tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1/* SPDX-License-Identifier: GPL-2.0-or-later */
2/*
3 * Poly1305 authenticator algorithm, RFC7539, x64 SSE2 functions
4 *
5 * Copyright (C) 2015 Martin Willi
6 */
7
8#include <linux/linkage.h>
9
10.section .rodata.cst16.ANMASK, "aM", @progbits, 16
11.align 16
12ANMASK: .octa 0x0000000003ffffff0000000003ffffff
13
14.section .rodata.cst16.ORMASK, "aM", @progbits, 16
15.align 16
16ORMASK: .octa 0x00000000010000000000000001000000
17
18.text
19
20#define h0 0x00(%rdi)
21#define h1 0x04(%rdi)
22#define h2 0x08(%rdi)
23#define h3 0x0c(%rdi)
24#define h4 0x10(%rdi)
25#define r0 0x00(%rdx)
26#define r1 0x04(%rdx)
27#define r2 0x08(%rdx)
28#define r3 0x0c(%rdx)
29#define r4 0x10(%rdx)
30#define s1 0x00(%rsp)
31#define s2 0x04(%rsp)
32#define s3 0x08(%rsp)
33#define s4 0x0c(%rsp)
34#define m %rsi
35#define h01 %xmm0
36#define h23 %xmm1
37#define h44 %xmm2
38#define t1 %xmm3
39#define t2 %xmm4
40#define t3 %xmm5
41#define t4 %xmm6
42#define mask %xmm7
43#define d0 %r8
44#define d1 %r9
45#define d2 %r10
46#define d3 %r11
47#define d4 %r12
48
49ENTRY(poly1305_block_sse2)
50 # %rdi: Accumulator h[5]
51 # %rsi: 16 byte input block m
52 # %rdx: Poly1305 key r[5]
53 # %rcx: Block count
54
55 # This single block variant tries to improve performance by doing two
56 # multiplications in parallel using SSE instructions. There is quite
57 # some quardword packing involved, hence the speedup is marginal.
58
59 push %rbx
60 push %r12
61 sub $0x10,%rsp
62
63 # s1..s4 = r1..r4 * 5
64 mov r1,%eax
65 lea (%eax,%eax,4),%eax
66 mov %eax,s1
67 mov r2,%eax
68 lea (%eax,%eax,4),%eax
69 mov %eax,s2
70 mov r3,%eax
71 lea (%eax,%eax,4),%eax
72 mov %eax,s3
73 mov r4,%eax
74 lea (%eax,%eax,4),%eax
75 mov %eax,s4
76
77 movdqa ANMASK(%rip),mask
78
79.Ldoblock:
80 # h01 = [0, h1, 0, h0]
81 # h23 = [0, h3, 0, h2]
82 # h44 = [0, h4, 0, h4]
83 movd h0,h01
84 movd h1,t1
85 movd h2,h23
86 movd h3,t2
87 movd h4,h44
88 punpcklqdq t1,h01
89 punpcklqdq t2,h23
90 punpcklqdq h44,h44
91
92 # h01 += [ (m[3-6] >> 2) & 0x3ffffff, m[0-3] & 0x3ffffff ]
93 movd 0x00(m),t1
94 movd 0x03(m),t2
95 psrld $2,t2
96 punpcklqdq t2,t1
97 pand mask,t1
98 paddd t1,h01
99 # h23 += [ (m[9-12] >> 6) & 0x3ffffff, (m[6-9] >> 4) & 0x3ffffff ]
100 movd 0x06(m),t1
101 movd 0x09(m),t2
102 psrld $4,t1
103 psrld $6,t2
104 punpcklqdq t2,t1
105 pand mask,t1
106 paddd t1,h23
107 # h44 += [ (m[12-15] >> 8) | (1 << 24), (m[12-15] >> 8) | (1 << 24) ]
108 mov 0x0c(m),%eax
109 shr $8,%eax
110 or $0x01000000,%eax
111 movd %eax,t1
112 pshufd $0xc4,t1,t1
113 paddd t1,h44
114
115 # t1[0] = h0 * r0 + h2 * s3
116 # t1[1] = h1 * s4 + h3 * s2
117 movd r0,t1
118 movd s4,t2
119 punpcklqdq t2,t1
120 pmuludq h01,t1
121 movd s3,t2
122 movd s2,t3
123 punpcklqdq t3,t2
124 pmuludq h23,t2
125 paddq t2,t1
126 # t2[0] = h0 * r1 + h2 * s4
127 # t2[1] = h1 * r0 + h3 * s3
128 movd r1,t2
129 movd r0,t3
130 punpcklqdq t3,t2
131 pmuludq h01,t2
132 movd s4,t3
133 movd s3,t4
134 punpcklqdq t4,t3
135 pmuludq h23,t3
136 paddq t3,t2
137 # t3[0] = h4 * s1
138 # t3[1] = h4 * s2
139 movd s1,t3
140 movd s2,t4
141 punpcklqdq t4,t3
142 pmuludq h44,t3
143 # d0 = t1[0] + t1[1] + t3[0]
144 # d1 = t2[0] + t2[1] + t3[1]
145 movdqa t1,t4
146 punpcklqdq t2,t4
147 punpckhqdq t2,t1
148 paddq t4,t1
149 paddq t3,t1
150 movq t1,d0
151 psrldq $8,t1
152 movq t1,d1
153
154 # t1[0] = h0 * r2 + h2 * r0
155 # t1[1] = h1 * r1 + h3 * s4
156 movd r2,t1
157 movd r1,t2
158 punpcklqdq t2,t1
159 pmuludq h01,t1
160 movd r0,t2
161 movd s4,t3
162 punpcklqdq t3,t2
163 pmuludq h23,t2
164 paddq t2,t1
165 # t2[0] = h0 * r3 + h2 * r1
166 # t2[1] = h1 * r2 + h3 * r0
167 movd r3,t2
168 movd r2,t3
169 punpcklqdq t3,t2
170 pmuludq h01,t2
171 movd r1,t3
172 movd r0,t4
173 punpcklqdq t4,t3
174 pmuludq h23,t3
175 paddq t3,t2
176 # t3[0] = h4 * s3
177 # t3[1] = h4 * s4
178 movd s3,t3
179 movd s4,t4
180 punpcklqdq t4,t3
181 pmuludq h44,t3
182 # d2 = t1[0] + t1[1] + t3[0]
183 # d3 = t2[0] + t2[1] + t3[1]
184 movdqa t1,t4
185 punpcklqdq t2,t4
186 punpckhqdq t2,t1
187 paddq t4,t1
188 paddq t3,t1
189 movq t1,d2
190 psrldq $8,t1
191 movq t1,d3
192
193 # t1[0] = h0 * r4 + h2 * r2
194 # t1[1] = h1 * r3 + h3 * r1
195 movd r4,t1
196 movd r3,t2
197 punpcklqdq t2,t1
198 pmuludq h01,t1
199 movd r2,t2
200 movd r1,t3
201 punpcklqdq t3,t2
202 pmuludq h23,t2
203 paddq t2,t1
204 # t3[0] = h4 * r0
205 movd r0,t3
206 pmuludq h44,t3
207 # d4 = t1[0] + t1[1] + t3[0]
208 movdqa t1,t4
209 psrldq $8,t4
210 paddq t4,t1
211 paddq t3,t1
212 movq t1,d4
213
214 # d1 += d0 >> 26
215 mov d0,%rax
216 shr $26,%rax
217 add %rax,d1
218 # h0 = d0 & 0x3ffffff
219 mov d0,%rbx
220 and $0x3ffffff,%ebx
221
222 # d2 += d1 >> 26
223 mov d1,%rax
224 shr $26,%rax
225 add %rax,d2
226 # h1 = d1 & 0x3ffffff
227 mov d1,%rax
228 and $0x3ffffff,%eax
229 mov %eax,h1
230
231 # d3 += d2 >> 26
232 mov d2,%rax
233 shr $26,%rax
234 add %rax,d3
235 # h2 = d2 & 0x3ffffff
236 mov d2,%rax
237 and $0x3ffffff,%eax
238 mov %eax,h2
239
240 # d4 += d3 >> 26
241 mov d3,%rax
242 shr $26,%rax
243 add %rax,d4
244 # h3 = d3 & 0x3ffffff
245 mov d3,%rax
246 and $0x3ffffff,%eax
247 mov %eax,h3
248
249 # h0 += (d4 >> 26) * 5
250 mov d4,%rax
251 shr $26,%rax
252 lea (%rax,%rax,4),%rax
253 add %rax,%rbx
254 # h4 = d4 & 0x3ffffff
255 mov d4,%rax
256 and $0x3ffffff,%eax
257 mov %eax,h4
258
259 # h1 += h0 >> 26
260 mov %rbx,%rax
261 shr $26,%rax
262 add %eax,h1
263 # h0 = h0 & 0x3ffffff
264 andl $0x3ffffff,%ebx
265 mov %ebx,h0
266
267 add $0x10,m
268 dec %rcx
269 jnz .Ldoblock
270
271 # Zeroing of key material
272 mov %rcx,0x00(%rsp)
273 mov %rcx,0x08(%rsp)
274
275 add $0x10,%rsp
276 pop %r12
277 pop %rbx
278 ret
279ENDPROC(poly1305_block_sse2)
280
281
282#define u0 0x00(%r8)
283#define u1 0x04(%r8)
284#define u2 0x08(%r8)
285#define u3 0x0c(%r8)
286#define u4 0x10(%r8)
287#define hc0 %xmm0
288#define hc1 %xmm1
289#define hc2 %xmm2
290#define hc3 %xmm5
291#define hc4 %xmm6
292#define ru0 %xmm7
293#define ru1 %xmm8
294#define ru2 %xmm9
295#define ru3 %xmm10
296#define ru4 %xmm11
297#define sv1 %xmm12
298#define sv2 %xmm13
299#define sv3 %xmm14
300#define sv4 %xmm15
301#undef d0
302#define d0 %r13
303
304ENTRY(poly1305_2block_sse2)
305 # %rdi: Accumulator h[5]
306 # %rsi: 16 byte input block m
307 # %rdx: Poly1305 key r[5]
308 # %rcx: Doubleblock count
309 # %r8: Poly1305 derived key r^2 u[5]
310
311 # This two-block variant further improves performance by using loop
312 # unrolled block processing. This is more straight forward and does
313 # less byte shuffling, but requires a second Poly1305 key r^2:
314 # h = (h + m) * r => h = (h + m1) * r^2 + m2 * r
315
316 push %rbx
317 push %r12
318 push %r13
319
320 # combine r0,u0
321 movd u0,ru0
322 movd r0,t1
323 punpcklqdq t1,ru0
324
325 # combine r1,u1 and s1=r1*5,v1=u1*5
326 movd u1,ru1
327 movd r1,t1
328 punpcklqdq t1,ru1
329 movdqa ru1,sv1
330 pslld $2,sv1
331 paddd ru1,sv1
332
333 # combine r2,u2 and s2=r2*5,v2=u2*5
334 movd u2,ru2
335 movd r2,t1
336 punpcklqdq t1,ru2
337 movdqa ru2,sv2
338 pslld $2,sv2
339 paddd ru2,sv2
340
341 # combine r3,u3 and s3=r3*5,v3=u3*5
342 movd u3,ru3
343 movd r3,t1
344 punpcklqdq t1,ru3
345 movdqa ru3,sv3
346 pslld $2,sv3
347 paddd ru3,sv3
348
349 # combine r4,u4 and s4=r4*5,v4=u4*5
350 movd u4,ru4
351 movd r4,t1
352 punpcklqdq t1,ru4
353 movdqa ru4,sv4
354 pslld $2,sv4
355 paddd ru4,sv4
356
357.Ldoblock2:
358 # hc0 = [ m[16-19] & 0x3ffffff, h0 + m[0-3] & 0x3ffffff ]
359 movd 0x00(m),hc0
360 movd 0x10(m),t1
361 punpcklqdq t1,hc0
362 pand ANMASK(%rip),hc0
363 movd h0,t1
364 paddd t1,hc0
365 # hc1 = [ (m[19-22] >> 2) & 0x3ffffff, h1 + (m[3-6] >> 2) & 0x3ffffff ]
366 movd 0x03(m),hc1
367 movd 0x13(m),t1
368 punpcklqdq t1,hc1
369 psrld $2,hc1
370 pand ANMASK(%rip),hc1
371 movd h1,t1
372 paddd t1,hc1
373 # hc2 = [ (m[22-25] >> 4) & 0x3ffffff, h2 + (m[6-9] >> 4) & 0x3ffffff ]
374 movd 0x06(m),hc2
375 movd 0x16(m),t1
376 punpcklqdq t1,hc2
377 psrld $4,hc2
378 pand ANMASK(%rip),hc2
379 movd h2,t1
380 paddd t1,hc2
381 # hc3 = [ (m[25-28] >> 6) & 0x3ffffff, h3 + (m[9-12] >> 6) & 0x3ffffff ]
382 movd 0x09(m),hc3
383 movd 0x19(m),t1
384 punpcklqdq t1,hc3
385 psrld $6,hc3
386 pand ANMASK(%rip),hc3
387 movd h3,t1
388 paddd t1,hc3
389 # hc4 = [ (m[28-31] >> 8) | (1<<24), h4 + (m[12-15] >> 8) | (1<<24) ]
390 movd 0x0c(m),hc4
391 movd 0x1c(m),t1
392 punpcklqdq t1,hc4
393 psrld $8,hc4
394 por ORMASK(%rip),hc4
395 movd h4,t1
396 paddd t1,hc4
397
398 # t1 = [ hc0[1] * r0, hc0[0] * u0 ]
399 movdqa ru0,t1
400 pmuludq hc0,t1
401 # t1 += [ hc1[1] * s4, hc1[0] * v4 ]
402 movdqa sv4,t2
403 pmuludq hc1,t2
404 paddq t2,t1
405 # t1 += [ hc2[1] * s3, hc2[0] * v3 ]
406 movdqa sv3,t2
407 pmuludq hc2,t2
408 paddq t2,t1
409 # t1 += [ hc3[1] * s2, hc3[0] * v2 ]
410 movdqa sv2,t2
411 pmuludq hc3,t2
412 paddq t2,t1
413 # t1 += [ hc4[1] * s1, hc4[0] * v1 ]
414 movdqa sv1,t2
415 pmuludq hc4,t2
416 paddq t2,t1
417 # d0 = t1[0] + t1[1]
418 movdqa t1,t2
419 psrldq $8,t2
420 paddq t2,t1
421 movq t1,d0
422
423 # t1 = [ hc0[1] * r1, hc0[0] * u1 ]
424 movdqa ru1,t1
425 pmuludq hc0,t1
426 # t1 += [ hc1[1] * r0, hc1[0] * u0 ]
427 movdqa ru0,t2
428 pmuludq hc1,t2
429 paddq t2,t1
430 # t1 += [ hc2[1] * s4, hc2[0] * v4 ]
431 movdqa sv4,t2
432 pmuludq hc2,t2
433 paddq t2,t1
434 # t1 += [ hc3[1] * s3, hc3[0] * v3 ]
435 movdqa sv3,t2
436 pmuludq hc3,t2
437 paddq t2,t1
438 # t1 += [ hc4[1] * s2, hc4[0] * v2 ]
439 movdqa sv2,t2
440 pmuludq hc4,t2
441 paddq t2,t1
442 # d1 = t1[0] + t1[1]
443 movdqa t1,t2
444 psrldq $8,t2
445 paddq t2,t1
446 movq t1,d1
447
448 # t1 = [ hc0[1] * r2, hc0[0] * u2 ]
449 movdqa ru2,t1
450 pmuludq hc0,t1
451 # t1 += [ hc1[1] * r1, hc1[0] * u1 ]
452 movdqa ru1,t2
453 pmuludq hc1,t2
454 paddq t2,t1
455 # t1 += [ hc2[1] * r0, hc2[0] * u0 ]
456 movdqa ru0,t2
457 pmuludq hc2,t2
458 paddq t2,t1
459 # t1 += [ hc3[1] * s4, hc3[0] * v4 ]
460 movdqa sv4,t2
461 pmuludq hc3,t2
462 paddq t2,t1
463 # t1 += [ hc4[1] * s3, hc4[0] * v3 ]
464 movdqa sv3,t2
465 pmuludq hc4,t2
466 paddq t2,t1
467 # d2 = t1[0] + t1[1]
468 movdqa t1,t2
469 psrldq $8,t2
470 paddq t2,t1
471 movq t1,d2
472
473 # t1 = [ hc0[1] * r3, hc0[0] * u3 ]
474 movdqa ru3,t1
475 pmuludq hc0,t1
476 # t1 += [ hc1[1] * r2, hc1[0] * u2 ]
477 movdqa ru2,t2
478 pmuludq hc1,t2
479 paddq t2,t1
480 # t1 += [ hc2[1] * r1, hc2[0] * u1 ]
481 movdqa ru1,t2
482 pmuludq hc2,t2
483 paddq t2,t1
484 # t1 += [ hc3[1] * r0, hc3[0] * u0 ]
485 movdqa ru0,t2
486 pmuludq hc3,t2
487 paddq t2,t1
488 # t1 += [ hc4[1] * s4, hc4[0] * v4 ]
489 movdqa sv4,t2
490 pmuludq hc4,t2
491 paddq t2,t1
492 # d3 = t1[0] + t1[1]
493 movdqa t1,t2
494 psrldq $8,t2
495 paddq t2,t1
496 movq t1,d3
497
498 # t1 = [ hc0[1] * r4, hc0[0] * u4 ]
499 movdqa ru4,t1
500 pmuludq hc0,t1
501 # t1 += [ hc1[1] * r3, hc1[0] * u3 ]
502 movdqa ru3,t2
503 pmuludq hc1,t2
504 paddq t2,t1
505 # t1 += [ hc2[1] * r2, hc2[0] * u2 ]
506 movdqa ru2,t2
507 pmuludq hc2,t2
508 paddq t2,t1
509 # t1 += [ hc3[1] * r1, hc3[0] * u1 ]
510 movdqa ru1,t2
511 pmuludq hc3,t2
512 paddq t2,t1
513 # t1 += [ hc4[1] * r0, hc4[0] * u0 ]
514 movdqa ru0,t2
515 pmuludq hc4,t2
516 paddq t2,t1
517 # d4 = t1[0] + t1[1]
518 movdqa t1,t2
519 psrldq $8,t2
520 paddq t2,t1
521 movq t1,d4
522
523 # Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
524 # h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
525 # amount. Careful: we must not assume the carry bits 'd0 >> 26',
526 # 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
527 # integers. It's true in a single-block implementation, but not here.
528
529 # d1 += d0 >> 26
530 mov d0,%rax
531 shr $26,%rax
532 add %rax,d1
533 # h0 = d0 & 0x3ffffff
534 mov d0,%rbx
535 and $0x3ffffff,%ebx
536
537 # d2 += d1 >> 26
538 mov d1,%rax
539 shr $26,%rax
540 add %rax,d2
541 # h1 = d1 & 0x3ffffff
542 mov d1,%rax
543 and $0x3ffffff,%eax
544 mov %eax,h1
545
546 # d3 += d2 >> 26
547 mov d2,%rax
548 shr $26,%rax
549 add %rax,d3
550 # h2 = d2 & 0x3ffffff
551 mov d2,%rax
552 and $0x3ffffff,%eax
553 mov %eax,h2
554
555 # d4 += d3 >> 26
556 mov d3,%rax
557 shr $26,%rax
558 add %rax,d4
559 # h3 = d3 & 0x3ffffff
560 mov d3,%rax
561 and $0x3ffffff,%eax
562 mov %eax,h3
563
564 # h0 += (d4 >> 26) * 5
565 mov d4,%rax
566 shr $26,%rax
567 lea (%rax,%rax,4),%rax
568 add %rax,%rbx
569 # h4 = d4 & 0x3ffffff
570 mov d4,%rax
571 and $0x3ffffff,%eax
572 mov %eax,h4
573
574 # h1 += h0 >> 26
575 mov %rbx,%rax
576 shr $26,%rax
577 add %eax,h1
578 # h0 = h0 & 0x3ffffff
579 andl $0x3ffffff,%ebx
580 mov %ebx,h0
581
582 add $0x20,m
583 dec %rcx
584 jnz .Ldoblock2
585
586 pop %r13
587 pop %r12
588 pop %rbx
589 ret
590ENDPROC(poly1305_2block_sse2)