[kojiws]

Summary

Make the IV length used by the AES-GCM benchmarks configurable via a new macro, WOLFHSM_CFG_BENCH_AES_GCM_IV_SIZE. The IV length was previously fixed at 16 bytes (sizeof(iv)), which made it impossible to benchmark with the recommended 96-bit (12-byte) GCM nonce.

Changes

• benchmark/bench_modules/wh_bench_mod_aes.c
  • Add WOLFHSM_CFG_BENCH_AES_GCM_IV_SIZE, defaulting to 12.
  • Reject values outside 1..16 with a compile-time #error. The bound is written as the literal 16 because WC_AES_BLOCK_SIZE is an enum and cannot be evaluated by the preprocessor.
  • Use the macro as the IV length in all four AES-GCM benchmark calls (standard and DMA, encrypt and decrypt).
  • The iv buffer itself stays WC_AES_BLOCK_SIZE bytes, since it is also passed to wc_AesSetIV(), which always reads a full block.
• benchmark/README.md: document the new option.

Usage

/* wolfhsm_cfg.h */
#define WOLFHSM_CFG_BENCH_AES_GCM_IV_SIZE 16

or -DWOLFHSM_CFG_BENCH_AES_GCM_IV_SIZE=16 in the compiler flags.

Testing

Tested with wolfSSL v5.9.4-stable.

• Default build (non-DMA): builds and runs; AES-GCM benchmarks work.
• DMA=1 with IV size 12 and 16, run with --type dma: builds and runs with no failures, including the AES-GCM DMA benchmarks.
• Compile-time check: -1, 0 and 17 fail with the expected #error; 1, 12 and 16 build.

[Copilot]

🟢 Approval recommended

The change consistently applies the validated IV length, preserves existing defaults and buffer safety, and has no identified blocking issues.

No open issues 🎉

What changed in this PR

This PR makes the AES-GCM benchmark IV length configurable, enabling 12-byte nonces while preserving the existing 16-byte default.

Changes:

• Adds WOLFHSM_CFG_BENCH_AES_GCM_IV_SIZE with compile-time validation for values from 1 to 16.
• Applies the setting to standard and DMA encryption/decryption benchmarks while retaining full-block IV buffers.
• Documents the option and recommended 12-byte setting.

File	Description
benchmark/​README.md	Documents the IV length option, default, and supported range.
benchmark/​bench_modules/​wh_bench_mod_aes.c	Defines and validates the option and uses it in all four AES-GCM benchmark calls.

_{Review effort: Balanced}

[bigbrett]

Great addition. I think we should just make the default 12 bytes too, and allow user to override if for some reason they want a slower implementation

[bigbrett]

thanks!