2 # Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
19 # ChaCha20 for PowerPC/AltiVec.
23 # Add VSX 2.07 code path. Original 3xAltiVec+1xIALU is well-suited for
24 # processors that can't issue more than one vector instruction per
25 # cycle. But POWER8 (and POWER9) can issue a pair, and vector-only 4x
26 # interleave would perform better. Incidentally PowerISA 2.07 (first
27 # implemented by POWER8) defined new usable instructions, hence 4xVSX
30 # Performance in cycles per byte out of large buffer.
32 # IALU/gcc-4.x 3xAltiVec+1xIALU 4xVSX
34 # Freescale e300 13.6/+115% - -
35 # PPC74x0/G4e 6.81/+310% 3.81 -
36 # PPC970/G5 9.29/+160% ? -
37 # POWER7 8.62/+61% 3.35 -
38 # POWER8 8.70/+51% 2.91 2.09
39 # POWER9 8.80/+29% 4.44(*) 2.45(**)
41 # (*) this is trade-off result, it's possible to improve it, but
42 # then it would negatively affect all others;
43 # (**) POWER9 seems to be "allergic" to mixing vector and integer
44 # instructions, which is why switch to vector-only code pays
47 # $output is the last argument if it looks like a file (it has an extension)
48 # $flavour is the first argument if it doesn't look like a file
49 $output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef;
50 $flavour = $#ARGV >= 0 && $ARGV[0] !~ m|\.| ? shift : undef;
52 if ($flavour =~ /64/) {
59 } elsif ($flavour =~ /32/) {
66 } else { die "nonsense $flavour"; }
68 $LITTLE_ENDIAN = ($flavour=~/le$/) ? 1 : 0;
70 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
71 ( $xlate="${dir}ppc-xlate.pl" and -f $xlate ) or
72 ( $xlate="${dir}../../perlasm/ppc-xlate.pl" and -f $xlate) or
73 die "can't locate ppc-xlate.pl";
75 open STDOUT,"| $^X $xlate $flavour \"$output\""
76 or die "can't call $xlate: $!";
79 $FRAME=$LOCALS+64+18*$SIZE_T; # 64 is for local variables
81 sub AUTOLOAD() # thunk [simplified] x86-style perlasm
82 { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./;
83 $code .= "\t$opcode\t".join(',',@_)."\n";
88 my ($out,$inp,$len,$key,$ctr) = map("r$_",(3..7));
90 my @x=map("r$_",(16..31));
91 my @d=map("r$_",(11,12,14,15));
92 my @t=map("r$_",(7..10));
95 my ($a0,$b0,$c0,$d0)=@_;
96 my ($a1,$b1,$c1,$d1)=map(($_&~3)+(($_+1)&3),($a0,$b0,$c0,$d0));
97 my ($a2,$b2,$c2,$d2)=map(($_&~3)+(($_+1)&3),($a1,$b1,$c1,$d1));
98 my ($a3,$b3,$c3,$d3)=map(($_&~3)+(($_+1)&3),($a2,$b2,$c2,$d2));
101 "&add (@x[$a0],@x[$a0],@x[$b0])",
102 "&add (@x[$a1],@x[$a1],@x[$b1])",
103 "&add (@x[$a2],@x[$a2],@x[$b2])",
104 "&add (@x[$a3],@x[$a3],@x[$b3])",
105 "&xor (@x[$d0],@x[$d0],@x[$a0])",
106 "&xor (@x[$d1],@x[$d1],@x[$a1])",
107 "&xor (@x[$d2],@x[$d2],@x[$a2])",
108 "&xor (@x[$d3],@x[$d3],@x[$a3])",
109 "&rotlwi (@x[$d0],@x[$d0],16)",
110 "&rotlwi (@x[$d1],@x[$d1],16)",
111 "&rotlwi (@x[$d2],@x[$d2],16)",
112 "&rotlwi (@x[$d3],@x[$d3],16)",
114 "&add (@x[$c0],@x[$c0],@x[$d0])",
115 "&add (@x[$c1],@x[$c1],@x[$d1])",
116 "&add (@x[$c2],@x[$c2],@x[$d2])",
117 "&add (@x[$c3],@x[$c3],@x[$d3])",
118 "&xor (@x[$b0],@x[$b0],@x[$c0])",
119 "&xor (@x[$b1],@x[$b1],@x[$c1])",
120 "&xor (@x[$b2],@x[$b2],@x[$c2])",
121 "&xor (@x[$b3],@x[$b3],@x[$c3])",
122 "&rotlwi (@x[$b0],@x[$b0],12)",
123 "&rotlwi (@x[$b1],@x[$b1],12)",
124 "&rotlwi (@x[$b2],@x[$b2],12)",
125 "&rotlwi (@x[$b3],@x[$b3],12)",
127 "&add (@x[$a0],@x[$a0],@x[$b0])",
128 "&add (@x[$a1],@x[$a1],@x[$b1])",
129 "&add (@x[$a2],@x[$a2],@x[$b2])",
130 "&add (@x[$a3],@x[$a3],@x[$b3])",
131 "&xor (@x[$d0],@x[$d0],@x[$a0])",
132 "&xor (@x[$d1],@x[$d1],@x[$a1])",
133 "&xor (@x[$d2],@x[$d2],@x[$a2])",
134 "&xor (@x[$d3],@x[$d3],@x[$a3])",
135 "&rotlwi (@x[$d0],@x[$d0],8)",
136 "&rotlwi (@x[$d1],@x[$d1],8)",
137 "&rotlwi (@x[$d2],@x[$d2],8)",
138 "&rotlwi (@x[$d3],@x[$d3],8)",
140 "&add (@x[$c0],@x[$c0],@x[$d0])",
141 "&add (@x[$c1],@x[$c1],@x[$d1])",
142 "&add (@x[$c2],@x[$c2],@x[$d2])",
143 "&add (@x[$c3],@x[$c3],@x[$d3])",
144 "&xor (@x[$b0],@x[$b0],@x[$c0])",
145 "&xor (@x[$b1],@x[$b1],@x[$c1])",
146 "&xor (@x[$b2],@x[$b2],@x[$c2])",
147 "&xor (@x[$b3],@x[$b3],@x[$c3])",
148 "&rotlwi (@x[$b0],@x[$b0],7)",
149 "&rotlwi (@x[$b1],@x[$b1],7)",
150 "&rotlwi (@x[$b2],@x[$b2],7)",
151 "&rotlwi (@x[$b3],@x[$b3],7)"
159 .globl .ChaCha20_ctr32_int
162 __ChaCha20_ctr32_int:
166 $STU $sp,-$FRAME($sp)
169 $PUSH r14,`$FRAME-$SIZE_T*18`($sp)
170 $PUSH r15,`$FRAME-$SIZE_T*17`($sp)
171 $PUSH r16,`$FRAME-$SIZE_T*16`($sp)
172 $PUSH r17,`$FRAME-$SIZE_T*15`($sp)
173 $PUSH r18,`$FRAME-$SIZE_T*14`($sp)
174 $PUSH r19,`$FRAME-$SIZE_T*13`($sp)
175 $PUSH r20,`$FRAME-$SIZE_T*12`($sp)
176 $PUSH r21,`$FRAME-$SIZE_T*11`($sp)
177 $PUSH r22,`$FRAME-$SIZE_T*10`($sp)
178 $PUSH r23,`$FRAME-$SIZE_T*9`($sp)
179 $PUSH r24,`$FRAME-$SIZE_T*8`($sp)
180 $PUSH r25,`$FRAME-$SIZE_T*7`($sp)
181 $PUSH r26,`$FRAME-$SIZE_T*6`($sp)
182 $PUSH r27,`$FRAME-$SIZE_T*5`($sp)
183 $PUSH r28,`$FRAME-$SIZE_T*4`($sp)
184 $PUSH r29,`$FRAME-$SIZE_T*3`($sp)
185 $PUSH r30,`$FRAME-$SIZE_T*2`($sp)
186 $PUSH r31,`$FRAME-$SIZE_T*1`($sp)
187 $PUSH r0,`$FRAME+$LRSAVE`($sp)
189 lwz @d[0],0($ctr) # load counter
196 $POP r0,`$FRAME+$LRSAVE`($sp)
197 $POP r14,`$FRAME-$SIZE_T*18`($sp)
198 $POP r15,`$FRAME-$SIZE_T*17`($sp)
199 $POP r16,`$FRAME-$SIZE_T*16`($sp)
200 $POP r17,`$FRAME-$SIZE_T*15`($sp)
201 $POP r18,`$FRAME-$SIZE_T*14`($sp)
202 $POP r19,`$FRAME-$SIZE_T*13`($sp)
203 $POP r20,`$FRAME-$SIZE_T*12`($sp)
204 $POP r21,`$FRAME-$SIZE_T*11`($sp)
205 $POP r22,`$FRAME-$SIZE_T*10`($sp)
206 $POP r23,`$FRAME-$SIZE_T*9`($sp)
207 $POP r24,`$FRAME-$SIZE_T*8`($sp)
208 $POP r25,`$FRAME-$SIZE_T*7`($sp)
209 $POP r26,`$FRAME-$SIZE_T*6`($sp)
210 $POP r27,`$FRAME-$SIZE_T*5`($sp)
211 $POP r28,`$FRAME-$SIZE_T*4`($sp)
212 $POP r29,`$FRAME-$SIZE_T*3`($sp)
213 $POP r30,`$FRAME-$SIZE_T*2`($sp)
214 $POP r31,`$FRAME-$SIZE_T*1`($sp)
219 .byte 0,12,4,1,0x80,18,5,0
221 .size .ChaCha20_ctr32_int,.-.ChaCha20_ctr32_int
226 lis @x[0],0x6170 # synthesize sigma
230 ori @x[0],@x[0],0x7865
231 ori @x[1],@x[1],0x646e
232 ori @x[2],@x[2],0x2d32
233 ori @x[3],@x[3],0x6574
235 li r0,10 # inner loop counter
236 lwz @x[4],0($key) # load key
241 mr @x[12],@d[0] # copy counter
257 foreach (&ROUND(0, 4, 8,12)) { eval; }
258 foreach (&ROUND(0, 5,10,15)) { eval; }
262 subic $len,$len,64 # $len-=64
263 addi @x[0],@x[0],0x7865 # accumulate key block
264 addi @x[1],@x[1],0x646e
265 addi @x[2],@x[2],0x2d32
266 addi @x[3],@x[3],0x6574
267 addis @x[0],@x[0],0x6170
268 addis @x[1],@x[1],0x3320
269 addis @x[2],@x[2],0x7962
270 addis @x[3],@x[3],0x6b20
272 subfe. r0,r0,r0 # borrow?-1:0
273 add @x[4],@x[4],@t[0]
275 add @x[5],@x[5],@t[1]
277 add @x[6],@x[6],@t[2]
279 add @x[7],@x[7],@t[3]
281 add @x[8],@x[8],@t[0]
282 add @x[9],@x[9],@t[1]
283 add @x[10],@x[10],@t[2]
284 add @x[11],@x[11],@t[3]
286 add @x[12],@x[12],@d[0]
287 add @x[13],@x[13],@d[1]
288 add @x[14],@x[14],@d[2]
289 add @x[15],@x[15],@d[3]
290 addi @d[0],@d[0],1 # increment counter
292 if (!$LITTLE_ENDIAN) { for($i=0;$i<16;$i++) { # flip byte order
295 rotlwi @x[$i],@x[$i],8
296 rlwimi @x[$i],@t[$i&3],24,0,7
297 rlwimi @x[$i],@t[$i&3],24,16,23
301 bne Ltail # $len-=64 borrowed
303 lwz @t[0],0($inp) # load input, aligned or not
305 ${UCMP}i $len,0 # done already?
308 xor @x[0],@x[0],@t[0] # xor with input
310 xor @x[1],@x[1],@t[1]
312 xor @x[2],@x[2],@t[2]
314 xor @x[3],@x[3],@t[3]
316 xor @x[4],@x[4],@t[0]
318 xor @x[5],@x[5],@t[1]
320 xor @x[6],@x[6],@t[2]
322 xor @x[7],@x[7],@t[3]
324 xor @x[8],@x[8],@t[0]
326 xor @x[9],@x[9],@t[1]
328 xor @x[10],@x[10],@t[2]
330 xor @x[11],@x[11],@t[3]
332 xor @x[12],@x[12],@t[0]
333 stw @x[0],0($out) # store output, aligned or not
334 xor @x[13],@x[13],@t[1]
336 xor @x[14],@x[14],@t[2]
338 xor @x[15],@x[15],@t[3]
361 addi $len,$len,64 # restore tail length
362 subi $inp,$inp,1 # prepare for *++ptr
364 addi @t[0],$sp,$LOCALS-1
367 stw @x[0],`$LOCALS+0`($sp) # save whole block to stack
368 stw @x[1],`$LOCALS+4`($sp)
369 stw @x[2],`$LOCALS+8`($sp)
370 stw @x[3],`$LOCALS+12`($sp)
371 stw @x[4],`$LOCALS+16`($sp)
372 stw @x[5],`$LOCALS+20`($sp)
373 stw @x[6],`$LOCALS+24`($sp)
374 stw @x[7],`$LOCALS+28`($sp)
375 stw @x[8],`$LOCALS+32`($sp)
376 stw @x[9],`$LOCALS+36`($sp)
377 stw @x[10],`$LOCALS+40`($sp)
378 stw @x[11],`$LOCALS+44`($sp)
379 stw @x[12],`$LOCALS+48`($sp)
380 stw @x[13],`$LOCALS+52`($sp)
381 stw @x[14],`$LOCALS+56`($sp)
382 stw @x[15],`$LOCALS+60`($sp)
384 Loop_tail: # byte-by-byte loop
387 xor @d[1],@d[0],@x[0]
391 stw $sp,`$LOCALS+0`($sp) # wipe block on stack
392 stw $sp,`$LOCALS+4`($sp)
393 stw $sp,`$LOCALS+8`($sp)
394 stw $sp,`$LOCALS+12`($sp)
395 stw $sp,`$LOCALS+16`($sp)
396 stw $sp,`$LOCALS+20`($sp)
397 stw $sp,`$LOCALS+24`($sp)
398 stw $sp,`$LOCALS+28`($sp)
399 stw $sp,`$LOCALS+32`($sp)
400 stw $sp,`$LOCALS+36`($sp)
401 stw $sp,`$LOCALS+40`($sp)
402 stw $sp,`$LOCALS+44`($sp)
403 stw $sp,`$LOCALS+48`($sp)
404 stw $sp,`$LOCALS+52`($sp)
405 stw $sp,`$LOCALS+56`($sp)
406 stw $sp,`$LOCALS+60`($sp)
410 .byte 0,12,0x14,0,0,0,0,0
414 my ($A0,$B0,$C0,$D0,$A1,$B1,$C1,$D1,$A2,$B2,$C2,$D2)
415 = map("v$_",(0..11));
416 my @K = map("v$_",(12..17));
417 my ($FOUR,$sixteen,$twenty4) = map("v$_",(18..19,23));
418 my ($inpperm,$outperm,$outmask) = map("v$_",(24..26));
419 my @D = map("v$_",(27..31));
420 my ($twelve,$seven,$T0,$T1) = @D;
422 my $FRAME=$LOCALS+64+10*16+18*$SIZE_T; # 10*16 is for v23-v31 offload
429 "&vadduwm ('$a','$a','$b')",
430 "&vxor ('$d','$d','$a')",
431 "&vperm ('$d','$d','$d','$sixteen')",
433 "&vadduwm ('$c','$c','$d')",
434 "&vxor ('$b','$b','$c')",
435 "&vrlw ('$b','$b','$twelve')",
437 "&vadduwm ('$a','$a','$b')",
438 "&vxor ('$d','$d','$a')",
439 "&vperm ('$d','$d','$d','$twenty4')",
441 "&vadduwm ('$c','$c','$d')",
442 "&vxor ('$b','$b','$c')",
443 "&vrlw ('$b','$b','$seven')",
445 "&vrldoi ('$c','$c',8)",
446 "&vrldoi ('$b','$b',$odd?4:12)",
447 "&vrldoi ('$d','$d',$odd?12:4)"
453 .globl .ChaCha20_ctr32_vmx
457 blt __ChaCha20_ctr32_int
459 $STU $sp,-$FRAME($sp)
461 li r10,`15+$LOCALS+64`
462 li r11,`31+$LOCALS+64`
480 stw r12,`$FRAME-$SIZE_T*18-4`($sp) # save vrsave
481 $PUSH r14,`$FRAME-$SIZE_T*18`($sp)
482 $PUSH r15,`$FRAME-$SIZE_T*17`($sp)
483 $PUSH r16,`$FRAME-$SIZE_T*16`($sp)
484 $PUSH r17,`$FRAME-$SIZE_T*15`($sp)
485 $PUSH r18,`$FRAME-$SIZE_T*14`($sp)
486 $PUSH r19,`$FRAME-$SIZE_T*13`($sp)
487 $PUSH r20,`$FRAME-$SIZE_T*12`($sp)
488 $PUSH r21,`$FRAME-$SIZE_T*11`($sp)
489 $PUSH r22,`$FRAME-$SIZE_T*10`($sp)
490 $PUSH r23,`$FRAME-$SIZE_T*9`($sp)
491 $PUSH r24,`$FRAME-$SIZE_T*8`($sp)
492 $PUSH r25,`$FRAME-$SIZE_T*7`($sp)
493 $PUSH r26,`$FRAME-$SIZE_T*6`($sp)
494 $PUSH r27,`$FRAME-$SIZE_T*5`($sp)
495 $PUSH r28,`$FRAME-$SIZE_T*4`($sp)
496 $PUSH r29,`$FRAME-$SIZE_T*3`($sp)
497 $PUSH r30,`$FRAME-$SIZE_T*2`($sp)
498 $PUSH r31,`$FRAME-$SIZE_T*1`($sp)
500 $PUSH r0, `$FRAME+$LRSAVE`($sp)
501 mtspr 256,r12 # preserve 29 AltiVec registers
503 bl Lconsts # returns pointer Lsigma in r12
508 li @x[4],31 # 31 is not a typo
509 li @x[5],15 # nor is 15
511 lvx @K[1],0,$key # load key
512 ?lvsr $T0,0,$key # prepare unaligned load
516 lvx @K[3],0,$ctr # load counter
517 ?lvsr $T1,0,$ctr # prepare unaligned load
520 lvx @K[0],0,r12 # load constants
521 lvx @K[5],@x[0],r12 # one
523 lvx $sixteen,@x[2],r12
524 lvx $twenty4,@x[3],r12
526 ?vperm @K[1],@K[2],@K[1],$T0 # align key
527 ?vperm @K[2],@D[0],@K[2],$T0
528 ?vperm @K[3],@D[1],@K[3],$T1 # align counter
530 lwz @d[0],0($ctr) # load counter to GPR
532 vadduwm @K[3],@K[3],@K[5] # adjust AltiVec counter
534 vadduwm @K[4],@K[3],@K[5]
536 vadduwm @K[5],@K[4],@K[5]
538 vxor $T0,$T0,$T0 # 0x00..00
539 vspltisw $outmask,-1 # 0xff..ff
540 ?lvsr $inpperm,0,$inp # prepare for unaligned load
541 ?lvsl $outperm,0,$out # prepare for unaligned store
542 ?vperm $outmask,$outmask,$T0,$outperm
544 be?lvsl $T0,0,@x[0] # 0x00..0f
545 be?vspltisb $T1,3 # 0x03..03
546 be?vxor $T0,$T0,$T1 # swap bytes within words
547 be?vxor $outperm,$outperm,$T1
548 be?vperm $inpperm,$inpperm,$inpperm,$T0
550 li r0,10 # inner loop counter
555 lis @x[0],0x6170 # synthesize sigma
561 ori @x[0],@x[0],0x7865
562 ori @x[1],@x[1],0x646e
564 ori @x[2],@x[2],0x2d32
565 ori @x[3],@x[3],0x6574
568 lwz @x[4],0($key) # load key to GPR
578 mr @x[12],@d[0] # copy GPR counter
594 vspltisw $twelve,12 # synthesize constants
601 my @thread0=&VMXROUND($A0,$B0,$C0,$D0,0);
602 my @thread1=&VMXROUND($A1,$B1,$C1,$D1,0);
603 my @thread2=&VMXROUND($A2,$B2,$C2,$D2,0);
604 my @thread3=&ROUND(0,4,8,12);
608 eval(shift(@thread1));
609 eval(shift(@thread2));
611 eval(shift(@thread3));
612 eval(shift(@thread3));
613 eval(shift(@thread3));
615 foreach (@thread3) { eval; }
617 @thread0=&VMXROUND($A0,$B0,$C0,$D0,1);
618 @thread1=&VMXROUND($A1,$B1,$C1,$D1,1);
619 @thread2=&VMXROUND($A2,$B2,$C2,$D2,1);
620 @thread3=&ROUND(0,5,10,15);
624 eval(shift(@thread1));
625 eval(shift(@thread2));
627 eval(shift(@thread3));
628 eval(shift(@thread3));
629 eval(shift(@thread3));
631 foreach (@thread3) { eval; }
635 subi $len,$len,256 # $len-=256
636 addi @x[0],@x[0],0x7865 # accumulate key block
637 addi @x[1],@x[1],0x646e
638 addi @x[2],@x[2],0x2d32
639 addi @x[3],@x[3],0x6574
640 addis @x[0],@x[0],0x6170
641 addis @x[1],@x[1],0x3320
642 addis @x[2],@x[2],0x7962
643 addis @x[3],@x[3],0x6b20
644 add @x[4],@x[4],@t[0]
646 add @x[5],@x[5],@t[1]
648 add @x[6],@x[6],@t[2]
650 add @x[7],@x[7],@t[3]
652 add @x[8],@x[8],@t[0]
653 add @x[9],@x[9],@t[1]
654 add @x[10],@x[10],@t[2]
655 add @x[11],@x[11],@t[3]
656 add @x[12],@x[12],@d[0]
657 add @x[13],@x[13],@d[1]
658 add @x[14],@x[14],@d[2]
659 add @x[15],@x[15],@d[3]
661 vadduwm $A0,$A0,@K[0] # accumulate key block
662 vadduwm $A1,$A1,@K[0]
663 vadduwm $A2,$A2,@K[0]
664 vadduwm $B0,$B0,@K[1]
665 vadduwm $B1,$B1,@K[1]
666 vadduwm $B2,$B2,@K[1]
667 vadduwm $C0,$C0,@K[2]
668 vadduwm $C1,$C1,@K[2]
669 vadduwm $C2,$C2,@K[2]
670 vadduwm $D0,$D0,@K[3]
671 vadduwm $D1,$D1,@K[4]
672 vadduwm $D2,$D2,@K[5]
674 addi @d[0],@d[0],4 # increment counter
675 vadduwm @K[3],@K[3],$FOUR
676 vadduwm @K[4],@K[4],$FOUR
677 vadduwm @K[5],@K[5],$FOUR
680 if (!$LITTLE_ENDIAN) { for($i=0;$i<16;$i++) { # flip byte order
683 rotlwi @x[$i],@x[$i],8
684 rlwimi @x[$i],@t[$i&3],24,0,7
685 rlwimi @x[$i],@t[$i&3],24,16,23
689 lwz @t[0],0($inp) # load input, aligned or not
693 xor @x[0],@x[0],@t[0] # xor with input
695 xor @x[1],@x[1],@t[1]
697 xor @x[2],@x[2],@t[2]
699 xor @x[3],@x[3],@t[3]
701 xor @x[4],@x[4],@t[0]
703 xor @x[5],@x[5],@t[1]
705 xor @x[6],@x[6],@t[2]
707 xor @x[7],@x[7],@t[3]
709 xor @x[8],@x[8],@t[0]
711 xor @x[9],@x[9],@t[1]
713 xor @x[10],@x[10],@t[2]
715 xor @x[11],@x[11],@t[3]
717 xor @x[12],@x[12],@t[0]
718 stw @x[0],0($out) # store output, aligned or not
719 xor @x[13],@x[13],@t[1]
721 xor @x[14],@x[14],@t[2]
723 xor @x[15],@x[15],@t[3]
744 lvx @D[0],0,$inp # load input
751 ?vperm @D[0],@D[1],@D[0],$inpperm # align input
752 ?vperm @D[1],@D[2],@D[1],$inpperm
753 ?vperm @D[2],@D[3],@D[2],$inpperm
754 ?vperm @D[3],@D[4],@D[3],$inpperm
755 vxor $A0,$A0,@D[0] # xor with input
757 lvx @D[1],@t[0],$inp # keep loading input
764 li @t[3],63 # 63 is not a typo
765 vperm $A0,$A0,$A0,$outperm # pre-misalign output
766 vperm $B0,$B0,$B0,$outperm
767 vperm $C0,$C0,$C0,$outperm
768 vperm $D0,$D0,$D0,$outperm
770 ?vperm @D[4],@D[1],@D[4],$inpperm # align input
771 ?vperm @D[1],@D[2],@D[1],$inpperm
772 ?vperm @D[2],@D[3],@D[2],$inpperm
773 ?vperm @D[3],@D[0],@D[3],$inpperm
776 lvx @D[1],@t[0],$inp # keep loading input
781 lvx @D[4],@t[3],$inp # redundant in aligned case
783 vperm $A1,$A1,$A1,$outperm # pre-misalign output
784 vperm $B1,$B1,$B1,$outperm
785 vperm $C1,$C1,$C1,$outperm
786 vperm $D1,$D1,$D1,$outperm
788 ?vperm @D[0],@D[1],@D[0],$inpperm # align input
789 ?vperm @D[1],@D[2],@D[1],$inpperm
790 ?vperm @D[2],@D[3],@D[2],$inpperm
791 ?vperm @D[3],@D[4],@D[3],$inpperm
796 vperm $A2,$A2,$A2,$outperm # pre-misalign output
797 vperm $B2,$B2,$B2,$outperm
798 vperm $C2,$C2,$C2,$outperm
799 vperm $D2,$D2,$D2,$outperm
801 andi. @x[1],$out,15 # is $out aligned?
804 vsel @D[0],$A0,$B0,$outmask # collect pre-misaligned output
805 vsel @D[1],$B0,$C0,$outmask
806 vsel @D[2],$C0,$D0,$outmask
807 vsel @D[3],$D0,$A1,$outmask
808 vsel $B0,$A1,$B1,$outmask
809 vsel $C0,$B1,$C1,$outmask
810 vsel $D0,$C1,$D1,$outmask
811 vsel $A1,$D1,$A2,$outmask
812 vsel $B1,$A2,$B2,$outmask
813 vsel $C1,$B2,$C2,$outmask
814 vsel $D1,$C2,$D2,$outmask
816 #stvx $A0,0,$out # take it easy on the edges
817 stvx @D[0],@t[0],$out # store output
818 stvx @D[1],@t[1],$out
819 stvx @D[2],@t[2],$out
834 sub @x[2],$out,@x[1] # in misaligned case edges
835 li @x[3],0 # are written byte-by-byte
837 stvebx $D2,@x[3],@x[2]
840 bne Lunaligned_tail_vmx
842 sub @x[2],@x[0],@x[1]
844 stvebx $A0,@x[1],@x[2]
847 bne Lunaligned_head_vmx
849 ${UCMP}i $len,255 # done with 256-byte blocks yet?
856 stvx $A0,0,@x[0] # head hexaword was not stored
858 ${UCMP}i $len,255 # done with 256-byte blocks yet?
863 ${UCMP}i $len,0 # done yet?
866 lwz r12,`$FRAME-$SIZE_T*18-4`($sp) # pull vrsave
867 li r10,`15+$LOCALS+64`
868 li r11,`31+$LOCALS+64`
869 mtspr 256,r12 # restore vrsave
886 $POP r0, `$FRAME+$LRSAVE`($sp)
887 $POP r14,`$FRAME-$SIZE_T*18`($sp)
888 $POP r15,`$FRAME-$SIZE_T*17`($sp)
889 $POP r16,`$FRAME-$SIZE_T*16`($sp)
890 $POP r17,`$FRAME-$SIZE_T*15`($sp)
891 $POP r18,`$FRAME-$SIZE_T*14`($sp)
892 $POP r19,`$FRAME-$SIZE_T*13`($sp)
893 $POP r20,`$FRAME-$SIZE_T*12`($sp)
894 $POP r21,`$FRAME-$SIZE_T*11`($sp)
895 $POP r22,`$FRAME-$SIZE_T*10`($sp)
896 $POP r23,`$FRAME-$SIZE_T*9`($sp)
897 $POP r24,`$FRAME-$SIZE_T*8`($sp)
898 $POP r25,`$FRAME-$SIZE_T*7`($sp)
899 $POP r26,`$FRAME-$SIZE_T*6`($sp)
900 $POP r27,`$FRAME-$SIZE_T*5`($sp)
901 $POP r28,`$FRAME-$SIZE_T*4`($sp)
902 $POP r29,`$FRAME-$SIZE_T*3`($sp)
903 $POP r30,`$FRAME-$SIZE_T*2`($sp)
904 $POP r31,`$FRAME-$SIZE_T*1`($sp)
909 .byte 0,12,0x04,1,0x80,18,5,0
911 .size .ChaCha20_ctr32_vmx,.-.ChaCha20_ctr32_vmx
915 my ($xa0,$xa1,$xa2,$xa3, $xb0,$xb1,$xb2,$xb3,
916 $xc0,$xc1,$xc2,$xc3, $xd0,$xd1,$xd2,$xd3) = map("v$_",(0..15));
917 my @K = map("v$_",(16..19));
919 my ($xt0,$xt1,$xt2,$xt3) = map("v$_",(27..30));
920 my ($sixteen,$twelve,$eight,$seven) = ($xt0,$xt1,$xt2,$xt3);
923 my ($x00,$x10,$x20,$x30) = (0, map("r$_",(8..10)));
925 my $FRAME=$LOCALS+64+7*16; # 7*16 is for v26-v31 offload
928 my ($a0,$b0,$c0,$d0)=@_;
929 my ($a1,$b1,$c1,$d1)=map(($_&~3)+(($_+1)&3),($a0,$b0,$c0,$d0));
930 my ($a2,$b2,$c2,$d2)=map(($_&~3)+(($_+1)&3),($a1,$b1,$c1,$d1));
931 my ($a3,$b3,$c3,$d3)=map(($_&~3)+(($_+1)&3),($a2,$b2,$c2,$d2));
932 my @x=map("\"v$_\"",(0..15));
935 "&vadduwm (@x[$a0],@x[$a0],@x[$b0])", # Q1
936 "&vadduwm (@x[$a1],@x[$a1],@x[$b1])", # Q2
937 "&vadduwm (@x[$a2],@x[$a2],@x[$b2])", # Q3
938 "&vadduwm (@x[$a3],@x[$a3],@x[$b3])", # Q4
939 "&vxor (@x[$d0],@x[$d0],@x[$a0])",
940 "&vxor (@x[$d1],@x[$d1],@x[$a1])",
941 "&vxor (@x[$d2],@x[$d2],@x[$a2])",
942 "&vxor (@x[$d3],@x[$d3],@x[$a3])",
943 "&vrlw (@x[$d0],@x[$d0],'$sixteen')",
944 "&vrlw (@x[$d1],@x[$d1],'$sixteen')",
945 "&vrlw (@x[$d2],@x[$d2],'$sixteen')",
946 "&vrlw (@x[$d3],@x[$d3],'$sixteen')",
948 "&vadduwm (@x[$c0],@x[$c0],@x[$d0])",
949 "&vadduwm (@x[$c1],@x[$c1],@x[$d1])",
950 "&vadduwm (@x[$c2],@x[$c2],@x[$d2])",
951 "&vadduwm (@x[$c3],@x[$c3],@x[$d3])",
952 "&vxor (@x[$b0],@x[$b0],@x[$c0])",
953 "&vxor (@x[$b1],@x[$b1],@x[$c1])",
954 "&vxor (@x[$b2],@x[$b2],@x[$c2])",
955 "&vxor (@x[$b3],@x[$b3],@x[$c3])",
956 "&vrlw (@x[$b0],@x[$b0],'$twelve')",
957 "&vrlw (@x[$b1],@x[$b1],'$twelve')",
958 "&vrlw (@x[$b2],@x[$b2],'$twelve')",
959 "&vrlw (@x[$b3],@x[$b3],'$twelve')",
961 "&vadduwm (@x[$a0],@x[$a0],@x[$b0])",
962 "&vadduwm (@x[$a1],@x[$a1],@x[$b1])",
963 "&vadduwm (@x[$a2],@x[$a2],@x[$b2])",
964 "&vadduwm (@x[$a3],@x[$a3],@x[$b3])",
965 "&vxor (@x[$d0],@x[$d0],@x[$a0])",
966 "&vxor (@x[$d1],@x[$d1],@x[$a1])",
967 "&vxor (@x[$d2],@x[$d2],@x[$a2])",
968 "&vxor (@x[$d3],@x[$d3],@x[$a3])",
969 "&vrlw (@x[$d0],@x[$d0],'$eight')",
970 "&vrlw (@x[$d1],@x[$d1],'$eight')",
971 "&vrlw (@x[$d2],@x[$d2],'$eight')",
972 "&vrlw (@x[$d3],@x[$d3],'$eight')",
974 "&vadduwm (@x[$c0],@x[$c0],@x[$d0])",
975 "&vadduwm (@x[$c1],@x[$c1],@x[$d1])",
976 "&vadduwm (@x[$c2],@x[$c2],@x[$d2])",
977 "&vadduwm (@x[$c3],@x[$c3],@x[$d3])",
978 "&vxor (@x[$b0],@x[$b0],@x[$c0])",
979 "&vxor (@x[$b1],@x[$b1],@x[$c1])",
980 "&vxor (@x[$b2],@x[$b2],@x[$c2])",
981 "&vxor (@x[$b3],@x[$b3],@x[$c3])",
982 "&vrlw (@x[$b0],@x[$b0],'$seven')",
983 "&vrlw (@x[$b1],@x[$b1],'$seven')",
984 "&vrlw (@x[$b2],@x[$b2],'$seven')",
985 "&vrlw (@x[$b3],@x[$b3],'$seven')"
991 .globl .ChaCha20_ctr32_vsx
994 $STU $sp,-$FRAME($sp)
996 li r10,`15+$LOCALS+64`
997 li r11,`31+$LOCALS+64`
1009 stw r12,`$FRAME-4`($sp) # save vrsave
1011 $PUSH r0, `$FRAME+$LRSAVE`($sp)
1012 mtspr 256,r12 # preserve 29 AltiVec registers
1014 bl Lconsts # returns pointer Lsigma in r12
1015 lvx_4w @K[0],0,r12 # load sigma
1022 lvx_4w @K[1],0,$key # load key
1023 lvx_4w @K[2],$x10,$key
1024 lvx_4w @K[3],0,$ctr # load counter
1029 vsldoi @K[3],@K[3],$xt0,4
1030 vsldoi @K[3],$xt0,@K[3],12 # clear @K[3].word[0]
1031 vadduwm $CTR,$CTR,$xt1
1033 be?lvsl $beperm,0,$x10 # 0x00..0f
1034 be?vspltisb $xt0,3 # 0x03..03
1035 be?vxor $beperm,$beperm,$xt0 # swap bytes within words
1037 li r0,10 # inner loop counter
1043 lvx $xa0,$x00,r12 # load [smashed] sigma
1048 vspltw $xb0,@K[1],0 # smash the key
1058 vmr $xd0,$CTR # smash the counter
1063 vspltisw $sixteen,-16 # synthesize constants
1070 foreach (&VSX_lane_ROUND(0, 4, 8,12)) { eval; }
1071 foreach (&VSX_lane_ROUND(0, 5,10,15)) { eval; }
1075 vadduwm $xd0,$xd0,$CTR
1077 vmrgew $xt0,$xa0,$xa1 # transpose data
1078 vmrgew $xt1,$xa2,$xa3
1079 vmrgow $xa0,$xa0,$xa1
1080 vmrgow $xa2,$xa2,$xa3
1081 vmrgew $xt2,$xb0,$xb1
1082 vmrgew $xt3,$xb2,$xb3
1083 vpermdi $xa1,$xa0,$xa2,0b00
1084 vpermdi $xa3,$xa0,$xa2,0b11
1085 vpermdi $xa0,$xt0,$xt1,0b00
1086 vpermdi $xa2,$xt0,$xt1,0b11
1088 vmrgow $xb0,$xb0,$xb1
1089 vmrgow $xb2,$xb2,$xb3
1090 vmrgew $xt0,$xc0,$xc1
1091 vmrgew $xt1,$xc2,$xc3
1092 vpermdi $xb1,$xb0,$xb2,0b00
1093 vpermdi $xb3,$xb0,$xb2,0b11
1094 vpermdi $xb0,$xt2,$xt3,0b00
1095 vpermdi $xb2,$xt2,$xt3,0b11
1097 vmrgow $xc0,$xc0,$xc1
1098 vmrgow $xc2,$xc2,$xc3
1099 vmrgew $xt2,$xd0,$xd1
1100 vmrgew $xt3,$xd2,$xd3
1101 vpermdi $xc1,$xc0,$xc2,0b00
1102 vpermdi $xc3,$xc0,$xc2,0b11
1103 vpermdi $xc0,$xt0,$xt1,0b00
1104 vpermdi $xc2,$xt0,$xt1,0b11
1106 vmrgow $xd0,$xd0,$xd1
1107 vmrgow $xd2,$xd2,$xd3
1109 vadduwm $CTR,$CTR,$xt0 # next counter value
1110 vpermdi $xd1,$xd0,$xd2,0b00
1111 vpermdi $xd3,$xd0,$xd2,0b11
1112 vpermdi $xd0,$xt2,$xt3,0b00
1113 vpermdi $xd2,$xt2,$xt3,0b11
1115 vadduwm $xa0,$xa0,@K[0]
1116 vadduwm $xb0,$xb0,@K[1]
1117 vadduwm $xc0,$xc0,@K[2]
1118 vadduwm $xd0,$xd0,@K[3]
1120 be?vperm $xa0,$xa0,$xa0,$beperm
1121 be?vperm $xb0,$xb0,$xb0,$beperm
1122 be?vperm $xc0,$xc0,$xc0,$beperm
1123 be?vperm $xd0,$xd0,$xd0,$beperm
1128 lvx_4w $xt0,$x00,$inp
1129 lvx_4w $xt1,$x10,$inp
1130 lvx_4w $xt2,$x20,$inp
1131 lvx_4w $xt3,$x30,$inp
1138 stvx_4w $xt0,$x00,$out
1139 stvx_4w $xt1,$x10,$out
1141 stvx_4w $xt2,$x20,$out
1143 stvx_4w $xt3,$x30,$out
1147 vadduwm $xa0,$xa1,@K[0]
1148 vadduwm $xb0,$xb1,@K[1]
1149 vadduwm $xc0,$xc1,@K[2]
1150 vadduwm $xd0,$xd1,@K[3]
1152 be?vperm $xa0,$xa0,$xa0,$beperm
1153 be?vperm $xb0,$xb0,$xb0,$beperm
1154 be?vperm $xc0,$xc0,$xc0,$beperm
1155 be?vperm $xd0,$xd0,$xd0,$beperm
1160 lvx_4w $xt0,$x00,$inp
1161 lvx_4w $xt1,$x10,$inp
1162 lvx_4w $xt2,$x20,$inp
1163 lvx_4w $xt3,$x30,$inp
1170 stvx_4w $xt0,$x00,$out
1171 stvx_4w $xt1,$x10,$out
1173 stvx_4w $xt2,$x20,$out
1175 stvx_4w $xt3,$x30,$out
1179 vadduwm $xa0,$xa2,@K[0]
1180 vadduwm $xb0,$xb2,@K[1]
1181 vadduwm $xc0,$xc2,@K[2]
1182 vadduwm $xd0,$xd2,@K[3]
1184 be?vperm $xa0,$xa0,$xa0,$beperm
1185 be?vperm $xb0,$xb0,$xb0,$beperm
1186 be?vperm $xc0,$xc0,$xc0,$beperm
1187 be?vperm $xd0,$xd0,$xd0,$beperm
1192 lvx_4w $xt0,$x00,$inp
1193 lvx_4w $xt1,$x10,$inp
1194 lvx_4w $xt2,$x20,$inp
1195 lvx_4w $xt3,$x30,$inp
1202 stvx_4w $xt0,$x00,$out
1203 stvx_4w $xt1,$x10,$out
1205 stvx_4w $xt2,$x20,$out
1207 stvx_4w $xt3,$x30,$out
1211 vadduwm $xa0,$xa3,@K[0]
1212 vadduwm $xb0,$xb3,@K[1]
1213 vadduwm $xc0,$xc3,@K[2]
1214 vadduwm $xd0,$xd3,@K[3]
1216 be?vperm $xa0,$xa0,$xa0,$beperm
1217 be?vperm $xb0,$xb0,$xb0,$beperm
1218 be?vperm $xc0,$xc0,$xc0,$beperm
1219 be?vperm $xd0,$xd0,$xd0,$beperm
1224 lvx_4w $xt0,$x00,$inp
1225 lvx_4w $xt1,$x10,$inp
1226 lvx_4w $xt2,$x20,$inp
1227 lvx_4w $xt3,$x30,$inp
1234 stvx_4w $xt0,$x00,$out
1235 stvx_4w $xt1,$x10,$out
1237 stvx_4w $xt2,$x20,$out
1239 stvx_4w $xt3,$x30,$out
1245 lwz r12,`$FRAME-4`($sp) # pull vrsave
1246 li r10,`15+$LOCALS+64`
1247 li r11,`31+$LOCALS+64`
1248 $POP r0, `$FRAME+$LRSAVE`($sp)
1249 mtspr 256,r12 # restore vrsave
1266 addi r11,$sp,$LOCALS
1268 stvx_4w $xa0,$x00,r11 # offload block to stack
1269 stvx_4w $xb0,$x10,r11
1270 stvx_4w $xc0,$x20,r11
1271 stvx_4w $xd0,$x30,r11
1272 subi r12,r11,1 # prepare for *++ptr
1283 stvx_4w $K[0],$x00,r11 # wipe copy of the block
1284 stvx_4w $K[0],$x10,r11
1285 stvx_4w $K[0],$x20,r11
1286 stvx_4w $K[0],$x30,r11
1290 .byte 0,12,0x04,1,0x80,0,5,0
1292 .size .ChaCha20_ctr32_vsx,.-.ChaCha20_ctr32_vsx
1300 mflr r12 #vvvvv "distance between . and Lsigma
1305 .byte 0,12,0x14,0,0,0,0,0
1308 .long 0x61707865,0x3320646e,0x79622d32,0x6b206574
1312 $code.=<<___ if ($LITTLE_ENDIAN);
1313 .long 0x0e0f0c0d,0x0a0b0809,0x06070405,0x02030001
1314 .long 0x0d0e0f0c,0x090a0b08,0x05060704,0x01020300
1316 $code.=<<___ if (!$LITTLE_ENDIAN); # flipped words
1317 .long 0x02030001,0x06070405,0x0a0b0809,0x0e0f0c0d
1318 .long 0x01020300,0x05060704,0x090a0b08,0x0d0e0f0c
1321 .long 0x61707865,0x61707865,0x61707865,0x61707865
1322 .long 0x3320646e,0x3320646e,0x3320646e,0x3320646e
1323 .long 0x79622d32,0x79622d32,0x79622d32,0x79622d32
1324 .long 0x6b206574,0x6b206574,0x6b206574,0x6b206574
1326 .asciz "ChaCha20 for PowerPC/AltiVec, CRYPTOGAMS by <appro\@openssl.org>"
1330 foreach (split("\n",$code)) {
1331 s/\`([^\`]*)\`/eval $1/ge;
1333 # instructions prefixed with '?' are endian-specific and need
1334 # to be adjusted accordingly...
1335 if ($flavour !~ /le$/) { # big-endian
1340 s/\?(vperm\s+v[0-9]+,\s*)(v[0-9]+,\s*)(v[0-9]+,\s*)(v[0-9]+)/$1$3$2$4/ or
1341 s/vrldoi(\s+v[0-9]+,\s*)(v[0-9]+,)\s*([0-9]+)/vsldoi$1$2$2 16-$3/;
1342 } else { # little-endian
1346 s/vrldoi(\s+v[0-9]+,\s*)(v[0-9]+,)\s*([0-9]+)/vsldoi$1$2$2 $3/;
1352 close STDOUT or die "error closing STDOUT: $!";