFSSL_SHA512` — Enable SHA-512, SHA-512/224, SHA-512/256 support.
-  - `WOLFSSL_SHA3` — Enable SHA-3 support.
-  - `WOLFSSL_SHAKE128`, `WOLFSSL_SHAKE256` — Enable SHAKE support.
-  - `HAVE_ECC` — Enable ECC and ECDSA support.
-
-**Example: Enabling SHA-1, SHA-2, and SHA-3 Hardware Acceleration**
+  - `PSOC6_HASH_SHA1` — Enables SHA-1 hardware acceleration
+  - `PSOC6_HASH_SHA2` — Enables SHA-2 family hardware acceleration
+  - `PSOC6_HASH_SHA3` — Enables SHA-3 family hardware acceleration
+- To enable the corresponding algorithms in wolfSSL, define these macros (typically in your `wolfssl/wolfcrypt/settings.h` or build system):
+  - `WOLFSSL_SHA224` — Enable SHA-224 support
+  - `WOLFSSL_SHA384` — Enable SHA-384 support
+  - `WOLFSSL_SHA512` — Enable SHA-512, SHA-512/224, SHA-512/256 support
+  - `WOLFSSL_SHA3` — Enable SHA-3 support
+  - `WOLFSSL_SHAKE128`, `WOLFSSL_SHAKE256` — Enable SHAKE support
+
+### AES Function Macros
+- AES hardware acceleration is automatically enabled when `NO_AES` is not defined
+- To enable specific AES modes, define:
+  - `HAVE_AES_ECB` — Enable AES-ECB mode
+  - `HAVE_AES_CBC` — Enable AES-CBC mode (typically enabled by default)
+  - `HAVE_AES_DECRYPT` — Enable AES decryption functions
+  - `WOLFSSL_AES_DIRECT` — Enable direct AES block operations
+  - `WOLFSSL_AES_CFB` — Enable AES-CFB mode
+  - `HAVE_AESGCM` — Enable AES-GCM authenticated encryption
+
+### ECC Function Macros
+- `HAVE_ECC` — Enable ECC and ECDSA support
+
+**Example: Enabling Full Hardware Acceleration**
 
 In your build configuration or `wolfssl/wolfcrypt/settings.h`:
 ```c
 #define WOLFSSL_PSOC6_CRYPTO
+
+/* Hash functions */
 #define WOLFSSL_SHA224
 #define WOLFSSL_SHA384
 #define WOLFSSL_SHA512
 #define WOLFSSL_SHA3
 #define WOLFSSL_SHAKE128
 #define WOLFSSL_SHAKE256
+
+/* AES cipher modes */
+#define HAVE_AES_ECB
+#define HAVE_AES_CBC
+#define HAVE_AES_DECRYPT
+#define WOLFSSL_AES_DIRECT
+#define WOLFSSL_AES_CFB
+#define HAVE_AESGCM
+
+/* ECC */
 #define HAVE_ECC
 ```
-- No need to define `PSOC6_HASH_SHA1`, `PSOC6_HASH_SHA2`, or `PSOC6_HASH_SHA3` yourself; they are defined in `psoc6_crypto.h`.
+- Note: `PSOC6_HASH_SHA1`, `PSOC6_HASH_SHA2`, and `PSOC6_HASH_SHA3` are automatically defined in `psoc6_crypto.h`; you don't need to define them explicitly.
 
 ## File Overview
 
 - `psoc6_crypto.h`
   Header file declaring the hardware crypto interface and configuration macros.
 - `psoc6_crypto.c`
-  Implementation of the hardware-accelerated hash and ECC functions for PSoC6.
+  Implementation of the hardware-accelerated hash, AES, and ECC functions for PSoC6.
 
 ## Integration Notes
 
 - The port expects the PSoC6 PDL (Peripheral Driver Library) to be available and included in your project.
 - The hardware crypto block is initialized on first use; no manual initialization is required unless you wish to call `psoc6_crypto_port_init` directly.
-- Hash operations are mutex-protected for thread safety.
+- Hash and AES operations are mutex-protected for thread safety.
 - ECC hardware operations are not mutex-protected; if you use ECC functions from multiple threads, you must provide your own synchronization.
-- The implementation is designed to be compatible with the wolfSSL API, so existing code using wolfSSL hash/ECC functions will automatically benefit from hardware acceleration when enabled.
+- The implementation is designed to be compatible with the wolfSSL API, so existing code using wolfSSL hash/AES/ECC functions will automatically benefit from hardware acceleration when enabled.
 
 ---