Adding support for Scalar Crypto Extension (Bitmanip instructions for…

… Cryptography, Zbkb) (#2653)

Introduction
This PR adds support for Zbkb extension in the CVA6 core. It also adds the documentation for this extension. These changes have been tested with self-written single instruction tests and with the riscv-arch-tests. This PR will be followed by other PRs that will add complete support for the Zkn - NIST Algorithm Suite extension.

Implementation
Zbkb Extension:
Added support for the Zbkb instruction set. It essentially expands the Zbb extension with additional instructions useful in cryptography. These instructions are pack, packh, packw, brev8, unzip and zip.

Modifications
1. A new bit ZKN was added. The complete Zkn extension will be added under this bit for ease of use. This configuration will also require the RVB (bitmanip) bit to be set.
2. Updated the ALU and decoder to recognize and handle Zbkb instructions.

Documentation and Reference
The official RISC-V Cryptography Extensions Volume I was followed to ensure alignment with ratification. The relevant documentation for the Zbkb instruction was also added.

Verification
Assembly Tests:
The instructions were tested and verified with the K module of both 32 bit and 64 bit versions of the riscv-arch-tests to ensure proper functionality. These tests check for ISA compliance, edge cases and use assertions to ensure expected behavior. The tests include:
pack-01.S
packh-01.S
packw-01.S
brev8-01.S
unzip-01.S
zip-01.S

.gitlab-ci/expected_synth.yml

@@ -1,2 +1,2 @@
 cv32a65x:
-  gates: 187456
+  gates: 188149

config/gen_from_riscv_config/cv32a65x/isa/isa.adoc

@@ -22,6 +22,7 @@
 |Zbc | RVZbc Carry-less multiplication | Carry-less multiplication is the multiplication in the polynomial ring over GF(2).clmul produces the lower half of the carry-less product and clmulh produces the upper half of the 2✕XLEN carry-less product.clmulr produces bits 2✕XLEN−2:XLEN-1 of the 2✕XLEN carry-less product.
 |Zbs | RVZbs Single bit Instructions | The single-bit instructions provide a mechanism to set, clear, invert, or extract a single bit in a register. The bit is specified by its index.
 |Zicntr | Zicntr | No info found yet for extension Zicntr
+|Zbkb | RVZbkb Bitmanip instructions for Cryptography | The Zbkb extension is a part of the RISC-V Bit-Manipulation (bitmanip) extensions, specifically targeting cryptographic applications. It introduces a set of instructions designed to facilitate operations commonly used in cryptographic algorithms, such as interleaving, packing, and reordering of bits.
 |===
 
 ==== RV32I Base Integer Instructions
@@ -220,4 +221,3 @@
 | BSET | bset rd, rs1, rs2 | X(rd) = X(rs1) \| (1 << (X(rs2) & (XLEN - 1))) | NONE | NONE | This instruction returns rs1 with a single bit set at the index specified in rs2. The index is read from the lower log2(XLEN) bits of rs2. | Single_bit_Operations 
 | BSETI | bseti rd, rs1, shamt | X(rd) = X(rs1) \| (1 << (shamt & (XLEN - 1))) | NONE | NONE | This instruction returns rs1 with a single bit set at the index specified in shamt. The index is read from the lower log2(XLEN) bits of shamt. For RV32, the encodings corresponding to shamt[5]=1 are reserved. | Single_bit_Operations 
 |===
-

config/gen_from_riscv_config/cv32a65x/isa/isa.rst

@@ -47,6 +47,8 @@ Instructions
 +---------------+-----------------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
 | Zicntr        | Zicntr_                                             | No info found yet for extension Zicntr                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
 +---------------+-----------------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
+| Zbkb          | RVZbkb Bitmanip instructions for Cryptography_      | The Zbkb extension is a part of the RISC-V Bit-Manipulation (bitmanip) extensions, specifically targeting cryptographic applications. It introduces a set of instructions designed to facilitate operations commonly used in cryptographic algorithms, such as interleaving, packing, and reordering of bits.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
++---------------+-----------------------------------------------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
 
 RV32I Base Integer Instructions
 -------------------------------
@@ -393,4 +395,3 @@ RVZbs Single bit Instructions
 +--------+----------------------+------------------------------------------------+------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
 | BSETI  | bseti rd, rs1, shamt | X(rd) = X(rs1) | (1 << (shamt & (XLEN - 1)))   | NONE             | NONE               | This instruction returns rs1 with a single bit set at the index specified in shamt. The index is read from the lower log2(XLEN) bits of shamt. For RV32, the encodings corresponding to shamt[5]=1 are reserved.      | Single_bit_Operations |
 +--------+----------------------+------------------------------------------------+------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------------+
-

core/alu.sv

@@ -51,6 +51,9 @@ module alu
   logic lz_tz_empty, lz_tz_wempty;
   logic [CVA6Cfg.XLEN-1:0] orcbw_result, rev8w_result;
 
+  logic [CVA6Cfg.XLEN-1:0] brev8_reversed;
+  logic [            31:0] unzip_gen;
+  logic [            31:0] zip_gen;
   // bit reverse operand_a for left shifts and bit counting
   generate
     genvar k;
@@ -263,6 +266,29 @@ module alu
     end
   end
 
+  // ZKN gen block
+  if (CVA6Cfg.ZKN && CVA6Cfg.RVB) begin : zkn_gen_block
+    genvar i, m, n;
+    // Generate brev8_reversed by reversing bits within each byte
+    for (i = 0; i < (CVA6Cfg.XLEN / 8); i++) begin : brev8_gen
+      for (m = 0; m < 8; m++) begin : reverse_bits
+        // Reversing the order of bits within a single byte
+        assign brev8_reversed[(i<<3)+m] = fu_data_i.operand_a[(i<<3)+(7-m)];
+      end
+    end
+    // Generate zip and unzip results
+    if (CVA6Cfg.IS_XLEN32) begin
+      for (n = 0; n < 16; n++) begin : zip_unzip_gen
+        // Assigning lower and upper half of operand into the even and odd positions of result
+        assign zip_gen[n<<1] = fu_data_i.operand_a[n];
+        assign zip_gen[(n<<1)+1] = fu_data_i.operand_a[n+16];
+        // Assigning even and odd bits of operand into lower and upper halves of result
+        assign unzip_gen[n] = fu_data_i.operand_a[n<<1];
+        assign unzip_gen[n+16] = fu_data_i.operand_a[(n<<1)+1];
+      end
+    end
+  end
+
   // -----------
   // Result MUX
   // -----------
@@ -358,5 +384,22 @@ module alu
         default: ;  // default case to suppress unique warning
       endcase
     end
+    // ZKN instructions
+    if (CVA6Cfg.ZKN && CVA6Cfg.RVB) begin
+      unique case (fu_data_i.operation)
+        PACK:
+        result_o = (CVA6Cfg.IS_XLEN32) ? ({fu_data_i.operand_b[15:0], fu_data_i.operand_a[15:0]}) : ({fu_data_i.operand_b[31:0], fu_data_i.operand_a[31:0]});
+        PACK_H:
+        result_o = (CVA6Cfg.IS_XLEN32) ? ({16'b0, fu_data_i.operand_b[7:0], fu_data_i.operand_a[7:0]}) : ({48'b0, fu_data_i.operand_b[7:0], fu_data_i.operand_a[7:0]});
+        BREV8: result_o = brev8_reversed;
+        default: ;
+      endcase
+      if (fu_data_i.operation == PACK_W && CVA6Cfg.IS_XLEN64)
+        result_o = {
+          {32{fu_data_i.operand_b[15]}}, {fu_data_i.operand_b[15:0]}, {fu_data_i.operand_a[15:0]}
+        };
+      if (fu_data_i.operation == UNZIP && CVA6Cfg.IS_XLEN32) result_o = unzip_gen;
+      if (fu_data_i.operation == ZIP && CVA6Cfg.IS_XLEN32) result_o = zip_gen;
+    end
   end
 endmodule

core/decoder.sv

@@ -776,12 +776,19 @@ module decoder
                 // Bitwise Shifting
                 {7'b011_0000, 3'b001} : instruction_o.op = ariane_pkg::ROL;  // rol
                 {7'b011_0000, 3'b101} : instruction_o.op = ariane_pkg::ROR;  // ror
+                {
+                  7'b000_0100, 3'b111
+                } : begin
+                  if (CVA6Cfg.ZKN) instruction_o.op = ariane_pkg::PACK_H;  //packh
+                  else illegal_instr_bm = 1'b1;
+                end
                 // Zero Extend Op RV32 encoding
                 {
                   7'b000_0100, 3'b100
                 } : begin
                   if (!CVA6Cfg.IS_XLEN64 && instr.instr[24:20] == 5'b00000)
-                    instruction_o.op = ariane_pkg::ZEXTH;
+                    instruction_o.op = ariane_pkg::ZEXTH;  // Zero Extend Op RV32 encoding
+                  else if (CVA6Cfg.ZKN) instruction_o.op = ariane_pkg::PACK;  // pack
                   else illegal_instr_bm = 1'b1;
                 end
                 default: begin
@@ -843,21 +850,21 @@ module decoder
                 instr.rtype.funct7, instr.rtype.funct3
               })
                 // Shift with Add (Unsigned Word)
-                {7'b001_0000, 3'b010}: instruction_o.op = ariane_pkg::SH1ADDUW; // sh1add.uw
-                {7'b001_0000, 3'b100}: instruction_o.op = ariane_pkg::SH2ADDUW; // sh2add.uw
-                {7'b001_0000, 3'b110}: instruction_o.op = ariane_pkg::SH3ADDUW; // sh3add.uw
+                {7'b001_0000, 3'b010} : instruction_o.op = ariane_pkg::SH1ADDUW;  // sh1add.uw
+                {7'b001_0000, 3'b100} : instruction_o.op = ariane_pkg::SH2ADDUW;  // sh2add.uw
+                {7'b001_0000, 3'b110} : instruction_o.op = ariane_pkg::SH3ADDUW;  // sh3add.uw
                 // Unsigned word Op's
-                {7'b000_0100, 3'b000}: instruction_o.op = ariane_pkg::ADDUW;    // add.uw
+                {7'b000_0100, 3'b000} : instruction_o.op = ariane_pkg::ADDUW;  // add.uw
                 // Bitwise Shifting
-                {7'b011_0000, 3'b001}: instruction_o.op = ariane_pkg::ROLW;     // rolw
-                {7'b011_0000, 3'b101}: instruction_o.op = ariane_pkg::RORW;     // rorw
-                // Zero Extend Op RV64 encoding
-                {7'b000_0100, 3'b100}:
-                begin
+                {7'b011_0000, 3'b001} : instruction_o.op = ariane_pkg::ROLW;  // rolw
+                {7'b011_0000, 3'b101} : instruction_o.op = ariane_pkg::RORW;  // rorw
+                {
+                  7'b000_0100, 3'b100
+                } : begin
                   if (instr.instr[24:20] == 5'b00000)
-                    instruction_o.op = ariane_pkg::ZEXTH;
-                  else
-                    illegal_instr_bm = 1'b1;
+                    instruction_o.op = ariane_pkg::ZEXTH;  // Zero Extend Op RV64 encoding
+                  else if (CVA6Cfg.ZKN) instruction_o.op = ariane_pkg::PACK_W;  // packw
+                  else illegal_instr_bm = 1'b1;
                 end
                 default: illegal_instr_bm = 1'b1;
               endcase
@@ -912,6 +919,8 @@ module decoder
                 end else if (instr.instr[31:26] == 6'b010010) instruction_o.op = ariane_pkg::BCLRI;
                 else if (instr.instr[31:26] == 6'b011010) instruction_o.op = ariane_pkg::BINVI;
                 else if (instr.instr[31:26] == 6'b001010) instruction_o.op = ariane_pkg::BSETI;
+                else if (CVA6Cfg.ZKN && instr.instr[31:20] == 12'b000010001111)
+                  instruction_o.op = ariane_pkg::ZIP;
                 else illegal_instr_bm = 1'b1;
               end
               3'b101: begin
@@ -922,6 +931,10 @@ module decoder
                   instruction_o.op = ariane_pkg::REV8;
                 else if (instr.instr[31:26] == 6'b010_010) instruction_o.op = ariane_pkg::BEXTI;
                 else if (instr.instr[31:26] == 6'b011_000) instruction_o.op = ariane_pkg::RORI;
+                else if (CVA6Cfg.ZKN && instr.instr[31:20] == 12'b011010000111)
+                  instruction_o.op = ariane_pkg::BREV8;
+                else if (CVA6Cfg.ZKN && instr.instr[31:20] == 12'b000010001111)
+                  instruction_o.op = ariane_pkg::UNZIP;
                 else illegal_instr_bm = 1'b1;
               end
               default: illegal_instr_bm = 1'b1;

core/include/ariane_pkg.sv

@@ -489,7 +489,16 @@ package ariane_pkg;
     ACCEL_OP_STORE,
     // Zicond instruction
     CZERO_EQZ,
-    CZERO_NEZ
+    CZERO_NEZ,
+    // Pack instructions
+    PACK,
+    PACK_H,
+    PACK_W,
+    // Brev8 instruction
+    BREV8,
+    // Zip instructions
+    UNZIP,
+    ZIP
   } fu_op;
 
   function automatic logic op_is_branch(input fu_op op);

core/include/build_config_pkg.sv

@@ -65,6 +65,7 @@ package build_config_pkg;
     cfg.XF8 = CVA6Cfg.XF8;
     cfg.RVA = CVA6Cfg.RVA;
     cfg.RVB = CVA6Cfg.RVB;
+    cfg.ZKN = CVA6Cfg.ZKN;
     cfg.RVV = CVA6Cfg.RVV;
     cfg.RVC = CVA6Cfg.RVC;
     cfg.RVH = CVA6Cfg.RVH;

core/include/config_pkg.sv

@@ -54,6 +54,8 @@ package config_pkg;
     bit                          RVA;
     // Bit manipulation RISC-V extension
     bit                          RVB;
+    // Scalar Cryptography RISC-V entension
+    bit                          ZKN;
     // Vector RISC-V extension
     bit                          RVV;
     // Compress RISC-V extension
@@ -240,6 +242,7 @@ package config_pkg;
     bit          XF8;
     bit          RVA;
     bit          RVB;
+    bit          ZKN;
     bit          RVV;
     bit          RVC;
     bit          RVH;

core/include/cv32a60x_config_pkg.sv

@@ -39,6 +39,7 @@ package cva6_config_pkg;
       XF8: bit'(0),
       RVA: bit'(0),
       RVB: bit'(1),
+      ZKN: bit'(0),
       RVV: bit'(0),
       RVC: bit'(1),
       RVH: bit'(0),

core/include/cv32a65x_config_pkg.sv

@@ -39,6 +39,7 @@ package cva6_config_pkg;
       XF8: bit'(0),
       RVA: bit'(0),
       RVB: bit'(1),
+      ZKN: bit'(0),
       RVV: bit'(0),
       RVC: bit'(1),
       RVH: bit'(0),

core/include/cv32a6_embedded_config_pkg_deprecated.sv

@@ -90,6 +90,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv32a6_ima_sv32_fpga_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv32a6_imac_sv0_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv32a6_imac_sv32_config_pkg.sv

@@ -24,7 +24,6 @@ package cva6_config_pkg;
   localparam CVA6ConfigZcmpExtEn = 0;
   localparam CVA6ConfigAExtEn = 1;
   localparam CVA6ConfigHExtEn = 0;  // always disabled
-  localparam CVA6ConfigBExtEn = 0;
   localparam CVA6ConfigVExtEn = 0;
   localparam CVA6ConfigRVZiCond = 0;
 
@@ -90,7 +89,8 @@ package cva6_config_pkg;
       XF16ALT: bit'(CVA6ConfigF16AltEn),
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
-      RVB: bit'(CVA6ConfigBExtEn),
+      RVB: bit'(1),
+      ZKN: bit'(1),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv32a6_imafc_sv32_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imadfcv_sv39_polara_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imafdc_sv39_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(1),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imafdc_sv39_hpdcache_config_pkg.sv

@@ -98,6 +98,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(1),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imafdc_sv39_openpiton_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imafdc_sv39_wb_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imafdch_sv39_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imafdch_sv39_wb_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_imafdcv_sv39_config_pkg.sv

@@ -91,6 +91,7 @@ package cva6_config_pkg;
       XF8: bit'(CVA6ConfigF8En),
       RVA: bit'(CVA6ConfigAExtEn),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(CVA6ConfigVExtEn),
       RVC: bit'(CVA6ConfigCExtEn),
       RVH: bit'(CVA6ConfigHExtEn),

core/include/cv64a6_mmu_config_pkg.sv

@@ -46,6 +46,7 @@ package cva6_config_pkg;
       XF8: bit'(0),
       RVA: bit'(0),
       RVB: bit'(CVA6ConfigBExtEn),
+      ZKN: bit'(0),
       RVV: bit'(0),
       RVC: bit'(1),
       RVH: bit'(0),