Implement AES backend for riscv64 using Zkned scalar crypto extensions #397
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR implements AES for riscv64 using the
zkned
scalar crypto extensions.Some comments:
This will require
nightly
to build since theriscv64
intrinsics are unstable. However, it should be enough to just feature-gate on the respective riscv64 extensions, since those are only available on nightly.Auto-detection of
zkne
andzknd
is currently problematic.It's possible to detect them (although I haven't tried that it actually works) with
std::arch::is_riscv_feature_detected
but this requiresstd
and also requires the featurestdsimd
(unstable).The approach used by
cpufeatures
usinglibc::getauxval(libc::AT_HWCAP)
won't work for riscv64 either. However, there is a new Linux syscall that exposes some riscv64 features: [https://www.kernel.org/doc/Documentation/riscv/hwprobe.rst](riscv_hwprobe
).Unfortunately, it doesn't expose the
zkne
orzknd
features yet, although it looks like it is supposed to eventually, based on this code: https://github.com/clementleger/hwprobe_dump/blob/main/hwprobe.hHence, the approach I used here, where the backend is used if
target_arch = "riscv64"
andzkne
andzknd
target features are enabled.I've opted not to add the
hazmat
module forriscv64
since supporting that is a little more complicated forriscv64
due to how the intrinsics work and how 1, 1.5, or 2 rounds are processed at a time depending on the key length.Also, I don't have useful benchmarks since I don't have any riscv64 hardware with these extensions. However, the implementation produces the correct output and passes the tests when run with QEMU
8.0.4
on Ubuntu 23.10.Regarding the CI config, I had some difficulty getting things to build and run properly with
cross
, and in any case a more recent QEMU is needed for the riscv64 extensions used here, so I used a custom docker image.EDIT: Marking as draft again since I'm going to try and implement the vector version also.