From cad26538e8579bb7f4bc6374e4b4155151bc2598 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Thu, 1 Jun 2023 23:22:20 -0700 Subject: target/riscv: Use aesenc_SB_SR_AK MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This implements the AES64ES instruction. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Richard Henderson --- target/riscv/crypto_helper.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'target/riscv/crypto_helper.c') diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c index 2ef30281b1..b072fed3e2 100644 --- a/target/riscv/crypto_helper.c +++ b/target/riscv/crypto_helper.c @@ -22,6 +22,7 @@ #include "exec/exec-all.h" #include "exec/helper-proto.h" #include "crypto/aes.h" +#include "crypto/aes-round.h" #include "crypto/sm4.h" #define AES_XTIME(a) \ @@ -136,6 +137,8 @@ target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2, AES_INVMIXBYTE(COL, 1, 2, 3, 0) << 8 | \ AES_INVMIXBYTE(COL, 0, 1, 2, 3) << 0) +static const AESState aes_zero = { }; + static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2, bool enc, bool mix) { @@ -200,7 +203,12 @@ target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2) target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2) { - return aes64_operation(rs1, rs2, true, false); + AESState t; + + t.d[HOST_BIG_ENDIAN] = rs1; + t.d[!HOST_BIG_ENDIAN] = rs2; + aesenc_SB_SR_AK(&t, &t, &aes_zero, false); + return t.d[HOST_BIG_ENDIAN]; } target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2) -- cgit 1.4.1 From 7a70583a4109a177468beab378177b2285344b7a Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 2 Jun 2023 01:33:15 -0700 Subject: target/riscv: Use aesdec_ISB_ISR_AK MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This implements the AES64DS instruction. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Richard Henderson --- target/riscv/crypto_helper.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'target/riscv/crypto_helper.c') diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c index b072fed3e2..e61f7fe1e5 100644 --- a/target/riscv/crypto_helper.c +++ b/target/riscv/crypto_helper.c @@ -213,7 +213,12 @@ target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2) target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2) { - return aes64_operation(rs1, rs2, false, false); + AESState t; + + t.d[HOST_BIG_ENDIAN] = rs1; + t.d[!HOST_BIG_ENDIAN] = rs2; + aesdec_ISB_ISR_AK(&t, &t, &aes_zero, false); + return t.d[HOST_BIG_ENDIAN]; } target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2) -- cgit 1.4.1 From 607a5f9d624fdd63d0b7f0e640f7a8d21213b8df Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 2 Jun 2023 02:29:40 -0700 Subject: target/riscv: Use aesdec_IMC MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This implements the AES64IM instruction. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Richard Henderson --- target/riscv/crypto_helper.c | 15 +++++---------- 1 file changed, 5 insertions(+), 10 deletions(-) (limited to 'target/riscv/crypto_helper.c') diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c index e61f7fe1e5..505166ce5a 100644 --- a/target/riscv/crypto_helper.c +++ b/target/riscv/crypto_helper.c @@ -272,17 +272,12 @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum) target_ulong HELPER(aes64im)(target_ulong rs1) { - uint64_t RS1 = rs1; - uint32_t col_0 = RS1 & 0xFFFFFFFF; - uint32_t col_1 = RS1 >> 32; - target_ulong result; - - col_0 = AES_INVMIXCOLUMN(col_0); - col_1 = AES_INVMIXCOLUMN(col_1); - - result = ((uint64_t)col_1 << 32) | col_0; + AESState t; - return result; + t.d[HOST_BIG_ENDIAN] = rs1; + t.d[!HOST_BIG_ENDIAN] = 0; + aesdec_IMC(&t, &t, false); + return t.d[HOST_BIG_ENDIAN]; } target_ulong HELPER(sm4ed)(target_ulong rs1, target_ulong rs2, -- cgit 1.4.1 From 274f33765af36b5c7447adec18b61125f05b7b83 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 2 Jun 2023 14:14:04 -0700 Subject: target/riscv: Use aesenc_SB_SR_MC_AK MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This implements the AES64ESM instruction. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Richard Henderson --- target/riscv/crypto_helper.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) (limited to 'target/riscv/crypto_helper.c') diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c index 505166ce5a..c036fe8632 100644 --- a/target/riscv/crypto_helper.c +++ b/target/riscv/crypto_helper.c @@ -198,7 +198,12 @@ static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2, target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2) { - return aes64_operation(rs1, rs2, true, true); + AESState t; + + t.d[HOST_BIG_ENDIAN] = rs1; + t.d[!HOST_BIG_ENDIAN] = rs2; + aesenc_SB_SR_MC_AK(&t, &t, &aes_zero, false); + return t.d[HOST_BIG_ENDIAN]; } target_ulong HELPER(aes64es)(target_ulong rs1, target_ulong rs2) -- cgit 1.4.1 From 4ad6f9bfa0757934078c00994c6ade3fb944b124 Mon Sep 17 00:00:00 2001 From: Richard Henderson Date: Fri, 2 Jun 2023 15:31:24 -0700 Subject: target/riscv: Use aesdec_ISB_ISR_IMC_AK MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This implements the AES64DSM instruction. This was the last use of aes64_operation and its support macros, so remove them all. Reviewed-by: Philippe Mathieu-Daudé Signed-off-by: Richard Henderson --- target/riscv/crypto_helper.c | 101 +++++-------------------------------------- 1 file changed, 10 insertions(+), 91 deletions(-) (limited to 'target/riscv/crypto_helper.c') diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c index c036fe8632..99d85a6188 100644 --- a/target/riscv/crypto_helper.c +++ b/target/riscv/crypto_helper.c @@ -104,98 +104,8 @@ target_ulong HELPER(aes32dsi)(target_ulong rs1, target_ulong rs2, return aes32_operation(shamt, rs1, rs2, false, false); } -#define BY(X, I) ((X >> (8 * I)) & 0xFF) - -#define AES_SHIFROWS_LO(RS1, RS2) ( \ - (((RS1 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \ - (((RS2 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \ - (((RS2 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \ - (((RS1 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0)) - -#define AES_INVSHIFROWS_LO(RS1, RS2) ( \ - (((RS2 >> 24) & 0xFF) << 56) | (((RS2 >> 48) & 0xFF) << 48) | \ - (((RS1 >> 8) & 0xFF) << 40) | (((RS1 >> 32) & 0xFF) << 32) | \ - (((RS1 >> 56) & 0xFF) << 24) | (((RS2 >> 16) & 0xFF) << 16) | \ - (((RS2 >> 40) & 0xFF) << 8) | (((RS1 >> 0) & 0xFF) << 0)) - -#define AES_MIXBYTE(COL, B0, B1, B2, B3) ( \ - BY(COL, B3) ^ BY(COL, B2) ^ AES_GFMUL(BY(COL, B1), 3) ^ \ - AES_GFMUL(BY(COL, B0), 2)) - -#define AES_MIXCOLUMN(COL) ( \ - AES_MIXBYTE(COL, 3, 0, 1, 2) << 24 | \ - AES_MIXBYTE(COL, 2, 3, 0, 1) << 16 | \ - AES_MIXBYTE(COL, 1, 2, 3, 0) << 8 | AES_MIXBYTE(COL, 0, 1, 2, 3) << 0) - -#define AES_INVMIXBYTE(COL, B0, B1, B2, B3) ( \ - AES_GFMUL(BY(COL, B3), 0x9) ^ AES_GFMUL(BY(COL, B2), 0xd) ^ \ - AES_GFMUL(BY(COL, B1), 0xb) ^ AES_GFMUL(BY(COL, B0), 0xe)) - -#define AES_INVMIXCOLUMN(COL) ( \ - AES_INVMIXBYTE(COL, 3, 0, 1, 2) << 24 | \ - AES_INVMIXBYTE(COL, 2, 3, 0, 1) << 16 | \ - AES_INVMIXBYTE(COL, 1, 2, 3, 0) << 8 | \ - AES_INVMIXBYTE(COL, 0, 1, 2, 3) << 0) - static const AESState aes_zero = { }; -static inline target_ulong aes64_operation(target_ulong rs1, target_ulong rs2, - bool enc, bool mix) -{ - uint64_t RS1 = rs1; - uint64_t RS2 = rs2; - uint64_t result; - uint64_t temp; - uint32_t col_0; - uint32_t col_1; - - if (enc) { - temp = AES_SHIFROWS_LO(RS1, RS2); - temp = (((uint64_t)AES_sbox[(temp >> 0) & 0xFF] << 0) | - ((uint64_t)AES_sbox[(temp >> 8) & 0xFF] << 8) | - ((uint64_t)AES_sbox[(temp >> 16) & 0xFF] << 16) | - ((uint64_t)AES_sbox[(temp >> 24) & 0xFF] << 24) | - ((uint64_t)AES_sbox[(temp >> 32) & 0xFF] << 32) | - ((uint64_t)AES_sbox[(temp >> 40) & 0xFF] << 40) | - ((uint64_t)AES_sbox[(temp >> 48) & 0xFF] << 48) | - ((uint64_t)AES_sbox[(temp >> 56) & 0xFF] << 56)); - if (mix) { - col_0 = temp & 0xFFFFFFFF; - col_1 = temp >> 32; - - col_0 = AES_MIXCOLUMN(col_0); - col_1 = AES_MIXCOLUMN(col_1); - - result = ((uint64_t)col_1 << 32) | col_0; - } else { - result = temp; - } - } else { - temp = AES_INVSHIFROWS_LO(RS1, RS2); - temp = (((uint64_t)AES_isbox[(temp >> 0) & 0xFF] << 0) | - ((uint64_t)AES_isbox[(temp >> 8) & 0xFF] << 8) | - ((uint64_t)AES_isbox[(temp >> 16) & 0xFF] << 16) | - ((uint64_t)AES_isbox[(temp >> 24) & 0xFF] << 24) | - ((uint64_t)AES_isbox[(temp >> 32) & 0xFF] << 32) | - ((uint64_t)AES_isbox[(temp >> 40) & 0xFF] << 40) | - ((uint64_t)AES_isbox[(temp >> 48) & 0xFF] << 48) | - ((uint64_t)AES_isbox[(temp >> 56) & 0xFF] << 56)); - if (mix) { - col_0 = temp & 0xFFFFFFFF; - col_1 = temp >> 32; - - col_0 = AES_INVMIXCOLUMN(col_0); - col_1 = AES_INVMIXCOLUMN(col_1); - - result = ((uint64_t)col_1 << 32) | col_0; - } else { - result = temp; - } - } - - return result; -} - target_ulong HELPER(aes64esm)(target_ulong rs1, target_ulong rs2) { AESState t; @@ -228,7 +138,16 @@ target_ulong HELPER(aes64ds)(target_ulong rs1, target_ulong rs2) target_ulong HELPER(aes64dsm)(target_ulong rs1, target_ulong rs2) { - return aes64_operation(rs1, rs2, false, true); + AESState t, z = { }; + + /* + * This instruction does not include a round key, + * so supply a zero to our primitive. + */ + t.d[HOST_BIG_ENDIAN] = rs1; + t.d[!HOST_BIG_ENDIAN] = rs2; + aesdec_ISB_ISR_IMC_AK(&t, &t, &z, false); + return t.d[HOST_BIG_ENDIAN]; } target_ulong HELPER(aes64ks2)(target_ulong rs1, target_ulong rs2) -- cgit 1.4.1