2 # Copyright 2014-2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
17 # GHASH for for PowerISA v2.07.
21 # Accurate performance measurements are problematic, because it's
22 # always virtualized setup with possibly throttled processor.
23 # Relative comparison is therefore more informative. This initial
24 # version is ~2.1x slower than hardware-assisted AES-128-CTR, ~12x
25 # faster than "4-bit" integer-only compiler-generated 64-bit code.
26 # "Initial version" means that there is room for further improvement.
30 # 2x aggregated reduction improves performance by 50% (resulting
31 # performance on POWER8 is 1 cycle per processed byte), and 4x
32 # aggregated reduction - by 170% or 2.7x (resulting in 0.55 cpb).
37 if ($flavour =~ /64/) {
45 } elsif ($flavour =~ /32/) {
53 } else { die "nonsense $flavour"; }
56 $FRAME=6*$SIZE_T+13*16; # 13*16 is for v20-v31 offload
58 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
59 ( $xlate="${dir}ppc-xlate.pl" and -f $xlate ) or
60 ( $xlate="${dir}../../perlasm/ppc-xlate.pl" and -f $xlate) or
61 die "can't locate ppc-xlate.pl";
63 open STDOUT,"| $^X $xlate $flavour $output" || die "can't call $xlate: $!";
65 my ($Xip,$Htbl,$inp,$len)=map("r$_",(3..6)); # argument block
67 my ($Xl,$Xm,$Xh,$IN)=map("v$_",(0..3));
68 my ($zero,$t0,$t1,$t2,$xC2,$H,$Hh,$Hl,$lemask)=map("v$_",(4..12));
69 my ($Xl1,$Xm1,$Xh1,$IN1,$H2,$H2h,$H2l)=map("v$_",(13..19));
86 lvx_u $H,0,r4 # load H
88 vspltisb $xC2,-16 # 0xf0
90 vaddubm $xC2,$xC2,$xC2 # 0xe0
91 vxor $zero,$zero,$zero
92 vor $xC2,$xC2,$t0 # 0xe1
93 vsldoi $xC2,$xC2,$zero,15 # 0xe1...
94 vsldoi $t1,$zero,$t0,1 # ...1
95 vaddubm $xC2,$xC2,$xC2 # 0xc2...
97 vor $xC2,$xC2,$t1 # 0xc2....01
98 vspltb $t1,$H,0 # most significant byte
100 vsrab $t1,$t1,$t2 # broadcast carry bit
102 vxor $IN,$H,$t1 # twisted H
104 vsldoi $H,$IN,$IN,8 # twist even more ...
105 vsldoi $xC2,$zero,$xC2,8 # 0xc2.0
106 vsldoi $Hl,$zero,$H,8 # ... and split
107 vsldoi $Hh,$H,$zero,8
109 stvx_u $xC2,0,r3 # save pre-computed table
117 vpmsumd $Xl,$IN,$Hl # H.lo·H.lo
118 vpmsumd $Xm,$IN,$H # H.hi·H.lo+H.lo·H.hi
119 vpmsumd $Xh,$IN,$Hh # H.hi·H.hi
121 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
123 vsldoi $t0,$Xm,$zero,8
124 vsldoi $t1,$zero,$Xm,8
131 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
136 vsldoi $H2,$IN1,$IN1,8
137 vsldoi $H2l,$zero,$H2,8
138 vsldoi $H2h,$H2,$zero,8
140 stvx_u $H2l,r8,r3 # save H^2
148 my ($t4,$t5,$t6) = ($Hl,$H,$Hh);
150 vpmsumd $Xl,$IN,$H2l # H.lo·H^2.lo
151 vpmsumd $Xl1,$IN1,$H2l # H^2.lo·H^2.lo
152 vpmsumd $Xm,$IN,$H2 # H.hi·H^2.lo+H.lo·H^2.hi
153 vpmsumd $Xm1,$IN1,$H2 # H^2.hi·H^2.lo+H^2.lo·H^2.hi
154 vpmsumd $Xh,$IN,$H2h # H.hi·H^2.hi
155 vpmsumd $Xh1,$IN1,$H2h # H^2.hi·H^2.hi
157 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
158 vpmsumd $t6,$Xl1,$xC2 # 1st reduction phase
160 vsldoi $t0,$Xm,$zero,8
161 vsldoi $t1,$zero,$Xm,8
162 vsldoi $t4,$Xm1,$zero,8
163 vsldoi $t5,$zero,$Xm1,8
170 vsldoi $Xl1,$Xl1,$Xl1,8
174 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
175 vsldoi $t5,$Xl1,$Xl1,8 # 2nd reduction phase
177 vpmsumd $Xl1,$Xl1,$xC2
184 vsldoi $H2,$Xl1,$Xl1,8
185 vsldoi $Hl,$zero,$H,8
186 vsldoi $Hh,$H,$zero,8
187 vsldoi $H2l,$zero,$H2,8
188 vsldoi $H2h,$H2,$zero,8
190 stvx_u $Hl,r8,r3 # save H^3
196 stvx_u $H2l,r8,r3 # save H^4
203 .byte 0,12,0x14,0,0,0,2,0
205 .size .gcm_init_p8,.-.gcm_init_p8
218 lvx_u $IN,0,$Xip # load Xi
220 lvx_u $Hl,r8,$Htbl # load pre-computed table
221 le?lvsl $lemask,r0,r0
225 le?vxor $lemask,$lemask,$t0
227 le?vperm $IN,$IN,$IN,$lemask
228 vxor $zero,$zero,$zero
230 vpmsumd $Xl,$IN,$Hl # H.lo·Xi.lo
231 vpmsumd $Xm,$IN,$H # H.hi·Xi.lo+H.lo·Xi.hi
232 vpmsumd $Xh,$IN,$Hh # H.hi·Xi.hi
234 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
236 vsldoi $t0,$Xm,$zero,8
237 vsldoi $t1,$zero,$Xm,8
244 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
249 le?vperm $Xl,$Xl,$Xl,$lemask
250 stvx_u $Xl,0,$Xip # write out Xi
255 .byte 0,12,0x14,0,0,0,2,0
257 .size .gcm_gmult_p8,.-.gcm_gmult_p8
268 lvx_u $Xl,0,$Xip # load Xi
270 lvx_u $Hl,r8,$Htbl # load pre-computed table
272 le?lvsl $lemask,r0,r0
278 le?vxor $lemask,$lemask,$t0
280 le?vperm $Xl,$Xl,$Xl,$lemask
281 vxor $zero,$zero,$zero
289 le?vperm $IN,$IN,$IN,$lemask
293 lvx_u $H2l,r8,$Htbl # load H^2
296 add r9,$inp,$len # end of input
303 le?vperm $IN1,$IN1,$IN1,$lemask
306 vpmsumd $Xl,$IN,$H2l # H^2.lo·Xi.lo
307 vpmsumd $Xl1,$IN1,$Hl # H.lo·Xi+1.lo
308 subfe r0,r0,r0 # borrow?-1:0
309 vpmsumd $Xm,$IN,$H2 # H^2.hi·Xi.lo+H^2.lo·Xi.hi
310 vpmsumd $Xm1,$IN1,$H # H.hi·Xi+1.lo+H.lo·Xi+1.hi
312 vpmsumd $Xh,$IN,$H2h # H^2.hi·Xi.hi
313 vpmsumd $Xh1,$IN1,$Hh # H.hi·Xi+1.hi
319 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
321 vsldoi $t0,$Xm,$zero,8
322 vsldoi $t1,$zero,$Xm,8
332 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
334 le?vperm $IN,$IN,$IN,$lemask
339 bgt Loop_2x # done yet?
345 vpmsumd $Xl,$IN,$Hl # H.lo·Xi.lo
346 vpmsumd $Xm,$IN,$H # H.hi·Xi.lo+H.lo·Xi.hi
347 vpmsumd $Xh,$IN,$Hh # H.hi·Xi.hi
349 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
351 vsldoi $t0,$Xm,$zero,8
352 vsldoi $t1,$zero,$Xm,8
359 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
365 le?vperm $Xl,$Xl,$Xl,$lemask
366 stvx_u $Xl,0,$Xip # write out Xi
371 .byte 0,12,0x14,0,0,0,4,0
375 my ($Xl3,$Xm2,$IN2,$H3l,$H3,$H3h,
376 $Xh3,$Xm3,$IN3,$H4l,$H4,$H4h) = map("v$_",(20..31));
378 my ($H21l,$H21h,$loperm,$hiperm) = ($Hl,$Hh,$H2l,$H2h);
384 $STU $sp,-$FRAME($sp)
385 li r10,`15+6*$SIZE_T`
386 li r11,`31+6*$SIZE_T`
411 stw $vrsave,`$FRAME-4`($sp) # save vrsave
412 mtspr 256,r0 # preserve all AltiVec registers
414 lvsl $t0,0,r8 # 0x0001..0e0f
415 #lvx_u $H2l,r8,$Htbl # load H^2
419 vspltisb $t1,8 # 0x0808..0808
420 #lvx_u $H2h,r10,$Htbl
422 lvx_u $H3l,r8,$Htbl # load H^3
428 lvx_u $H4l,r8,$Htbl # load H^4
435 vsldoi $t2,$zero,$t1,8 # 0x0000..0808
436 vaddubm $hiperm,$t0,$t2 # 0x0001..1617
437 vaddubm $loperm,$t1,$hiperm # 0x0809..1e1f
439 $SHRI $len,$len,4 # this allows to use sign bit
441 lvx_u $IN0,0,$inp # load input
447 le?vperm $IN0,$IN0,$IN0,$lemask
448 le?vperm $IN1,$IN1,$IN1,$lemask
449 le?vperm $IN2,$IN2,$IN2,$lemask
450 le?vperm $IN3,$IN3,$IN3,$lemask
454 vpmsumd $Xl1,$IN1,$H3l
455 vpmsumd $Xm1,$IN1,$H3
456 vpmsumd $Xh1,$IN1,$H3h
458 vperm $H21l,$H2,$H,$hiperm
459 vperm $t0,$IN2,$IN3,$loperm
460 vperm $H21h,$H2,$H,$loperm
461 vperm $t1,$IN2,$IN3,$hiperm
462 vpmsumd $Xm2,$IN2,$H2 # H^2.lo·Xi+2.hi+H^2.hi·Xi+2.lo
463 vpmsumd $Xl3,$t0,$H21l # H^2.lo·Xi+2.lo+H.lo·Xi+3.lo
464 vpmsumd $Xm3,$IN3,$H # H.hi·Xi+3.lo +H.lo·Xi+3.hi
465 vpmsumd $Xh3,$t1,$H21h # H^2.hi·Xi+2.hi+H.hi·Xi+3.hi
481 le?vperm $IN1,$IN1,$IN1,$lemask
482 le?vperm $IN2,$IN2,$IN2,$lemask
483 le?vperm $IN3,$IN3,$IN3,$lemask
484 le?vperm $IN0,$IN0,$IN0,$lemask
486 vpmsumd $Xl,$Xh,$H4l # H^4.lo·Xi.lo
487 vpmsumd $Xm,$Xh,$H4 # H^4.hi·Xi.lo+H^4.lo·Xi.hi
488 vpmsumd $Xh,$Xh,$H4h # H^4.hi·Xi.hi
489 vpmsumd $Xl1,$IN1,$H3l
490 vpmsumd $Xm1,$IN1,$H3
491 vpmsumd $Xh1,$IN1,$H3h
496 vperm $t0,$IN2,$IN3,$loperm
497 vperm $t1,$IN2,$IN3,$hiperm
499 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
500 vpmsumd $Xl3,$t0,$H21l # H.lo·Xi+3.lo +H^2.lo·Xi+2.lo
501 vpmsumd $Xh3,$t1,$H21h # H.hi·Xi+3.hi +H^2.hi·Xi+2.hi
503 vsldoi $t0,$Xm,$zero,8
504 vsldoi $t1,$zero,$Xm,8
511 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
512 vpmsumd $Xm2,$IN2,$H2 # H^2.hi·Xi+2.lo+H^2.lo·Xi+2.hi
513 vpmsumd $Xm3,$IN3,$H # H.hi·Xi+3.lo +H.lo·Xi+3.hi
526 vpmsumd $Xl,$Xh,$H4l # H^4.lo·Xi.lo
527 vpmsumd $Xm,$Xh,$H4 # H^4.hi·Xi.lo+H^4.lo·Xi.hi
528 vpmsumd $Xh,$Xh,$H4h # H^4.hi·Xi.hi
533 vpmsumd $t2,$Xl,$xC2 # 1st reduction phase
535 vsldoi $t0,$Xm,$zero,8
536 vsldoi $t1,$zero,$Xm,8
544 vsldoi $t1,$Xl,$Xl,8 # 2nd reduction phase
561 le?vperm $IN0,$IN0,$IN0,$lemask
562 le?vperm $IN1,$IN1,$IN1,$lemask
563 le?vperm $IN2,$IN2,$IN2,$lemask
570 vperm $t0,$IN1,$IN2,$loperm
571 vperm $t1,$IN1,$IN2,$hiperm
572 vpmsumd $Xm2,$IN1,$H2 # H^2.lo·Xi+1.hi+H^2.hi·Xi+1.lo
573 vpmsumd $Xm3,$IN2,$H # H.hi·Xi+2.lo +H.lo·Xi+2.hi
574 vpmsumd $Xl3,$t0,$H21l # H^2.lo·Xi+1.lo+H.lo·Xi+2.lo
575 vpmsumd $Xh3,$t1,$H21h # H^2.hi·Xi+1.hi+H.hi·Xi+2.hi
582 le?vperm $IN0,$IN0,$IN0,$lemask
583 le?vperm $IN1,$IN1,$IN1,$lemask
586 vperm $t0,$zero,$IN1,$loperm
587 vperm $t1,$zero,$IN1,$hiperm
589 vsldoi $H4l,$zero,$H2,8
591 vsldoi $H4h,$H2,$zero,8
593 vpmsumd $Xl3,$t0, $H21l # H.lo·Xi+1.lo
594 vpmsumd $Xm3,$IN1,$H # H.hi·Xi+1.lo+H.lo·Xi+2.hi
595 vpmsumd $Xh3,$t1, $H21h # H.hi·Xi+1.hi
601 le?vperm $IN0,$IN0,$IN0,$lemask
603 vsldoi $H4l,$zero,$H,8
605 vsldoi $H4h,$H,$zero,8
615 le?vperm $Xl,$Xl,$Xl,$lemask
616 stvx_u $Xl,0,$Xip # write out Xi
618 li r10,`15+6*$SIZE_T`
619 li r11,`31+6*$SIZE_T`
646 .byte 0,12,0x04,0,0x80,0,4,0
651 .size .gcm_ghash_p8,.-.gcm_ghash_p8
653 .asciz "GHASH for PowerISA 2.07, CRYPTOGAMS by <appro\@openssl.org>"
657 foreach (split("\n",$code)) {
658 s/\`([^\`]*)\`/eval $1/geo;
660 if ($flavour =~ /le$/o) { # little-endian
670 close STDOUT; # enforce flush