From 3ff08e1dde56747011a702a9a5aae06cfa8ae5fc Mon Sep 17 00:00:00 2001 From: Andy Polyakov Date: Thu, 23 Oct 2014 16:08:44 +0200 Subject: [PATCH 1/1] ecp_nistz256 update. Facilitate switch to custom scatter-gather routines. This modification does not change algorithms, only makes it possible to implement alternative. This is achieved by a) moving precompute table to assembly (perlasm parses ecp_nistz256_table.c and is free to rearrange data to match gathering algorithm); b) adhering to explicit scatter subroutine (which for now is simply a memcpy). First implementations that will use this option are 32-bit assembly implementations, ARMv4 and x86, where equivalent of current read-whole-table-select-single-value algorithm is too time-consuming. [On side note, switching to scatter-gather on x86_64 would allow to improve server-side ECDSA performance by ~5%]. Reviewed-by: Bodo Moeller --- crypto/crypto.h | 1 + crypto/ec/asm/ecp_nistz256-avx2.pl | 18 ++-- crypto/ec/asm/ecp_nistz256-x86_64.pl | 143 ++++++++++++++++++------- crypto/ec/ecp_nistz256.c | 151 ++++++++++++++++----------- 4 files changed, 208 insertions(+), 105 deletions(-) diff --git a/crypto/crypto.h b/crypto/crypto.h index 3eb1c55329..256220ba01 100644 --- a/crypto/crypto.h +++ b/crypto/crypto.h @@ -395,6 +395,7 @@ int CRYPTO_is_mem_check_on(void); #define OPENSSL_malloc_locked(num) \ CRYPTO_malloc_locked((int)num,__FILE__,__LINE__) #define OPENSSL_free_locked(addr) CRYPTO_free_locked(addr) +#define OPENSSL_MALLOC_MAX_NELEMS(type) (((1U<<(sizeof(int)*8-1))-1)/sizeof(type)) const char *SSLeay_version(int type); diff --git a/crypto/ec/asm/ecp_nistz256-avx2.pl b/crypto/ec/asm/ecp_nistz256-avx2.pl index 4c220aa645..9dc5cc6aa3 100755 --- a/crypto/ec/asm/ecp_nistz256-avx2.pl +++ b/crypto/ec/asm/ecp_nistz256-avx2.pl @@ -1909,7 +1909,7 @@ ___ } { ################################################################################ -# void ecp_nistz256_avx2_multi_select_w7(void* RESULT, void *in, +# void ecp_nistz256_avx2_multi_gather_w7(void* RESULT, void *in, # int index0, int index1, int index2, int index3); ################################################################################ @@ -1919,10 +1919,10 @@ my ($R0a,$R0b,$R1a,$R1b,$R2a,$R2b,$R3a,$R3b)=map("%ymm$_",(4..11)); my ($M0,$T0,$T1,$TMP0)=map("%ymm$_",(12..15)); $code.=<<___; -.globl ecp_nistz256_avx2_multi_select_w7 -.type ecp_nistz256_avx2_multi_select_w7,\@function,6 +.globl ecp_nistz256_avx2_multi_gather_w7 +.type ecp_nistz256_avx2_multi_gather_w7,\@function,6 .align 32 -ecp_nistz256_avx2_multi_select_w7: +ecp_nistz256_avx2_multi_gather_w7: vzeroupper ___ $code.=<<___ if ($win64); @@ -2036,7 +2036,7 @@ $code.=<<___ if ($win64); ___ $code.=<<___; ret -.size ecp_nistz256_avx2_multi_select_w7,.-ecp_nistz256_avx2_multi_select_w7 +.size ecp_nistz256_avx2_multi_gather_w7,.-ecp_nistz256_avx2_multi_gather_w7 .extern OPENSSL_ia32cap_P .globl ecp_nistz_avx2_eligible @@ -2061,8 +2061,8 @@ $code.=<<___; .globl ecp_nistz256_avx2_to_mont .globl ecp_nistz256_avx2_from_mont .globl ecp_nistz256_avx2_set1 -.globl ecp_nistz256_avx2_multi_select_w7 -.type ecp_nistz256_avx2_multi_select_w7,\@abi-omnipotent +.globl ecp_nistz256_avx2_multi_gather_w7 +.type ecp_nistz256_avx2_multi_gather_w7,\@abi-omnipotent ecp_nistz256_avx2_transpose_convert: ecp_nistz256_avx2_convert_transpose_back: ecp_nistz256_avx2_point_add_affine_x4: @@ -2070,10 +2070,10 @@ ecp_nistz256_avx2_point_add_affines_x4: ecp_nistz256_avx2_to_mont: ecp_nistz256_avx2_from_mont: ecp_nistz256_avx2_set1: -ecp_nistz256_avx2_multi_select_w7: +ecp_nistz256_avx2_multi_gather_w7: .byte 0x0f,0x0b # ud2 ret -.size ecp_nistz256_avx2_multi_select_w7,.-ecp_nistz256_avx2_multi_select_w7 +.size ecp_nistz256_avx2_multi_gather_w7,.-ecp_nistz256_avx2_multi_gather_w7 .globl ecp_nistz_avx2_eligible .type ecp_nistz_avx2_eligible,\@abi-omnipotent diff --git a/crypto/ec/asm/ecp_nistz256-x86_64.pl b/crypto/ec/asm/ecp_nistz256-x86_64.pl index c4b6d0f741..946b734922 100755 --- a/crypto/ec/asm/ecp_nistz256-x86_64.pl +++ b/crypto/ec/asm/ecp_nistz256-x86_64.pl @@ -1465,20 +1465,44 @@ my ($M1,$T2a,$T2b,$TMP2,$M2,$T2a,$T2b,$TMP2)=map("%xmm$_",(8..15)); $code.=<<___; ################################################################################ -# void ecp_nistz256_select_w5(uint64_t *val, uint64_t *in_t, int index); -.globl ecp_nistz256_select_w5 -.type ecp_nistz256_select_w5,\@abi-omnipotent +# void ecp_nistz256_scatter_w5(uint64_t *val, uint64_t *in_t, int index); +.globl ecp_nistz256_scatter_w5 +.type ecp_nistz256_scatter_w5,\@abi-omnipotent .align 32 -ecp_nistz256_select_w5: +ecp_nistz256_scatter_w5: + lea -3($index,$index,2), $index + movdqa 0x00($in_t), %xmm0 + shl \$5, $index + movdqa 0x10($in_t), %xmm1 + movdqa 0x20($in_t), %xmm2 + movdqa 0x30($in_t), %xmm3 + movdqa 0x40($in_t), %xmm4 + movdqa 0x50($in_t), %xmm5 + movdqa %xmm0, 0x00($val,$index) + movdqa %xmm1, 0x10($val,$index) + movdqa %xmm2, 0x20($val,$index) + movdqa %xmm3, 0x30($val,$index) + movdqa %xmm4, 0x40($val,$index) + movdqa %xmm5, 0x50($val,$index) + + ret +.size ecp_nistz256_scatter_w5,.-ecp_nistz256_scatter_w5 + +################################################################################ +# void ecp_nistz256_gather_w5(uint64_t *val, uint64_t *in_t, int index); +.globl ecp_nistz256_gather_w5 +.type ecp_nistz256_gather_w5,\@abi-omnipotent +.align 32 +ecp_nistz256_gather_w5: ___ $code.=<<___ if ($avx>1); mov OPENSSL_ia32cap_P+8(%rip), %eax test \$`1<<5`, %eax - jnz .Lavx2_select_w5 + jnz .Lavx2_gather_w5 ___ $code.=<<___ if ($win64); lea -0x88(%rsp), %rax -.LSEH_begin_ecp_nistz256_select_w5: +.LSEH_begin_ecp_nistz256_gather_w5: .byte 0x48,0x8d,0x60,0xe0 #lea -0x20(%rax), %rsp .byte 0x0f,0x29,0x70,0xe0 #movaps %xmm6, -0x20(%rax) .byte 0x0f,0x29,0x78,0xf0 #movaps %xmm7, -0x10(%rax) @@ -1555,27 +1579,46 @@ $code.=<<___ if ($win64); movaps 0x80(%rsp), %xmm14 movaps 0x90(%rsp), %xmm15 lea 0xa8(%rsp), %rsp -.LSEH_end_ecp_nistz256_select_w5: +.LSEH_end_ecp_nistz256_gather_w5: ___ $code.=<<___; ret -.size ecp_nistz256_select_w5,.-ecp_nistz256_select_w5 +.size ecp_nistz256_gather_w5,.-ecp_nistz256_gather_w5 ################################################################################ -# void ecp_nistz256_select_w7(uint64_t *val, uint64_t *in_t, int index); -.globl ecp_nistz256_select_w7 -.type ecp_nistz256_select_w7,\@abi-omnipotent +# void ecp_nistz256_scatter_w7(uint64_t *val, uint64_t *in_t, int index); +.globl ecp_nistz256_scatter_w7 +.type ecp_nistz256_scatter_w7,\@abi-omnipotent .align 32 -ecp_nistz256_select_w7: +ecp_nistz256_scatter_w7: + movdqu 0x00($in_t), %xmm0 + shl \$6, $index + movdqu 0x10($in_t), %xmm1 + movdqu 0x20($in_t), %xmm2 + movdqu 0x30($in_t), %xmm3 + movdqa %xmm0, 0x00($val,$index) + movdqa %xmm1, 0x10($val,$index) + movdqa %xmm2, 0x20($val,$index) + movdqa %xmm3, 0x30($val,$index) + + ret +.size ecp_nistz256_scatter_w7,.-ecp_nistz256_scatter_w7 + +################################################################################ +# void ecp_nistz256_gather_w7(uint64_t *val, uint64_t *in_t, int index); +.globl ecp_nistz256_gather_w7 +.type ecp_nistz256_gather_w7,\@abi-omnipotent +.align 32 +ecp_nistz256_gather_w7: ___ $code.=<<___ if ($avx>1); mov OPENSSL_ia32cap_P+8(%rip), %eax test \$`1<<5`, %eax - jnz .Lavx2_select_w7 + jnz .Lavx2_gather_w7 ___ $code.=<<___ if ($win64); lea -0x88(%rsp), %rax -.LSEH_begin_ecp_nistz256_select_w7: +.LSEH_begin_ecp_nistz256_gather_w7: .byte 0x48,0x8d,0x60,0xe0 #lea -0x20(%rax), %rsp .byte 0x0f,0x29,0x70,0xe0 #movaps %xmm6, -0x20(%rax) .byte 0x0f,0x29,0x78,0xf0 #movaps %xmm7, -0x10(%rax) @@ -1641,11 +1684,11 @@ $code.=<<___ if ($win64); movaps 0x80(%rsp), %xmm14 movaps 0x90(%rsp), %xmm15 lea 0xa8(%rsp), %rsp -.LSEH_end_ecp_nistz256_select_w7: +.LSEH_end_ecp_nistz256_gather_w7: ___ $code.=<<___; ret -.size ecp_nistz256_select_w7,.-ecp_nistz256_select_w7 +.size ecp_nistz256_gather_w7,.-ecp_nistz256_gather_w7 ___ } if ($avx>1) { @@ -1656,16 +1699,16 @@ my ($M1,$T1a,$T1b,$T1c,$TMP1)=map("%ymm$_",(10..14)); $code.=<<___; ################################################################################ -# void ecp_nistz256_avx2_select_w5(uint64_t *val, uint64_t *in_t, int index); -.type ecp_nistz256_avx2_select_w5,\@abi-omnipotent +# void ecp_nistz256_avx2_gather_w5(uint64_t *val, uint64_t *in_t, int index); +.type ecp_nistz256_avx2_gather_w5,\@abi-omnipotent .align 32 -ecp_nistz256_avx2_select_w5: -.Lavx2_select_w5: +ecp_nistz256_avx2_gather_w5: +.Lavx2_gather_w5: vzeroupper ___ $code.=<<___ if ($win64); lea -0x88(%rsp), %rax -.LSEH_begin_ecp_nistz256_avx2_select_w5: +.LSEH_begin_ecp_nistz256_avx2_gather_w5: .byte 0x48,0x8d,0x60,0xe0 #lea -0x20(%rax), %rsp .byte 0xc5,0xf8,0x29,0x70,0xe0 #vmovaps %xmm6, -0x20(%rax) .byte 0xc5,0xf8,0x29,0x78,0xf0 #vmovaps %xmm7, -0x10(%rax) @@ -1743,11 +1786,11 @@ $code.=<<___ if ($win64); movaps 0x80(%rsp), %xmm14 movaps 0x90(%rsp), %xmm15 lea 0xa8(%rsp), %rsp -.LSEH_end_ecp_nistz256_avx2_select_w5: +.LSEH_end_ecp_nistz256_avx2_gather_w5: ___ $code.=<<___; ret -.size ecp_nistz256_avx2_select_w5,.-ecp_nistz256_avx2_select_w5 +.size ecp_nistz256_avx2_gather_w5,.-ecp_nistz256_avx2_gather_w5 ___ } if ($avx>1) { @@ -1760,17 +1803,17 @@ my ($M2,$T2a,$T2b,$TMP2)=map("%ymm$_",(12..15)); $code.=<<___; ################################################################################ -# void ecp_nistz256_avx2_select_w7(uint64_t *val, uint64_t *in_t, int index); -.globl ecp_nistz256_avx2_select_w7 -.type ecp_nistz256_avx2_select_w7,\@abi-omnipotent +# void ecp_nistz256_avx2_gather_w7(uint64_t *val, uint64_t *in_t, int index); +.globl ecp_nistz256_avx2_gather_w7 +.type ecp_nistz256_avx2_gather_w7,\@abi-omnipotent .align 32 -ecp_nistz256_avx2_select_w7: -.Lavx2_select_w7: +ecp_nistz256_avx2_gather_w7: +.Lavx2_gather_w7: vzeroupper ___ $code.=<<___ if ($win64); lea -0x88(%rsp), %rax -.LSEH_begin_ecp_nistz256_avx2_select_w7: +.LSEH_begin_ecp_nistz256_avx2_gather_w7: .byte 0x48,0x8d,0x60,0xe0 #lea -0x20(%rax), %rsp .byte 0xc5,0xf8,0x29,0x70,0xe0 #vmovaps %xmm6, -0x20(%rax) .byte 0xc5,0xf8,0x29,0x78,0xf0 #vmovaps %xmm7, -0x10(%rax) @@ -1863,21 +1906,21 @@ $code.=<<___ if ($win64); movaps 0x80(%rsp), %xmm14 movaps 0x90(%rsp), %xmm15 lea 0xa8(%rsp), %rsp -.LSEH_end_ecp_nistz256_avx2_select_w7: +.LSEH_end_ecp_nistz256_avx2_gather_w7: ___ $code.=<<___; ret -.size ecp_nistz256_avx2_select_w7,.-ecp_nistz256_avx2_select_w7 +.size ecp_nistz256_avx2_gather_w7,.-ecp_nistz256_avx2_gather_w7 ___ } else { $code.=<<___; -.globl ecp_nistz256_avx2_select_w7 -.type ecp_nistz256_avx2_select_w7,\@function,3 +.globl ecp_nistz256_avx2_gather_w7 +.type ecp_nistz256_avx2_gather_w7,\@function,3 .align 32 -ecp_nistz256_avx2_select_w7: +ecp_nistz256_avx2_gather_w7: .byte 0x0f,0x0b # ud2 ret -.size ecp_nistz256_avx2_select_w7,.-ecp_nistz256_avx2_select_w7 +.size ecp_nistz256_avx2_gather_w7,.-ecp_nistz256_avx2_gather_w7 ___ } {{{ @@ -3087,6 +3130,36 @@ ___ } }}} +######################################################################## +# Convert ecp_nistz256_table.c to layout expected by ecp_nistz_gather_w7 +# +open TABLE,") { + s/TOBN\(\s*(0x[0-9a-f]+),\s*(0x[0-9a-f]+)\s*\)/push @arr,hex($2),hex($1)/geo; +} +close TABLE; + +die "insane number of elements" if ($#arr != 64*16*37-1); + +print <<___; +.text +.globl ecp_nistz256_precomputed +.type ecp_nistz256_precomputed,\@object +.align 4096 +ecp_nistz256_precomputed: +___ +while (@line=splice(@arr,0,16)) { + print ".long\t",join(',',map { sprintf "0x%08x",$_} @line),"\n"; +} +print <<___; +.size ecp_nistz256_precomputed,.-ecp_nistz256_precomputed +___ + $code =~ s/\`([^\`]*)\`/eval $1/gem; print $code; close STDOUT; diff --git a/crypto/ec/ecp_nistz256.c b/crypto/ec/ecp_nistz256.c index bf3fcc6b59..1871c45c2d 100644 --- a/crypto/ec/ecp_nistz256.c +++ b/crypto/ec/ecp_nistz256.c @@ -113,9 +113,13 @@ void ecp_nistz256_from_mont(BN_ULONG res[P256_LIMBS], void ecp_nistz256_to_mont(BN_ULONG res[P256_LIMBS], const BN_ULONG in[P256_LIMBS]); /* Functions that perform constant time access to the precomputed tables */ -void ecp_nistz256_select_w5(P256_POINT * val, +void ecp_nistz256_scatter_w5(P256_POINT * val, const P256_POINT * in_t, int index); -void ecp_nistz256_select_w7(P256_POINT_AFFINE * val, +void ecp_nistz256_gather_w5(P256_POINT * val, + const P256_POINT * in_t, int index); +void ecp_nistz256_scatter_w7(P256_POINT_AFFINE * val, + const P256_POINT_AFFINE * in_t, int index); +void ecp_nistz256_gather_w7(P256_POINT_AFFINE * val, const P256_POINT_AFFINE * in_t, int index); /* One converted into the Montgomery domain */ @@ -130,7 +134,7 @@ static void ecp_nistz256_pre_comp_clear_free(void *); static EC_PRE_COMP *ecp_nistz256_pre_comp_new(const EC_GROUP * group); /* Precomputed tables for the default generator */ -#include "ecp_nistz256_table.c" +extern const PRECOMP256_ROW ecp_nistz256_precomputed[37]; /* Recode window to a signed digit, see ecp_nistputil.c for details */ static unsigned int _booth_recode_w5(unsigned int in) @@ -560,23 +564,23 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP * group, const unsigned int window_size = 5; const unsigned int mask = (1 << (window_size + 1)) - 1; unsigned int wvalue; - BN_ULONG tmp[P256_LIMBS]; - ALIGN32 P256_POINT h; + P256_POINT *temp; /* place for 5 temporary points */ const BIGNUM **scalars = NULL; P256_POINT(*table)[16] = NULL; void *table_storage = NULL; if ((table_storage = - OPENSSL_malloc(num * 16 * sizeof(P256_POINT) + 64)) == NULL + OPENSSL_malloc((num * 16 + 5) * sizeof(P256_POINT) + 64)) == NULL || (p_str = OPENSSL_malloc(num * 33 * sizeof(unsigned char))) == NULL || (scalars = OPENSSL_malloc(num * sizeof(BIGNUM *))) == NULL) { ECerr(EC_F_ECP_NISTZ256_WINDOWED_MUL, ERR_R_MALLOC_FAILURE); goto err; - } else { - table = (void *)ALIGNPTR(table_storage, 64); } + table = (void *)ALIGNPTR(table_storage, 64); + temp = (P256_POINT *)(table + num); + for (i = 0; i < num; i++) { P256_POINT *row = table[i]; @@ -611,33 +615,49 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP * group, for (; j < 33; j++) p_str[i][j] = 0; - /* table[0] is implicitly (0,0,0) (the point at infinity), - * therefore it is not stored. All other values are actually - * stored with an offset of -1 in table. - */ - - if (!ecp_nistz256_bignum_to_field_elem(row[1 - 1].X, &point[i]->X) - || !ecp_nistz256_bignum_to_field_elem(row[1 - 1].Y, &point[i]->Y) - || !ecp_nistz256_bignum_to_field_elem(row[1 - 1].Z, &point[i]->Z)) { + if (!ecp_nistz256_bignum_to_field_elem(temp[0].X, &point[i]->X) + || !ecp_nistz256_bignum_to_field_elem(temp[0].Y, &point[i]->Y) + || !ecp_nistz256_bignum_to_field_elem(temp[0].Z, &point[i]->Z)) { ECerr(EC_F_ECP_NISTZ256_WINDOWED_MUL, EC_R_COORDINATES_OUT_OF_RANGE); goto err; } - ecp_nistz256_point_double(&row[ 2 - 1], &row[ 1 - 1]); - ecp_nistz256_point_add (&row[ 3 - 1], &row[ 2 - 1], &row[1 - 1]); - ecp_nistz256_point_double(&row[ 4 - 1], &row[ 2 - 1]); - ecp_nistz256_point_double(&row[ 6 - 1], &row[ 3 - 1]); - ecp_nistz256_point_double(&row[ 8 - 1], &row[ 4 - 1]); - ecp_nistz256_point_double(&row[12 - 1], &row[ 6 - 1]); - ecp_nistz256_point_add (&row[ 5 - 1], &row[ 4 - 1], &row[1 - 1]); - ecp_nistz256_point_add (&row[ 7 - 1], &row[ 6 - 1], &row[1 - 1]); - ecp_nistz256_point_add (&row[ 9 - 1], &row[ 8 - 1], &row[1 - 1]); - ecp_nistz256_point_add (&row[13 - 1], &row[12 - 1], &row[1 - 1]); - ecp_nistz256_point_double(&row[14 - 1], &row[ 7 - 1]); - ecp_nistz256_point_double(&row[10 - 1], &row[ 5 - 1]); - ecp_nistz256_point_add (&row[15 - 1], &row[14 - 1], &row[1 - 1]); - ecp_nistz256_point_add (&row[11 - 1], &row[10 - 1], &row[1 - 1]); - ecp_nistz256_point_add (&row[16 - 1], &row[15 - 1], &row[1 - 1]); + /* row[0] is implicitly (0,0,0) (the point at infinity), + * therefore it is not stored. All other values are actually + * stored with an offset of -1 in table. + */ + + ecp_nistz256_scatter_w5 (row, &temp[0], 1); + ecp_nistz256_point_double(&temp[1], &temp[0]); /*1+1=2 */ + ecp_nistz256_scatter_w5 (row, &temp[1], 2); + ecp_nistz256_point_add (&temp[2], &temp[1], &temp[0]); /*2+1=3 */ + ecp_nistz256_scatter_w5 (row, &temp[2], 3); + ecp_nistz256_point_double(&temp[1], &temp[1]); /*2*2=4 */ + ecp_nistz256_scatter_w5 (row, &temp[1], 4); + ecp_nistz256_point_double(&temp[2], &temp[2]); /*2*3=6 */ + ecp_nistz256_scatter_w5 (row, &temp[2], 6); + ecp_nistz256_point_add (&temp[3], &temp[1], &temp[0]); /*4+1=5 */ + ecp_nistz256_scatter_w5 (row, &temp[3], 5); + ecp_nistz256_point_add (&temp[4], &temp[2], &temp[0]); /*6+1=7 */ + ecp_nistz256_scatter_w5 (row, &temp[4], 7); + ecp_nistz256_point_double(&temp[1], &temp[1]); /*2*4=8 */ + ecp_nistz256_scatter_w5 (row, &temp[1], 8); + ecp_nistz256_point_double(&temp[2], &temp[2]); /*2*6=12 */ + ecp_nistz256_scatter_w5 (row, &temp[2], 12); + ecp_nistz256_point_double(&temp[3], &temp[3]); /*2*5=10 */ + ecp_nistz256_scatter_w5 (row, &temp[3], 10); + ecp_nistz256_point_double(&temp[4], &temp[4]); /*2*7=14 */ + ecp_nistz256_scatter_w5 (row, &temp[4], 14); + ecp_nistz256_point_add (&temp[2], &temp[2], &temp[0]); /*12+1=13*/ + ecp_nistz256_scatter_w5 (row, &temp[2], 13); + ecp_nistz256_point_add (&temp[3], &temp[3], &temp[0]); /*10+1=11*/ + ecp_nistz256_scatter_w5 (row, &temp[3], 11); + ecp_nistz256_point_add (&temp[4], &temp[4], &temp[0]); /*14+1=15*/ + ecp_nistz256_scatter_w5 (row, &temp[4], 15); + ecp_nistz256_point_add (&temp[2], &temp[1], &temp[0]); /*8+1=9 */ + ecp_nistz256_scatter_w5 (row, &temp[2], 9); + ecp_nistz256_point_double(&temp[1], &temp[1]); /*2*8=16 */ + ecp_nistz256_scatter_w5 (row, &temp[1], 16); } index = 255; @@ -645,7 +665,12 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP * group, wvalue = p_str[0][(index - 1) / 8]; wvalue = (wvalue >> ((index - 1) % 8)) & mask; - ecp_nistz256_select_w5(r, table[0], _booth_recode_w5(wvalue) >> 1); + /* + * We gather to temp[0], because we know it's position relative + * to table + */ + ecp_nistz256_gather_w5(&temp[0], table[0], _booth_recode_w5(wvalue) >> 1); + memcpy(r, &temp[0], sizeof(temp[0])); while (index >= 5) { for (i = (index == 255 ? 1 : 0); i < num; i++) { @@ -656,12 +681,12 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP * group, wvalue = _booth_recode_w5(wvalue); - ecp_nistz256_select_w5(&h, table[i], wvalue >> 1); + ecp_nistz256_gather_w5(&temp[0], table[i], wvalue >> 1); - ecp_nistz256_neg(tmp, h.Y); - copy_conditional(h.Y, tmp, (wvalue & 1)); + ecp_nistz256_neg(temp[1].Y, temp[0].Y); + copy_conditional(temp[0].Y, temp[1].Y, (wvalue & 1)); - ecp_nistz256_point_add(r, r, &h); + ecp_nistz256_point_add(r, r, &temp[0]); } index -= window_size; @@ -680,12 +705,12 @@ static void ecp_nistz256_windowed_mul(const EC_GROUP * group, wvalue = _booth_recode_w5(wvalue); - ecp_nistz256_select_w5(&h, table[i], wvalue >> 1); + ecp_nistz256_gather_w5(&temp[0], table[i], wvalue >> 1); - ecp_nistz256_neg(tmp, h.Y); - copy_conditional(h.Y, tmp, wvalue & 1); + ecp_nistz256_neg(temp[1].Y, temp[0].Y); + copy_conditional(temp[0].Y, temp[1].Y, wvalue & 1); - ecp_nistz256_point_add(r, r, &h); + ecp_nistz256_point_add(r, r, &temp[0]); } err: @@ -781,10 +806,10 @@ static int ecp_nistz256_mult_precompute(EC_GROUP * group, BN_CTX * ctx) OPENSSL_malloc(37 * 64 * sizeof(P256_POINT_AFFINE) + 64)) == NULL) { ECerr(EC_F_ECP_NISTZ256_MULT_PRECOMPUTE, ERR_R_MALLOC_FAILURE); goto err; - } else { - preComputedTable = (void *)ALIGNPTR(precomp_storage, 64); } + preComputedTable = (void *)ALIGNPTR(precomp_storage, 64); + P = EC_POINT_new(group); T = EC_POINT_new(group); @@ -795,14 +820,14 @@ static int ecp_nistz256_mult_precompute(EC_GROUP * group, BN_CTX * ctx) for (k = 0; k < 64; k++) { EC_POINT_copy(P, T); for (j = 0; j < 37; j++) { + P256_POINT_AFFINE temp; /* It would be faster to use * ec_GFp_simple_points_make_affine and make multiple * points affine at the same time. */ ec_GFp_simple_make_affine(group, P, ctx); - ecp_nistz256_bignum_to_field_elem(preComputedTable[j] - [k].X, &P->X); - ecp_nistz256_bignum_to_field_elem(preComputedTable[j] - [k].Y, &P->Y); + ecp_nistz256_bignum_to_field_elem(temp.X, &P->X); + ecp_nistz256_bignum_to_field_elem(temp.Y, &P->Y); + ecp_nistz256_scatter_w7(preComputedTable[j], &temp, k); for (i = 0; i < 7; i++) ec_GFp_simple_dbl(group, P, P, ctx); } @@ -851,15 +876,13 @@ err: * you'd need to compile even asm/ecp_nistz256-avx.pl module. */ #if defined(ECP_NISTZ256_AVX2) -# if !(defined(__x86_64) || defined(__x86_64__)) || \ +# if !(defined(__x86_64) || defined(__x86_64__) || \ defined(_M_AMD64) || defined(_MX64)) || \ !(defined(__GNUC__) || defined(_MSC_VER)) /* this is for ALIGN32 */ # undef ECP_NISTZ256_AVX2 # else /* Constant time access, loading four values, from four consecutive tables */ -void ecp_nistz256_avx2_select_w7(P256_POINT_AFFINE * val, - const P256_POINT_AFFINE * in_t, int index); -void ecp_nistz256_avx2_multi_select_w7(void *result, const void *in, int index0, +void ecp_nistz256_avx2_multi_gather_w7(void *result, const void *in, int index0, int index1, int index2, int index3); void ecp_nistz256_avx2_transpose_convert(void *RESULTx4, const void *in); void ecp_nistz256_avx2_convert_transpose_back(void *result, const void *Ax4); @@ -908,8 +931,8 @@ static void ecp_nistz256_avx2_mul_g(P256_POINT * r, ALIGN32 BN_ULONG aX4[4 * 9 * 3] = { 0 }; ALIGN32 BN_ULONG bX4[4 * 9 * 2] = { 0 }; - ALIGN32 P256_POINT_AFFINE point_arr[P256_LIMBS]; - ALIGN32 P256_POINT res_point_arr[P256_LIMBS]; + ALIGN32 P256_POINT_AFFINE point_arr[4]; + ALIGN32 P256_POINT res_point_arr[4]; /* Initial four windows */ wvalue = *((u16 *) & p_str[0]); @@ -929,7 +952,7 @@ static void ecp_nistz256_avx2_mul_g(P256_POINT * r, index += window_size; booth_recode_w7(&sign3, &digit3, wvalue); - ecp_nistz256_avx2_multi_select_w7(point_arr, preComputedTable[0], + ecp_nistz256_avx2_multi_gather_w7(point_arr, preComputedTable[0], digit0, digit1, digit2, digit3); ecp_nistz256_neg(tmp, point_arr[0].Y); @@ -963,7 +986,7 @@ static void ecp_nistz256_avx2_mul_g(P256_POINT * r, index += window_size; booth_recode_w7(&sign3, &digit3, wvalue); - ecp_nistz256_avx2_multi_select_w7(point_arr, preComputedTable[4 * 1], + ecp_nistz256_avx2_multi_gather_w7(point_arr, preComputedTable[4 * 1], digit0, digit1, digit2, digit3); ecp_nistz256_neg(tmp, point_arr[0].Y); @@ -999,7 +1022,7 @@ static void ecp_nistz256_avx2_mul_g(P256_POINT * r, index += window_size; booth_recode_w7(&sign3, &digit3, wvalue); - ecp_nistz256_avx2_multi_select_w7(point_arr, + ecp_nistz256_avx2_multi_gather_w7(point_arr, preComputedTable[4 * i], digit0, digit1, digit2, digit3); @@ -1028,7 +1051,7 @@ static void ecp_nistz256_avx2_mul_g(P256_POINT * r, wvalue = *((u16 *) & p_str[(index - 1) / 8]); wvalue = (wvalue >> ((index - 1) % 8)) & mask; booth_recode_w7(&sign0, &digit0, wvalue); - ecp_nistz256_avx2_select_w7((P256_POINT_AFFINE *) r, + ecp_nistz256_gather_w7((P256_POINT_AFFINE *) r, preComputedTable[36], digit0); ecp_nistz256_neg(tmp, r->Y); copy_conditional(r->Y, tmp, sign0); @@ -1091,6 +1114,11 @@ static int ecp_nistz256_points_mul(const EC_GROUP * group, } t, p; BIGNUM *tmp_scalar; + if ((num+1) == 0 || (num+1) > OPENSSL_MALLOC_MAX_NELEMS(void *)) { + ECerr(EC_F_ECP_NISTZ256_POINTS_MUL, ERR_R_MALLOC_FAILURE); + return 0; + } + if (group->meth != r->meth) { ECerr(EC_F_ECP_NISTZ256_POINTS_MUL, EC_R_INCOMPATIBLE_OBJECTS); return 0; @@ -1134,8 +1162,9 @@ static int ecp_nistz256_points_mul(const EC_GROUP * group, if (pre_comp_generator == NULL) goto err; - if (!ecp_nistz256_set_from_affine - (pre_comp_generator, group, pre_comp->precomp[0], ctx)) + if (!ecp_nistz256_set_from_affine(pre_comp_generator, + group, pre_comp->precomp[0], + ctx)) goto err; if (0 == EC_POINT_cmp(group, generator, pre_comp_generator, ctx)) @@ -1149,7 +1178,7 @@ static int ecp_nistz256_points_mul(const EC_GROUP * group, * is the default, a hardcoded table of precomputed * data is used. This is because applications, such as * Apache, do not use EC_KEY_precompute_mult. */ - preComputedTable = (const PRECOMP256_ROW *)ecp_nistz256_precomputed; + preComputedTable = ecp_nistz256_precomputed; } if (preComputedTable) { @@ -1196,7 +1225,7 @@ static int ecp_nistz256_points_mul(const EC_GROUP * group, wvalue = _booth_recode_w7(wvalue); - ecp_nistz256_select_w7(&p.a, preComputedTable[0], wvalue >> 1); + ecp_nistz256_gather_w7(&p.a, preComputedTable[0], wvalue >> 1); ecp_nistz256_neg(p.p.Z, p.p.Y); copy_conditional(p.p.Y, p.p.Z, wvalue & 1); @@ -1211,7 +1240,7 @@ static int ecp_nistz256_points_mul(const EC_GROUP * group, wvalue = _booth_recode_w7(wvalue); - ecp_nistz256_select_w7(&t.a, + ecp_nistz256_gather_w7(&t.a, preComputedTable[i], wvalue >> 1); ecp_nistz256_neg(t.p.Z, t.a.Y); -- 2.34.1