菜单
Implements Keystone SBI extension calls in keystone-zig. Use when adding SBI functions, ecall wrappers, error codes, or clarigggz kernel enclave API.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/nathfavour/keystone-zig --skill keystone-zig-sbi命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Guides clean-room Keystone TEE implementation in native Zig for clarigggz. Use when working on keystone-zig architecture, clarigggz integration, threat model, boot chain, or deciding what to port from upstream Keystone.
Integrates keystone-zig TEE with clarigggz OS smart-glasses microkernel. Use when connecting clarigggz kernel to SM, spawning secure enclaves for camera/crypto/wallet, or planning adapter isolation.
Configures RISC-V Physical Memory Protection in keystone-zig using comptime validation. Use when adding memory regions, PMP entries, NAPOT encoding, or debugging isolation failures.
基于 SOC 职业分类
正在显示 SKILL.md
| name | keystone-zig-sbi |
| description | Implements Keystone SBI extension calls in keystone-zig. Use when adding SBI functions, ecall wrappers, error codes, or clarigggz kernel enclave API. |
0x08424b45 (lib/sbi.zig)a7, fid in a6, args in a0–a5a0, value in a1const ret = keystone.sbi.ecall(
keystone.sbi.extension_id,
@intFromEnum(keystone.sbi.Fid.create_enclave),
@intFromPtr(&args), 0, 0, 0, 0, 0,
);
if (ret.error_code != 0) { /* handle */ }
const eid = ret.value;
const args = keystone.sbi.CreateArgs{
.epm_paddr = 0x9000_0000,
.epm_size = 0x0040_0000,
.utm_paddr = 0x9400_0000,
.utm_size = 0x0010_0000,
};
Validated by enclave.validateCreateArgs — page-aligned sizes, granule-aligned bases.
Use keystone.sbi.Error enum (range 100000–100100). Convert with .toSbiRet().
| Range | Caller |
|---|---|
| 2000–2999 | Host (kernel) |
| 3000–3999 | Enclave |
| 4000–4999 | Experimental plugins |
lib/sbi.zig Fid enumsm/main.zig handleSbiEcalldocs/architecture.mdExpose thin kernel API:
pub fn spawnSecureEnclave(epm: PhysRange, utm: PhysRange) !EnclaveId {
// pack CreateArgs, ecall, return eid
}
Keep SBI details inside keystone module — adapters never call SM directly.
Upstream spec (read-only): ../keystone/sm/spec/v1.0.md