This patchset adds support for the archrandom API to the RISC-V
architecture.
The ratified crypto scalar extensions provide entropy bits via the seed
CSR, as exposed by the Zkr extension.
The first patch of this patchset allows for detecting support of the Zbc
and all scalar crypto extensions. The second patch documents the
corresponding dt-bindings.
The third patch exposes the Zbc and scalar crypto extensions through
the hwprobe syscall.
The last patch relies on the first ones to check for the Zkr support,
and implements get_random_seed_longs by looping through a seed CSR
read-write to return one long worth of entropy.
---
v3:
- Increase the CSR SEED retry loop max iterations to 100
- Document the added extensions in the related dt-bindings file
v2:
- Fixed the ISA map setting for zkbx
- Alphanumerically sort the ISA map setting
- Added my SOB on Hongren's patch
- Fixed patch #1 commit message
- Remove printk prefix from the archrandom implementation
- Fix needed_seeds computation (and make it const)
- Replace riscv_isa_extension_available() with
riscv_has_extension_likely()
- Make the get_random_seed_longs implementation more readable
---
Hongren (Zenithal) Zheng (1):
RISC-V: Add Bitmanip/Scalar Crypto parsing from DT
Samuel Ortiz (3):
dt-bindings: riscv: Document the 1.0 scalar cryptography extensions
RISC-V: hwprobe: Expose Zbc and the scalar crypto extensions
RISC-V: Implement archrandom when Zkr is available
.../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
Documentation/riscv/hwprobe.rst | 33 ++++++++
arch/riscv/include/asm/archrandom.h | 70 ++++++++++++++++
arch/riscv/include/asm/csr.h | 9 ++
arch/riscv/include/asm/hwcap.h | 11 +++
arch/riscv/include/uapi/asm/hwprobe.h | 11 +++
arch/riscv/kernel/cpu.c | 11 +++
arch/riscv/kernel/cpufeature.c | 30 +++++++
arch/riscv/kernel/sys_riscv.c | 36 ++++----
9 files changed, 279 insertions(+), 14 deletions(-)
create mode 100644 arch/riscv/include/asm/archrandom.h
base-commit: e8605e8fdf42642048b7e59141deaf8e4cf06d71
--
2.41.0
From: "Hongren (Zenithal) Zheng" <[email protected]>
Parse Zb/Zk related string from DT and output them to cpuinfo.
It is worth noting that the Scalar Crypto extension defines "zk" as a
shorthand for the Zkn, Zkr and Zkt extensions. Since the Zkn one also
implies the Zbkb, Zbkc and Zbkx extensions, simply passing the valid
"zk" extension name through a DT will enable all of the Zbkb, Zbkc,
Zbkx, Zkn, Zkr and Zkt extensions.
Also, since there currently is no mechanism to merge all enabled
extensions, the generated cpuinfo output could be relatively large.
For example, setting the "riscv,isa" DT property to "rv64imafdc_zk_zks"
will generate the following cpuinfo output:
"rv64imafdc_zbkb_zbkc_zbkx_zknd_zkne_zknh_zkr_zksed_zksh_zkt".
Tested-by: Jiatai He <[email protected]>
Reviewed-by: Evan Green <[email protected]>
Reviewed-by: Conor Dooley <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>
Signed-off-by: Hongren (Zenithal) Zheng <[email protected]>
---
arch/riscv/include/asm/hwcap.h | 11 +++++++++++
arch/riscv/kernel/cpu.c | 11 +++++++++++
arch/riscv/kernel/cpufeature.c | 30 ++++++++++++++++++++++++++++++
3 files changed, 52 insertions(+)
diff --git a/arch/riscv/include/asm/hwcap.h b/arch/riscv/include/asm/hwcap.h
index f041bfa7f6a0..b80ca6e77088 100644
--- a/arch/riscv/include/asm/hwcap.h
+++ b/arch/riscv/include/asm/hwcap.h
@@ -53,6 +53,17 @@
#define RISCV_ISA_EXT_ZICSR 40
#define RISCV_ISA_EXT_ZIFENCEI 41
#define RISCV_ISA_EXT_ZIHPM 42
+#define RISCV_ISA_EXT_ZBC 43
+#define RISCV_ISA_EXT_ZBKB 44
+#define RISCV_ISA_EXT_ZBKC 45
+#define RISCV_ISA_EXT_ZBKX 46
+#define RISCV_ISA_EXT_ZKND 47
+#define RISCV_ISA_EXT_ZKNE 48
+#define RISCV_ISA_EXT_ZKNH 49
+#define RISCV_ISA_EXT_ZKR 50
+#define RISCV_ISA_EXT_ZKSED 51
+#define RISCV_ISA_EXT_ZKSH 52
+#define RISCV_ISA_EXT_ZKT 53
#define RISCV_ISA_EXT_MAX 64
#define RISCV_ISA_EXT_NAME_LEN_MAX 32
diff --git a/arch/riscv/kernel/cpu.c b/arch/riscv/kernel/cpu.c
index a2fc952318e9..10524322a4c0 100644
--- a/arch/riscv/kernel/cpu.c
+++ b/arch/riscv/kernel/cpu.c
@@ -215,7 +215,18 @@ static struct riscv_isa_ext_data isa_ext_arr[] = {
__RISCV_ISA_EXT_DATA(zihpm, RISCV_ISA_EXT_ZIHPM),
__RISCV_ISA_EXT_DATA(zba, RISCV_ISA_EXT_ZBA),
__RISCV_ISA_EXT_DATA(zbb, RISCV_ISA_EXT_ZBB),
+ __RISCV_ISA_EXT_DATA(zbc, RISCV_ISA_EXT_ZBC),
+ __RISCV_ISA_EXT_DATA(zbkb, RISCV_ISA_EXT_ZBKB),
+ __RISCV_ISA_EXT_DATA(zbkc, RISCV_ISA_EXT_ZBKC),
+ __RISCV_ISA_EXT_DATA(zbkx, RISCV_ISA_EXT_ZBKX),
__RISCV_ISA_EXT_DATA(zbs, RISCV_ISA_EXT_ZBS),
+ __RISCV_ISA_EXT_DATA(zknd, RISCV_ISA_EXT_ZKND),
+ __RISCV_ISA_EXT_DATA(zkne, RISCV_ISA_EXT_ZKNE),
+ __RISCV_ISA_EXT_DATA(zknh, RISCV_ISA_EXT_ZKNH),
+ __RISCV_ISA_EXT_DATA(zkr, RISCV_ISA_EXT_ZKR),
+ __RISCV_ISA_EXT_DATA(zksed, RISCV_ISA_EXT_ZKSED),
+ __RISCV_ISA_EXT_DATA(zksh, RISCV_ISA_EXT_ZKSH),
+ __RISCV_ISA_EXT_DATA(zkt, RISCV_ISA_EXT_ZKT),
__RISCV_ISA_EXT_DATA(smaia, RISCV_ISA_EXT_SMAIA),
__RISCV_ISA_EXT_DATA(ssaia, RISCV_ISA_EXT_SSAIA),
__RISCV_ISA_EXT_DATA(sscofpmf, RISCV_ISA_EXT_SSCOFPMF),
diff --git a/arch/riscv/kernel/cpufeature.c b/arch/riscv/kernel/cpufeature.c
index bdcf460ea53d..9a872a2007a5 100644
--- a/arch/riscv/kernel/cpufeature.c
+++ b/arch/riscv/kernel/cpufeature.c
@@ -309,10 +309,40 @@ void __init riscv_fill_hwcap(void)
SET_ISA_EXT_MAP("svpbmt", RISCV_ISA_EXT_SVPBMT);
SET_ISA_EXT_MAP("zba", RISCV_ISA_EXT_ZBA);
SET_ISA_EXT_MAP("zbb", RISCV_ISA_EXT_ZBB);
+ SET_ISA_EXT_MAP("zbc", RISCV_ISA_EXT_ZBC);
+ SET_ISA_EXT_MAP("zbkb", RISCV_ISA_EXT_ZBKB);
+ SET_ISA_EXT_MAP("zbkc", RISCV_ISA_EXT_ZBKC);
+ SET_ISA_EXT_MAP("zbkx", RISCV_ISA_EXT_ZBKX);
SET_ISA_EXT_MAP("zbs", RISCV_ISA_EXT_ZBS);
SET_ISA_EXT_MAP("zicbom", RISCV_ISA_EXT_ZICBOM);
SET_ISA_EXT_MAP("zicboz", RISCV_ISA_EXT_ZICBOZ);
SET_ISA_EXT_MAP("zihintpause", RISCV_ISA_EXT_ZIHINTPAUSE);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZBKB);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZBKC);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZBKX);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZKND);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZKNE);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZKNH);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZKR);
+ SET_ISA_EXT_MAP("zk", RISCV_ISA_EXT_ZKT);
+ SET_ISA_EXT_MAP("zkn", RISCV_ISA_EXT_ZBKB);
+ SET_ISA_EXT_MAP("zkn", RISCV_ISA_EXT_ZBKC);
+ SET_ISA_EXT_MAP("zkn", RISCV_ISA_EXT_ZBKX);
+ SET_ISA_EXT_MAP("zkn", RISCV_ISA_EXT_ZKND);
+ SET_ISA_EXT_MAP("zkn", RISCV_ISA_EXT_ZKNE);
+ SET_ISA_EXT_MAP("zkn", RISCV_ISA_EXT_ZKNH);
+ SET_ISA_EXT_MAP("zknd", RISCV_ISA_EXT_ZKND);
+ SET_ISA_EXT_MAP("zkne", RISCV_ISA_EXT_ZKNE);
+ SET_ISA_EXT_MAP("zknh", RISCV_ISA_EXT_ZKNH);
+ SET_ISA_EXT_MAP("zks", RISCV_ISA_EXT_ZBKB);
+ SET_ISA_EXT_MAP("zks", RISCV_ISA_EXT_ZBKC);
+ SET_ISA_EXT_MAP("zks", RISCV_ISA_EXT_ZBKX);
+ SET_ISA_EXT_MAP("zks", RISCV_ISA_EXT_ZKSED);
+ SET_ISA_EXT_MAP("zks", RISCV_ISA_EXT_ZKSH);
+ SET_ISA_EXT_MAP("zksed", RISCV_ISA_EXT_ZKSED);
+ SET_ISA_EXT_MAP("zksh", RISCV_ISA_EXT_ZKSH);
+ SET_ISA_EXT_MAP("zkr", RISCV_ISA_EXT_ZKR);
+ SET_ISA_EXT_MAP("zkt", RISCV_ISA_EXT_ZKT);
}
#undef SET_ISA_EXT_MAP
}
--
2.41.0
The Zkr extension is ratified and provides 16 bits of entropy seed when
reading the SEED CSR.
We can implement arch_get_random_seed_longs() by doing multiple csrrw to
that CSR and filling an unsigned long with valid entropy bits.
Acked-by: Conor Dooley <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>
---
arch/riscv/include/asm/archrandom.h | 70 +++++++++++++++++++++++++++++
arch/riscv/include/asm/csr.h | 9 ++++
2 files changed, 79 insertions(+)
create mode 100644 arch/riscv/include/asm/archrandom.h
diff --git a/arch/riscv/include/asm/archrandom.h b/arch/riscv/include/asm/archrandom.h
new file mode 100644
index 000000000000..38f3cced0fd0
--- /dev/null
+++ b/arch/riscv/include/asm/archrandom.h
@@ -0,0 +1,70 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Kernel interface for the RISCV arch_random_* functions
+ *
+ * Copyright (c) 2023 by Rivos Inc.
+ *
+ */
+
+#ifndef ASM_RISCV_ARCHRANDOM_H
+#define ASM_RISCV_ARCHRANDOM_H
+
+#include <asm/csr.h>
+
+#define SEED_RETRY_LOOPS 100
+
+static inline bool __must_check csr_seed_long(unsigned long *v)
+{
+ unsigned int retry = SEED_RETRY_LOOPS, valid_seeds = 0;
+ const int needed_seeds = sizeof(long) / sizeof(u16);
+ u16 *entropy = (u16 *)v;
+
+ do {
+ /*
+ * The SEED CSR (0x015) must be accessed with a read-write
+ * instruction.
+ */
+ unsigned long csr_seed = csr_swap(CSR_SEED, 0);
+
+ switch (csr_seed & SEED_OPST_MASK) {
+ case SEED_OPST_ES16:
+ entropy[valid_seeds++] = csr_seed & SEED_ENTROPY_MASK;
+ if (valid_seeds == needed_seeds)
+ return true;
+ break;
+
+ case SEED_OPST_DEAD:
+ pr_err_once("archrandom: Unrecoverable error\n");
+ return false;
+
+ case SEED_OPST_BIST:
+ case SEED_OPST_WAIT:
+ default:
+ continue;
+ }
+ } while (--retry);
+
+ return false;
+}
+
+static inline size_t __must_check arch_get_random_longs(unsigned long *v, size_t max_longs)
+{
+ return 0;
+}
+
+static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs)
+{
+ if (!max_longs)
+ return 0;
+
+ /*
+ * If Zkr is supported and csr_seed_long succeeds, we return one long
+ * worth of entropy.
+ */
+ if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v))
+ return 1;
+
+ return 0;
+}
+
+#endif /* ASM_RISCV_ARCHRANDOM_H */
diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h
index b98b3b6c9da2..7d0ca9082c66 100644
--- a/arch/riscv/include/asm/csr.h
+++ b/arch/riscv/include/asm/csr.h
@@ -389,6 +389,15 @@
#define CSR_VTYPE 0xc21
#define CSR_VLENB 0xc22
+/* Scalar Crypto Extension - Entropy */
+#define CSR_SEED 0x015
+#define SEED_OPST_MASK _AC(0xC0000000, UL)
+#define SEED_OPST_BIST _AC(0x00000000, UL)
+#define SEED_OPST_WAIT _AC(0x40000000, UL)
+#define SEED_OPST_ES16 _AC(0x80000000, UL)
+#define SEED_OPST_DEAD _AC(0xC0000000, UL)
+#define SEED_ENTROPY_MASK _AC(0xFFFF, UL)
+
#ifdef CONFIG_RISCV_M_MODE
# define CSR_STATUS CSR_MSTATUS
# define CSR_IE CSR_MIE
--
2.41.0
The RISC-V cryptography extensions define a set of instructions, CSR
definitions, architectural interfaces and also extension shorthands for
running scalar and vector based cryptography operations on RISC-V
systems.
This documents all the dt-bindings for the scalar cryptography
extensions, including the Zk, Zkn and Zks shorthands.
Signed-off-by: Samuel Ortiz <[email protected]>
---
.../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
1 file changed, 82 insertions(+)
diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
index cc1f546fdbdc..361756978da1 100644
--- a/Documentation/devicetree/bindings/riscv/extensions.yaml
+++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
@@ -190,6 +190,24 @@ properties:
instructions as ratified at commit 6d33919 ("Merge pull request #158
from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
+ - const: zbkb
+ description: |
+ The standard Zbkb cryptography extension for bit-manipulation
+ instructions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zbkc
+ description: |
+ The standard Zbkc cryptography extension for carry-less multiply
+ instructions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zbkx
+ description: |
+ The standard Zbkx cryptography extension for crossbar permutation
+ instructions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
- const: zicbom
description:
The standard Zicbom extension for base cache management operations as
@@ -240,6 +258,70 @@ properties:
ratified in the 20191213 version of the unprivileged ISA
specification.
+ - const: zk
+ description: |
+ The standard Zk cryptography extension is a shorthand for the
+ union of the Zkn, Zkr and Zkt cryptography extensions, as ratified
+ at commit 73de909 ("Zvk: Update AES instruction specs") of
+ riscv-crypto.
+
+ - const: zkn
+ description: |
+ The standard Zkn cryptography extension covers the NIST algorithm
+ suite that other cryptography extensions support. It is the union of
+ the Zbkb, Zbkc, Zbkx, Zknd, Zkne and Zknh extensions, as ratified at
+ commit 73de909 ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zknd
+ description: |
+ The standard Zknd cryptography extension for AES block cipher
+ decryption acceleration instructions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zkne
+ description: |
+ The standard Zkne cryptography extension for AES block cipher
+ encryption acceleration instructions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zknh
+ description: |
+ The standard Zknh cryptography extension for SHA2 hash algorithm
+ functions acceleration instructions as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zkr
+ description: |
+ The standard Zkr cryptography extension for the entropy source CSR
+ definitions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zks
+ description: |
+ The standard Zks cryptography extension covers the ShangMi algorithm
+ suite that other cryptography extensions support. It is the union of
+ the Zbkb, Zbkc, Zbkx, Zksed and Zksh extensions, as ratified at
+ commit 73de909 ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zksed
+ description: |
+ The standard Zksed cryptography extension for SM4 block cipher
+ acceleration instructions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zksh
+ description: |
+ The standard Zksh cryptography extension for SM3 hash algorithm
+ funstions acceleration instructions, as ratified at commit 73de909
+ ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+ - const: zkt
+ description: |
+ The standard Zkt cryptography extension for data independent
+ execution latency attestation, for a safe subset of instructions,
+ as ratified at commit 73de909 ("Zvk: Update AES instruction specs")
+ of riscv-crypto.
+
- const: ztso
description:
The standard Ztso extension for total store ordering, as ratified
--
2.41.0
Zbc was missing from a previous Bit-Manipulation extension hwprobe
patch.
Add all scalar crypto extensions bits, and define a macro for setting
the hwprobe key/pair in a more readable way.
Reviewed-by: Evan Green <[email protected]>
Reviewed-by: Conor Dooley <[email protected]>
Reviewed-by: Heiko Stuebner <[email protected]>
Tested-by: Heiko Stuebner <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>
---
Documentation/riscv/hwprobe.rst | 33 ++++++++++++++++++++++++
arch/riscv/include/uapi/asm/hwprobe.h | 11 ++++++++
arch/riscv/kernel/sys_riscv.c | 36 ++++++++++++++++-----------
3 files changed, 66 insertions(+), 14 deletions(-)
diff --git a/Documentation/riscv/hwprobe.rst b/Documentation/riscv/hwprobe.rst
index 19165ebd82ba..3177550106e0 100644
--- a/Documentation/riscv/hwprobe.rst
+++ b/Documentation/riscv/hwprobe.rst
@@ -72,11 +72,44 @@ The following keys are defined:
extensions.
* :c:macro:`RISCV_HWPROBE_EXT_ZBB`: The Zbb extension is supported, as defined
+ in version 1.0 of the Bit-Manipulation ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZBC`: The Zbc extension is supported, as defined
in version 1.0 of the Bit-Manipulation ISA extensions.
* :c:macro:`RISCV_HWPROBE_EXT_ZBS`: The Zbs extension is supported, as defined
in version 1.0 of the Bit-Manipulation ISA extensions.
+ * :c:macro:`RISCV_HWPROBE_EXT_ZBKB`: The Zbkb extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZBKC`: The Zbkc extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZBKX`: The Zbkx extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZKND`: The Zknd extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZKNE`: The Zkne extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZKNH`: The Zknh extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZKR`: The Zkr extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZKSED`: The Zksed extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZKSH`: The Zksh extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
+ * :c:macro:`RISCV_HWPROBE_EXT_ZKT`: The Zkt extension is supported, as defined
+ in version 1.0 of the Scalar Cryptography ISA extensions.
+
* :c:macro:`RISCV_HWPROBE_KEY_CPUPERF_0`: A bitmask that contains performance
information about the selected set of processors.
diff --git a/arch/riscv/include/uapi/asm/hwprobe.h b/arch/riscv/include/uapi/asm/hwprobe.h
index 006bfb48343d..8357052061b3 100644
--- a/arch/riscv/include/uapi/asm/hwprobe.h
+++ b/arch/riscv/include/uapi/asm/hwprobe.h
@@ -29,6 +29,17 @@ struct riscv_hwprobe {
#define RISCV_HWPROBE_EXT_ZBA (1 << 3)
#define RISCV_HWPROBE_EXT_ZBB (1 << 4)
#define RISCV_HWPROBE_EXT_ZBS (1 << 5)
+#define RISCV_HWPROBE_EXT_ZBC (1 << 6)
+#define RISCV_HWPROBE_EXT_ZBKB (1 << 7)
+#define RISCV_HWPROBE_EXT_ZBKC (1 << 8)
+#define RISCV_HWPROBE_EXT_ZBKX (1 << 9)
+#define RISCV_HWPROBE_EXT_ZKND (1 << 10)
+#define RISCV_HWPROBE_EXT_ZKNE (1 << 11)
+#define RISCV_HWPROBE_EXT_ZKNH (1 << 12)
+#define RISCV_HWPROBE_EXT_ZKR (1 << 13)
+#define RISCV_HWPROBE_EXT_ZKSED (1 << 14)
+#define RISCV_HWPROBE_EXT_ZKSH (1 << 15)
+#define RISCV_HWPROBE_EXT_ZKT (1 << 16)
#define RISCV_HWPROBE_KEY_CPUPERF_0 5
#define RISCV_HWPROBE_MISALIGNED_UNKNOWN (0 << 0)
#define RISCV_HWPROBE_MISALIGNED_EMULATED (1 << 0)
diff --git a/arch/riscv/kernel/sys_riscv.c b/arch/riscv/kernel/sys_riscv.c
index 26ef5526bfb4..df15926196b6 100644
--- a/arch/riscv/kernel/sys_riscv.c
+++ b/arch/riscv/kernel/sys_riscv.c
@@ -145,20 +145,28 @@ static void hwprobe_isa_ext0(struct riscv_hwprobe *pair,
for_each_cpu(cpu, cpus) {
struct riscv_isainfo *isainfo = &hart_isa[cpu];
- if (riscv_isa_extension_available(isainfo->isa, ZBA))
- pair->value |= RISCV_HWPROBE_EXT_ZBA;
- else
- missing |= RISCV_HWPROBE_EXT_ZBA;
-
- if (riscv_isa_extension_available(isainfo->isa, ZBB))
- pair->value |= RISCV_HWPROBE_EXT_ZBB;
- else
- missing |= RISCV_HWPROBE_EXT_ZBB;
-
- if (riscv_isa_extension_available(isainfo->isa, ZBS))
- pair->value |= RISCV_HWPROBE_EXT_ZBS;
- else
- missing |= RISCV_HWPROBE_EXT_ZBS;
+#define SET_HWPROBE_EXT_PAIR(ext) \
+ do { \
+ if (riscv_isa_extension_available(isainfo->isa, ext)) \
+ pair->value |= RISCV_HWPROBE_EXT_## ext; \
+ else \
+ missing |= RISCV_HWPROBE_EXT_## ext; \
+ } while (false) \
+
+ SET_HWPROBE_EXT_PAIR(ZBA);
+ SET_HWPROBE_EXT_PAIR(ZBB);
+ SET_HWPROBE_EXT_PAIR(ZBC);
+ SET_HWPROBE_EXT_PAIR(ZBS);
+ SET_HWPROBE_EXT_PAIR(ZBKB);
+ SET_HWPROBE_EXT_PAIR(ZBKC);
+ SET_HWPROBE_EXT_PAIR(ZBKX);
+ SET_HWPROBE_EXT_PAIR(ZKND);
+ SET_HWPROBE_EXT_PAIR(ZKNE);
+ SET_HWPROBE_EXT_PAIR(ZKNH);
+ SET_HWPROBE_EXT_PAIR(ZKR);
+ SET_HWPROBE_EXT_PAIR(ZKSED);
+ SET_HWPROBE_EXT_PAIR(ZKSH);
+ SET_HWPROBE_EXT_PAIR(ZKT);
}
/* Now turn off reporting features if any CPU is missing it. */
--
2.41.0
Am Sonntag, 9. Juli 2023, 13:55:44 CEST schrieb Samuel Ortiz:
> The RISC-V cryptography extensions define a set of instructions, CSR
> definitions, architectural interfaces and also extension shorthands for
> running scalar and vector based cryptography operations on RISC-V
> systems.
>
> This documents all the dt-bindings for the scalar cryptography
> extensions, including the Zk, Zkn and Zks shorthands.
>
> Signed-off-by: Samuel Ortiz <[email protected]>
Reviewed-by: Heiko Stuebner <[email protected]>
Am Sonntag, 9. Juli 2023, 13:55:43 CEST schrieb Samuel Ortiz:
> From: "Hongren (Zenithal) Zheng" <[email protected]>
>
> Parse Zb/Zk related string from DT and output them to cpuinfo.
>
> It is worth noting that the Scalar Crypto extension defines "zk" as a
> shorthand for the Zkn, Zkr and Zkt extensions. Since the Zkn one also
> implies the Zbkb, Zbkc and Zbkx extensions, simply passing the valid
> "zk" extension name through a DT will enable all of the Zbkb, Zbkc,
> Zbkx, Zkn, Zkr and Zkt extensions.
>
> Also, since there currently is no mechanism to merge all enabled
> extensions, the generated cpuinfo output could be relatively large.
> For example, setting the "riscv,isa" DT property to "rv64imafdc_zk_zks"
> will generate the following cpuinfo output:
> "rv64imafdc_zbkb_zbkc_zbkx_zknd_zkne_zknh_zkr_zksed_zksh_zkt".
>
> Tested-by: Jiatai He <[email protected]>
> Reviewed-by: Evan Green <[email protected]>
> Reviewed-by: Conor Dooley <[email protected]>
> Signed-off-by: Samuel Ortiz <[email protected]>
> Signed-off-by: Hongren (Zenithal) Zheng <[email protected]>
Signed-off-by lines should be the other way around (Hongren Zhen first,
then yours), otherwise
Reviewed-by: Heiko Stuebner <[email protected]>
Tested-by: Heiko Stuebner <[email protected]>
Am Sonntag, 9. Juli 2023, 13:55:44 CEST schrieb Samuel Ortiz:
> The RISC-V cryptography extensions define a set of instructions, CSR
> definitions, architectural interfaces and also extension shorthands for
> running scalar and vector based cryptography operations on RISC-V
> systems.
>
> This documents all the dt-bindings for the scalar cryptography
> extensions, including the Zk, Zkn and Zks shorthands.
>
> Signed-off-by: Samuel Ortiz <[email protected]>
Reviewed-by: Heiko Stuebner <[email protected]>
Am Sonntag, 9. Juli 2023, 13:55:43 CEST schrieb Samuel Ortiz:
> From: "Hongren (Zenithal) Zheng" <[email protected]>
>
> Parse Zb/Zk related string from DT and output them to cpuinfo.
>
> It is worth noting that the Scalar Crypto extension defines "zk" as a
> shorthand for the Zkn, Zkr and Zkt extensions. Since the Zkn one also
> implies the Zbkb, Zbkc and Zbkx extensions, simply passing the valid
> "zk" extension name through a DT will enable all of the Zbkb, Zbkc,
> Zbkx, Zkn, Zkr and Zkt extensions.
>
> Also, since there currently is no mechanism to merge all enabled
> extensions, the generated cpuinfo output could be relatively large.
> For example, setting the "riscv,isa" DT property to "rv64imafdc_zk_zks"
> will generate the following cpuinfo output:
> "rv64imafdc_zbkb_zbkc_zbkx_zknd_zkne_zknh_zkr_zksed_zksh_zkt".
>
> Tested-by: Jiatai He <[email protected]>
> Reviewed-by: Evan Green <[email protected]>
> Reviewed-by: Conor Dooley <[email protected]>
> Signed-off-by: Samuel Ortiz <[email protected]>
> Signed-off-by: Hongren (Zenithal) Zheng <[email protected]>
Signed-off-by lines should be the other way around (Hongren Zhen first,
then yours), otherwise
Reviewed-by: Heiko Stuebner <[email protected]>
Tested-by: Heiko Stuebner <[email protected]>
Am Sonntag, 9. Juli 2023, 13:55:46 CEST schrieb Samuel Ortiz:
> The Zkr extension is ratified and provides 16 bits of entropy seed when
> reading the SEED CSR.
>
> We can implement arch_get_random_seed_longs() by doing multiple csrrw to
> that CSR and filling an unsigned long with valid entropy bits.
>
> Acked-by: Conor Dooley <[email protected]>
> Signed-off-by: Samuel Ortiz <[email protected]>
> ---
> +static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs)
> +{
> + if (!max_longs)
> + return 0;
> +
> + /*
> + * If Zkr is supported and csr_seed_long succeeds, we return one long
> + * worth of entropy.
> + */
> + if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v))
While this whole thing looks really nice, I don't think you can only
check the ZKR existence though.
To access the seed csr from supervisor-mode, it looks like the SSEED
bit in the mseccfg register also needs to be set by firmware.
And in the kernel we will likely need to check this setting somehow
before enabling access.
At least my qemu fails with an illegal instruction otherwise during the
early random seed initialization.
Heiko
Am Sonntag, 9. Juli 2023, 13:55:46 CEST schrieb Samuel Ortiz:
> The Zkr extension is ratified and provides 16 bits of entropy seed when
> reading the SEED CSR.
>
> We can implement arch_get_random_seed_longs() by doing multiple csrrw to
> that CSR and filling an unsigned long with valid entropy bits.
>
> Acked-by: Conor Dooley <[email protected]>
> Signed-off-by: Samuel Ortiz <[email protected]>
> ---
> +static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs)
> +{
> + if (!max_longs)
> + return 0;
> +
> + /*
> + * If Zkr is supported and csr_seed_long succeeds, we return one long
> + * worth of entropy.
> + */
> + if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v))
While this whole thing looks really nice, I don't think you can only
check the ZKR existence though.
To access the seed csr from supervisor-mode, it looks like the SSEED
bit in the mseccfg register also needs to be set by firmware.
And in the kernel we will likely need to check this setting somehow
before enabling access.
At least my qemu fails with an illegal instruction otherwise during the
early random seed initialization.
Heiko
On Sun, Jul 09, 2023 at 01:55:44PM +0200, Samuel Ortiz wrote:
> The RISC-V cryptography extensions define a set of instructions, CSR
> definitions, architectural interfaces and also extension shorthands for
> running scalar and vector based cryptography operations on RISC-V
> systems.
>
> This documents all the dt-bindings for the scalar cryptography
> extensions, including the Zk, Zkn and Zks shorthands.
>
> Signed-off-by: Samuel Ortiz <[email protected]>
> ---
> .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
> 1 file changed, 82 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
> index cc1f546fdbdc..361756978da1 100644
> --- a/Documentation/devicetree/bindings/riscv/extensions.yaml
> +++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
> @@ -190,6 +190,24 @@ properties:
> instructions as ratified at commit 6d33919 ("Merge pull request #158
> from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
>
> + - const: zbkb
> + description: |
Don't need '|' if no formatting to preserve.
> + The standard Zbkb cryptography extension for bit-manipulation
> + instructions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zbkc
> + description: |
> + The standard Zbkc cryptography extension for carry-less multiply
> + instructions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zbkx
> + description: |
> + The standard Zbkx cryptography extension for crossbar permutation
> + instructions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> - const: zicbom
> description:
> The standard Zicbom extension for base cache management operations as
> @@ -240,6 +258,70 @@ properties:
> ratified in the 20191213 version of the unprivileged ISA
> specification.
>
> + - const: zk
> + description: |
> + The standard Zk cryptography extension is a shorthand for the
> + union of the Zkn, Zkr and Zkt cryptography extensions, as ratified
> + at commit 73de909 ("Zvk: Update AES instruction specs") of
> + riscv-crypto.
> +
> + - const: zkn
> + description: |
> + The standard Zkn cryptography extension covers the NIST algorithm
> + suite that other cryptography extensions support. It is the union of
> + the Zbkb, Zbkc, Zbkx, Zknd, Zkne and Zknh extensions, as ratified at
> + commit 73de909 ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zknd
> + description: |
> + The standard Zknd cryptography extension for AES block cipher
> + decryption acceleration instructions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zkne
> + description: |
> + The standard Zkne cryptography extension for AES block cipher
> + encryption acceleration instructions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zknh
> + description: |
> + The standard Zknh cryptography extension for SHA2 hash algorithm
> + functions acceleration instructions as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zkr
> + description: |
> + The standard Zkr cryptography extension for the entropy source CSR
> + definitions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zks
> + description: |
> + The standard Zks cryptography extension covers the ShangMi algorithm
> + suite that other cryptography extensions support. It is the union of
> + the Zbkb, Zbkc, Zbkx, Zksed and Zksh extensions, as ratified at
> + commit 73de909 ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zksed
> + description: |
> + The standard Zksed cryptography extension for SM4 block cipher
> + acceleration instructions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zksh
> + description: |
> + The standard Zksh cryptography extension for SM3 hash algorithm
> + funstions acceleration instructions, as ratified at commit 73de909
> + ("Zvk: Update AES instruction specs") of riscv-crypto.
> +
> + - const: zkt
> + description: |
> + The standard Zkt cryptography extension for data independent
> + execution latency attestation, for a safe subset of instructions,
> + as ratified at commit 73de909 ("Zvk: Update AES instruction specs")
> + of riscv-crypto.
> +
> - const: ztso
> description:
> The standard Ztso extension for total store ordering, as ratified
> --
> 2.41.0
>
On Mon, Jul 10, 2023 at 09:16:24AM -0600, Rob Herring wrote:
> On Sun, Jul 09, 2023 at 01:55:44PM +0200, Samuel Ortiz wrote:
> > The RISC-V cryptography extensions define a set of instructions, CSR
> > definitions, architectural interfaces and also extension shorthands for
> > running scalar and vector based cryptography operations on RISC-V
> > systems.
> >
> > This documents all the dt-bindings for the scalar cryptography
> > extensions, including the Zk, Zkn and Zks shorthands.
> >
> > Signed-off-by: Samuel Ortiz <[email protected]>
> > ---
> > .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
> > 1 file changed, 82 insertions(+)
> >
> > diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
> > index cc1f546fdbdc..361756978da1 100644
> > --- a/Documentation/devicetree/bindings/riscv/extensions.yaml
> > +++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
> > @@ -190,6 +190,24 @@ properties:
> > instructions as ratified at commit 6d33919 ("Merge pull request #158
> > from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
> >
> > + - const: zbkb
> > + description: |
>
> Don't need '|' if no formatting to preserve.
The existing binding only adds the `|` where the commit message contains
a #, please drop the `|`s if you end up re-submitting. Otherwise,
Reviewed-by: Conor Dooley <[email protected]>
Cheers,
Conor.
Hi Heiko,
On Sun, Jul 09, 2023 at 04:06:16PM +0200, Heiko Stuebner wrote:
> Am Sonntag, 9. Juli 2023, 13:55:46 CEST schrieb Samuel Ortiz:
> > The Zkr extension is ratified and provides 16 bits of entropy seed when
> > reading the SEED CSR.
> >
> > We can implement arch_get_random_seed_longs() by doing multiple csrrw to
> > that CSR and filling an unsigned long with valid entropy bits.
> >
> > Acked-by: Conor Dooley <[email protected]>
> > Signed-off-by: Samuel Ortiz <[email protected]>
> > ---
>
> > +static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs)
> > +{
> > + if (!max_longs)
> > + return 0;
> > +
> > + /*
> > + * If Zkr is supported and csr_seed_long succeeds, we return one long
> > + * worth of entropy.
> > + */
> > + if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v))
>
> While this whole thing looks really nice, I don't think you can only
> check the ZKR existence though.
>
> To access the seed csr from supervisor-mode, it looks like the SSEED
> bit in the mseccfg register also needs to be set by firmware.
> And in the kernel we will likely need to check this setting somehow
> before enabling access.
We can't check it as msseccfg is an M-mode only CSR. While reviewing v2
of this patchset, Stephen suggested to either document the SSEED
requirement with the dt-bindings documentation, use the SBI FWFEATURE
extension to ask firmware to set mseecfg properly, or trap seed access
and feed the caller with a virtual entropy source.
I'd like to go with the second proposed approach (FWFEATURE) but that
requires the corresponding pending patch to be merged first. So for now,
I will only document the SSEED requirement when passing the Zkr
extension, so that we at least have a contract definition for firmwares
that enable Zkr through DT. When they do, they're required to at least
set SSEED in MSSECFG.
I have a couple of pending patches ([1],[2]) related to that, so that an
OpenSBI+qemu+linux combination works as expected when enabling Zkr. I am
going to submit them upstream as well.
Cheers,
Samuel.
[1] https://github.com/qemu/qemu/commit/2a146057099ada946bf4a9c2e355a5a290c23c80
[2] https://github.com/riscv-software-src/opensbi/pull/315
On Mon, Jul 10, 2023 at 04:42:42PM +0100, Conor Dooley wrote:
> On Mon, Jul 10, 2023 at 09:16:24AM -0600, Rob Herring wrote:
> > On Sun, Jul 09, 2023 at 01:55:44PM +0200, Samuel Ortiz wrote:
> > > The RISC-V cryptography extensions define a set of instructions, CSR
> > > definitions, architectural interfaces and also extension shorthands for
> > > running scalar and vector based cryptography operations on RISC-V
> > > systems.
> > >
> > > This documents all the dt-bindings for the scalar cryptography
> > > extensions, including the Zk, Zkn and Zks shorthands.
> > >
> > > Signed-off-by: Samuel Ortiz <[email protected]>
> > > ---
> > > .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
> > > 1 file changed, 82 insertions(+)
> > >
> > > diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
> > > index cc1f546fdbdc..361756978da1 100644
> > > --- a/Documentation/devicetree/bindings/riscv/extensions.yaml
> > > +++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
> > > @@ -190,6 +190,24 @@ properties:
> > > instructions as ratified at commit 6d33919 ("Merge pull request #158
> > > from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
> > >
> > > + - const: zbkb
> > > + description: |
> >
> > Don't need '|' if no formatting to preserve.
>
> The existing binding only adds the `|` where the commit message contains
> a #, please drop the `|`s if you end up re-submitting. Otherwise,
I think the `|` is needed because the messages contains a `:`? This is
the case as the messages in this patch have a "Zvk:..." string.
Removing the `|` makes dt_binding_check fail because of that.
Cheers,
Samuel.
On Tue, Jul 11, 2023 at 07:28:23PM +0200, Samuel Ortiz wrote:
> On Mon, Jul 10, 2023 at 04:42:42PM +0100, Conor Dooley wrote:
> > On Mon, Jul 10, 2023 at 09:16:24AM -0600, Rob Herring wrote:
> > > On Sun, Jul 09, 2023 at 01:55:44PM +0200, Samuel Ortiz wrote:
> > > > The RISC-V cryptography extensions define a set of instructions, CSR
> > > > definitions, architectural interfaces and also extension shorthands for
> > > > running scalar and vector based cryptography operations on RISC-V
> > > > systems.
> > > >
> > > > This documents all the dt-bindings for the scalar cryptography
> > > > extensions, including the Zk, Zkn and Zks shorthands.
> > > >
> > > > Signed-off-by: Samuel Ortiz <[email protected]>
> > > > ---
> > > > .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
> > > > 1 file changed, 82 insertions(+)
> > > >
> > > > diff --git a/Documentation/devicetree/bindings/riscv/extensions.yaml b/Documentation/devicetree/bindings/riscv/extensions.yaml
> > > > index cc1f546fdbdc..361756978da1 100644
> > > > --- a/Documentation/devicetree/bindings/riscv/extensions.yaml
> > > > +++ b/Documentation/devicetree/bindings/riscv/extensions.yaml
> > > > @@ -190,6 +190,24 @@ properties:
> > > > instructions as ratified at commit 6d33919 ("Merge pull request #158
> > > > from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
> > > >
> > > > + - const: zbkb
> > > > + description: |
> > >
> > > Don't need '|' if no formatting to preserve.
> >
> > The existing binding only adds the `|` where the commit message contains
> > a #, please drop the `|`s if you end up re-submitting. Otherwise,
>
> I think the `|` is needed because the messages contains a `:`? This is
> the case as the messages in this patch have a "Zvk:..." string.
> Removing the `|` makes dt_binding_check fail because of that.
Right you are. Please keep them so!