Browse Source
These instructions are RV32 only. Previously, they zero-extended their 32-bit result to 64-bits, to match the Spike implementation detail that the X registers are always 64-bits long. This exposed a data dependant problem when the instruction results fed into the add and sltu instructions. The lack of sign extension on the sha512*, combined with the presence of sign extension on the add, meant sltu would (as it is currently implemented) produce the wrong result. There were two potential fixes: 1) Sign extend from 32-bits to XLEN the result of the SHA512 instructions. 2) Change the SLTU implementation to truncate RS1/RS2 to be XLEN bits before it does the comparison. This patch implements option 1, because I didn't want to mess with a base ISA instruction. However, this leaves the implementation detail open to cause problems for people in the future. Fixing this is outside the scope of this commit. On branch scalar-crypto-fix Changes to be committed: modified: riscv/insns/sha512sig0h.h modified: riscv/insns/sha512sig0l.h modified: riscv/insns/sha512sig1h.h modified: riscv/insns/sha512sig1l.h modified: riscv/insns/sha512sum0r.h modified: riscv/insns/sha512sum1r.hpull/649/head
6 changed files with 24 additions and 24 deletions
Loading…
Reference in new issue