RISC-V: archrandom support

From: "Hongren (Zenithal) Zheng" <[email protected]>

Parse Zb/Zk related string from DT and output them to cpuinfo.

It is worth noting that the Scalar Crypto extension defines "zk" as a shorthand for the Zkn, Zkr and Zkt extensions. Since the Zkn one also implies the Zbkb, Zbkc and Zbkx extensions, simply passing the valid "zk" extension name through a DT will enable all of the Zbkb, Zbkc, Zbkx, Zkn, Zkr and Zkt extensions.

Also, since there currently is no mechanism to merge all enabled extensions, the generated cpuinfo output could be relatively large. For example, setting the "riscv,isa" DT property to "rv64imafdc_zk_zks" will generate the following cpuinfo output:
"rv64imafdc_zbkb_zbkc_zbkx_zknd_zkne_zknh_zkr_zksed_zksh_zkt".

Tested-by Jiatai He <[email protected]>

Reviewed-by Evan Green <[email protected]>

Reviewed-by Conor Dooley <[email protected]>

Signed-off-by Samuel Ortiz <[email protected]>

Signed-off-by Hongren (Zenithal) Zheng <[email protected]>

From: "Hongren (Zenithal) Zheng" <[email protected]>

Parse Zb/Zk related string from DT and output them to cpuinfo.

It is worth noting that the Scalar Crypto extension defines "zk" as a shorthand for the Zkn, Zkr and Zkt extensions. Since the Zkn one also implies the Zbkb, Zbkc and Zbkx extensions, simply passing the valid "zk" extension name through a DT will enable all of the Zbkb, Zbkc, Zbkx, Zkn, Zkr and Zkt extensions.

Also, since there currently is no mechanism to merge all enabled extensions, the generated cpuinfo output could be relatively large. For example, setting the "riscv,isa" DT property to "rv64imafdc_zk_zks" will generate the following cpuinfo output:
"rv64imafdc_zbkb_zbkc_zbkx_zknd_zkne_zknh_zkr_zksed_zksh_zkt".

Tested-by Jiatai He <[email protected]>

Reviewed-by Evan Green <[email protected]>

Reviewed-by Conor Dooley <[email protected]>

Signed-off-by Samuel Ortiz <[email protected]>

Signed-off-by Hongren (Zenithal) Zheng <[email protected]>

The RISC-V cryptography extensions define a set of instructions, CSR definitions, architectural interfaces and also extension shorthands for running scalar and vector based cryptography operations on RISC-V systems.

This documents all the dt-bindings for the scalar cryptography extensions, including the Zk, Zkn and Zks shorthands.

Signed-off-by Samuel Ortiz <[email protected]>

The RISC-V cryptography extensions define a set of instructions, CSR definitions, architectural interfaces and also extension shorthands for running scalar and vector based cryptography operations on RISC-V systems.

This documents all the dt-bindings for the scalar cryptography extensions, including the Zk, Zkn and Zks shorthands.

Signed-off-by Samuel Ortiz <[email protected]>

The RISC-V cryptography extensions define a set of instructions, CSR definitions, architectural interfaces and also extension shorthands for running scalar and vector based cryptography operations on RISC-V systems.

This documents all the dt-bindings for the scalar cryptography extensions, including the Zk, Zkn and Zks shorthands.

Signed-off-by Samuel Ortiz <[email protected]>

---
 .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

Documentation/devicetree/bindings/riscv/extensions.yaml +0 -0

index cc1f546fdbdc..361756978da1 100644

Documentation/devicetree/bindings/riscv/extensions.yaml +80 -0

+            The standard Zbkb cryptography extension for bit-manipulation
+            instructions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zbkc
+          description: |
+            The standard Zbkc cryptography extension for carry-less multiply
+            instructions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zbkx
+          description: |
+            The standard Zbkx cryptography extension for crossbar permutation
+            instructions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
         - const: zicbom
           description:
             The standard Zicbom extension for base cache management operations as

@@ -240,6 +258,70 @@ properties:
             ratified in the 20191213 version of the unprivileged ISA
             specification.
 
+        - const: zk
+          description: |
+            The standard Zk cryptography extension is a shorthand for the
+            union of the Zkn, Zkr and Zkt cryptography extensions, as ratified
+            at commit 73de909 ("Zvk: Update AES instruction specs") of
+            riscv-crypto.
+
+        - const: zkn
+          description: |
+            The standard Zkn cryptography extension covers the NIST algorithm
+            suite that other cryptography extensions support. It is the union of
+            the Zbkb, Zbkc, Zbkx, Zknd, Zkne and Zknh extensions, as ratified at
+            commit 73de909 ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zknd
+          description: |
+            The standard Zknd cryptography extension for AES block cipher
+            decryption acceleration instructions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zkne
+          description: |
+            The standard Zkne cryptography extension for AES block cipher
+            encryption acceleration instructions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zknh
+          description: |
+            The standard Zknh cryptography extension for SHA2 hash algorithm
+            functions acceleration instructions as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zkr
+          description: |
+            The standard Zkr cryptography extension for the entropy source CSR
+            definitions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zks
+          description: |
+            The standard Zks cryptography extension covers the ShangMi algorithm
+            suite that other cryptography extensions support. It is the union of
+            the Zbkb, Zbkc, Zbkx, Zksed and Zksh extensions, as ratified at
+            commit 73de909 ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zksed
+          description: |
+            The standard Zksed cryptography extension for SM4 block cipher
+            acceleration instructions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zksh
+          description: |
+            The standard Zksh cryptography extension for SM3 hash algorithm
+            funstions acceleration instructions, as ratified at commit 73de909
+            ("Zvk: Update AES instruction specs") of riscv-crypto.
+
+        - const: zkt
+          description: |
+            The standard Zkt cryptography extension for data independent
+            execution latency attestation, for a safe subset of instructions,
+            as ratified at commit 73de909 ("Zvk: Update AES instruction specs")
+            of riscv-crypto.
+
         - const: ztso
           description:
             The standard Ztso extension for total store ordering, as ratified

Signature · 1 line

2.41.0

Quoted 21 lines · Samuel Ortiz

The RISC-V cryptography extensions define a set of instructions, CSR definitions, architectural interfaces and also extension shorthands for running scalar and vector based cryptography operations on RISC-V systems.

This documents all the dt-bindings for the scalar cryptography extensions, including the Zk, Zkn and Zks shorthands.

Signed-off-by Samuel Ortiz <[email protected]>

---
 .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

Documentation/devicetree/bindings/riscv/extensions.yaml +0 -0

index cc1f546fdbdc..361756978da1 100644
@@ -190,6 +190,24 @@ properties:
             instructions as ratified at commit 6d33919 ("Merge pull request #158
             from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
 

Documentation/devicetree/bindings/riscv/extensions.yaml properties: · line 194

Quoted 2 lines

Documentation/devicetree/bindings/riscv/extensions.yaml +2 -0

+        - const: zbkb
+          description: |

Don't need '|' if no formatting to preserve.

Quoted 22 lines · Rob Herring

Quoted 21 lines · Samuel Ortiz

The RISC-V cryptography extensions define a set of instructions, CSR definitions, architectural interfaces and also extension shorthands for running scalar and vector based cryptography operations on RISC-V systems.

This documents all the dt-bindings for the scalar cryptography extensions, including the Zk, Zkn and Zks shorthands.

Signed-off-by Samuel Ortiz <[email protected]>

---
 .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

Documentation/devicetree/bindings/riscv/extensions.yaml +0 -0

index cc1f546fdbdc..361756978da1 100644
@@ -190,6 +190,24 @@ properties:
             instructions as ratified at commit 6d33919 ("Merge pull request #158
             from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
 

Quoted 4 lines

Documentation/devicetree/bindings/riscv/extensions.yaml properties: · line 194

Quoted 2 lines

Documentation/devicetree/bindings/riscv/extensions.yaml +2 -0

+        - const: zbkb
+          description: |

Don't need '|' if no formatting to preserve.

The existing binding only adds the | where the commit message contains a #, please drop the |s if you end up re-submitting. Otherwise,

Quoted 28 lines · Conor Dooley

Quoted 26 lines · Rob Herring

Quoted 18 lines · Samuel Ortiz

The RISC-V cryptography extensions define a set of instructions, CSR definitions, architectural interfaces and also extension shorthands for running scalar and vector based cryptography operations on RISC-V systems.

This documents all the dt-bindings for the scalar cryptography extensions, including the Zk, Zkn and Zks shorthands.

Signed-off-by Samuel Ortiz <[email protected]>

---
 .../devicetree/bindings/riscv/extensions.yaml | 82 +++++++++++++++++++
 1 file changed, 82 insertions(+)

Documentation/devicetree/bindings/riscv/extensions.yaml +0 -0

index cc1f546fdbdc..361756978da1 100644

Documentation/devicetree/bindings/riscv/extensions.yaml properties: · line 194

Quoted 5 lines

Documentation/devicetree/bindings/riscv/extensions.yaml +2 -0

@@ -190,6 +190,24 @@ properties:
             instructions as ratified at commit 6d33919 ("Merge pull request #158
             from hirooih/clmul-fix-loop-end-condition") of riscv-bitmanip.
 
+        - const: zbkb
+          description: |

Don't need '|' if no formatting to preserve.

Quoted 2 lines

The existing binding only adds the | where the commit message contains a #, please drop the |s if you end up re-submitting. Otherwise,

I think the | is needed because the messages contains a :? This is the case as the messages in this patch have a "Zvk:..." string. Removing the | makes dt_binding_check fail because of that.

The Zkr extension is ratified and provides 16 bits of entropy seed when reading the SEED CSR.

We can implement arch_get_random_seed_longs() by doing multiple csrrw to that CSR and filling an unsigned long with valid entropy bits.

Acked-by Conor Dooley <[email protected]>

Signed-off-by Samuel Ortiz <[email protected]>

---

Am Sonntag, 9. Juli 2023, 13:55:46 CEST schrieb Samuel Ortiz:

Quoted 10 lines

The Zkr extension is ratified and provides 16 bits of entropy seed when reading the SEED CSR.

We can implement arch_get_random_seed_longs() by doing multiple csrrw to that CSR and filling an unsigned long with valid entropy bits.

Acked-by Conor Dooley <[email protected]>

Signed-off-by Samuel Ortiz <[email protected]>

---

arch/riscv/include/asm/archrandom.h line 64

Quoted 10 lines

arch/riscv/include/asm/archrandom.h new file +10 -0

+static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs)
+{
+	if (!max_longs)
+		return 0;
+
+	/*
+	 * If Zkr is supported and csr_seed_long succeeds, we return one long
+	 * worth of entropy.
+	 */
+	if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v))

While this whole thing looks really nice, I don't think you can only check the ZKR existence though.

To access the seed csr from supervisor-mode, it looks like the SSEED bit in the mseccfg register also needs to be set by firmware. And in the kernel we will likely need to check this setting somehow before enabling access.

The Zkr extension is ratified and provides 16 bits of entropy seed when reading the SEED CSR.

We can implement arch_get_random_seed_longs() by doing multiple csrrw to that CSR and filling an unsigned long with valid entropy bits.

Acked-by Conor Dooley <[email protected]>

Signed-off-by Samuel Ortiz <[email protected]>

---