[RISCV] Mask instructions in Zkt as constant-time

[wangpc]

Summary

We use one bit in TSFlags to indicate that this instruction has
data-independent execution time property (constant-time) as required
in Zkt extension.

This property may help to verify whether a function is constant-time.

(Though there are limited usages currently, I think this will be
helpful to crypto libraries).

[asb]

Interesting idea. Some initial thoughts:

• The HINT instructions are not included in the constant time guarantee, and this approach doesn't account for that
• A different name is probably need, as these instructions are only known to be constant time if zkt is enabled, and we'll need something similar for zvkt.

I'll put this on the agenda for the RISC-V LLVM sync-up call tomorrow.

[craig.topper]

llvm/lib/Target/RISCV/RISCVInstrFormats.td

211

zkt -> Zkt

[craig.topper]

In order for this to work, the loop over the buffer to encrypt has to be a separate piece of code? Since the branch instructions aren't constant time.

This patch needs a test that shows the warning fires for a non-constant time instruction.

[wangpc]

In D155690#4515159, @craig.topper wrote:

In order for this to work, the loop over the buffer to encrypt has to be a separate piece of code? Since the branch instructions aren't constant time.

This patch needs a test that shows the warning fires for a non-constant time instruction.

I'm imagining something like this:

__attribute__((constant_time))
void aes128_encrypt(char block_to_encrypt[16], __attribute__((secret)) char key[16], char output_cipher[16]){
  // ...
}

An attribute __attribute__((constant_time)) will indicate that a function needs to be constant-time and shouldn't leak secret key with __attribute__((secret)), then we will do some transformations (for example, do if-conversion to eliminate branches) in the frontend (Clang) and middle end (LLVM IR) to make sure generated code is with this property. There are lots of downstreams/papers doing similar works (for X86, ARM, etc.). Since RISCV has made this constant-time property a standard extension, I think this can be attractive.

But for now, there is still a long way to go. I plan to start from verifying a piece of assemblies as this patch has done.

---

Go back to your question. :-)
The place where a secret may leak is what we need to protect. If each iteration (without the branch instruction in latch) of a loop is constant-time, then the loop won't leak any information about secret key with or without misprediction (generally speaking).
Actually, Zkt is just a list of instructions that are “safe to use” to handle crypto secrets. So if the branch instructions won't use any registers that hold secrets or effected by secrets, it's OK to be in a "constant-time" loop/function.
I may not explain it clearly, so I lead you to RISC-V Zkt: Portable Timing Attack Resistance (via Dynamic Taint Analysis). :-)

[craig.topper]

llvm/lib/Target/RISCV/RISCVInstrInfo.td

688

Can we move this scope start above ADDI? Then we don't need to mention it 3 other times before this.

llvm/lib/Target/RISCV/RISCVInstrInfoZb.td

336

Are ROLW/RORW not in the constant time list? Surely that's a miss in the table in the spec since it says "The Zbkb, Zbkx and Zbkx extensions are included in their entirety."

[craig.topper]

llvm/lib/Target/RISCV/RISCVInstrInfoZb.td

336

PR for the spec https://github.com/riscv/riscv-crypto/pull/347

[craig.topper]

Should we include c.mul, c.not, and c.zext.b from Zcb? Those map to mul, xor, and andi.

I filed an issue about whether Zba, Zbb, and Zbs should be part of Zkt. https://github.com/riscv/riscv-crypto/issues/348

[craig.topper]

In D155690#4515774, @craig.topper wrote:

Should we include c.mul, c.not, and c.zext.b from Zcb? Those map to mul, xor, and andi.

I guess as currently written they aren't constant time. So crypto writers have to disable the Zcb extension I guess.

[wangpc]

• Rebase.
• Add more Zbkb instructions.
• Add invalid tests.

llvm/lib/Target/RISCV/AsmParser/RISCVAsmParser.cpp

 #define DEBUG_TYPE "riscv-asm-parser"
 
 STATISTIC(RISCVNumInstrsCompressed,
           "Number of RISC-V Compressed instructions emitted");
 
 static cl::opt<bool> AddBuildAttributes("riscv-add-build-attributes",
                                         cl::init(false));
 
+static cl::opt<bool> VerifyConstantTime("riscv-verify-constant-time",
+                                        cl::init(false));
+
 namespace llvm {
 extern const SubtargetFeatureKV RISCVFeatureKV[RISCV::NumSubtargetFeatures];
 } // namespace llvm
 
 namespace {
 struct RISCVOperand;
 
 struct ParserOptionsSet {
bool RISCVAsmParser::MatchAndEmitInstruction(SMLoc IDLoc, unsigned &Opcode,
   auto Result = MatchInstructionImpl(Operands, Inst, ErrorInfo, MissingFeatures,
                                      MatchingInlineAsm);
   switch (Result) {
   default:
     break;
   case Match_Success:
     if (validateInstruction(Inst, Operands))
       return true;
+
+    // TODO: Verify that only constant-time instructions will operate on
+    // secret operands.
+    if (VerifyConstantTime &&
+        !RISCVII::isConstantTime(MII.get(Inst.getOpcode()).TSFlags))
+      return Warning(IDLoc, "This instruction is not constant-time.");
+
     return processInstruction(Inst, IDLoc, Operands, Out);
   case Match_MissingFeature: {
     assert(MissingFeatures.any() && "Unknown missing features!");
     bool FirstFeature = true;
     std::string Msg = "instruction requires the following:";
     for (unsigned i = 0, e = MissingFeatures.size(); i != e; ++i) {
       if (MissingFeatures[i]) {
         Msg += FirstFeature ? " " : ", ";

llvm/lib/Target/RISCV/MCTargetDesc/RISCVBaseInfo.h

enum {
   IsSignExtendingOpWShift = UsesMaskPolicyShift + 1,
   IsSignExtendingOpWMask = 1ULL << IsSignExtendingOpWShift,
 
   HasRoundModeOpShift = IsSignExtendingOpWShift + 1,
   HasRoundModeOpMask = 1 << HasRoundModeOpShift,
 
   UsesVXRMShift = HasRoundModeOpShift + 1,
   UsesVXRMMask = 1 << UsesVXRMShift,
+
+  // Indicates that this instruction has data-independent execution time
+  // property (constant-time) as required in zkt extension.
+  IsConstantTimeShift = UsesVXRMShift + 1,
+  IsConstantTimeMask = 1 << IsConstantTimeShift,
 };
 
 enum VLMUL : uint8_t {
   LMUL_1 = 0,
   LMUL_2,
   LMUL_4,
   LMUL_8,
   LMUL_RESERVED,

 /// \returns true if there is a rounding mode operand for this instruction
 static inline bool hasRoundModeOp(uint64_t TSFlags) {
   return TSFlags & HasRoundModeOpMask;
 }
 
 /// \returns true if this instruction uses vxrm
 static inline bool usesVXRM(uint64_t TSFlags) { return TSFlags & UsesVXRMMask; }
 
+/// \returns true if this instruction is constant-time
+static inline bool isConstantTime(uint64_t TSFlags) {
+  return TSFlags & IsConstantTimeMask;
+}
+
 static inline unsigned getVLOpNum(const MCInstrDesc &Desc) {
   const uint64_t TSFlags = Desc.TSFlags;
   // This method is only called if we expect to have a VL operand, and all
   // instructions with VL also have SEW.
   assert(hasSEWOp(TSFlags) && hasVLOp(TSFlags));
   unsigned Offset = 2;
   if (hasVecPolicyOp(TSFlags))
     Offset = 3;

llvm/lib/Target/RISCV/RISCVInstrFormats.td

class RVInstCommon<InstFormat format> : Instruction {
 
   // This is only valid when HasRoundModeOp is set to 1. HasRoundModeOp is set
   // to 1 for vector fixed-point or floating-point intrinsics. This bit is
   // processed under pass 'RISCVInsertReadWriteCSR' pass to distinguish between
   // fixed-point / floating-point instructions and emit appropriate read/write
   // to the correct CSR.
   bit UsesVXRM = 0;
   let TSFlags{20} =  UsesVXRM;
+
+  // Indicates that this instruction has data-independent execution time
+  // property (constant-time) as required in Zkt extension.
+  bit IsConstantTime = 0;
+  let TSFlags{21} =  IsConstantTime;
 }
 
 class RVInst<dag outs, dag ins, string opcodestr, string argstr,
              list<dag> pattern, InstFormat format>
     : RVInstCommon<format> {
   field bits<32> Inst;
   // SoftFail is a field the disassembler can use to provide a way for
   // instructions to not match without killing the whole decode process. It is

llvm/lib/Target/RISCV/RISCVInstrInfo.td

 }
 
 //===----------------------------------------------------------------------===//
 // Instructions
 //===----------------------------------------------------------------------===//
 
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in {
 let isReMaterializable = 1, isAsCheapAsAMove = 1,
-    IsSignExtendingOpW = 1 in
+    IsSignExtendingOpW = 1, IsConstantTime = 1 in
 def LUI : RVInstU<OPC_LUI, (outs GPR:$rd), (ins uimm20_lui:$imm20),
                   "lui", "$rd, $imm20">, Sched<[WriteIALU]>;
 
+let IsConstantTime = 1 in
 def AUIPC : RVInstU<OPC_AUIPC, (outs GPR:$rd), (ins uimm20_auipc:$imm20),
                     "auipc", "$rd, $imm20">, Sched<[WriteIALU]>;
 
 def JAL : RVInstJ<OPC_JAL, (outs GPR:$rd), (ins simm21_lsb0_jal:$imm20),
                   "jal", "$rd, $imm20">, Sched<[WriteJal]>;
 
 def JALR : RVInstI<0b000, OPC_JALR, (outs GPR:$rd),
                    (ins GPR:$rs1, simm12:$imm12),

 }
 
 def SB : Store_rri<0b000, "sb">, Sched<[WriteSTB, ReadStoreData, ReadMemBase]>;
 def SH : Store_rri<0b001, "sh">, Sched<[WriteSTH, ReadStoreData, ReadMemBase]>;
 def SW : Store_rri<0b010, "sw">, Sched<[WriteSTW, ReadStoreData, ReadMemBase]>;
 
 // ADDI isn't always rematerializable, but isReMaterializable will be used as
 // a hint which is verified in isReallyTriviallyReMaterializable.
+let IsConstantTime = 1 in {
 let isReMaterializable = 1, isAsCheapAsAMove = 1 in
 def ADDI  : ALU_ri<0b000, "addi">;
 
 let IsSignExtendingOpW = 1 in {
 def SLTI  : ALU_ri<0b010, "slti">;
 def SLTIU : ALU_ri<0b011, "sltiu">;
 }
 
 let isReMaterializable = 1, isAsCheapAsAMove = 1 in {
 def XORI  : ALU_ri<0b100, "xori">;
 def ORI   : ALU_ri<0b110, "ori">;
 }
 
 def ANDI  : ALU_ri<0b111, "andi">;
 
 def SLLI : Shift_ri<0b00000, 0b001, "slli">;
 def SRLI : Shift_ri<0b00000, 0b101, "srli">;
 def SRAI : Shift_ri<0b01000, 0b101, "srai">;
 
 def ADD  : ALU_rr<0b0000000, 0b000, "add", /*Commutable*/1>,
            Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 def SUB  : ALU_rr<0b0100000, 0b000, "sub">,

 def SRL  : ALU_rr<0b0000000, 0b101, "srl">,
            Sched<[WriteShiftReg, ReadShiftReg, ReadShiftReg]>;
 def SRA  : ALU_rr<0b0100000, 0b101, "sra">,
            Sched<[WriteShiftReg, ReadShiftReg, ReadShiftReg]>;
 def OR   : ALU_rr<0b0000000, 0b110, "or", /*Commutable*/1>,
            Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 def AND  : ALU_rr<0b0000000, 0b111, "and", /*Commutable*/1>,
            Sched<[WriteIALU, ReadIALU, ReadIALU]>;
+} // IsConstantTime = 1
 
 let hasSideEffects = 1, mayLoad = 0, mayStore = 0 in {
 def FENCE : RVInstI<0b000, OPC_MISC_MEM, (outs),
                     (ins fencearg:$pred, fencearg:$succ),
                     "fence", "$pred, $succ">, Sched<[]> {
   bits<4> pred;
   bits<4> succ;
 

 
 /// RV64I instructions
 
 let Predicates = [IsRV64] in {
 def LWU   : Load_ri<0b110, "lwu">, Sched<[WriteLDW, ReadMemBase]>;
 def LD    : Load_ri<0b011, "ld">, Sched<[WriteLDD, ReadMemBase]>;
 def SD    : Store_rri<0b011, "sd">, Sched<[WriteSTD, ReadStoreData, ReadMemBase]>;
 
-let IsSignExtendingOpW = 1 in {
+let IsSignExtendingOpW = 1, IsConstantTime = 1 in {
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
 def ADDIW : RVInstI<0b000, OPC_OP_IMM_32, (outs GPR:$rd),
                     (ins GPR:$rs1, simm12:$imm12),
                     "addiw", "$rd, $rs1, $imm12">,
             Sched<[WriteIALU32, ReadIALU32]>;
 
 def SLLIW : ShiftW_ri<0b0000000, 0b001, "slliw">;
 def SRLIW : ShiftW_ri<0b0000000, 0b101, "srliw">;
 def SRAIW : ShiftW_ri<0b0100000, 0b101, "sraiw">;
 
 def ADDW  : ALUW_rr<0b0000000, 0b000, "addw", /*Commutable*/1>,
             Sched<[WriteIALU32, ReadIALU32, ReadIALU32]>;
 def SUBW  : ALUW_rr<0b0100000, 0b000, "subw">,
             Sched<[WriteIALU32, ReadIALU32, ReadIALU32]>;
 def SLLW  : ALUW_rr<0b0000000, 0b001, "sllw">,
             Sched<[WriteShiftReg32, ReadShiftReg32, ReadShiftReg32]>;
 def SRLW  : ALUW_rr<0b0000000, 0b101, "srlw">,
             Sched<[WriteShiftReg32, ReadShiftReg32, ReadShiftReg32]>;
 def SRAW  : ALUW_rr<0b0100000, 0b101, "sraw">,
             Sched<[WriteShiftReg32, ReadShiftReg32, ReadShiftReg32]>;
-} // IsSignExtendingOpW = 1
+} // IsSignExtendingOpW = 1, IsConstantTime = 1
 } // Predicates = [IsRV64]
 
 //===----------------------------------------------------------------------===//
 // Privileged instructions
 //===----------------------------------------------------------------------===//
 
 let isBarrier = 1, isReturn = 1, isTerminator = 1 in {
 def SRET : Priv<"sret", 0b0001000>, Sched<[]> {

llvm/lib/Target/RISCV/RISCVInstrInfoC.td

 let Predicates = [HasStdExtCOrZca, IsRV64] in
 def C_SD : CStore_rri<0b111, "c.sd", GPRC, uimm8_lsb000>,
            Sched<[WriteSTD, ReadStoreData, ReadMemBase]> {
   bits<8> imm;
   let Inst{12-10} = imm{5-3};
   let Inst{6-5} = imm{7-6};
 }
 
+let IsConstantTime = 1 in {
 let rd = 0, imm = 0, hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
 def C_NOP : RVInst16CI<0b000, 0b01, (outs), (ins), "c.nop", "">,
             Sched<[WriteNop]> {
   let Inst{6-2} = 0;
 }
 
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
 def C_ADDI : RVInst16CI<0b000, 0b01, (outs GPRNoX0:$rd_wb),
                         (ins GPRNoX0:$rd, simm6nonzero:$imm),
                         "c.addi", "$rd, $imm">,
              Sched<[WriteIALU, ReadIALU]> {
   let Constraints = "$rd = $rd_wb";
   let Inst{6-2} = imm{4-0};
 }
 
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
 def C_ADDI_NOP : RVInst16CI<0b000, 0b01, (outs GPRX0:$rd_wb),
                             (ins GPRX0:$rd, immzero:$imm),
                             "c.addi", "$rd, $imm">,
                  Sched<[WriteIALU, ReadIALU]> {
   let Constraints = "$rd = $rd_wb";
   let Inst{6-2} = 0;
   let isAsmParserOnly = 1;
 }
+} // IsConstantTime = 1
 
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0, isCall = 1,
     DecoderNamespace = "RISCV32Only_", Defs = [X1],
     Predicates = [HasStdExtCOrZca, IsRV32]  in
 def C_JAL : RVInst16CJ<0b001, 0b01, (outs), (ins simm12_lsb0:$offset),
                        "c.jal", "$offset">, Sched<[WriteJal]>;
 
-let hasSideEffects = 0, mayLoad = 0, mayStore = 0,
+let hasSideEffects = 0, mayLoad = 0, mayStore = 0, IsConstantTime = 1,
     Predicates = [HasStdExtCOrZca, IsRV64] in
 def C_ADDIW : RVInst16CI<0b001, 0b01, (outs GPRNoX0:$rd_wb),
                          (ins GPRNoX0:$rd, simm6:$imm),
                          "c.addiw", "$rd, $imm">,
               Sched<[WriteIALU32, ReadIALU32]> {
   let Constraints = "$rd = $rd_wb";
   let Inst{6-2} = imm{4-0};
 }
def C_ADDI16SP : RVInst16CI<0b011, 0b01, (outs SP:$rd_wb),
   let Inst{12} = imm{9};
   let Inst{11-7} = 2;
   let Inst{6} = imm{4};
   let Inst{5} = imm{6};
   let Inst{4-3} = imm{8-7};
   let Inst{2} = imm{5};
 }
 
+let IsConstantTime = 1 in {
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
 def C_LUI : RVInst16CI<0b011, 0b01, (outs GPRNoX0X2:$rd),
                        (ins c_lui_imm:$imm),
                        "c.lui", "$rd, $imm">,
             Sched<[WriteIALU]> {
   let Inst{6-2} = imm{4-0};
 }
 
def C_AND  : CA_ALU<0b100011, 0b11, "c.and", GPRC>,
              Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 
 let Predicates = [HasStdExtCOrZca, IsRV64] in {
 def C_SUBW : CA_ALU<0b100111, 0b00, "c.subw", GPRC>,
              Sched<[WriteIALU32, ReadIALU32, ReadIALU32]>;
 def C_ADDW : CA_ALU<0b100111, 0b01, "c.addw", GPRC>,
              Sched<[WriteIALU32, ReadIALU32, ReadIALU32]>;
 }
+} // IsConstantTime = 1
 
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
 def C_J : RVInst16CJ<0b101, 0b01, (outs), (ins simm12_lsb0:$offset),
                      "c.j", "$offset">, Sched<[WriteJmp]> {
   let isBranch = 1;
   let isTerminator=1;
   let isBarrier=1;
 }
 
 def C_BEQZ : Bcz<0b110, "c.beqz", GPRC>, Sched<[WriteJmp, ReadJmp]>;
 def C_BNEZ : Bcz<0b111, "c.bnez", GPRC>, Sched<[WriteJmp, ReadJmp]>;
 
-let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
+let hasSideEffects = 0, mayLoad = 0, mayStore = 0, IsConstantTime = 1 in
 def C_SLLI : RVInst16CI<0b000, 0b10, (outs GPRNoX0:$rd_wb),
                         (ins GPRNoX0:$rd, uimmlog2xlennonzero:$imm),
                         "c.slli", "$rd, $imm">,
              Sched<[WriteShiftImm, ReadShiftImm]> {
   let Constraints = "$rd = $rd_wb";
   let Inst{6-2} = imm{4-0};
 }
 

 def C_JR : RVInst16CR<0b1000, 0b10, (outs), (ins GPRNoX0:$rs1),
                       "c.jr", "$rs1">, Sched<[WriteJalr, ReadJalr]> {
   let isBarrier = 1;
   let isTerminator = 1;
   let rs2 = 0;
 }
 
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0, isMoveReg = 1,
-    isAsCheapAsAMove = 1 in
+    isAsCheapAsAMove = 1, IsConstantTime = 1 in
 def C_MV : RVInst16CR<0b1000, 0b10, (outs GPRNoX0:$rs1), (ins GPRNoX0:$rs2),
                       "c.mv", "$rs1, $rs2">,
            Sched<[WriteIALU, ReadIALU]>;
 
 let rs1 = 0, rs2 = 0, hasSideEffects = 1, mayLoad = 0, mayStore = 0 in
 def C_EBREAK : RVInst16CR<0b1001, 0b10, (outs), (ins), "c.ebreak", "">, Sched<[]>;
 
 let hasSideEffects = 0, mayLoad = 0, mayStore = 0,
     isCall=1, Defs=[X1], rs2 = 0 in
 def C_JALR : RVInst16CR<0b1001, 0b10, (outs), (ins GPRNoX0:$rs1),
                         "c.jalr", "$rs1">, Sched<[WriteJalr, ReadJalr]>;
 
-let hasSideEffects = 0, mayLoad = 0, mayStore = 0 in
+let hasSideEffects = 0, mayLoad = 0, mayStore = 0, IsConstantTime = 1 in
 def C_ADD : RVInst16CR<0b1001, 0b10, (outs GPRNoX0:$rs1_wb),
                        (ins GPRNoX0:$rs1, GPRNoX0:$rs2),
                        "c.add", "$rs1, $rs2">,
             Sched<[WriteIALU, ReadIALU, ReadIALU]> {
   let Constraints = "$rs1 = $rs1_wb";
 }
 
 let Predicates = [HasStdExtCOrZcd, HasStdExtD] in

llvm/lib/Target/RISCV/RISCVInstrInfoM.td

 def riscv_divw  : SDNode<"RISCVISD::DIVW",  SDT_RISCVIntBinOpW>;
 def riscv_divuw : SDNode<"RISCVISD::DIVUW", SDT_RISCVIntBinOpW>;
 def riscv_remuw : SDNode<"RISCVISD::REMUW", SDT_RISCVIntBinOpW>;
 
 //===----------------------------------------------------------------------===//
 // Instructions
 //===----------------------------------------------------------------------===//
 
-let Predicates = [HasStdExtMOrZmmul] in {
+let Predicates = [HasStdExtMOrZmmul], IsConstantTime = 1 in {
 def MUL     : ALU_rr<0b0000001, 0b000, "mul", /*Commutable*/1>,
               Sched<[WriteIMul, ReadIMul, ReadIMul]>;
 def MULH    : ALU_rr<0b0000001, 0b001, "mulh", /*Commutable*/1>,
               Sched<[WriteIMul, ReadIMul, ReadIMul]>;
 def MULHSU  : ALU_rr<0b0000001, 0b010, "mulhsu">,
               Sched<[WriteIMul, ReadIMul, ReadIMul]>;
 def MULHU   : ALU_rr<0b0000001, 0b011, "mulhu", /*Commutable*/1>,
               Sched<[WriteIMul, ReadIMul, ReadIMul]>;
-} // Predicates = [HasStdExtMOrZmmul]
+} // Predicates = [HasStdExtMOrZmmul], IsConstantTime = 1
 
 let Predicates = [HasStdExtM] in {
 def DIV     : ALU_rr<0b0000001, 0b100, "div">,
               Sched<[WriteIDiv, ReadIDiv, ReadIDiv]>;
 def DIVU    : ALU_rr<0b0000001, 0b101, "divu">,
               Sched<[WriteIDiv, ReadIDiv, ReadIDiv]>;
 def REM     : ALU_rr<0b0000001, 0b110, "rem">,
               Sched<[WriteIDiv, ReadIDiv, ReadIDiv]>;
 def REMU    : ALU_rr<0b0000001, 0b111, "remu">,
               Sched<[WriteIDiv, ReadIDiv, ReadIDiv]>;
 } // Predicates = [HasStdExtM]
 
-let Predicates = [HasStdExtMOrZmmul, IsRV64], IsSignExtendingOpW = 1 in {
+let Predicates = [HasStdExtMOrZmmul, IsRV64], IsSignExtendingOpW = 1,
+    IsConstantTime = 1 in {
 def MULW    : ALUW_rr<0b0000001, 0b000, "mulw", /*Commutable*/1>,
               Sched<[WriteIMul32, ReadIMul32, ReadIMul32]>;
 } // Predicates = [HasStdExtMOrZmmul, IsRV64]
 
 let Predicates = [HasStdExtM, IsRV64], IsSignExtendingOpW = 1 in {
 def DIVW    : ALUW_rr<0b0000001, 0b100, "divw">,
               Sched<[WriteIDiv32, ReadIDiv32, ReadIDiv32]>;
 def DIVUW   : ALUW_rr<0b0000001, 0b101, "divuw">,

llvm/lib/Target/RISCV/RISCVInstrInfoZb.td

class RVBShiftW_ri<bits<7> imm11_5, bits<3> funct3, RISCVOpcode opcode,
     : RVInstIShiftW<imm11_5, funct3, opcode, (outs GPR:$rd),
                     (ins GPR:$rs1, uimm5:$shamt), opcodestr,
                     "$rd, $rs1, $shamt">;
 
 //===----------------------------------------------------------------------===//
 // Instructions
 //===----------------------------------------------------------------------===//
 
-let Predicates = [HasStdExtZbbOrZbkb] in {
+let IsConstantTime = 1, Predicates = [HasStdExtZbbOrZbkb] in {
 def ANDN  : ALU_rr<0b0100000, 0b111, "andn">,
             Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 def ORN   : ALU_rr<0b0100000, 0b110, "orn">,
             Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 def XNOR  : ALU_rr<0b0100000, 0b100, "xnor">,
             Sched<[WriteIALU, ReadIALU, ReadIALU]>;
-} // Predicates = [HasStdExtZbbOrZbkb]
+} // IsConstantTime = 1, Predicates = [HasStdExtZbbOrZbkb]
 
 let Predicates = [HasStdExtZba] in {
 def SH1ADD : ALU_rr<0b0010000, 0b010, "sh1add">,
              Sched<[WriteSHXADD, ReadSHXADD, ReadSHXADD]>;
 def SH2ADD : ALU_rr<0b0010000, 0b100, "sh2add">,
              Sched<[WriteSHXADD, ReadSHXADD, ReadSHXADD]>;
 def SH3ADD : ALU_rr<0b0010000, 0b110, "sh3add">,
              Sched<[WriteSHXADD, ReadSHXADD, ReadSHXADD]>;
 } // Predicates = [HasStdExtZba]
 
 let Predicates = [HasStdExtZba, IsRV64] in {
 def SLLI_UW : RVBShift_ri<0b00001, 0b001, OPC_OP_IMM_32, "slli.uw">,
               Sched<[WriteShiftImm32, ReadShiftImm32]>;
 def ADD_UW : ALUW_rr<0b0000100, 0b000, "add.uw">,
              Sched<[WriteIALU32, ReadIALU32, ReadIALU32]>;
 def SH1ADD_UW : ALUW_rr<0b0010000, 0b010, "sh1add.uw">,
                 Sched<[WriteSHXADD32, ReadSHXADD32, ReadSHXADD32]>;
 def SH2ADD_UW : ALUW_rr<0b0010000, 0b100, "sh2add.uw">,
                 Sched<[WriteSHXADD32, ReadSHXADD32, ReadSHXADD32]>;
 def SH3ADD_UW : ALUW_rr<0b0010000, 0b110, "sh3add.uw">,
                 Sched<[WriteSHXADD32, ReadSHXADD32, ReadSHXADD32]>;
 } // Predicates = [HasStdExtZba, IsRV64]
 
+let IsConstantTime = 1 in {
 let Predicates = [HasStdExtZbbOrZbkb] in {
 def ROL   : ALU_rr<0b0110000, 0b001, "rol">,
             Sched<[WriteRotateReg, ReadRotateReg, ReadRotateReg]>;
 def ROR   : ALU_rr<0b0110000, 0b101, "ror">,
             Sched<[WriteRotateReg, ReadRotateReg, ReadRotateReg]>;
 
 def RORI  : RVBShift_ri<0b01100, 0b101, OPC_OP_IMM, "rori">,
             Sched<[WriteRotateImm, ReadRotateImm]>;
 } // Predicates = [HasStdExtZbbOrZbkb]
 
 let Predicates = [HasStdExtZbbOrZbkb, IsRV64], IsSignExtendingOpW = 1 in {
 def ROLW  : ALUW_rr<0b0110000, 0b001, "rolw">,
             Sched<[WriteRotateReg32, ReadRotateReg32, ReadRotateReg32]>;
 def RORW  : ALUW_rr<0b0110000, 0b101, "rorw">,
             Sched<[WriteRotateReg32, ReadRotateReg32, ReadRotateReg32]>;
 
 def RORIW : RVBShiftW_ri<0b0110000, 0b101, OPC_OP_IMM_32, "roriw">,
             Sched<[WriteRotateImm32, ReadRotateImm32]>;
 } // Predicates = [HasStdExtZbbOrZbkb, IsRV64]
+} // IsConstantTime = 1
 
 let Predicates = [HasStdExtZbs] in {
 def BCLR : ALU_rr<0b0100100, 0b001, "bclr">,
            Sched<[WriteSingleBit, ReadSingleBit, ReadSingleBit]>;
 def BSET : ALU_rr<0b0010100, 0b001, "bset">,
            Sched<[WriteSingleBit, ReadSingleBit, ReadSingleBit]>;
 def BINV : ALU_rr<0b0110100, 0b001, "binv">,
            Sched<[WriteSingleBit, ReadSingleBit, ReadSingleBit]>;

 let IsSignExtendingOpW = 1 in
 def BEXTI : RVBShift_ri<0b01001, 0b101, OPC_OP_IMM, "bexti">,
             Sched<[WriteBEXTI, ReadSingleBitImm]>;
 } // Predicates = [HasStdExtZbs]
 
 // These instructions were named xperm.n and xperm.b in the last version of
 // the draft bit manipulation specification they were included in. However, we
 // use the mnemonics given to them in the ratified Zbkx extension.
-let Predicates = [HasStdExtZbkx] in {
+let IsConstantTime = 1, Predicates = [HasStdExtZbkx] in {
 def XPERM4 : ALU_rr<0b0010100, 0b010, "xperm4">,
              Sched<[WriteXPERM, ReadXPERM, ReadXPERM]>;
 def XPERM8 : ALU_rr<0b0010100, 0b100, "xperm8">,
              Sched<[WriteXPERM, ReadXPERM, ReadXPERM]>;
-} // Predicates = [HasStdExtZbkx]
+} // IsConstantTime = 1, Predicates = [HasStdExtZbkx]
 
 let Predicates = [HasStdExtZbb], IsSignExtendingOpW = 1 in {
 def CLZ  : RVBUnary<0b0110000, 0b00000, 0b001, OPC_OP_IMM, "clz">,
            Sched<[WriteCLZ, ReadCLZ]>;
 def CTZ  : RVBUnary<0b0110000, 0b00001, 0b001, OPC_OP_IMM, "ctz">,
            Sched<[WriteCTZ, ReadCTZ]>;
 def CPOP : RVBUnary<0b0110000, 0b00010, 0b001, OPC_OP_IMM, "cpop">,
            Sched<[WriteCPOP, ReadCPOP]>;
def SEXT_H : RVBUnary<0b0110000, 0b00101, 0b001, OPC_OP_IMM, "sext.h">,
              Sched<[WriteIALU, ReadIALU]>;
 } // Predicates = [HasStdExtZbb]
 
 let Predicates = [HasStdExtZbc] in {
 def CLMULR : ALU_rr<0b0000101, 0b010, "clmulr", /*Commutable*/1>,
              Sched<[WriteCLMUL, ReadCLMUL, ReadCLMUL]>;
 } // Predicates = [HasStdExtZbc]
 
-let Predicates = [HasStdExtZbcOrZbkc] in {
+let IsConstantTime = 1, Predicates = [HasStdExtZbcOrZbkc] in {
 def CLMUL  : ALU_rr<0b0000101, 0b001, "clmul", /*Commutable*/1>,
              Sched<[WriteCLMUL, ReadCLMUL, ReadCLMUL]>;
 def CLMULH : ALU_rr<0b0000101, 0b011, "clmulh", /*Commutable*/1>,
              Sched<[WriteCLMUL, ReadCLMUL, ReadCLMUL]>;
-} // Predicates = [HasStdExtZbcOrZbkc]
+} // IsConstantTime = 1, Predicates = [HasStdExtZbcOrZbkc]
 
 let Predicates = [HasStdExtZbb] in {
 def MIN  : ALU_rr<0b0000101, 0b100, "min", /*Commutable*/1>,
            Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 def MINU : ALU_rr<0b0000101, 0b101, "minu", /*Commutable*/1>,
            Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 def MAX  : ALU_rr<0b0000101, 0b110, "max", /*Commutable*/1>,
            Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 def MAXU : ALU_rr<0b0000101, 0b111, "maxu", /*Commutable*/1>,
            Sched<[WriteIALU, ReadIALU, ReadIALU]>;
 } // Predicates = [HasStdExtZbb]
 
+let IsConstantTime = 1 in {
 let Predicates = [HasStdExtZbkb] in {
 def PACK  : ALU_rr<0b0000100, 0b100, "pack">,
             Sched<[WritePACK, ReadPACK, ReadPACK]>;
 let IsSignExtendingOpW = 1 in
 def PACKH : ALU_rr<0b0000100, 0b111, "packh">,
             Sched<[WritePACK, ReadPACK, ReadPACK]>;
 } // Predicates = [HasStdExtZbkb]
 
 let Predicates = [HasStdExtZbkb, IsRV64], IsSignExtendingOpW = 1 in
 def PACKW  : ALUW_rr<0b0000100, 0b100, "packw">,
              Sched<[WritePACK32, ReadPACK32, ReadPACK32]>;
+} // IsConstantTime = 1
 
 let Predicates = [HasStdExtZbb, IsRV32] in {
 def ZEXT_H_RV32 : RVBUnary<0b0000100, 0b00000, 0b100, OPC_OP, "zext.h">,
                   Sched<[WriteIALU, ReadIALU]>;
 } // Predicates = [HasStdExtZbb, IsRV32]
 
 let Predicates = [HasStdExtZbb, IsRV64], IsSignExtendingOpW = 1 in {
 def ZEXT_H_RV64 : RVBUnary<0b0000100, 0b00000, 0b100, OPC_OP_32, "zext.h">,
                   Sched<[WriteIALU, ReadIALU]>;
 } // Predicates = [HasStdExtZbb, IsRV64]
 
+let IsConstantTime = 1 in {
 let Predicates = [HasStdExtZbbOrZbkb, IsRV32] in {
 def REV8_RV32 : RVBUnary<0b0110100, 0b11000, 0b101, OPC_OP_IMM, "rev8">,
                 Sched<[WriteREV8, ReadREV8]>;
 } // Predicates = [HasStdExtZbbOrZbkb, IsRV32]
 
 let Predicates = [HasStdExtZbbOrZbkb, IsRV64] in {
 def REV8_RV64 : RVBUnary<0b0110101, 0b11000, 0b101, OPC_OP_IMM, "rev8">,
                 Sched<[WriteREV8, ReadREV8]>;
 } // Predicates = [HasStdExtZbbOrZbkb, IsRV64]
+} // IsConstantTime = 1
 
 let Predicates = [HasStdExtZbb] in {
 def ORC_B : RVBUnary<0b0010100, 0b00111, 0b101, OPC_OP_IMM, "orc.b">,
             Sched<[WriteORCB, ReadORCB]>;
 } // Predicates = [HasStdExtZbb]
 
+let IsConstantTime = 1 in {
 let Predicates = [HasStdExtZbkb] in
 def BREV8 : RVBUnary<0b0110100, 0b00111, 0b101, OPC_OP_IMM, "brev8">,
             Sched<[WriteBREV8, ReadBREV8]>;
 
 let Predicates = [HasStdExtZbkb, IsRV32] in {
 def ZIP_RV32   : RVBUnary<0b0000100, 0b01111, 0b001, OPC_OP_IMM, "zip">,
                  Sched<[WriteZIP, ReadZIP]>;
 def UNZIP_RV32 : RVBUnary<0b0000100, 0b01111, 0b101, OPC_OP_IMM, "unzip">,
                  Sched<[WriteZIP, ReadZIP]>;
 } // Predicates = [HasStdExtZbkb, IsRV32]
+} // IsConstantTime = 1
 
 
 //===----------------------------------------------------------------------===//
 // Pseudo Instructions
 //===----------------------------------------------------------------------===//
 
 let Predicates = [HasStdExtZba, IsRV64] in {
 def : InstAlias<"zext.w $rd, $rs", (ADD_UW GPR:$rd, GPR:$rs, X0)>;

llvm/lib/Target/RISCV/RISCVInstrInfoZk.td

class RVKUnary_rnum<bits<7> funct7, bits<3> funct3, string opcodestr>
     let Inst{31-25} = funct7;
     let Inst{24} = 1;
     let Inst{23-20} = rnum;
 }
 
 //===----------------------------------------------------------------------===//
 // Instructions
 //===----------------------------------------------------------------------===//
+// All K-specific instructions are constant-time.
+let IsConstantTime = 1 in {
 let Predicates = [HasStdExtZknd, IsRV32] in {
 def AES32DSI  : RVKByteSelect<0b10101, "aes32dsi">;
 def AES32DSMI : RVKByteSelect<0b10111, "aes32dsmi">;
 } // Predicates = [HasStdExtZknd, IsRV32]
 
 let Predicates = [HasStdExtZknd, IsRV64] in {
 def AES64DS  : ALU_rr<0b0011101, 0b000, "aes64ds">;
 def AES64DSM : ALU_rr<0b0011111, 0b000, "aes64dsm">;

 def SM4ED : RVKByteSelect<0b11000, "sm4ed">;
 def SM4KS : RVKByteSelect<0b11010, "sm4ks">;
 } // Predicates = [HasStdExtZksed]
 
 let Predicates = [HasStdExtZksh], IsSignExtendingOpW = 1 in {
 def SM3P0 : RVKUnary<0b000100001000, 0b001, "sm3p0">;
 def SM3P1 : RVKUnary<0b000100001001, 0b001, "sm3p1">;
 } // Predicates = [HasStdExtZksh]
+} // IsConstantTime = 1
 
 //===----------------------------------------------------------------------===//
 // Codegen patterns
 //===----------------------------------------------------------------------===//
 
 class PatGprGprByteSelect<SDPatternOperator OpNode, RVInst Inst>
     : Pat<(XLenVT (OpNode (XLenVT GPR:$rs1), (XLenVT GPR:$rs2), byteselect:$imm)),
           (Inst GPR:$rs1, GPR:$rs2, byteselect:$imm)>;

llvm/test/MC/RISCV/rv32-constant-time-invalid.s

+# RUN: llvm-mc %s -triple=riscv32 -mattr=+m,+f,+d,+c,+zba,+zbb,+zbc,+zbs -riscv-verify-constant-time 2>&1 \
+# RUN:     | FileCheck %s
+
+# Not all instructions are listed here.
+
+# RVI
+lw a0, 0(a1)
+sw s0, 0(a1)
+jalr a0, 0(a1)
+jalr a0, 0(a1)
+
+# RVM
+div a0, a1, a2
+rem a0, a1, a2
+
+# RVF/RVD
+fld fa0, 0(a0)
+fsd fa0, 0(a0)
+fadd.s fa0, fa1, fa2
+fadd.d fa0, fa1, fa2
+fmul.s fa0, fa1, fa2
+fmul.d fa0, fa1, fa2
+fdiv.s fa0, fa1, fa2
+fdiv.d fa0, fa1, fa2
+
+# RVC
+c.j 0
+c.jr ra
+c.jalr a0
+c.lwsp a0, 0(sp)
+c.swsp a0, 252(sp)
+c.lw a0, 0(a1)
+c.sw a0, 0(a1)
+c.beqz a3, 128
+c.bnez a5, 128
+
+# RVB
+sh1add a0, a1, a2
+bclr a0, a1, a2
+bclri a0, a1, 1
+clz a0, a1
+sext.b a0, a1
+clmulr a0, a1, a2
+min a0, a1, a2
+orc.b a0, a1
+
+# CHECK-COUNT-31: warning: This instruction is not constant-time.

llvm/test/MC/RISCV/rv32-constant-time.s

+# RUN: llvm-mc %s -triple=riscv32 -mattr=+m,+c,+zk,+zks -riscv-verify-constant-time 2>&1 \
+# RUN:     | FileCheck %s
+
+# RVI
+lui a0, 1
+auipc a0, 1
+addi a0, a1, 1
+slti a0, a1, 1
+sltiu a0, a1, 1
+xori a0, a1, 1
+ori a0, a1, 1
+andi a0, a1, 1
+slli a0, a1, 1
+srli a0, a1, 1
+srai a0, a1, 1
+add a0, a1, a2
+sub a0, a1, a2
+sll a0, a1, a2
+slt a0, a1, a2
+sltu a0, a1, a2
+xor a0, a1, a2
+srl a0, a1, a2
+sra a0, a1, a2
+or a0, a1, a2
+and a0, a1, a2
+
+# RVM
+mul a0, a1, a2
+mulh a0, a1, a2
+mulhsu a0, a1, a2
+mulhu a0, a1, a2
+
+# RVC
+c.nop
+c.addi a0, 1
+c.lui a0, 1
+c.srli a0, 1
+c.srai a0, 1
+c.andi a0, 1
+c.sub a0, a1
+c.xor a0, a1
+c.or a0, a1
+c.and a0, a1
+c.slli a0, 1
+c.mv a0, a1
+c.add a0, a1
+
+# RVK
+aes32dsi a0, a1, a2, 1
+aes32dsmi a0, a1, a2, 1
+aes32esi a0, a1, a2, 1
+aes32esmi a0, a1, a2, 1
+
+sha256sig0 a0, a1
+sha256sig1 a0, a1
+sha256sum0 a0, a1
+sha256sum1 a0, a1
+
+sha512sig0h a0, a1, a2
+sha512sig0l a0, a1, a2
+sha512sig1h a0, a1, a2
+sha512sig1l a0, a1, a2
+sha512sum0r a0, a1, a2
+sha512sum1r a0, a1, a2
+
+sm3p0 a0, a1
+sm3p1 a0, a1
+sm4ed a0, a1, a2, 1
+sm4ks a0, a1, a2, 1
+
+# RVB
+clmul a0, a1, a2
+clmulh a0, a1, a2
+xperm4 a0, a1, a2
+xperm8 a0, a1, a2
+ror a0, a1, a2
+rol a0, a1, a2
+rori a0, a1, 1
+andn a0, a1, a2
+orn a0, a1, a2
+xnor a0, a1, a2
+pack a0, a1, a2
+packh a0, a1, a2
+brev8 a0, a1
+rev8 a0, a1
+zip a0, a1
+unzip a0, a1
+
+# CHECK-NOT: warning: This instruction is not constant-time.

llvm/test/MC/RISCV/rv64-constant-time-invalid.s

+# RUN: llvm-mc %s -triple=riscv64 -mattr=+m,+f,+d,+c,+zba,+zbb,+zbc,+zbs -riscv-verify-constant-time 2>&1 \
+# RUN:     | FileCheck %s
+
+# Not all instructions are listed here.
+
+# RVI
+ld a0, 0(a1)
+sd s0, 0(a1)
+jalr a0, 0(a1)
+jalr a0, 0(a1)
+
+# RVM
+div a0, a1, a2
+rem a0, a1, a2
+
+# RVF/RVD
+fld fa0, 0(a0)
+fsd fa0, 0(a0)
+fadd.s fa0, fa1, fa2
+fadd.d fa0, fa1, fa2
+fmul.s fa0, fa1, fa2
+fmul.d fa0, fa1, fa2
+fdiv.s fa0, fa1, fa2
+fdiv.d fa0, fa1, fa2
+
+# RVC
+c.j 0
+c.jr ra
+c.jalr a0
+c.lwsp a0, 0(sp)
+c.swsp a0, 252(sp)
+c.lw a0, 0(a1)
+c.sw a0, 0(a1)
+c.beqz a3, 128
+c.bnez a5, 128
+
+# RVB
+sh1add a0, a1, a2
+sh1add.uw a0, a1, a2
+slli.uw a0, a1, 1
+bclr a0, a1, a2
+bclri a0, a1, 1
+clz a0, a1
+sext.b a0, a1
+clmulr a0, a1, a2
+min a0, a1, a2
+orc.b a0, a1
+
+# CHECK-COUNT-33: warning: This instruction is not constant-time.

llvm/test/MC/RISCV/rv64-constant-time.s

+# RUN: llvm-mc %s -triple=riscv64 -mattr=+m,+c,+zk,+zks -riscv-verify-constant-time 2>&1 \
+# RUN:     | FileCheck %s
+
+# RVI
+lui a0, 1
+auipc a0, 1
+addi a0, a1, 1
+slti a0, a1, 1
+sltiu a0, a1, 1
+xori a0, a1, 1
+ori a0, a1, 1
+andi a0, a1, 1
+slli a0, a1, 1
+srli a0, a1, 1
+srai a0, a1, 1
+add a0, a1, a2
+sub a0, a1, a2
+sll a0, a1, a2
+slt a0, a1, a2
+sltu a0, a1, a2
+xor a0, a1, a2
+srl a0, a1, a2
+sra a0, a1, a2
+or a0, a1, a2
+and a0, a1, a2
+
+addiw a0, a1, 1
+slliw a0, a1, 1
+srliw a0, a1, 1
+sraiw a0, a1, 1
+addw a0, a1, a2
+subw a0, a1, a2
+sllw a0, a1, a2
+srlw a0, a1, a2
+sraw a0, a1, a2
+
+# RVM
+mul a0, a1, a2
+mulh a0, a1, a2
+mulhsu a0, a1, a2
+mulhu a0, a1, a2
+mulw a0, a1, a2
+
+# RVC
+c.nop
+c.addi a0, 1
+c.addiw a0, 1
+c.lui a0, 1
+c.srli a0, 1
+c.srai a0, 1
+c.andi a0, 1
+c.sub a0, a1
+c.xor a0, a1
+c.or a0, a1
+c.and a0, a1
+c.subw a0, a1
+c.addw a0, a1
+c.slli a0, 1
+c.mv a0, a1
+c.add a0, a1
+
+# RVK
+aes64ds a0, a1, a2
+aes64dsm a0, a1, a2
+aes64es a0, a1, a2
+aes64esm a0, a1, a2
+aes64im a0, a1
+aes64ks1i a0, a1, 1
+aes64ks2 a0, a1, a2
+
+sha256sig0 a0, a1
+sha256sig1 a0, a1
+sha256sum0 a0, a1
+sha256sum1 a0, a1
+
+sha512sig0 a0, a1
+sha512sig1 a0, a1
+sha512sum0 a0, a1
+sha512sum1 a0, a1
+
+sm3p0 a0, a1
+sm3p1 a0, a1
+sm4ed a0, a1, a2, 1
+sm4ks a0, a1, a2, 1
+
+# RVB
+clmul a0, a1, a2
+clmulh a0, a1, a2
+xperm4 a0, a1, a2
+xperm8 a0, a1, a2
+ror a0, a1, a2
+rol a0, a1, a2
+rori a0, a1, 1
+rorw a0, a1, a2
+rolw a0, a1, a2
+roriw a0, a1, 1
+andn a0, a1, a2
+orn a0, a1, a2
+xnor a0, a1, a2
+pack a0, a1, a2
+packh a0, a1, a2
+packw a0, a1, a2
+brev8 a0, a1
+rev8 a0, a1
+
+# CHECK-NOT: warning: This instruction is not constant-time.