3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
10 # Poly1305 hash for C64x+.
14 # Performance is [incredible for a 32-bit processor] 1.76 cycles per
15 # processed byte. Comparison to compiler-generated code is problematic,
16 # because results were observed to vary from 2.1 to 7.6 cpb depending
17 # on compiler's ability to inline small functions. Compiler also
18 # disables interrupts for some reason, thus making interrupt response
19 # time dependent on input length. This module on the other hand is free
20 # from such limitation.
23 open STDOUT,">$output";
25 ($CTXA,$INPB,$LEN,$PADBIT)=("A4","B4","A6","B6");
26 ($H0,$H1,$H2,$H3,$H4,$H4a)=("A8","B8","A10","B10","B2",$LEN);
27 ($D0,$D1,$D2,$D3)= ("A9","B9","A11","B11");
28 ($R0,$R1,$R2,$R3,$S1,$S2,$S3,$S3b)=("A0","B0","A1","B1","A12","B12","A13","B13");
29 ($THREE,$R0b,$S2a)=("B7","B5","A5");
34 .if .ASSEMBLER_VERSION<7000000
38 .asg poly1305_init,_poly1305_init
39 .asg poly1305_blocks,_poly1305_blocks
40 .asg poly1305_emit,_poly1305_emit
52 .global _poly1305_init
55 LDNDW *${INPB}[0],B17:B16 ; load key material
56 LDNDW *${INPB}[1],A17:A16
60 STDW B9:B8,*${CTXA}[0] ; initialize h1:h0
61 || SHRU B0,4,B0 ; 0x0fffffff
63 STDW B9:B8,*${CTXA}[1] ; initialize h3:h2
64 || AND B0,B1,B1 ; 0x0ffffffc
65 STW B8,*${CTXA}[4] ; initialize h4
78 AND B16,B0,B20 ; r0 = key[0] & 0x0fffffff
79 || AND B17,B1,B22 ; r1 = key[1] & 0x0ffffffc
80 || EXTU B17,4,6,B16 ; r1>>2
81 AND A16,B1,B21 ; r2 = key[2] & 0x0ffffffc
82 || AND A17,B1,A23 ; r3 = key[3] & 0x0ffffffc
85 || ADD B22,B16,B16 ; s1 = r1 + r1>>2
87 STDW B21:B20,*${CTXA}[3] ; save r2:r0
88 || ADD B21,B18,B18 ; s2 = r2 + r2>>2
91 STDW B23:B22,*${CTXA}[4] ; save r3:r1
92 || ADD B23,B17,B19 ; s3 = r3 + r3>>2
93 || ADD B23,B17,B17 ; s3 = r3 + r3>>2
94 STDW B17:B16,*${CTXA}[5] ; save s3:s1
95 STDW B19:B18,*${CTXA}[6] ; save s3:s2
99 .global _poly1305_blocks
102 .asmfunc stack_usage(40)
103 SHRU $LEN,4,A2 ; A2 is loop counter, number of blocks
104 [!A2] BNOP RA ; no data
105 || [A2] STW FP,*SP--(40) ; save frame pointer and alloca(40)
107 [A2] STDW B13:B12,*SP[4] ; ABI says so
108 || [A2] MV $CTXA,$S3b ; borrow $S3b
109 [A2] STDW B11:B10,*SP[3]
110 || [A2] STDW A13:A12,*FP[-3]
111 [A2] STDW A11:A10,*FP[-4]
113 || [A2] LDDW *${S3b}[0],B25:B24 ; load h1:h0
114 [A2] LDNW *${INPB}++[4],$D0 ; load inp[0]
115 [A2] LDNW *${INPB}[-3],$D1 ; load inp[1]
117 LDDW *${CTXA}[1],B29:B28 ; load h3:h2, B28 is h2
118 LDNW *${INPB}[-2],$D2 ; load inp[2]
119 LDNW *${INPB}[-1],$D3 ; load inp[3]
121 LDDW *${CTXA}[3],$R2:$R0 ; load r2:r0
122 || LDDW *${S3b}[4],$R3:$R1 ; load r3:r1
125 LDDW *${CTXA}[5],$S3:$S1 ; load s3:s1
126 || LDDW *${S3b}[6],$S3b:$S2 ; load s3:s2
130 ADDU $D0,B24,$D0:$H0 ; h0+=inp[0]
131 || ADD $D0,B24,B31 ; B-copy of h0+inp[0]
133 ADDU $D1,B25,$D1:$H1 ; h1+=inp[1]
136 LDW *${CTXA}[4],$H4 ; load h4
138 || MV B29,B30 ; B30 is h3
142 MPY32U $H0,$R0,A17:A16
143 || MPY32U B31,$R1,B17:B16 ; MPY32U $H0,$R1,B17:B16
144 || ADDU $D0,$D1:$H1,B25:B24 ; ADDU $D0,$D1:$H1,$D1:$H1
145 || ADDU $D2,B28,$D2:$H2 ; h2+=inp[2]
147 MPY32U $H0,$R2,A19:A18
148 || MPY32U B31,$R3,B19:B18 ; MPY32U $H0,$R3,B19:B18
149 || ADD $D0,$H1,A24 ; A-copy of B24
151 || [A2] SUB A2,1,A2 ; decrement loop counter
153 MPY32U A24,$S3,A21:A20 ; MPY32U $H1,$S3,A21:A20
154 || MPY32U B24,$R0b,B21:B20 ; MPY32U $H1,$R0,B21:B20
155 || ADDU B25,$D2:$H2,$D2:$H2 ; ADDU $D1,$D2:$H2,$D2:$H2
156 || ADDU $D3,B30,$D3:$H3 ; h3+=inp[3]
157 || ADD B25,$H2,B25 ; B-copy of $H2
158 MPY32U A24,$R1,A23:A22 ; MPY32U $H1,$R1,A23:A22
159 || MPY32U B24,$R2,B23:B22 ; MPY32U $H1,$R2,B23:B22
161 MPY32U $H2,$S2,A25:A24
162 || MPY32U B25,$S3b,B25:B24 ; MPY32U $H2,$S3,B25:B24
163 || ADDU $D2,$D3:$H3,$D3:$H3
164 || ADD $PADBIT,$H4,$H4 ; h4+=padbit
165 MPY32U $H2,$R0,A27:A26
166 || MPY32U $H2,$R1,B27:B26
170 MPY32U $H3,$S1,A29:A28
171 || MPY32U $H3,$S2,B29:B28
172 || ADD A21,A17,A21 ; start accumulating "d3:d0"
174 || ADDU A20,A16,A17:A16
175 || ADDU B20,B16,B17:B16
176 || [A2] LDNW *${INPB}++[4],$D0 ; load inp[0]
177 MPY32U $H3,$S3,A31:A30
178 || MPY32U $H3,$R0b,B31:B30
181 || ADDU A22,A18,A19:A18
182 || ADDU B22,B18,B19:B18
183 || [A2] LDNW *${INPB}[-3],$D1 ; load inp[1]
186 || MPY32 $H4,$S2a,A20
189 || ADDU A24,A17:A16,A17:A16
190 || ADDU B24,B17:B16,B17:B16
191 || [A2] LDNW *${INPB}[-2],$D2 ; load inp[2]
195 || ADDU A26,A19:A18,A19:A18
196 || ADDU B26,B19:B18,B19:B18
197 || [A2] LDNW *${INPB}[-1],$D3 ; load inp[3]
200 || ADD A29,A21,A21 ; final hi("d0")
201 || ADD B29,B21,B21 ; final hi("d1")
202 || ADDU A28,A17:A16,A17:A16 ; final lo("d0")
203 || ADDU B28,B17:B16,B17:B16
204 ADD A31,A23,A23 ; final hi("d2")
205 || ADD B31,B23,B23 ; final hi("d3")
206 || ADDU A30,A19:A18,A19:A18
207 || ADDU B30,B19:B18,B19:B18
208 ADDU B20,B17:B16,B17:B16 ; final lo("d1")
209 || ADDU A20,A19:A18,A19:A18 ; final lo("d2")
210 ADDU B22,B19:B18,B19:B18 ; final lo("d3")
212 || ADD A17,A21,A21 ; "flatten" "d3:d0"
213 MV A19,B29 ; move to avoid cross-path stalls
214 ADDU A21,B17:B16,B27:B26 ; B26 is h1
216 || DMV B29,A18,B29:B28 ; move to avoid cross-path stalls
217 ADDU B27,B29:B28,B29:B28 ; B28 is h2
218 || [A2] SWAP2 $D0,$D0
220 || [A2] SWAP4 $D0,$D0
221 ADDU B29,B19:B18,B31:B30 ; B30 is h3
223 || MV A16,B24 ; B24 is h0
224 || [A2] SWAP2 $D1,$D1
226 || [A2] SWAP4 $D1,$D1
228 SHRU $H4,2,B16 ; last reduction step
229 || AND $H4,$THREE,$H4
231 ADDAW B16,B16,B16 ; 5*(h4>>2)
233 ADDU B24,B16,B25:B24 ; B24 is h0
234 || [A2] SWAP2 $D2,$D2
235 ADDU B26,B25,B27:B26 ; B26 is h1
236 || [A2] SWAP4 $D2,$D2
237 ADDU B28,B27,B29:B28 ; B28 is h2
238 || [A2] ADDU $D0,B24,$D0:$H0 ; h0+=inp[0]
239 || [A2] ADD $D0,B24,B31 ; B-copy of h0+inp[0]
240 ADD B30,B29,B30 ; B30 is h3
241 || [A2] ADDU $D1,B26,$D1:$H1 ; h1+=inp[1]
242 ;;===== branch to loop? is taken here
244 LDDW *FP[-4],A11:A10 ; ABI says so
246 || LDDW *SP[3],B11:B10
250 LDW *++SP(40),FP ; restore frame pointer
252 STDW B25:B24,*${CTXA}[0] ; save h1:h0
253 STDW B29:B28,*${CTXA}[1] ; save h3:h2
254 STW $H4,*${CTXA}[4] ; save h4
259 my ($MAC,$NONCEA,$NONCEB)=($INPB,$LEN,$PADBIT);
262 .global _poly1305_emit
266 LDDW *${CTXA}[0],A17:A16 ; load h1:h0
267 LDDW *${CTXA}[1],A19:A18 ; load h3:h2
268 LDW *${CTXA}[4],A20 ; load h4
271 MVK 5,A22 ; compare to modulus
273 || LDW *${NONCEA}[0],A8
274 || LDW *${NONCEB}[1],B8
276 || LDW *${NONCEA}[2],A9
277 || LDW *${NONCEB}[3],B9
282 SHRU A29,2,A2 ; check for overflow in 130-th bit
284 [A2] MV A22,A16 ; select
289 || ADDU A8,A16,A23:A22 ; accumulate nonce
292 ADDU A23,A25:A24,A25:A24
295 ADDU A25,A27:A26,A27:A26
310 STNW A22,*${MAC}[0] ; write the result
319 .cstring "Poly1305 for C64x+, CRYPTOGAMS by <appro\@openssl.org>"