wolfHSM: add DMA_NONCOHERENT macro and support

.github/workflows/build-and-bench.yml

@@ -50,6 +50,10 @@ jobs:
     - name: Benchmark All
       run: cd benchmark && make clean && make WOLFSSL_DIR=../wolfssl DMA=1 && make run
 
+    # Benchmark DMA with non-coherent client caches (wolfCrypt DMA refused)
+    - name: Benchmark DMA ALIGNED_PADDED_OUTPUT
+      run: cd benchmark && make clean && make WOLFSSL_DIR=../wolfssl DMA=1 DMA_ALIGNED_PADDED_OUTPUT=1 && make run
+
     # Benchmark with DEBUG_VERBOSE=1 (includes DEBUG)
     - name: Benchmark with DEBUG_VERBOSE
       run: cd benchmark && make clean && make -j DEBUG_VERBOSE=1 WOLFSSL_DIR=../wolfssl && make run

.github/workflows/build-and-test-refactor.yml

@@ -77,6 +77,12 @@ jobs:
       if: matrix.group == 'pq-dma'
       run: cd test-refactor/posix && make clean && make -j DMA=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
 
+    # Build and test DMA with non-coherent client caches (wolfCrypt DMA refused),
+    # aborting on DMA output buffers that are not aligned and padded.
+    - name: Build and test refactor DMA ALIGNED_PADDED_OUTPUT THREADSAFE ASAN
+      if: matrix.group == 'pq-dma'
+      run: cd test-refactor/posix && make clean && make -j THREADSAFE=1 DMA=1 DMA_ALIGNED_PADDED_OUTPUT=1 DMA_ALIGN_CHECK=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run
+
     # Build and test with NVM flash CRC16 integrity checking enabled
     - name: Build and test refactor NVM flash CRC ASAN
       run: cd test-refactor/posix && make clean && make -j NVM_FLASH_CRC=1 ASAN=1 WOLFSSL_DIR=../../wolfssl && make run

.github/workflows/build-and-test.yml

@@ -77,6 +77,12 @@ jobs:
       if: matrix.group == 'pq-dma'
       run: cd test && make clean && make -j DMA=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run
 
+    # Build and test DMA with non-coherent client caches (wolfCrypt DMA refused),
+    # aborting on DMA output buffers that are not aligned and padded
+    - name: Build and test DMA ALIGNED_PADDED_OUTPUT ASAN
+      if: matrix.group == 'pq-dma'
+      run: cd test && make clean && make -j DMA=1 DMA_ALIGNED_PADDED_OUTPUT=1 DMA_ALIGN_CHECK=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run
+
     # Build and test with NVM flash CRC16 integrity checking enabled
     - name: Build and test NVM flash CRC ASAN
       run: cd test && make clean && make -j NVM_FLASH_CRC=1 ASAN=1 WOLFSSL_DIR=../wolfssl && make run

benchmark/Makefile

@@ -121,6 +121,14 @@ ifeq ($(DMA),1)
 	DEF += -DWOLFHSM_CFG_DMA
 endif
 
+# DMA with non-coherent client caches (requires DMA=1)
+ifeq ($(DMA_ALIGNED_PADDED_OUTPUT),1)
+    ifneq ($(DMA),1)
+        $(error "DMA_ALIGNED_PADDED_OUTPUT=1 requires DMA=1 to be set")
+    endif
+	DEF += -DWOLFHSM_CFG_DMA_REQUIRE_ALIGNED_PADDED_OUTPUT
+endif
+
 # Support a SHE-capable build
 ifeq ($(SHE),1)
 	DEF += -DWOLFHSM_CFG_SHE_EXTENSION

benchmark/bench_modules/wh_bench_mod_aes.c

@@ -43,7 +43,7 @@ static const byte key256[] = {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
 enum { DECRYPT = 0, ENCRYPT = 1 };
 
 #if defined(WOLFSSL_AES_COUNTER)
-#ifdef WOLFHSM_CFG_DMA
+#ifdef WH_BENCH_CRYPTOCB_DMA
 static int _benchAesCtrDma(whClientContext* client, whBenchOpContext* ctx,
                            int id, const uint8_t* key, size_t keyLen,
                            int encrypt)
@@ -172,7 +172,7 @@ static int _benchAesCtrDma(whClientContext* client, whBenchOpContext* ctx,
 
     return ret;
 }
-#endif /* WOLFHSM_CFG_DMA */
+#endif /* WH_BENCH_CRYPTOCB_DMA */
 
 static int _benchAesCtr(whClientContext* client, whBenchOpContext* ctx, int id,
                         const uint8_t* key, size_t keyLen, int encrypt)
@@ -305,7 +305,7 @@ int wh_Bench_Mod_Aes128CTREncryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCtrDma(client, ctx, id, (uint8_t*)key128, sizeof(key128),
                            ENCRYPT);
@@ -322,7 +322,7 @@ int wh_Bench_Mod_Aes128CTRDecryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCtrDma(client, ctx, id, (uint8_t*)key128, sizeof(key128),
                            DECRYPT);
@@ -339,7 +339,7 @@ int wh_Bench_Mod_Aes256CTREncryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCtrDma(client, ctx, id, (uint8_t*)key256, sizeof(key256),
                            ENCRYPT);
@@ -356,7 +356,7 @@ int wh_Bench_Mod_Aes256CTRDecryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCtrDma(client, ctx, id, (uint8_t*)key256, sizeof(key256),
                            DECRYPT);
@@ -371,7 +371,7 @@ int wh_Bench_Mod_Aes256CTRDecryptDma(whClientContext*  client,
 
 #endif /* WOLFSSL_AES_COUNTER */
 #if defined(HAVE_AES_ECB)
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
 static int _benchAesEcbDma(whClientContext* client, whBenchOpContext* ctx,
                            int id, const uint8_t* key, size_t keyLen,
                            int encrypt)
@@ -503,7 +503,7 @@ static int _benchAesEcbDma(whClientContext* client, whBenchOpContext* ctx,
 
     return ret;
 }
-#endif /* WOLFHSM_CFG_DMA */
+#endif /* WH_BENCH_CRYPTOCB_DMA */
 
 static int _benchAesEcb(whClientContext* client, whBenchOpContext* ctx, int id,
                         const uint8_t* key, size_t keyLen, int encrypt)
@@ -642,7 +642,7 @@ int wh_Bench_Mod_Aes128ECBEncryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesEcbDma(client, ctx, id, (uint8_t*)key128, sizeof(key128),
                            ENCRYPT);
@@ -659,7 +659,7 @@ int wh_Bench_Mod_Aes128ECBDecryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesEcbDma(client, ctx, id, (uint8_t*)key128, sizeof(key128),
                            DECRYPT);
@@ -676,7 +676,7 @@ int wh_Bench_Mod_Aes256ECBEncryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesEcbDma(client, ctx, id, (uint8_t*)key256, sizeof(key256),
                            ENCRYPT);
@@ -693,7 +693,7 @@ int wh_Bench_Mod_Aes256ECBDecryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesEcbDma(client, ctx, id, (uint8_t*)key256, sizeof(key256),
                            DECRYPT);
@@ -708,7 +708,7 @@ int wh_Bench_Mod_Aes256ECBDecryptDma(whClientContext*  client,
 #endif /* HAVE_AES_ECB */
 
 #if defined(HAVE_AES_CBC)
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
 static int _benchAesCbcDma(whClientContext* client, whBenchOpContext* ctx,
                            int id, const uint8_t* key, size_t keyLen,
                            int encrypt)
@@ -849,7 +849,7 @@ static int _benchAesCbcDma(whClientContext* client, whBenchOpContext* ctx,
 
     return ret;
 }
-#endif /* WOLFHSM_CFG_DMA */
+#endif /* WH_BENCH_CRYPTOCB_DMA */
 
 static int _benchAesCbc(whClientContext* client, whBenchOpContext* ctx, int id,
                         const uint8_t* key, size_t keyLen, int encrypt)
@@ -998,7 +998,7 @@ int wh_Bench_Mod_Aes128CBCEncryptDma(whClientContext*  client,
                                      whBenchOpContext* ctx, int id,
                                      void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCbcDma(client, ctx, id, (uint8_t*)key128, sizeof(key128),
                            ENCRYPT);
@@ -1015,7 +1015,7 @@ int wh_Bench_Mod_Aes128CBCDecryptDma(whClientContext*  client,
     whBenchOpContext* ctx, int id,
     void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCbcDma(client, ctx, id, (uint8_t*)key128, sizeof(key128),
                            DECRYPT);
@@ -1032,7 +1032,7 @@ int wh_Bench_Mod_Aes256CBCEncryptDma(whClientContext*  client,
     whBenchOpContext* ctx, int id,
     void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCbcDma(client, ctx, id, (uint8_t*)key256, sizeof(key256),
                            ENCRYPT);
@@ -1049,7 +1049,7 @@ int wh_Bench_Mod_Aes256CBCDecryptDma(whClientContext*  client,
     whBenchOpContext* ctx, int id,
     void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchAesCbcDma(client, ctx, id, (uint8_t*)key256, sizeof(key256),
                            DECRYPT);
@@ -1088,20 +1088,20 @@ static int _benchAesGcmDma(whClientContext* client, whBenchOpContext* ctx,
     (void)wh_Client_SetDmaMode(client, 1);
 
 #if defined(WOLFHSM_CFG_TEST_POSIX)
-    /* Allocate buffers using XMALLOC with heap hints for DMA */
+    /* Allocate aligned, padded buffers from the DMA heap */
     if (ctx->transportType == WH_BENCH_TRANSPORT_POSIX_DMA) {
         void* heap =
             posixTransportShm_GetDmaHeap(client->comm->transport_context);
-        in = XMALLOC(inLen, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        in = posixTransportShm_DmaAlloc(inLen, heap);
         if (in == NULL) {
             WH_BENCH_PRINTF("Failed to allocate memory for DMA input\n");
             return WH_ERROR_NOSPACE;
         }
 
-        out = XMALLOC(inLen, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        out = posixTransportShm_DmaAlloc(inLen, heap);
         if (out == NULL) {
             WH_BENCH_PRINTF("Failed to allocate memory for DMA output\n");
-            XFREE((uint8_t*)in, heap, DYNAMIC_TYPE_TMP_BUFFER);
+            posixTransportShm_DmaFree((uint8_t*)in, heap);
             return WH_ERROR_NOSPACE;
         }
     }
@@ -1212,11 +1212,11 @@ static int _benchAesGcmDma(whClientContext* client, whBenchOpContext* ctx,
 
 #if defined(WOLFHSM_CFG_TEST_POSIX)
     if (ctx->transportType == WH_BENCH_TRANSPORT_POSIX_DMA) {
-        /* if static memory was used with DMA then use XFREE */
+        /* free the buffers allocated from the DMA heap */
         void* heap =
             posixTransportShm_GetDmaHeap(client->comm->transport_context);
-        XFREE((uint8_t*)in, heap, DYNAMIC_TYPE_TMP_BUFFER);
-        XFREE(out, heap, DYNAMIC_TYPE_TMP_BUFFER);
+        posixTransportShm_DmaFree((uint8_t*)in, heap);
+        posixTransportShm_DmaFree(out, heap);
     }
 #endif /* WOLFHSM_CFG_TEST_POSIX */
 

benchmark/bench_modules/wh_bench_mod_cmac.c

@@ -65,7 +65,7 @@ int _benchCmacAes(whClientContext* client, whBenchOpContext* ctx, int id,
     }
 
     out = tag; /* default to using tag buffer on the stack */
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     if (useDma) {
         inLen = WOLFHSM_CFG_BENCH_DMA_BUFFER_SIZE;
 #if defined(WOLFHSM_CFG_TEST_POSIX)
@@ -161,7 +161,7 @@ int _benchCmacAes(whClientContext* client, whBenchOpContext* ctx, int id,
             ret = evictRet;
         }
     }
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
 #if defined(WOLFHSM_CFG_TEST_POSIX)
     if (useDma && ctx->transportType == WH_BENCH_TRANSPORT_POSIX_DMA) {
         /* if static memory was used with DMA then use XFREE */
@@ -186,7 +186,7 @@ int wh_Bench_Mod_CmacAes128(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_CmacAes128Dma(whClientContext* client, whBenchOpContext* ctx,
                                int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchCmacAes(client, ctx, id, key128, sizeof(key128), 1);
 #else
@@ -208,7 +208,7 @@ int wh_Bench_Mod_CmacAes256(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_CmacAes256Dma(whClientContext* client, whBenchOpContext* ctx,
                                int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchCmacAes(client, ctx, id, key256, sizeof(key256), 1);
 #else

benchmark/bench_modules/wh_bench_mod_hmac.c

@@ -45,7 +45,7 @@ int _benchHmacSha256(whClientContext* client, whBenchOpContext* ctx, int id,
 
     (void)wh_Client_SetDmaMode(client, useDma);
 
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     if (useDma) {
         in    = WH_BENCH_DMA_BUFFER;
         inLen = WOLFHSM_CFG_BENCH_DMA_BUFFER_SIZE;
@@ -136,7 +136,7 @@ int wh_Bench_Mod_HmacSha256(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_HmacSha256Dma(whClientContext* client, whBenchOpContext* ctx,
                                int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchHmacSha256(client, ctx, id, 1);
 #else
@@ -168,7 +168,7 @@ static int _benchHmacSha3(whClientContext* client, whBenchOpContext* ctx,
 
     (void)wh_Client_SetDmaMode(client, useDma);
 
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     if (useDma) {
         in    = WH_BENCH_DMA_BUFFER;
         inLen = WOLFHSM_CFG_BENCH_DMA_BUFFER_SIZE;
@@ -261,7 +261,7 @@ int wh_Bench_Mod_HmacSha3224(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_HmacSha3224Dma(whClientContext* client, whBenchOpContext* ctx,
                                 int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchHmacSha3(client, ctx, id, 1, WC_SHA3_224);
 #else
@@ -287,7 +287,7 @@ int wh_Bench_Mod_HmacSha3256(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_HmacSha3256Dma(whClientContext* client, whBenchOpContext* ctx,
                                 int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchHmacSha3(client, ctx, id, 1, WC_SHA3_256);
 #else
@@ -313,7 +313,7 @@ int wh_Bench_Mod_HmacSha3384(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_HmacSha3384Dma(whClientContext* client, whBenchOpContext* ctx,
                                 int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchHmacSha3(client, ctx, id, 1, WC_SHA3_384);
 #else
@@ -339,7 +339,7 @@ int wh_Bench_Mod_HmacSha3512(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_HmacSha3512Dma(whClientContext* client, whBenchOpContext* ctx,
                                 int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA)
+#if defined(WH_BENCH_CRYPTOCB_DMA)
     (void)params;
     return _benchHmacSha3(client, ctx, id, 1, WC_SHA3_512);
 #else

benchmark/bench_modules/wh_bench_mod_lms.c

@@ -30,7 +30,7 @@
  * (see the vectors below) instead of generating them. The verify path is
  * therefore guarded only by WOLFSSL_HAVE_LMS, while keygen/sign additionally
  * require !WOLFSSL_LMS_VERIFY_ONLY. */
-#if defined(WOLFHSM_CFG_DMA) && defined(WOLFSSL_HAVE_LMS)
+#if defined(WH_BENCH_CRYPTOCB_DMA) && defined(WOLFSSL_HAVE_LMS)
 
 #include <string.h>
 #include "wolfssl/wolfcrypt/random.h"
@@ -563,13 +563,13 @@ static int _benchLmsSign(whClientContext* client, whBenchOpContext* ctx, int id)
 
 #endif /* !WOLFSSL_LMS_VERIFY_ONLY */
 
-#endif /* WOLFHSM_CFG_DMA && WOLFSSL_HAVE_LMS */
+#endif /* WH_BENCH_CRYPTOCB_DMA && WOLFSSL_HAVE_LMS */
 
 /* Public benchmark module functions for LMS */
 int wh_Bench_Mod_LmsKeyGen(whClientContext* client, whBenchOpContext* ctx,
                            int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA) && defined(WOLFSSL_HAVE_LMS) && \
+#if defined(WH_BENCH_CRYPTOCB_DMA) && defined(WOLFSSL_HAVE_LMS) && \
     !defined(WOLFSSL_LMS_VERIFY_ONLY)
     (void)params;
     return _benchLmsKeyGen(client, ctx, id);
@@ -585,7 +585,7 @@ int wh_Bench_Mod_LmsKeyGen(whClientContext* client, whBenchOpContext* ctx,
 int wh_Bench_Mod_LmsSign(whClientContext* client, whBenchOpContext* ctx, int id,
                          void* params)
 {
-#if defined(WOLFHSM_CFG_DMA) && defined(WOLFSSL_HAVE_LMS) && \
+#if defined(WH_BENCH_CRYPTOCB_DMA) && defined(WOLFSSL_HAVE_LMS) && \
     !defined(WOLFSSL_LMS_VERIFY_ONLY)
     (void)params;
     return _benchLmsSign(client, ctx, id);
@@ -601,7 +601,7 @@ int wh_Bench_Mod_LmsSign(whClientContext* client, whBenchOpContext* ctx, int id,
 int wh_Bench_Mod_LmsVerify(whClientContext* client, whBenchOpContext* ctx,
                            int id, void* params)
 {
-#if defined(WOLFHSM_CFG_DMA) && defined(WOLFSSL_HAVE_LMS)
+#if defined(WH_BENCH_CRYPTOCB_DMA) && defined(WOLFSSL_HAVE_LMS)
     (void)params;
     return _benchLmsVerify(client, ctx, id);
 #else