3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
12 # The module implements "4-bit" GCM GHASH function and underlying
13 # single multiplication operation in GF(2^128). "4-bit" means that it
14 # uses 256 bytes per-key table [+128 bytes shared table]. Performance
15 # results are for streamed GHASH subroutine on UltraSPARC pre-Tx CPU
16 # and are expressed in cycles per processed byte, less is better:
18 # gcc 3.3.x cc 5.2 this assembler
20 # 32-bit build 81.4 43.3 12.6 (+546%/+244%)
21 # 64-bit build 20.2 21.2 12.6 (+60%/+68%)
23 # Here is data collected on UltraSPARC T1 system running Linux:
25 # gcc 4.4.1 this assembler
27 # 32-bit build 566 50 (+1000%)
28 # 64-bit build 56 50 (+12%)
30 # I don't quite understand why difference between 32-bit and 64-bit
31 # compiler-generated code is so big. Compilers *were* instructed to
32 # generate code for UltraSPARC and should have used 64-bit registers
33 # for Z vector (see C code) even in 32-bit build... Oh well, it only
34 # means more impressive improvement coefficients for this assembler
35 # module;-) Loops are aggressively modulo-scheduled in respect to
36 # references to input data and Z.hi updates to achieve 12 cycles
37 # timing. To anchor to something else, sha1-sparcv9.pl spends 11.6
38 # cycles to process one byte on UltraSPARC pre-Tx CPU and ~24 on T1.
42 # Add VIS3 lookup-table-free implementation using polynomial
43 # multiplication xmulx[hi] and extended addition addxc[cc]
44 # instructions. 3.96/6.26x improvement on T3/T4 or in absolute
45 # terms 9.02/2.61 cycles per byte.
48 for (@ARGV) { $bits=64 if (/\-m64/ || /\-xarch\=v9/); }
49 if ($bits==64) { $bias=2047; $frame=192; }
50 else { $bias=0; $frame=112; }
53 open STDOUT,">$output";
55 $Zhi="%o0"; # 64-bit values
62 $nhi="%l0"; # small values and pointers
71 $Xi="%i0"; # input argument block
76 $code.=<<___ if ($bits==64);
77 .register %g2,#scratch
78 .register %g3,#scratch
81 .section ".text",#alloc,#execinstr
85 .long `0x0000<<16`,0,`0x1C20<<16`,0,`0x3840<<16`,0,`0x2460<<16`,0
86 .long `0x7080<<16`,0,`0x6CA0<<16`,0,`0x48C0<<16`,0,`0x54E0<<16`,0
87 .long `0xE100<<16`,0,`0xFD20<<16`,0,`0xD940<<16`,0,`0xC560<<16`,0
88 .long `0x9180<<16`,0,`0x8DA0<<16`,0,`0xA9C0<<16`,0,`0xB5E0<<16`,0
89 .type rem_4bit,#object
90 .size rem_4bit,(.-rem_4bit)
103 add %o7,rem_4bit-1b,$rem_4bit
110 ldx [$Htblo+$nlo],$Zlo
111 ldx [$Htbl+$nlo],$Zhi
115 ldx [$Htblo+$nhi],$Tlo
117 ldx [$Htbl+$nhi],$Thi
119 ldx [$rem_4bit+$remi],$rem
135 ldx [$Htblo+$nlo],$Tlo
138 ldx [$Htbl+$nlo],$Thi
141 ldx [$rem_4bit+$remi],$rem
144 ldub [$inp+$cnt],$nlo
151 ldx [$Htblo+$nhi],$Tlo
154 ldx [$Htbl+$nhi],$Thi
156 ldx [$rem_4bit+$remi],$rem
169 ldx [$Htblo+$nlo],$Tlo
172 ldx [$Htbl+$nlo],$Thi
175 ldx [$rem_4bit+$remi],$rem
184 be,pn `$bits==64?"%xcc":"%icc"`,.Ldone
187 ldx [$Htblo+$nhi],$Tlo
190 ldx [$Htbl+$nhi],$Thi
192 ldx [$rem_4bit+$remi],$rem
208 ldx [$Htblo+$nhi],$Tlo
211 ldx [$Htbl+$nhi],$Thi
213 ldx [$rem_4bit+$remi],$rem
225 .type gcm_ghash_4bit,#function
226 .size gcm_ghash_4bit,(.-gcm_ghash_4bit)
233 .globl gcm_gmult_4bit
241 add %o7,rem_4bit-1b,$rem_4bit
246 ldx [$Htblo+$nlo],$Zlo
247 ldx [$Htbl+$nlo],$Zhi
251 ldx [$Htblo+$nhi],$Tlo
253 ldx [$Htbl+$nhi],$Thi
255 ldx [$rem_4bit+$remi],$rem
270 ldx [$Htblo+$nlo],$Tlo
273 ldx [$Htbl+$nlo],$Thi
276 ldx [$rem_4bit+$remi],$rem
285 ldx [$Htblo+$nhi],$Tlo
288 ldx [$Htbl+$nhi],$Thi
290 ldx [$rem_4bit+$remi],$rem
302 ldx [$Htblo+$nlo],$Tlo
305 ldx [$Htbl+$nlo],$Thi
308 ldx [$rem_4bit+$remi],$rem
316 ldx [$Htblo+$nhi],$Tlo
319 ldx [$Htbl+$nhi],$Thi
321 ldx [$rem_4bit+$remi],$rem
333 .type gcm_gmult_4bit,#function
334 .size gcm_gmult_4bit,(.-gcm_gmult_4bit)
338 # Straightforward 64-bits-at-a-time approach with pair of 128x64-bit
339 # multiplications followed by 64-bit reductions. While it might be
340 # suboptimal with regard to sheer amount of multiplications, other
341 # methods would require larger amount of 64-bit registers, which we
342 # don't have in 32-bit application. Also, they [alternative methods
343 # such as aggregated reduction] kind of thrive on fast 128-bit SIMD
344 # instructions and these are not option on SPARC...
346 ($Xip,$Htable,$inp,$len)=map("%i$_",(0..3));
348 ($xE1,$Hhi,$Hlo,$Rhi,$Rlo,$M0hi,$M0lo,$M1hi,$M1lo,$Zhi,$Zlo,$X)=
349 (map("%g$_",(1..5)),map("%o$_",(0..5,7)));
350 ($shl,$shr)=map("%l$_",(0..7));
353 .globl gcm_gmult_vis3
358 ldx [$Xip+8],$X ! load X.lo
359 ldx [$Htable-8], $Hlo ! load H
360 ldx [$Htable-16],$Hhi
364 xmulx $X,$Hlo,$M0lo ! H·X.lo
365 xmulxhi $X,$Hlo,$M0hi
367 xmulxhi $X,$Hhi,$M1hi
368 ldx [$Xip+0],$X ! load X.hi
370 addcc $M0lo,$M0lo,$M0lo ! (H·X.lo)<<1
371 xor $M0hi,$M1lo,$M1lo
373 xmulx $xE1,$M0lo,$Rlo ! res=Z.lo·(0xE1<<57)
374 xmulxhi $xE1,$M0lo,$Rhi
376 addxccc $M1lo,$M1lo,$Zlo ! Z=((H·X.lo)<<1)>>64
377 addxc $M1hi,$M1hi,$Zhi
378 xor $M0lo,$Zhi,$Zhi ! overflow bit from 0xE1<<57
380 xmulx $X,$Hlo,$M0lo ! H·X.hi
381 xmulxhi $X,$Hlo,$M0hi
383 xmulxhi $X,$Hhi,$M1hi
385 xor $Rlo,$Zlo,$Zlo ! Z^=res
388 addcc $M0lo,$M0lo,$M0lo ! (H·X.lo)<<1
389 xor $Zlo, $M0lo,$M0lo
390 xor $M0hi,$M1lo,$M1lo
392 xmulx $xE1,$M0lo,$Rlo ! res=Z.lo·(0xE1<<57)
393 xmulxhi $xE1,$M0lo,$Rhi
395 addxccc $M1lo,$M1lo,$M1lo
396 addxc $M1hi,$M1hi,$M1hi
398 xor $M1lo,$Zhi,$Zlo ! Z=(Z^(H·X.hi)<<1)>>64
399 xor $M0lo,$M1hi,$Zhi ! overflow bit from 0xE1<<57
401 xor $Rlo,$Zlo,$Zlo ! Z^=res
404 stx $Zlo,[$Xip+8] ! save Xi
409 .type gcm_gmult_vis3,#function
410 .size gcm_gmult_vis3,.-gcm_gmult_vis3
412 .globl gcm_ghash_vis3
417 ldx [$Xip+0],$Zhi ! load X.hi
418 ldx [$Xip+8],$Zlo ! load X.lo
421 ldx [$Htable-8], $Hlo ! load H
422 ldx [$Htable-16],$Hhi
424 prefetch [$inp+63], 20
430 ldx [$inp+8],$Rlo ! load *inp
434 ldx [$inp+16],$X ! align data
446 prefetch [$inp+63], 20
448 xmulx $X,$Hlo,$M0lo ! H·X.lo
449 xmulxhi $X,$Hlo,$M0hi
451 xmulxhi $X,$Hhi,$M1hi
454 addcc $M0lo,$M0lo,$M0lo ! (H·X.lo)<<1
455 xor $M0hi,$M1lo,$M1lo
457 xmulx $xE1,$M0lo,$Rlo ! res=Z.lo·(0xE1<<57)
458 xmulxhi $xE1,$M0lo,$Rhi
460 addxccc $M1lo,$M1lo,$Zlo ! Z=((H·X.lo)<<1)>>64
461 addxc $M1hi,$M1hi,$Zhi
462 xor $M0lo,$Zhi,$Zhi ! overflow bit from 0xE1<<57
464 xmulx $X,$Hlo,$M0lo ! H·X.hi
465 xmulxhi $X,$Hlo,$M0hi
467 xmulxhi $X,$Hhi,$M1hi
469 xor $Rlo,$Zlo,$Zlo ! Z^=res
472 addcc $M0lo,$M0lo,$M0lo ! (H·X.lo)<<1
473 xor $Zlo, $M0lo,$M0lo
474 xor $M0hi,$M1lo,$M1lo
476 xmulx $xE1,$M0lo,$Rlo ! res=Z.lo·(0xE1<<57)
477 xmulxhi $xE1,$M0lo,$Rhi
479 addxccc $M1lo,$M1lo,$M1lo
480 addxc $M1hi,$M1hi,$M1hi
482 xor $M1lo,$Zhi,$Zlo ! Z=(Z^(H·X.hi)<<1)>>64
483 xor $M0lo,$M1hi,$Zhi ! overflow bit from 0xE1<<57
485 xor $Rlo,$Zlo,$Zlo ! Z^=res
489 stx $Zlo,[$Xip+8] ! save Xi
494 .type gcm_ghash_vis3,#function
495 .size gcm_ghash_vis3,.-gcm_ghash_vis3
499 .asciz "GHASH for SPARCv9/VIS3, CRYPTOGAMS by <appro\@openssl.org>"
504 # Purpose of these subroutines is to explicitly encode VIS instructions,
505 # so that one can compile the module without having to specify VIS
506 # extentions on compiler command line, e.g. -xarch=v9 vs. -xarch=v9a.
507 # Idea is to reserve for option to produce "universal" binary and let
508 # programmer detect if current CPU is VIS capable at run-time.
510 my ($mnemonic,$rs1,$rs2,$rd)=@_;
511 my %bias = ( "g" => 0, "o" => 8, "l" => 16, "i" => 24 );
513 my %visopf = ( "addxc" => 0x011,
516 "xmulxhi" => 0x116 );
518 $ref = "$mnemonic\t$rs1,$rs2,$rd";
520 if ($opf=$visopf{$mnemonic}) {
521 foreach ($rs1,$rs2,$rd) {
522 return $ref if (!/%([goli])([0-9])/);
526 return sprintf ".word\t0x%08x !%s",
527 0x81b00000|$rd<<25|$rs1<<14|$opf<<5|$rs2,
534 foreach (split("\n",$code)) {
535 s/\`([^\`]*)\`/eval $1/ge;
537 s/\b(xmulx[hi]*|addxc[c]{0,2})\s+(%[goli][0-7]),\s*(%[goli][0-7]),\s*(%[goli][0-7])/