SP RISC-V 64-bit: new implementation

.github/configs/multi-arch.json

@@ -20,7 +20,7 @@
  "configure": ["--host=riscv64-linux-gnu", "--enable-all",
   "--disable-examples",
   "CPPFLAGS=-pedantic -Wdeclaration-after-statement -Wnull-dereference -DTEST_LIBWOLFSSL_SOURCES_INCLUSION_SEQUENCE -DWOLFCRYPT_TEST_LINT",
-  "--enable-riscv-asm", "CFLAGS=-O0"],
+  "--enable-riscv-asm", "--enable-sp-asm", "CFLAGS=-O0"],
  "check": false,
  "run": [["env", "QEMU_LD_PREFIX=/usr/riscv64-linux-gnu", "./wolfcrypt/test/testwolfcrypt"]]},
 {"name": "armel-o0", "minutes": 4,

.github/workflows/multi-arch.yml

@@ -1,3 +1,3 @@
 name: Multiple architectures
 
 # START OF COMMON SECTION
@@ -63,6 +63,12 @@
       # run testwolfcrypt transparently under qemu-user (binfmt) with the
       # matching QEMU_LD_PREFIX.
       #
+      # Because --enable-riscv-asm does not imply it, riscv64-o0 passes
+      # --enable-sp-asm explicitly: it is the only job that compiles
+      # sp_riscv64.c at all. -O0 is the one to carry it, since that is where
+      # the frame pointer is always live and so where an asm operand or
+      # clobber that names s0 is rejected.
+      #
       # The list is kept out of this file on purpose: GitHub caps a single
       # `run:` step at 21000 characters, and an inlined heredoc is what
       # silently pushed os-check.yml past that cap - the whole file then

configure.ac

@@ -11390,8 +11390,13 @@ if test "$ENABLED_SP_ASM" = "yes" && test "$ENABLED_SP" = "yes"; then
     AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_X86_64_ASM"
     ENABLED_SP_X86_64_ASM=yes
     ;;
+  *riscv64*)
+    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_SP_RISCV64_ASM"
+    AM_CCASFLAGS="$AM_CCASFLAGS -DWOLFSSL_SP_RISCV64_ASM"
+    ENABLED_SP_RISCV64_ASM=yes
+    ;;
   *)
-    AC_MSG_ERROR([SP ASM not available for CPU. Supported CPUs: x86_64, aarch64, arm])
+    AC_MSG_ERROR([SP ASM not available for CPU. Supported CPUs: x86_64, aarch64, arm, riscv64])
     ;;
   esac
 
@@ -13355,6 +13360,7 @@ AM_CONDITIONAL([BUILD_SP_ARM32],[test "x$ENABLED_SP_ARM32_ASM" = "xyes" || test
 AM_CONDITIONAL([BUILD_SP_ARM_THUMB],[test "x$ENABLED_SP_ARM_THUMB_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_SP_ARM_CORTEX],[test "x$ENABLED_SP_ARM_CORTEX_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_SP_X86_64],[test "x$ENABLED_SP_X86_64_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
+AM_CONDITIONAL([BUILD_SP_RISCV64],[test "x$ENABLED_SP_RISCV64_ASM" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_CONDITIONAL([BUILD_SP_INT],[test "x$ENABLED_SP_MATH" = "xyes" || test "x$ENABLED_SP_MATH_ALL" = "xyes" || test "x$ENABLED_USERSETTINGS" = "xyes"])
 AM_COND_IF([BUILD_SP], [INCLUDE_SP_INT="yes"])
 AM_COND_IF([BUILD_SP_INT], [INCLUDE_SP_INT="yes"])

doc/ASM_AND_MATH_DEFINES.md

@@ -60,11 +60,11 @@ enable, so it is worth reading before you pick your defines:
   have no specialised implementation. Available for many CPUs. Sets the
   internal `SP_INT_ASM_AVAILABLE`.
 * **`WOLFSSL_SP_<arch>_ASM`** — the *specialised* fixed-size implementations in
-  `sp_<arch>.c`. Only x86_64 adds a separate `sp_x86_64_asm.S`; the ARM files
-  carry their assembly inline (§ 5). Much faster, but
+  `sp_<arch>.c`. Only x86_64 adds a separate `sp_x86_64_asm.S`; the ARM and
+  RISC-V files carry their assembly inline (§ 5). Much faster, but
   only for the specific key sizes and curves compiled in (RSA/DH 2048/3072/4096,
   P-256/P-384/P-521, SM2, SAKKE). Only available for x86_64, Aarch64, ARM32,
-  ARM Thumb and Cortex-M.
+  ARM Thumb, Cortex-M and RISC-V 64.
 
 Defining any `WOLFSSL_SP_<arch>_ASM` implies `WOLFSSL_SP_ASM`. You will normally
 want both tiers together, which is what the per-CPU table in the next section
@@ -97,7 +97,7 @@ back end.
 | ARM32 (Cortex-A, Cortex-R, ARM11 and earlier) | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_ARM32`, `WOLFSSL_SP_ARM32_ASM`, `WOLFSSL_ARMASM`, `WOLFSSL_ARM_ARCH=<n>` |
 | ARM Thumb (Cortex-M0/M0+/M1) | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_ARM_THUMB`, `WOLFSSL_SP_ARM_THUMB_ASM` |
 | Cortex-M3/M4/M7/M33 (Thumb-2) | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_ARM_CORTEX_M`, `WOLFSSL_SP_ARM_CORTEX_M_ASM`, `WOLFSSL_ARMASM`, `WOLFSSL_ARMASM_THUMB2`, `WOLFSSL_ARM_ARCH=7` |
-| RISC-V 64 | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_RISCV64`, `WOLFSSL_RISCV_ASM` (+ extension defines) |
+| RISC-V 64 | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_RISCV64`, `WOLFSSL_SP_RISCV64_ASM`, `WOLFSSL_RISCV_ASM` (+ extension defines) |
 | RISC-V 32 | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_RISCV32` (inline SP only) |
 | PowerPC 64 | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_PPC64`, `WOLFSSL_PPC64_ASM` |
 | PowerPC 32 | `WOLFSSL_SP_MATH_ALL` | add `WOLFSSL_SP_PPC`, `WOLFSSL_PPC32_ASM` |
@@ -364,13 +364,15 @@ SHA-384 and P-521 with SHA-512, and the wolfCrypt test suite reports
 | `WOLFSSL_SP_ARM32_ASM` | ARM32 | `sp_arm32.c` |
 | `WOLFSSL_SP_ARM_THUMB_ASM` | ARM Thumb | `sp_armthumb.c` |
 | `WOLFSSL_SP_ARM_CORTEX_M_ASM` | Cortex-M | `sp_cortexm.c` |
+| `WOLFSSL_SP_RISCV64_ASM` | RISC-V 64 | `sp_riscv64.c` |
 
 Any of these implies `WOLFSSL_SP_ASM`. Without one of them, `sp_c32.c` or
 `sp_c64.c` is compiled instead, chosen by `SP_WORD_SIZE`.
 
-Only x86_64 needs a separate assembly file. The ARM `sp_*.c` files carry their
-assembly inline, so an ARM project adds a single `.c` file and no `.S` — useful
-if your toolchain or coding standard makes separate assembly files awkward.
+Only x86_64 needs a separate assembly file. The ARM and RISC-V `sp_*.c` files
+carry their assembly inline, so those projects add a single `.c` file and no
+`.S` — useful if your toolchain or coding standard makes separate assembly
+files awkward.
 
 `RSA_LOW_MEM` implies `SP_RSA_PRIVATE_EXP_D` and `WOLFSSL_SP_SMALL`. It performs
 RSA private key operations with the plain private exponent instead of the
@@ -538,8 +540,12 @@ The rest of the table does gate real code.
 Take care to enable only the extensions your hardware actually has. Unlike the
 Intel options, there is no run-time check: an extension that is not present
 produces an illegal-instruction trap at run time rather than a build error.
-RISC-V has no specialised SP assembly, so use `WOLFSSL_SP_RISCV64` for the
-inline tier.
+RISC-V 64 has a specialised SP implementation: add `WOLFSSL_SP_RISCV64_ASM`
+alongside `WOLFSSL_SP_RISCV64` (autotools: `--enable-sp-asm`). It is inline
+assembly in `sp_riscv64.c`, so there is no separate `.S` file, and it needs
+only the base integer ISA plus M — it is independent of the vector and crypto
+extensions that `WOLFSSL_RISCV_ASM` selects. RISC-V 32 has no specialised
+implementation; use `WOLFSSL_SP_RISCV32` for the inline tier.
 
 ### PowerPC
 

examples/configs/user_settings_embedded.h

@@ -849,6 +849,12 @@ extern "C" {
     #if WC_CFG_ASM_SP
         #define WOLFSSL_SP_RISCV64
     #endif
+    /* Specialised SP assembly, inline in sp_riscv64.c. Needs only the base
+     * integer ISA plus M, so it is selected by WC_CFG_ASM_SP alone and is
+     * independent of the extensions WC_CFG_ASM_CRYPTO switches on below. */
+    #if WC_CFG_ASM_SP
+        #define WOLFSSL_SP_RISCV64_ASM
+    #endif
     #if WC_CFG_ASM_CRYPTO
         #define WOLFSSL_RISCV_ASM
         #if WC_CFG_RISCV_BITMANIP

src/include.am

@@ -923,6 +923,9 @@ endif
 if BUILD_SP_ARM_CORTEX
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_cortexm.c
 endif
+if BUILD_SP_RISCV64
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_riscv64.c
+endif
 endif BUILD_SP
 
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/fips.c \
@@ -1303,6 +1306,9 @@ endif
 if BUILD_SP_ARM_CORTEX
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_cortexm.c
 endif
+if BUILD_SP_RISCV64
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_riscv64.c
+endif
 endif BUILD_SP
 
 # PQ Algorithms (FIPS v7.0.0+)
@@ -1548,6 +1554,9 @@ endif
 if BUILD_SP_ARM_CORTEX
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_cortexm.c
 endif
+if BUILD_SP_RISCV64
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_riscv64.c
+endif
 endif BUILD_SP
 endif !BUILD_FIPS_V6_PLUS
 
@@ -1824,6 +1833,9 @@ if BUILD_SP_ARM64
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_sm2_arm64.c
 endif
 endif
+if BUILD_SP_RISCV64
+src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_sm2_riscv64.c
+endif
 if BUILD_SP_ARM_CORTEX
 src_libwolfssl@LIBSUFFIX@_la_SOURCES += wolfcrypt/src/sp_sm2_cortexm.c
 endif

wolfcrypt/src/sp_arm32.c

@@ -193,15 +193,15 @@ static void sp_2048_from_bin(sp_digit* r, int size, const byte* a, int n)
         d = (byte*)(r + j);
 #ifdef BIG_ENDIAN_ORDER
         switch (i) {
-            case 2: d[1] = *(a++); //fallthrough
-            case 1: d[2] = *(a++); //fallthrough
-            case 0: d[3] = *a    ; //fallthrough
+            case 2: d[1] = *(a++); FALL_THROUGH;
+            case 1: d[2] = *(a++); FALL_THROUGH;
+            case 0: d[3] = *a    ;
         }
 #else
         switch (i) {
-            case 2: d[i-2] = a[2]; //fallthrough
-            case 1: d[i-1] = a[1]; //fallthrough
-            case 0: d[i-0] = a[0]; //fallthrough
+            case 2: d[i-2] = a[2]; FALL_THROUGH;
+            case 1: d[i-1] = a[1]; FALL_THROUGH;
+            case 0: d[i-0] = a[0];
         }
 #endif
         j++;
@@ -19176,15 +19176,15 @@ static void sp_3072_from_bin(sp_digit* r, int size, const byte* a, int n)
         d = (byte*)(r + j);
 #ifdef BIG_ENDIAN_ORDER
         switch (i) {
-            case 2: d[1] = *(a++); //fallthrough
-            case 1: d[2] = *(a++); //fallthrough
-            case 0: d[3] = *a    ; //fallthrough
+            case 2: d[1] = *(a++); FALL_THROUGH;
+            case 1: d[2] = *(a++); FALL_THROUGH;
+            case 0: d[3] = *a    ;
         }
 #else
         switch (i) {
-            case 2: d[i-2] = a[2]; //fallthrough
-            case 1: d[i-1] = a[1]; //fallthrough
-            case 0: d[i-0] = a[0]; //fallthrough
+            case 2: d[i-2] = a[2]; FALL_THROUGH;
+            case 1: d[i-1] = a[1]; FALL_THROUGH;
+            case 0: d[i-0] = a[0];
         }
 #endif
         j++;
@@ -47426,15 +47426,15 @@ static void sp_4096_from_bin(sp_digit* r, int size, const byte* a, int n)
         d = (byte*)(r + j);
 #ifdef BIG_ENDIAN_ORDER
         switch (i) {
-            case 2: d[1] = *(a++); //fallthrough
-            case 1: d[2] = *(a++); //fallthrough
-            case 0: d[3] = *a    ; //fallthrough
+            case 2: d[1] = *(a++); FALL_THROUGH;
+            case 1: d[2] = *(a++); FALL_THROUGH;
+            case 0: d[3] = *a    ;
         }
 #else
         switch (i) {
-            case 2: d[i-2] = a[2]; //fallthrough
-            case 1: d[i-1] = a[1]; //fallthrough
-            case 0: d[i-0] = a[0]; //fallthrough
+            case 2: d[i-2] = a[2]; FALL_THROUGH;
+            case 1: d[i-1] = a[1]; FALL_THROUGH;
+            case 0: d[i-0] = a[0];
         }
 #endif
         j++;
@@ -75552,7 +75552,7 @@ static int sp_256_proj_point_dbl_8_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r,
         /* Y = Y - T2 */
         sp_256_mont_sub_8(ctx->y, ctx->y, ctx->t2, p256_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;
@@ -78806,15 +78806,15 @@ static void sp_256_from_bin(sp_digit* r, int size, const byte* a, int n)
         d = (byte*)(r + j);
 #ifdef BIG_ENDIAN_ORDER
         switch (i) {
-            case 2: d[1] = *(a++); //fallthrough
-            case 1: d[2] = *(a++); //fallthrough
-            case 0: d[3] = *a    ; //fallthrough
+            case 2: d[1] = *(a++); FALL_THROUGH;
+            case 1: d[2] = *(a++); FALL_THROUGH;
+            case 0: d[3] = *a    ;
         }
 #else
         switch (i) {
-            case 2: d[i-2] = a[2]; //fallthrough
-            case 1: d[i-1] = a[1]; //fallthrough
-            case 0: d[i-0] = a[0]; //fallthrough
+            case 2: d[i-2] = a[2]; FALL_THROUGH;
+            case 1: d[i-1] = a[1]; FALL_THROUGH;
+            case 0: d[i-0] = a[0];
         }
 #endif
         j++;
@@ -93814,7 +93814,7 @@ static int sp_384_proj_point_dbl_12_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r,
         /* Y = Y - T2 */
         sp_384_mont_sub_12(ctx->y, ctx->y, ctx->t2, p384_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;
@@ -97132,15 +97132,15 @@ static void sp_384_from_bin(sp_digit* r, int size, const byte* a, int n)
         d = (byte*)(r + j);
 #ifdef BIG_ENDIAN_ORDER
         switch (i) {
-            case 2: d[1] = *(a++); //fallthrough
-            case 1: d[2] = *(a++); //fallthrough
-            case 0: d[3] = *a    ; //fallthrough
+            case 2: d[1] = *(a++); FALL_THROUGH;
+            case 1: d[2] = *(a++); FALL_THROUGH;
+            case 0: d[3] = *a    ;
         }
 #else
         switch (i) {
-            case 2: d[i-2] = a[2]; //fallthrough
-            case 1: d[i-1] = a[1]; //fallthrough
-            case 0: d[i-0] = a[0]; //fallthrough
+            case 2: d[i-2] = a[2]; FALL_THROUGH;
+            case 1: d[i-1] = a[1]; FALL_THROUGH;
+            case 0: d[i-0] = a[0];
         }
 #endif
         j++;
@@ -121173,7 +121173,7 @@ static int sp_521_proj_point_dbl_17_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r,
         /* Y = Y - T2 */
         sp_521_mont_sub_17(ctx->y, ctx->y, ctx->t2, p521_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;
@@ -125131,15 +125131,15 @@ static void sp_521_from_bin(sp_digit* r, int size, const byte* a, int n)
         d = (byte*)(r + j);
 #ifdef BIG_ENDIAN_ORDER
         switch (i) {
-            case 2: d[1] = *(a++); //fallthrough
-            case 1: d[2] = *(a++); //fallthrough
-            case 0: d[3] = *a    ; //fallthrough
+            case 2: d[1] = *(a++); FALL_THROUGH;
+            case 1: d[2] = *(a++); FALL_THROUGH;
+            case 0: d[3] = *a    ;
         }
 #else
         switch (i) {
-            case 2: d[i-2] = a[2]; //fallthrough
-            case 1: d[i-1] = a[1]; //fallthrough
-            case 0: d[i-0] = a[0]; //fallthrough
+            case 2: d[i-2] = a[2]; FALL_THROUGH;
+            case 1: d[i-1] = a[1]; FALL_THROUGH;
+            case 0: d[i-0] = a[0];
         }
 #endif
         j++;
@@ -151490,7 +151490,7 @@ static int sp_1024_proj_point_dbl_32_nb(sp_ecc_ctx_t* sp_ctx, sp_point_1024* r,
         /* Y = Y - T2 */
         sp_1024_mont_sub_32(ctx->y, ctx->y, ctx->t2, p1024_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;
@@ -160133,15 +160133,15 @@ static void sp_1024_from_bin(sp_digit* r, int size, const byte* a, int n)
         d = (byte*)(r + j);
 #ifdef BIG_ENDIAN_ORDER
         switch (i) {
-            case 2: d[1] = *(a++); //fallthrough
-            case 1: d[2] = *(a++); //fallthrough
-            case 0: d[3] = *a    ; //fallthrough
+            case 2: d[1] = *(a++); FALL_THROUGH;
+            case 1: d[2] = *(a++); FALL_THROUGH;
+            case 0: d[3] = *a    ;
         }
 #else
         switch (i) {
-            case 2: d[i-2] = a[2]; //fallthrough
-            case 1: d[i-1] = a[1]; //fallthrough
-            case 0: d[i-0] = a[0]; //fallthrough
+            case 2: d[i-2] = a[2]; FALL_THROUGH;
+            case 1: d[i-1] = a[1]; FALL_THROUGH;
+            case 0: d[i-0] = a[0];
         }
 #endif
         j++;

wolfcrypt/src/sp_arm64.c

@@ -24024,7 +24024,7 @@ static int sp_256_proj_point_dbl_4_nb(sp_ecc_ctx_t* sp_ctx, sp_point_256* r,
         /* Y = Y - T2 */
         sp_256_mont_sub_4(ctx->y, ctx->y, ctx->t2, p256_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;
@@ -44890,7 +44890,7 @@ static int sp_384_proj_point_dbl_6_nb(sp_ecc_ctx_t* sp_ctx, sp_point_384* r,
         /* Y = Y - T2 */
         sp_384_mont_sub_6(ctx->y, ctx->y, ctx->t2, p384_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;
@@ -73123,7 +73123,7 @@ static int sp_521_proj_point_dbl_9_nb(sp_ecc_ctx_t* sp_ctx, sp_point_521* r,
         /* Y = Y - T2 */
         sp_521_mont_sub_9(ctx->y, ctx->y, ctx->t2, p521_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;
@@ -117057,7 +117057,7 @@ static int sp_1024_proj_point_dbl_16_nb(sp_ecc_ctx_t* sp_ctx, sp_point_1024* r,
         /* Y = Y - T2 */
         sp_1024_mont_sub_16(ctx->y, ctx->y, ctx->t2, p1024_mod);
         ctx->state = 19;
-        /* fall-through */
+        FALL_THROUGH;
     case 19:
         err = MP_OKAY;
         break;