* [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I
@ 2023-08-31 15:41 Ard Biesheuvel
2023-08-31 16:22 ` Richard Henderson
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Ard Biesheuvel @ 2023-08-31 15:41 UTC (permalink / raw)
To: qemu-devel
Cc: Ard Biesheuvel, Richard Henderson, Philippe Mathieu-Daudé,
Palmer Dabbelt, Alistair Francis
Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
implement the first half of the key schedule derivation. This does not
actually involve shifting rows, so clone the same value into all four
columns of the AES vector to counter that operation.
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
v2: assign round constant to elements 0 and 1 only
target/riscv/crypto_helper.c | 17 +++++------------
1 file changed, 5 insertions(+), 12 deletions(-)
diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
index 4d65945429c6dcc4..bb084e00efe52d1b 100644
--- a/target/riscv/crypto_helper.c
+++ b/target/riscv/crypto_helper.c
@@ -148,24 +148,17 @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
uint8_t enc_rnum = rnum;
uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
- uint8_t rcon_ = 0;
- target_ulong result;
+ AESState t, rc = {};
if (enc_rnum != 0xA) {
temp = ror32(temp, 8); /* Rotate right by 8 */
- rcon_ = round_consts[enc_rnum];
+ rc.w[0] = rc.w[1] = round_consts[enc_rnum];
}
- temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
- ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
- ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
- ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
+ t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
+ aesenc_SB_SR_AK(&t, &t, &rc, false);
- temp ^= rcon_;
-
- result = ((uint64_t)temp << 32) | temp;
-
- return result;
+ return t.d[0];
}
target_ulong HELPER(aes64im)(target_ulong rs1)
--
2.39.2
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I
2023-08-31 15:41 [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I Ard Biesheuvel
@ 2023-08-31 16:22 ` Richard Henderson
2023-08-31 20:02 ` Philippe Mathieu-Daudé
2023-09-01 2:30 ` Alistair Francis
2 siblings, 0 replies; 4+ messages in thread
From: Richard Henderson @ 2023-08-31 16:22 UTC (permalink / raw)
To: Ard Biesheuvel, qemu-devel
Cc: Philippe Mathieu-Daudé, Palmer Dabbelt, Alistair Francis
On 8/31/23 08:41, Ard Biesheuvel wrote:
> Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
> implement the first half of the key schedule derivation. This does not
> actually involve shifting rows, so clone the same value into all four
> columns of the AES vector to counter that operation.
>
> Cc: Richard Henderson<richard.henderson@linaro.org>
> Cc: Philippe Mathieu-Daudé<philmd@linaro.org>
> Cc: Palmer Dabbelt<palmer@dabbelt.com>
> Cc: Alistair Francis<alistair.francis@wdc.com>
> Signed-off-by: Ard Biesheuvel<ardb@kernel.org>
> ---
> v2: assign round constant to elements 0 and 1 only
>
> target/riscv/crypto_helper.c | 17 +++++------------
> 1 file changed, 5 insertions(+), 12 deletions(-)
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
r~
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I
2023-08-31 15:41 [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I Ard Biesheuvel
2023-08-31 16:22 ` Richard Henderson
@ 2023-08-31 20:02 ` Philippe Mathieu-Daudé
2023-09-01 2:30 ` Alistair Francis
2 siblings, 0 replies; 4+ messages in thread
From: Philippe Mathieu-Daudé @ 2023-08-31 20:02 UTC (permalink / raw)
To: Ard Biesheuvel, qemu-devel
Cc: Richard Henderson, Palmer Dabbelt, Alistair Francis
On 31/8/23 17:41, Ard Biesheuvel wrote:
> Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
> implement the first half of the key schedule derivation. This does not
> actually involve shifting rows, so clone the same value into all four
> columns of the AES vector to counter that operation.
>
> Cc: Richard Henderson <richard.henderson@linaro.org>
> Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
> Cc: Palmer Dabbelt <palmer@dabbelt.com>
> Cc: Alistair Francis <alistair.francis@wdc.com>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
> v2: assign round constant to elements 0 and 1 only
>
> target/riscv/crypto_helper.c | 17 +++++------------
> 1 file changed, 5 insertions(+), 12 deletions(-)
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I
2023-08-31 15:41 [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I Ard Biesheuvel
2023-08-31 16:22 ` Richard Henderson
2023-08-31 20:02 ` Philippe Mathieu-Daudé
@ 2023-09-01 2:30 ` Alistair Francis
2 siblings, 0 replies; 4+ messages in thread
From: Alistair Francis @ 2023-09-01 2:30 UTC (permalink / raw)
To: Ard Biesheuvel
Cc: qemu-devel, Richard Henderson, Philippe Mathieu-Daudé,
Palmer Dabbelt, Alistair Francis
On Fri, Sep 1, 2023 at 3:12 AM Ard Biesheuvel <ardb@kernel.org> wrote:
>
> Use the accelerated SubBytes/ShiftRows/AddRoundKey AES helper to
> implement the first half of the key schedule derivation. This does not
> actually involve shifting rows, so clone the same value into all four
> columns of the AES vector to counter that operation.
>
> Cc: Richard Henderson <richard.henderson@linaro.org>
> Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
> Cc: Palmer Dabbelt <palmer@dabbelt.com>
> Cc: Alistair Francis <alistair.francis@wdc.com>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Thanks!
Applied to riscv-to-apply.next
Alistair
> ---
> v2: assign round constant to elements 0 and 1 only
>
> target/riscv/crypto_helper.c | 17 +++++------------
> 1 file changed, 5 insertions(+), 12 deletions(-)
>
> diff --git a/target/riscv/crypto_helper.c b/target/riscv/crypto_helper.c
> index 4d65945429c6dcc4..bb084e00efe52d1b 100644
> --- a/target/riscv/crypto_helper.c
> +++ b/target/riscv/crypto_helper.c
> @@ -148,24 +148,17 @@ target_ulong HELPER(aes64ks1i)(target_ulong rs1, target_ulong rnum)
>
> uint8_t enc_rnum = rnum;
> uint32_t temp = (RS1 >> 32) & 0xFFFFFFFF;
> - uint8_t rcon_ = 0;
> - target_ulong result;
> + AESState t, rc = {};
>
> if (enc_rnum != 0xA) {
> temp = ror32(temp, 8); /* Rotate right by 8 */
> - rcon_ = round_consts[enc_rnum];
> + rc.w[0] = rc.w[1] = round_consts[enc_rnum];
> }
>
> - temp = ((uint32_t)AES_sbox[(temp >> 24) & 0xFF] << 24) |
> - ((uint32_t)AES_sbox[(temp >> 16) & 0xFF] << 16) |
> - ((uint32_t)AES_sbox[(temp >> 8) & 0xFF] << 8) |
> - ((uint32_t)AES_sbox[(temp >> 0) & 0xFF] << 0);
> + t.w[0] = t.w[1] = t.w[2] = t.w[3] = temp;
> + aesenc_SB_SR_AK(&t, &t, &rc, false);
>
> - temp ^= rcon_;
> -
> - result = ((uint64_t)temp << 32) | temp;
> -
> - return result;
> + return t.d[0];
> }
>
> target_ulong HELPER(aes64im)(target_ulong rs1)
> --
> 2.39.2
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2023-09-01 2:31 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-31 15:41 [PATCH v2] target/riscv: Use accelerated helper for AES64KS1I Ard Biesheuvel
2023-08-31 16:22 ` Richard Henderson
2023-08-31 20:02 ` Philippe Mathieu-Daudé
2023-09-01 2:30 ` Alistair Francis
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).