sha2: remove RISC-V hack for unaligned loads (#879)

It simplifies the code of Zknh backends, but results in an atrocious
codegen without `-mno-strict-align`.

Arguably, it's both an LLVM and RISC-V problem (see
llvm/llvm-project#110454 and
riscv/riscv-profiles#187), so it's not our
responsibility to work around this stupidity. I will mention the issue
in the crate docs.

Hopefully, in future we will get either [this optimization][1], the
Zicclsm handling in LLVM will change, or the proposed Oilsm extension
will become the default instead of the currently useless Zicclsm.

[1]: llvm/llvm-project#150263

Author: newpavlov

sha2/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.11.1 (UNRELEASED)
+### Changed
+- Removed workaround for unaligned loads in `riscv-zknh` backend ([#879])
+- `riscv-zknh` no longer requires `zbkb` (or `zbb`) target feature ([#879])
+
+[#879]: https://github.com/RustCrypto/hashes/pull/879
+
 ## 0.11.0 (2026-03-25)
 ### Changed
 - Edition changed to 2024 and MSRV bumped to 1.85 ([#652])

sha2/README.md

@@ -63,8 +63,7 @@ SHA-256 and SHA-512 backends:
 - `soft`: portable software implementation
 - `loongarch64-asm`: `asm!`-based implementation for LoongArch64 targets
 - `riscv-zknh`: uses the RISC-V `Zknh` scalar crypto extension. Experimental,
-  requires Nightly compiler and to enable `Zknh` and `Zbkb` (or `Zbb`)
-  target features at compile time.
+  see the [section below](#about-riscv-zknh) for more information.
 - `wasm32-simd128`: uses the WASM `simd128` extension.
 
 SHA-256 only backends:
@@ -91,10 +90,10 @@ You can force backend selection using the following configuration flags:
 - `sha2_512_backend`: select SHA-512 backend. Supported values: `aarch64-sha3`, `soft`,
   `riscv-zknh`, `x86-avx2`.
 
-They can be enabled using either the `RUSTFLAGS` environment variable
+They can be enabled using either a `RUSTFLAGS` environment variable
 (e.g. `RUSTFLAGS='--cfg sha2_backend="soft"'`), or by modifying your `.cargo/config.toml` file.
 
-Note that `sha2_backend` has higher priority than `sha2_256_backend` and `sha2_512_backend`.
+Note that `sha2_backend` has a higher priority than `sha2_256_backend` and `sha2_512_backend`.
 In other words, using `--cfg sha2_backend="soft" --cfg sha2_256_backend="x86_sha"` will result
 in selection of the software backend for SHA-256.
 
@@ -103,6 +102,16 @@ performance at the cost of a bigger resulting binary. You can disable unrolling
 by using `sha2_backend_soft = "compact"` and `sha2_backend_riscv_zknh = "compact"` configuration
 flags respectively.
 
+### About `riscv-zknh`
+
+This is an experimental RISC-V-only backend which requires a Nightly compiler and
+to enable the `Zknh` target feature at compile time. For a more efficient code generation,
+it's recommended to enable the `Zbkb` (or `Zbb`) and `unaligned-scalar-mem` target features
+(see [this LLVM issue][Zicclsm] for more information). For example, you can do it by using
+`RUSTFLAGS="-C target-feature=+zknh,+zbkb,+unaligned-scalar-mem"`.
+
+[Zicclsm]: https://github.com/llvm/llvm-project/issues/110454
+
 ## License
 
 The crate is licensed under either of:

sha2/src/sha256.rs

@@ -5,11 +5,8 @@ cfg_if::cfg_if! {
     } else if #[cfg(any(sha2_backend = "riscv-zknh", sha2_256_backend = "riscv-zknh"))] {
         mod riscv_zknh;
 
-        #[cfg(not(all(
-            target_feature = "zknh",
-            any(target_feature = "zbb", target_feature = "zbkb")
-        )))]
-        compile_error!("riscv-zknh backend requires zknh and zbkb (or zbb) target features");
+        #[cfg(not(target_feature = "zknh"))]
+        compile_error!("riscv-zknh backend requires `zknh` target feature");
 
         fn compress(state: &mut [u32; 8], blocks: &[[u8; 64]]) {
             // SAFETY: we checked above that the required target features are enabled
@@ -22,7 +19,7 @@ cfg_if::cfg_if! {
             target_feature = "sha",
             target_feature = "sse4.1",
         )))]
-        compile_error!("x86-sha backend requires sha and sse4.1 target features");
+        compile_error!("x86-sha backend requires `sha` and `sse4.1` target features");
 
         fn compress(state: &mut [u32; 8], blocks: &[[u8; 64]]) {
             // SAFETY: we checked above that the required target features are enabled
@@ -32,7 +29,7 @@ cfg_if::cfg_if! {
         mod aarch64_sha2;
 
         #[cfg(not(target_feature = "sha2"))]
-        compile_error!("aarch64-sha2 backend requires sha2 target feature");
+        compile_error!("aarch64-sha2 backend requires `sha2` target feature");
 
         fn compress(state: &mut [u64; 8], blocks: &[[u8; 128]]) {
             // SAFETY: we checked above that the required target features are enabled

sha2/src/sha256/riscv_zknh.rs

@@ -1,8 +1,6 @@
 #[cfg(not(any(target_arch = "riscv32", target_arch = "riscv64")))]
 compile_error!("riscv-zknh backend can be used only on riscv32 and riscv64 target arches");
 
-mod utils;
-
 #[cfg(target_arch = "riscv32")]
 use core::arch::riscv32::{sha256sig0, sha256sig1, sha256sum0, sha256sum1};
 #[cfg(target_arch = "riscv64")]
@@ -11,9 +9,20 @@ use core::arch::riscv64::{sha256sig0, sha256sig1, sha256sum0, sha256sum1};
 cfg_if::cfg_if! {
     if #[cfg(sha2_backend_riscv_zknh = "compact")] {
         mod compact;
-        pub(super) use compact::compress;
+        use compact::compress_block;
     } else {
         mod unroll;
-        pub(super) use unroll::compress;
+        use unroll::compress_block;
+    }
+}
+
+#[target_feature(enable = "zknh")]
+pub(super) fn compress(state: &mut [u32; 8], blocks: &[[u8; 64]]) {
+    for block in blocks {
+        let block: [u32; 16] = core::array::from_fn(|i| {
+            let chunk = block[4 * i..][..4].try_into().unwrap();
+            u32::from_be_bytes(chunk)
+        });
+        compress_block(state, block);
     }
 }

sha2/src/sha256/riscv_zknh/compact.rs

@@ -2,14 +2,7 @@ use super::{sha256sig0, sha256sig1, sha256sum0, sha256sum1};
 use crate::consts::K32;
 
 #[target_feature(enable = "zknh")]
-pub(in super::super) fn compress(state: &mut [u32; 8], blocks: &[[u8; 64]]) {
-    for block in blocks.iter().map(super::utils::load_block) {
-        compress_block(state, block);
-    }
-}
-
-#[target_feature(enable = "zknh")]
-fn compress_block(state: &mut [u32; 8], mut block: [u32; 16]) {
+pub(super) fn compress_block(state: &mut [u32; 8], mut block: [u32; 16]) {
     let mut s = *state;
 
     for r in 0..64 {

sha2/src/sha256/riscv_zknh/unroll.rs

@@ -2,14 +2,7 @@ use super::{sha256sig0, sha256sig1, sha256sum0, sha256sum1};
 use crate::consts::K32;
 
 #[target_feature(enable = "zknh")]
-pub(in super::super) fn compress(state: &mut [u32; 8], blocks: &[[u8; 64]]) {
-    for block in blocks.iter().map(super::utils::load_block) {
-        compress_block(state, block);
-    }
-}
-
-#[target_feature(enable = "zknh")]
-fn compress_block(state: &mut [u32; 8], mut block: [u32; 16]) {
+pub(super) fn compress_block(state: &mut [u32; 8], mut block: [u32; 16]) {
     let s = &mut state.clone();
     let b = &mut block;
 
@@ -82,7 +75,7 @@ fn round<const R: usize>(state: &mut [u32; 8], block: &[u32; 16], k: &[u32]) {
     state[h] = state[h]
         .wrapping_add(sha256sum1(state[e]))
         .wrapping_add(ch(state[e], state[f], state[g]))
-        .wrapping_add(super::utils::opaque_load::<R>(k))
+        .wrapping_add(opaque_load::<R>(k))
         .wrapping_add(block[R]);
     state[d] = state[d].wrapping_add(state[h]);
     state[h] = state[h]
@@ -99,3 +92,33 @@ fn ch(x: u32, y: u32, z: u32) -> u32 {
 fn maj(x: u32, y: u32, z: u32) -> u32 {
     (x & y) ^ (x & z) ^ (y & z)
 }
+
+/// This function returns `k[R]`, but prevents the compiler from inlining the indexed value
+fn opaque_load<const R: usize>(k: &[u32]) -> u32 {
+    assert!(R < k.len());
+    let dst;
+
+    #[cfg(target_arch = "riscv64")]
+    unsafe {
+        core::arch::asm!(
+            "lwu {dst}, 4*{R}({k})",
+            R = const R,
+            k = in(reg) k.as_ptr(),
+            dst = out(reg) dst,
+            options(pure, readonly, nostack, preserves_flags),
+        );
+    }
+
+    #[cfg(target_arch = "riscv32")]
+    unsafe {
+        core::arch::asm!(
+            "lw {dst}, 4*{R}({k})",
+            R = const R,
+            k = in(reg) k.as_ptr(),
+            dst = out(reg) dst,
+            options(pure, readonly, nostack, preserves_flags),
+        );
+    }
+
+    dst
+}

sha2/src/sha256/riscv_zknh/utils.rs

@@ -5,11 +5,8 @@ cfg_if::cfg_if! {
     } else if #[cfg(any(sha2_backend = "riscv-zknh", sha2_256_backend = "riscv-zknh"))] {
         mod riscv_zknh;
 
-        #[cfg(not(all(
-            target_feature = "zknh",
-            any(target_feature = "zbb", target_feature = "zbkb")
-        )))]
-        compile_error!("riscv-zknh backend requires zknh and zbkb (or zbb) target features");
+        #[cfg(not(target_feature = "zknh"))]
+        compile_error!("riscv-zknh backend requires `zknh` target features");
 
         fn compress(state: &mut [u64; 8], blocks: &[[u8; 128]]) {
             // SAFETY: we checked above that the required target features are enabled
@@ -19,7 +16,7 @@ cfg_if::cfg_if! {
         mod x86_avx2;
 
         #[cfg(not(target_feature = "avx2"))]
-        compile_error!("x86-avx2 backend requires avx2 target feature");
+        compile_error!("x86-avx2 backend requires `avx2` target feature");
 
         fn compress(state: &mut [u32; 8], blocks: &[[u8; 64]]) {
             // SAFETY: we checked above that the required target features are enabled
@@ -29,7 +26,7 @@ cfg_if::cfg_if! {
         mod aarch64_sha3;
 
         #[cfg(not(target_feature = "sha3"))]
-        compile_error!("aarch64-sha3 backend requires sha3 target feature");
+        compile_error!("aarch64-sha3 backend requires `sha3` target feature");
 
         fn compress(state: &mut [u64; 8], blocks: &[[u8; 128]]) {
             // SAFETY: we checked above that the required target features are enabled