| Message ID | 20230709115549.2666557-5-sameo@rivosinc.com |
|---|---|
| State | Superseded |
| Headers | show |
| Series | RISC-V: archrandom support | expand |
Am Sonntag, 9. Juli 2023, 13:55:46 CEST schrieb Samuel Ortiz: > The Zkr extension is ratified and provides 16 bits of entropy seed when > reading the SEED CSR. > > We can implement arch_get_random_seed_longs() by doing multiple csrrw to > that CSR and filling an unsigned long with valid entropy bits. > > Acked-by: Conor Dooley <conor.dooley@microchip.com> > Signed-off-by: Samuel Ortiz <sameo@rivosinc.com> > --- > +static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs) > +{ > + if (!max_longs) > + return 0; > + > + /* > + * If Zkr is supported and csr_seed_long succeeds, we return one long > + * worth of entropy. > + */ > + if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v)) While this whole thing looks really nice, I don't think you can only check the ZKR existence though. To access the seed csr from supervisor-mode, it looks like the SSEED bit in the mseccfg register also needs to be set by firmware. And in the kernel we will likely need to check this setting somehow before enabling access. At least my qemu fails with an illegal instruction otherwise during the early random seed initialization. Heiko
Hi Heiko, On Sun, Jul 09, 2023 at 04:06:16PM +0200, Heiko Stuebner wrote: > Am Sonntag, 9. Juli 2023, 13:55:46 CEST schrieb Samuel Ortiz: > > The Zkr extension is ratified and provides 16 bits of entropy seed when > > reading the SEED CSR. > > > > We can implement arch_get_random_seed_longs() by doing multiple csrrw to > > that CSR and filling an unsigned long with valid entropy bits. > > > > Acked-by: Conor Dooley <conor.dooley@microchip.com> > > Signed-off-by: Samuel Ortiz <sameo@rivosinc.com> > > --- > > > +static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs) > > +{ > > + if (!max_longs) > > + return 0; > > + > > + /* > > + * If Zkr is supported and csr_seed_long succeeds, we return one long > > + * worth of entropy. > > + */ > > + if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v)) > > While this whole thing looks really nice, I don't think you can only > check the ZKR existence though. > > To access the seed csr from supervisor-mode, it looks like the SSEED > bit in the mseccfg register also needs to be set by firmware. > And in the kernel we will likely need to check this setting somehow > before enabling access. We can't check it as msseccfg is an M-mode only CSR. While reviewing v2 of this patchset, Stephen suggested to either document the SSEED requirement with the dt-bindings documentation, use the SBI FWFEATURE extension to ask firmware to set mseecfg properly, or trap seed access and feed the caller with a virtual entropy source. I'd like to go with the second proposed approach (FWFEATURE) but that requires the corresponding pending patch to be merged first. So for now, I will only document the SSEED requirement when passing the Zkr extension, so that we at least have a contract definition for firmwares that enable Zkr through DT. When they do, they're required to at least set SSEED in MSSECFG. I have a couple of pending patches ([1],[2]) related to that, so that an OpenSBI+qemu+linux combination works as expected when enabling Zkr. I am going to submit them upstream as well. Cheers, Samuel. [1] https://github.com/qemu/qemu/commit/2a146057099ada946bf4a9c2e355a5a290c23c80 [2] https://github.com/riscv-software-src/opensbi/pull/315
diff --git a/arch/riscv/include/asm/archrandom.h b/arch/riscv/include/asm/archrandom.h new file mode 100644 index 000000000000..38f3cced0fd0 --- /dev/null +++ b/arch/riscv/include/asm/archrandom.h @@ -0,0 +1,70 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Kernel interface for the RISCV arch_random_* functions + * + * Copyright (c) 2023 by Rivos Inc. + * + */ + +#ifndef ASM_RISCV_ARCHRANDOM_H +#define ASM_RISCV_ARCHRANDOM_H + +#include <asm/csr.h> + +#define SEED_RETRY_LOOPS 100 + +static inline bool __must_check csr_seed_long(unsigned long *v) +{ + unsigned int retry = SEED_RETRY_LOOPS, valid_seeds = 0; + const int needed_seeds = sizeof(long) / sizeof(u16); + u16 *entropy = (u16 *)v; + + do { + /* + * The SEED CSR (0x015) must be accessed with a read-write + * instruction. + */ + unsigned long csr_seed = csr_swap(CSR_SEED, 0); + + switch (csr_seed & SEED_OPST_MASK) { + case SEED_OPST_ES16: + entropy[valid_seeds++] = csr_seed & SEED_ENTROPY_MASK; + if (valid_seeds == needed_seeds) + return true; + break; + + case SEED_OPST_DEAD: + pr_err_once("archrandom: Unrecoverable error\n"); + return false; + + case SEED_OPST_BIST: + case SEED_OPST_WAIT: + default: + continue; + } + } while (--retry); + + return false; +} + +static inline size_t __must_check arch_get_random_longs(unsigned long *v, size_t max_longs) +{ + return 0; +} + +static inline size_t __must_check arch_get_random_seed_longs(unsigned long *v, size_t max_longs) +{ + if (!max_longs) + return 0; + + /* + * If Zkr is supported and csr_seed_long succeeds, we return one long + * worth of entropy. + */ + if (riscv_has_extension_likely(RISCV_ISA_EXT_ZKR) && csr_seed_long(v)) + return 1; + + return 0; +} + +#endif /* ASM_RISCV_ARCHRANDOM_H */ diff --git a/arch/riscv/include/asm/csr.h b/arch/riscv/include/asm/csr.h index b98b3b6c9da2..7d0ca9082c66 100644 --- a/arch/riscv/include/asm/csr.h +++ b/arch/riscv/include/asm/csr.h @@ -389,6 +389,15 @@ #define CSR_VTYPE 0xc21 #define CSR_VLENB 0xc22 +/* Scalar Crypto Extension - Entropy */ +#define CSR_SEED 0x015 +#define SEED_OPST_MASK _AC(0xC0000000, UL) +#define SEED_OPST_BIST _AC(0x00000000, UL) +#define SEED_OPST_WAIT _AC(0x40000000, UL) +#define SEED_OPST_ES16 _AC(0x80000000, UL) +#define SEED_OPST_DEAD _AC(0xC0000000, UL) +#define SEED_ENTROPY_MASK _AC(0xFFFF, UL) + #ifdef CONFIG_RISCV_M_MODE # define CSR_STATUS CSR_MSTATUS # define CSR_IE CSR_MIE