2 # Copyright 2014-2018 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
17 # GHASH for for PowerISA v2.07.
21 # Accurate performance measurements are problematic, because it's
22 # always virtualized setup with possibly throttled processor.
23 # Relative comparison is therefore more informative. This initial
24 # version is ~2.1x slower than hardware-assisted AES-128-CTR, ~12x
25 # faster than "4-bit" integer-only compiler-generated 64-bit code.
26 # "Initial version" means that there is room for further improvement.
30 # 2x aggregated reduction improves performance by 50% (resulting
31 # performance on POWER8 is 1 cycle per processed byte), and 4x
32 # aggregated reduction - by 170% or 2.7x (resulting in 0.55 cpb).
33 # POWER9 delivers 0.51 cpb.
38 if ($flavour =~ /64/) {
46 } elsif ($flavour =~ /32/) {
54 } else { die "nonsense $flavour"; }
57 $FRAME=6*$SIZE_T+13*16; # 13*16 is for v20-v31 offload
59 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
60 ( $xlate="${dir}ppc-xlate.pl" and -f $xlate ) or
61 ( $xlate="${dir}../../perlasm/ppc-xlate.pl" and -f $xlate) or
62 die "can't locate ppc-xlate.pl";
64 open STDOUT,"| $^X $xlate $flavour $output" || die "can't call $xlate: $!";
66 my ($Xip,$Htbl,$inp,$len)=map("r$_",(3..6)); # argument block
68 my ($Xl,$Xm,$Xh,$IN)=map("v$_",(0..3));
69 my ($zero,$t0,$t1,$t2,$xC2,$H,$Hh,$Hl,$lemask)=map("v$_",(4..12));
70 my ($Xl1,$Xm1,$Xh1,$IN1,$H2,$H2h,$H2l)=map("v$_",(13..19));
87 lvx_u $H,0,r4 # load H
89 vspltisb $xC2,-16 # 0xf0
91 vaddubm $xC2,$xC2,$xC2 # 0xe0
92 vxor $zero,$zero,$zero
93 vor $xC2,$xC2,$t0 # 0xe1
94 vsldoi $xC2,$xC2,$zero,15 # 0xe1...
95 vsldoi $t1,$zero,$t0,1 # ...1
96 vaddubm $xC2,$xC2,$xC2 # 0xc2...
98 vor $xC2,$xC2,$t1 # 0xc2....01
99 vspltb $t1,$H,0 # most significant byte
100 vsl $H,$H,$t0 # H<<=1
101 vsrab $t1,$t1,$t2 # broadcast carry bit
103 vxor $IN,$H,$t1 # twisted H
105 vsldoi $H,$IN,$IN,8 # twist even more ...
106 vsldoi $xC2,$zero,$xC2,8 # 0xc2.0
107 vsldoi $Hl,$zero,$H,8 # ... and split
108 vsldoi $Hh,$H,$zero,8
110 stvx_u $xC2,0,r3 # save pre-computed table
118 vpmsumd $Xl,$IN,$Hl # H.lo·H.lo
119 vpmsumd $Xm,$IN,$H # H.hi·H.lo+H.lo·H.hi
120 vpmsumd $Xh,$IN,$Hh # H.hi·H.hi
122 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
124 vsldoi $t0,$Xm,$zero,8
125 vsldoi $t1,$zero,$Xm,8
132 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
137 vsldoi $H2,$IN1,$IN1,8
138 vsldoi $H2l,$zero,$H2,8
139 vsldoi $H2h,$H2,$zero,8
141 stvx_u $H2l,r8,r3 # save H^2
149 my ($t4,$t5,$t6) = ($Hl,$H,$Hh);
151 vpmsumd $Xl,$IN,$H2l # H.lo·H^2.lo
152 vpmsumd $Xl1,$IN1,$H2l # H^2.lo·H^2.lo
153 vpmsumd $Xm,$IN,$H2 # H.hi·H^2.lo+H.lo·H^2.hi
154 vpmsumd $Xm1,$IN1,$H2 # H^2.hi·H^2.lo+H^2.lo·H^2.hi
155 vpmsumd $Xh,$IN,$H2h # H.hi·H^2.hi
156 vpmsumd $Xh1,$IN1,$H2h # H^2.hi·H^2.hi
158 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
159 vpmsumd $t6,$Xl1,$xC2 # 1st reduction phase
161 vsldoi $t0,$Xm,$zero,8
162 vsldoi $t1,$zero,$Xm,8
163 vsldoi $t4,$Xm1,$zero,8
164 vsldoi $t5,$zero,$Xm1,8
171 vsldoi $Xl1,$Xl1,$Xl1,8
175 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
176 vsldoi $t5,$Xl1,$Xl1,8 # 2nd reduction phase
178 vpmsumd $Xl1,$Xl1,$xC2
185 vsldoi $H2,$Xl1,$Xl1,8
186 vsldoi $Hl,$zero,$H,8
187 vsldoi $Hh,$H,$zero,8
188 vsldoi $H2l,$zero,$H2,8
189 vsldoi $H2h,$H2,$zero,8
191 stvx_u $Hl,r8,r3 # save H^3
197 stvx_u $H2l,r8,r3 # save H^4
204 .byte 0,12,0x14,0,0,0,2,0
206 .size .gcm_init_p8,.-.gcm_init_p8
219 lvx_u $IN,0,$Xip # load Xi
221 lvx_u $Hl,r8,$Htbl # load pre-computed table
222 le?lvsl $lemask,r0,r0
226 le?vxor $lemask,$lemask,$t0
228 le?vperm $IN,$IN,$IN,$lemask
229 vxor $zero,$zero,$zero
231 vpmsumd $Xl,$IN,$Hl # H.lo·Xi.lo
232 vpmsumd $Xm,$IN,$H # H.hi·Xi.lo+H.lo·Xi.hi
233 vpmsumd $Xh,$IN,$Hh # H.hi·Xi.hi
235 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
237 vsldoi $t0,$Xm,$zero,8
238 vsldoi $t1,$zero,$Xm,8
245 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
250 le?vperm $Xl,$Xl,$Xl,$lemask
251 stvx_u $Xl,0,$Xip # write out Xi
256 .byte 0,12,0x14,0,0,0,2,0
258 .size .gcm_gmult_p8,.-.gcm_gmult_p8
269 lvx_u $Xl,0,$Xip # load Xi
271 lvx_u $Hl,r8,$Htbl # load pre-computed table
273 le?lvsl $lemask,r0,r0
279 le?vxor $lemask,$lemask,$t0
281 le?vperm $Xl,$Xl,$Xl,$lemask
282 vxor $zero,$zero,$zero
290 le?vperm $IN,$IN,$IN,$lemask
294 lvx_u $H2l,r8,$Htbl # load H^2
297 add r9,$inp,$len # end of input
304 le?vperm $IN1,$IN1,$IN1,$lemask
307 vpmsumd $Xl,$IN,$H2l # H^2.lo·Xi.lo
308 vpmsumd $Xl1,$IN1,$Hl # H.lo·Xi+1.lo
309 subfe r0,r0,r0 # borrow?-1:0
310 vpmsumd $Xm,$IN,$H2 # H^2.hi·Xi.lo+H^2.lo·Xi.hi
311 vpmsumd $Xm1,$IN1,$H # H.hi·Xi+1.lo+H.lo·Xi+1.hi
313 vpmsumd $Xh,$IN,$H2h # H^2.hi·Xi.hi
314 vpmsumd $Xh1,$IN1,$Hh # H.hi·Xi+1.hi
320 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
322 vsldoi $t0,$Xm,$zero,8
323 vsldoi $t1,$zero,$Xm,8
333 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
335 le?vperm $IN,$IN,$IN,$lemask
340 bgt Loop_2x # done yet?
346 vpmsumd $Xl,$IN,$Hl # H.lo·Xi.lo
347 vpmsumd $Xm,$IN,$H # H.hi·Xi.lo+H.lo·Xi.hi
348 vpmsumd $Xh,$IN,$Hh # H.hi·Xi.hi
350 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
352 vsldoi $t0,$Xm,$zero,8
353 vsldoi $t1,$zero,$Xm,8
360 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
366 le?vperm $Xl,$Xl,$Xl,$lemask
367 stvx_u $Xl,0,$Xip # write out Xi
372 .byte 0,12,0x14,0,0,0,4,0
376 my ($Xl3,$Xm2,$IN2,$H3l,$H3,$H3h,
377 $Xh3,$Xm3,$IN3,$H4l,$H4,$H4h) = map("v$_",(20..31));
379 my ($H21l,$H21h,$loperm,$hiperm) = ($Hl,$Hh,$H2l,$H2h);
385 $STU $sp,-$FRAME($sp)
386 li r10,`15+6*$SIZE_T`
387 li r11,`31+6*$SIZE_T`
412 stw $vrsave,`$FRAME-4`($sp) # save vrsave
413 mtspr 256,r0 # preserve all AltiVec registers
415 lvsl $t0,0,r8 # 0x0001..0e0f
416 #lvx_u $H2l,r8,$Htbl # load H^2
420 vspltisb $t1,8 # 0x0808..0808
421 #lvx_u $H2h,r10,$Htbl
423 lvx_u $H3l,r8,$Htbl # load H^3
429 lvx_u $H4l,r8,$Htbl # load H^4
436 vsldoi $t2,$zero,$t1,8 # 0x0000..0808
437 vaddubm $hiperm,$t0,$t2 # 0x0001..1617
438 vaddubm $loperm,$t1,$hiperm # 0x0809..1e1f
440 $SHRI $len,$len,4 # this allows to use sign bit
442 lvx_u $IN0,0,$inp # load input
448 le?vperm $IN0,$IN0,$IN0,$lemask
449 le?vperm $IN1,$IN1,$IN1,$lemask
450 le?vperm $IN2,$IN2,$IN2,$lemask
451 le?vperm $IN3,$IN3,$IN3,$lemask
455 vpmsumd $Xl1,$IN1,$H3l
456 vpmsumd $Xm1,$IN1,$H3
457 vpmsumd $Xh1,$IN1,$H3h
459 vperm $H21l,$H2,$H,$hiperm
460 vperm $t0,$IN2,$IN3,$loperm
461 vperm $H21h,$H2,$H,$loperm
462 vperm $t1,$IN2,$IN3,$hiperm
463 vpmsumd $Xm2,$IN2,$H2 # H^2.lo·Xi+2.hi+H^2.hi·Xi+2.lo
464 vpmsumd $Xl3,$t0,$H21l # H^2.lo·Xi+2.lo+H.lo·Xi+3.lo
465 vpmsumd $Xm3,$IN3,$H # H.hi·Xi+3.lo +H.lo·Xi+3.hi
466 vpmsumd $Xh3,$t1,$H21h # H^2.hi·Xi+2.hi+H.hi·Xi+3.hi
482 le?vperm $IN1,$IN1,$IN1,$lemask
483 le?vperm $IN2,$IN2,$IN2,$lemask
484 le?vperm $IN3,$IN3,$IN3,$lemask
485 le?vperm $IN0,$IN0,$IN0,$lemask
487 vpmsumd $Xl,$Xh,$H4l # H^4.lo·Xi.lo
488 vpmsumd $Xm,$Xh,$H4 # H^4.hi·Xi.lo+H^4.lo·Xi.hi
489 vpmsumd $Xh,$Xh,$H4h # H^4.hi·Xi.hi
490 vpmsumd $Xl1,$IN1,$H3l
491 vpmsumd $Xm1,$IN1,$H3
492 vpmsumd $Xh1,$IN1,$H3h
497 vperm $t0,$IN2,$IN3,$loperm
498 vperm $t1,$IN2,$IN3,$hiperm
500 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
501 vpmsumd $Xl3,$t0,$H21l # H.lo·Xi+3.lo +H^2.lo·Xi+2.lo
502 vpmsumd $Xh3,$t1,$H21h # H.hi·Xi+3.hi +H^2.hi·Xi+2.hi
504 vsldoi $t0,$Xm,$zero,8
505 vsldoi $t1,$zero,$Xm,8
512 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
513 vpmsumd $Xm2,$IN2,$H2 # H^2.hi·Xi+2.lo+H^2.lo·Xi+2.hi
514 vpmsumd $Xm3,$IN3,$H # H.hi·Xi+3.lo +H.lo·Xi+3.hi
527 vpmsumd $Xl,$Xh,$H4l # H^4.lo·Xi.lo
528 vpmsumd $Xm,$Xh,$H4 # H^4.hi·Xi.lo+H^4.lo·Xi.hi
529 vpmsumd $Xh,$Xh,$H4h # H^4.hi·Xi.hi
534 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
536 vsldoi $t0,$Xm,$zero,8
537 vsldoi $t1,$zero,$Xm,8
545 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
562 le?vperm $IN0,$IN0,$IN0,$lemask
563 le?vperm $IN1,$IN1,$IN1,$lemask
564 le?vperm $IN2,$IN2,$IN2,$lemask
571 vperm $t0,$IN1,$IN2,$loperm
572 vperm $t1,$IN1,$IN2,$hiperm
573 vpmsumd $Xm2,$IN1,$H2 # H^2.lo·Xi+1.hi+H^2.hi·Xi+1.lo
574 vpmsumd $Xm3,$IN2,$H # H.hi·Xi+2.lo +H.lo·Xi+2.hi
575 vpmsumd $Xl3,$t0,$H21l # H^2.lo·Xi+1.lo+H.lo·Xi+2.lo
576 vpmsumd $Xh3,$t1,$H21h # H^2.hi·Xi+1.hi+H.hi·Xi+2.hi
583 le?vperm $IN0,$IN0,$IN0,$lemask
584 le?vperm $IN1,$IN1,$IN1,$lemask
587 vperm $t0,$zero,$IN1,$loperm
588 vperm $t1,$zero,$IN1,$hiperm
590 vsldoi $H4l,$zero,$H2,8
592 vsldoi $H4h,$H2,$zero,8
594 vpmsumd $Xl3,$t0, $H21l # H.lo·Xi+1.lo
595 vpmsumd $Xm3,$IN1,$H # H.hi·Xi+1.lo+H.lo·Xi+2.hi
596 vpmsumd $Xh3,$t1, $H21h # H.hi·Xi+1.hi
602 le?vperm $IN0,$IN0,$IN0,$lemask
604 vsldoi $H4l,$zero,$H,8
606 vsldoi $H4h,$H,$zero,8
616 le?vperm $Xl,$Xl,$Xl,$lemask
617 stvx_u $Xl,0,$Xip # write out Xi
619 li r10,`15+6*$SIZE_T`
620 li r11,`31+6*$SIZE_T`
647 .byte 0,12,0x04,0,0x80,0,4,0
652 .size .gcm_ghash_p8,.-.gcm_ghash_p8
654 .asciz "GHASH for PowerISA 2.07, CRYPTOGAMS by <appro\@openssl.org>"
658 foreach (split("\n",$code)) {
659 s/\`([^\`]*)\`/eval $1/geo;
661 if ($flavour =~ /le$/o) { # little-endian
671 close STDOUT; # enforce flush