Access control of CSR seed about riscv-smmtt HOT 6 CLOSED

A RDSM can delegate access to seed CSR to a supervisor domain. The seed CSR is a per hart CSR. For the duration of the SD execution, the SD can consume entropy from the seed CSR. There is no specific reason to disallow the delegation unless the entropy source is shared by multiple harts. Consuming entropy using seed CSR from one hart should not affect the entropy availability on another hart unless they are shared. On an implementation where such sharing is present the RDSM may mediate and emulate access to seed CSR - either through a SBI or by emulating the CSR access and in such cases implement the appropriate rate limits. Please elaborate more on the DOS attack concern if it is beyond the shared entropy source concern.

from riscv-smmtt.

Please elaborate more on the DOS attack concern if it is beyond the shared entropy source concern.

Let's say

1. SD(a) is going to execute csrrw instruction to read seed.
2. Suddenly SD(b)'s interrupt asserted, causing CPU traps to RDSM.
3. RDSM immediately performs context switch for this hart, saving SD(a)'s context and restoring SD(b).
4. However, SD(b) reads seed in its interrupt handler. SD(b) may consume much of entropy.
5. SD(b) finishes its handler. RDSM performs context switch back to SD(a). SD(a) executes previous csrrw, but it might not get sufficient entropy.

Above case 1 to case 5 can be an infinite loop.

from riscv-smmtt.

Got it. When such a bad entropy source is implemented, the RDSM as a policy should not delegate seed to SDs.

from riscv-smmtt.

So it depends on the quality of entropy source ?

from riscv-smmtt.

Depends on quality of entropy source and the SW policies. The ISA provides controls to support either policies than an RDSM may want to implement.

from riscv-smmtt.

Depends on quality of entropy source and the SW policies. The ISA provides controls to support either policies than an RDSM may want to implement.

It makes sense.
Seems we don't need any ISA changes for access control of seed.
Thanks!

from riscv-smmtt.