nettle-bugs

nettle-bugs@lists.lysator.liu.se

2196 discussions

[PATCH] "PowerPC64" GCM support
by Maamoun TK 25 Sep '20

25 Sep '20

This is a stand-alone patch that applies all the previous patches to the optimized GCM implementation. This patch is based on the master upstream so it can be merged directly. It passes the testsuite and yields the expected performance. --- configure.ac | 5 +- fat-ppc.c | 44 +++ fat-setup.h | 9 + gcm.c | 82 +++- powerpc64/README | 2 +- powerpc64/fat/gcm-hash.asm | 40 ++ powerpc64/p8/gcm-hash.asm | 956 +++++++++++++++++++++++++++++++++++++++++++++ 7 files changed, 1121 insertions(+), 17 deletions(-) create mode 100644 powerpc64/fat/gcm-hash.asm create mode 100644 powerpc64/p8/gcm-hash.asm diff --git a/configure.ac b/configure.ac index e9983697..13cfe33a 100644 --- a/configure.ac +++ b/configure.ac @@ -488,7 +488,7 @@ asm_replace_list="aes-encrypt-internal.asm aes-decrypt-internal.asm \ sha3-permute.asm umac-nh.asm umac-nh-n.asm machine.m4" # Assembler files which generate additional object files if they are used. -asm_nettle_optional_list="gcm-hash8.asm cpuid.asm \ +asm_nettle_optional_list="gcm-hash.asm gcm-hash8.asm cpuid.asm \ aes-encrypt-internal-2.asm aes-decrypt-internal-2.asm memxor-2.asm \ chacha-3core.asm chacha-core-internal-2.asm salsa20-2core.asm \ salsa20-core-internal-2.asm sha1-compress-2.asm sha256-compress-2.asm \ @@ -612,7 +612,8 @@ AH_VERBATIM([HAVE_NATIVE], #undef HAVE_NATIVE_ecc_secp384r1_redc #undef HAVE_NATIVE_ecc_secp521r1_modp #undef HAVE_NATIVE_ecc_secp521r1_redc -#undef HAVE_NATIVE_gcm_init_key8 +#undef HAVE_NATIVE_gcm_init_key +#undef HAVE_NATIVE_gcm_hash #undef HAVE_NATIVE_gcm_hash8 #undef HAVE_NATIVE_gcm_fill #undef HAVE_NATIVE_salsa20_core diff --git a/fat-ppc.c b/fat-ppc.c index 2bc50481..e69dff95 100644 --- a/fat-ppc.c +++ b/fat-ppc.c @@ -120,6 +120,20 @@ DECLARE_FAT_FUNC(_nettle_aes_decrypt, aes_crypt_internal_func) DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, c) DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, ppc64) +#if GCM_TABLE_BITS == 8 +DECLARE_FAT_FUNC(_nettle_gcm_init_key, gcm_init_key_func) +DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, c) +DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, ppc64) + +DECLARE_FAT_FUNC(_nettle_gcm_hash, gcm_hash_func) +DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, c) +DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, ppc64) +#endif /* GCM_TABLE_BITS == 8 */ + +DECLARE_FAT_FUNC(_nettle_gcm_fill, gcm_fill_func) +DECLARE_FAT_FUNC_VAR(gcm_fill, gcm_fill_func, c) +DECLARE_FAT_FUNC_VAR(gcm_fill, gcm_fill_func, ppc64) + static void CONSTRUCTOR fat_init (void) { @@ -139,11 +153,25 @@ fat_init (void) fprintf (stderr, "libnettle: enabling arch 2.07 code.\n"); _nettle_aes_encrypt_vec = _nettle_aes_encrypt_ppc64; _nettle_aes_decrypt_vec = _nettle_aes_decrypt_ppc64; +#if GCM_TABLE_BITS == 8 + /* Make sure _nettle_gcm_init_key_vec function is compatible + with _nettle_gcm_hash_vec function e.g. _nettle_gcm_init_key_c() + fills gcm_key table with values that are incompatible with + _nettle_gcm_hash_ppc64() */ + _nettle_gcm_init_key_vec = _nettle_gcm_init_key_ppc64; + _nettle_gcm_hash_vec = _nettle_gcm_hash_ppc64; +#endif /* GCM_TABLE_BITS == 8 */ + _nettle_gcm_fill_vec = _nettle_gcm_fill_ppc64; } else { _nettle_aes_encrypt_vec = _nettle_aes_encrypt_c; _nettle_aes_decrypt_vec = _nettle_aes_decrypt_c; +#if GCM_TABLE_BITS == 8 + _nettle_gcm_init_key_vec = _nettle_gcm_init_key_c; + _nettle_gcm_hash_vec = _nettle_gcm_hash_c; +#endif /* GCM_TABLE_BITS == 8 */ + _nettle_gcm_fill_vec = _nettle_gcm_fill_c; } } @@ -160,3 +188,19 @@ DEFINE_FAT_FUNC(_nettle_aes_decrypt, void, size_t length, uint8_t *dst, const uint8_t *src), (rounds, keys, T, length, dst, src)) + + #if GCM_TABLE_BITS == 8 +DEFINE_FAT_FUNC(_nettle_gcm_init_key, void, + (union nettle_block16 *table), + (table)) + +DEFINE_FAT_FUNC(_nettle_gcm_hash, void, + (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data), + (key, x, length, data)) +#endif /* GCM_TABLE_BITS == 8 */ + +DEFINE_FAT_FUNC(_nettle_gcm_fill, void, + (uint8_t *ctr, size_t blocks, + union nettle_block16 *buffer), + (ctr, blocks, buffer)) diff --git a/fat-setup.h b/fat-setup.h index 99f1ea67..623f9579 100644 --- a/fat-setup.h +++ b/fat-setup.h @@ -162,6 +162,15 @@ typedef void aes_crypt_internal_func (unsigned rounds, const uint32_t *keys, size_t length, uint8_t *dst, const uint8_t *src); +#if GCM_TABLE_BITS == 8 +typedef void gcm_init_key_func (union nettle_block16 *table); + +typedef void gcm_hash_func (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data); +#endif /* GCM_TABLE_BITS == 8 */ + +typedef void gcm_fill_func (uint8_t *ctr, size_t blocks, union nettle_block16 *buffer); + typedef void *(memxor_func)(void *dst, const void *src, size_t n); typedef void salsa20_core_func (uint32_t *dst, const uint32_t *src, unsigned rounds); diff --git a/gcm.c b/gcm.c index cf615daf..935d4420 100644 --- a/gcm.c +++ b/gcm.c @@ -140,6 +140,26 @@ gcm_gf_mul (union nettle_block16 *x, const union nettle_block16 *table) memcpy (x->b, Z.b, sizeof(Z)); } # elif GCM_TABLE_BITS == 8 +# if HAVE_NATIVE_gcm_init_key + +#define gcm_init_key _nettle_gcm_init_key +void +_nettle_gcm_init_key (union nettle_block16 *table); +/* For fat builds */ +void +_nettle_gcm_init_key_c (union nettle_block16 *table); +# endif /* HAVE_NATIVE_gcm_init_key */ +# if HAVE_NATIVE_gcm_hash + +#define gcm_hash _nettle_gcm_hash +void +_nettle_gcm_hash (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data); +/* For fat builds */ +void +_nettle_gcm_hash_c (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data); +# endif /* HAVE_NATIVE_gcm_hash */ # if HAVE_NATIVE_gcm_hash8 #define gcm_hash _nettle_gcm_hash8 @@ -225,9 +245,45 @@ gcm_gf_mul (union nettle_block16 *x, const union nettle_block16 *table) #endif /* GCM_TABLE_BITS */ +#if HAVE_NATIVE_gcm_fill + +#define gcm_fill _nettle_gcm_fill +void +_nettle_gcm_fill (uint8_t *ctr, size_t blocks, union nettle_block16 *buffer); +/* For fat builds */ +void +_nettle_gcm_fill_c (uint8_t *ctr, size_t blocks, union nettle_block16 *buffer); +#endif /* HAVE_NATIVE_gcm_fill */ + /* Increment the rightmost 32 bits. */ #define INC32(block) INCREMENT(4, (block.b) + GCM_BLOCK_SIZE - 4) +#ifdef gcm_init_key +void +_nettle_gcm_init_key_c(union nettle_block16 *table) +#else +static void +gcm_init_key(union nettle_block16 *table) +#endif /* !gcm_init_key */ +{ +#if GCM_TABLE_BITS + /* Middle element if GCM_TABLE_BITS > 0, otherwise the first + element */ + unsigned i = (1<<GCM_TABLE_BITS)/2; + + /* Algorithm 3 from the gcm paper. First do powers of two, then do + the rest by adding. */ + while (i /= 2) + block16_mulx_ghash(&table[i], &table[2*i]); + for (i = 2; i < 1<<GCM_TABLE_BITS; i *= 2) + { + unsigned j; + for (j = 1; j < i; j++) + block16_xor3(&table[i+j], &table[i], &table[j]); + } +#endif +} + /* Initialization of GCM. * @ctx: The context of GCM * @cipher: The context of the underlying block cipher @@ -245,24 +301,18 @@ gcm_set_key(struct gcm_key *key, memset(key->h[0].b, 0, GCM_BLOCK_SIZE); f (cipher, GCM_BLOCK_SIZE, key->h[i].b, key->h[0].b); -#if GCM_TABLE_BITS - /* Algorithm 3 from the gcm paper. First do powers of two, then do - the rest by adding. */ - while (i /= 2) - block16_mulx_ghash(&key->h[i], &key->h[2*i]); - for (i = 2; i < 1<<GCM_TABLE_BITS; i *= 2) - { - unsigned j; - for (j = 1; j < i; j++) - block16_xor3(&key->h[i+j], &key->h[i],&key->h[j]); - } -#endif + gcm_init_key(key->h); } -#ifndef gcm_hash +#ifdef gcm_hash +void +_nettle_gcm_hash_c(const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data) +#else static void gcm_hash(const struct gcm_key *key, union nettle_block16 *x, size_t length, const uint8_t *data) +#endif /* !gcm_hash */ { for (; length >= GCM_BLOCK_SIZE; length -= GCM_BLOCK_SIZE, data += GCM_BLOCK_SIZE) @@ -276,7 +326,6 @@ gcm_hash(const struct gcm_key *key, union nettle_block16 *x, gcm_gf_mul (x, key->h); } } -#endif /* !gcm_hash */ static void gcm_hash_sizes(const struct gcm_key *key, union nettle_block16 *x, @@ -333,9 +382,14 @@ gcm_update(struct gcm_ctx *ctx, const struct gcm_key *key, ctx->auth_size += length; } +#ifdef gcm_fill +void +_nettle_gcm_fill_c(uint8_t *ctr, size_t blocks, union nettle_block16 *buffer) +#else static nettle_fill16_func gcm_fill; static void gcm_fill(uint8_t *ctr, size_t blocks, union nettle_block16 *buffer) +#endif /* !gcm_fill */ { uint32_t c; diff --git a/powerpc64/README b/powerpc64/README index 7301953b..fac1108b 100644 --- a/powerpc64/README +++ b/powerpc64/README @@ -52,7 +52,7 @@ storage operands, refer to "6.4.1 Accessing Unaligned Storage Operands" in [3] to see an example of accessing unaligned storage operands. "lxvd2x/stxvd2x" can be used to load/store data into unaligned storage operands but permuting is needed for loading and storing data in -little-endian mode VSX registers are defined with "X" suffix +little-endian mode Function Prologue diff --git a/powerpc64/fat/gcm-hash.asm b/powerpc64/fat/gcm-hash.asm new file mode 100644 index 00000000..2d9f281e --- /dev/null +++ b/powerpc64/fat/gcm-hash.asm @@ -0,0 +1,40 @@ +C powerpc64/fat/gcm-hash.asm + + +ifelse(` + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +') + +dnl picked up by configure +dnl PROLOGUE(_nettle_gcm_init_key) +dnl PROLOGUE(_nettle_gcm_hash) +dnl PROLOGUE(_nettle_gcm_fill) + +define(`fat_transform', `$1_ppc64') +include_src(`powerpc64/p8/gcm-hash.asm') diff --git a/powerpc64/p8/gcm-hash.asm b/powerpc64/p8/gcm-hash.asm new file mode 100644 index 00000000..f57cbfe4 --- /dev/null +++ b/powerpc64/p8/gcm-hash.asm @@ -0,0 +1,956 @@ +C powerpc64/p8/gcm-hash.asm + +ifelse(` + Copyright (C) 2020 Mamone Tarsha + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +') + +C Alignment of gcm_key table elements, which is declared in gcm.h +define(`TableElemAlign', `0x100') + +C Register usage: + +define(`SP', `r1') +define(`TOCP', `r2') + +define(`TABLE', `r3') +define(`X', `r4') +define(`LENGTH', `r5') +define(`DATA', `r6') + +define(`zero', `v0') +define(`swap_mask', `v1') +define(`hidw_mask', `v2') +define(`lodw_mask', `v3') +define(`poly', `v4') +define(`poly_h', `v4') +define(`poly_l', `v5') +define(`RP', `v6') +define(`Mh', `v7') +define(`Ml', `v8') +define(`H', `v9') +define(`Hh', `v10') +define(`Hl', `v11') +define(`RP2', `v9') +define(`M2h', `v10') +define(`M2l', `v11') + +define(`sl1', `v1') +define(`msb', `v5') +define(`H2', `v6') +define(`H2h', `v7') +define(`H2l', `v8') +define(`H_h', `v12') +define(`H_m', `v13') +define(`H_l', `v14') +define(`H_Hh', `v12') +define(`H_H', `v13') +define(`H_Hl', `v14') +define(`H_t', `v15') +define(`H2_h', `v16') +define(`H2_m', `v17') +define(`H2_l', `v18') +define(`H2_t', `v19') + +define(`C0', `v6') +define(`C1', `v7') +define(`C2', `v8') +define(`C3', `v12') +define(`C4', `v6') +define(`C5', `v7') +define(`C6', `v8') +define(`C7', `v12') + +define(`C', `v13') + +define(`Ch', `v14') +define(`Cl', `v15') +define(`Cm', `v16') + +define(`C01h', `v14') +define(`C01l', `v15') +define(`C01', `v16') +define(`C23h', `v17') +define(`C23l', `v18') +define(`C23', `v19') +define(`C45h', `v20') +define(`C45l', `v21') +define(`C45', `v22') +define(`C67h', `v6') +define(`C67l', `v7') +define(`C67', `v8') + +define(`H21', `v9') +define(`H21h', `v10') +define(`H21l', `v11') +define(`H43', `v23') +define(`H43h', `v24') +define(`H43l', `v25') +define(`H65', `v26') +define(`H65h', `v27') +define(`H65l', `v28') +define(`H87', `v29') +define(`H87h', `v30') +define(`H87l', `v31') + +# gcm_fill registers: + +define(`CTR', `r3') +define(`BLOCKS', `r4') +define(`BUFFER', `r5') + +define(`CTR0', `v2') +define(`CTR0S', `v3') +define(`CTR1', `v4') +define(`CTR2', `v5') +define(`CTR3', `v6') +define(`CTR4', `v7') +define(`CTR5', `v8') +define(`CTR6', `v9') +define(`CTR7', `v10') + +define(`I1', `v11') +define(`I2', `v12') +define(`I3', `v13') +define(`I4', `v14') +define(`I5', `v15') +define(`I6', `v16') +define(`I7', `v17') +define(`I8', `v18') + +.file "gcm-hash.asm" + +.text + + # void gcm_init_key (union gcm_block *table) + +define(`FUNC_ALIGN', `5') +PROLOGUE(_nettle_gcm_init_key) + DATA_LOAD_VEC(poly,.polynomial,r7) +IF_LE(`DATA_LOAD_VEC(swap_mask,.swap_mask,r7)') + DATA_LOAD_VEC(hidw_mask,.hidw_mask,r7) + DATA_LOAD_VEC(lodw_mask,.lodw_mask,r7) + + li r10,8*TableElemAlign + lxvd2x VSR(H),r10,TABLE # load H +IF_LE(`vperm H,H,H,swap_mask') + + # --- calculate H = H shift left 1 modulo polynomial --- + + vupkhsw msb,H # most significant bit word-extend + vspltisb sl1,1 # splat 1 for shift left + vspltw msb,msb,0 # most significant bit extend + vsl H,H,sl1 # H shift left 1 + vand msb,msb,poly + vxor zero,zero,zero + vxor H_t,H,msb + + vsldoi H,H_t,H_t,8 # doubleword swap + vsldoi Hh,H,zero,8 + vsldoi Hl,zero,H,8 + + # --- calculate H^2 = H*H --- + + # reduction pre-processing + vsldoi poly_h,zero,poly,8 + vsldoi poly_l,poly_h,poly_h,8 + + # polynomial multiplication "classical" + vpmsumd H_h,H_t,Hh # H^1h*H^1h + vpmsumd H_l,H_t,Hl # H^1l*H^1l + vpmsumd H_m,H_t,H # H^1h*H^1l⊕H^1l*H^1h + + # reduction first phase # [1] + vpmsumd RP,H_l,poly_h # [1] + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,H_m,8 # [2] + vsldoi Ml,H_m,zero,8 # [2] + vsldoi RP,RP,RP,8 # [1] + vxor H_h,H_h,Mh # [2] + vxor H_l,H_l,Ml # [2] + vxor H_l,H_l,RP # [1] + + # reduction second phase + vpmsumd RP,H_l,poly_l + vxor H_h,H_l,H_h + vxor H2_t,H_h,RP + + vsldoi H2,H2_t,H2_t,8 + vsldoi H2h,H2,zero,8 + vsldoi H2l,zero,H2,8 + + # --- calculate [H^2.Hi⊕H^2.Lo:H^1.Hi⊕H^1.Lo] --- + + vperm H_Hh,H2,H,lodw_mask + vperm H_Hl,H2,H,hidw_mask + vxor H_H,H_Hh,H_Hl + + # --- store H,[H^2.Hi⊕H^2.Lo:H^1.Hi⊕H^1.Lo] --- + + li r8,0*TableElemAlign + li r9,1*TableElemAlign + li r10,2*TableElemAlign + stxvd2x VSR(Hl),r8,TABLE + stxvd2x VSR(H),r9,TABLE + stxvd2x VSR(Hh),r10,TABLE + + li r8,3*TableElemAlign + li r9,4*TableElemAlign + li r10,5*TableElemAlign + stxvd2x VSR(H_Hh),r8,TABLE + stxvd2x VSR(H_H),r9,TABLE + stxvd2x VSR(H_Hl),r10,TABLE + + # --- calculate H^3,H^4 --- + + # polynomial multiplication "classical" + vpmsumd H_l,H_t,H2l # H^1l*H^2l + vpmsumd H_m,H_t,H2 # H^1h*H^2l⊕H^1l*H^2h + vpmsumd H_h,H_t,H2h # H^1h*H^2h + vpmsumd H2_l,H2_t,H2l # H^2l*H^2l + vpmsumd H2_m,H2_t,H2 # H^2h*H^2l⊕H^2l*H^2h + vpmsumd H2_h,H2_t,H2h # H^2h*H^2h + + # reduction first phase # [1] + vpmsumd RP,H_l,poly_h # [1] H^3 + vpmsumd RP2,H2_l,poly_h # [1] H^4 + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,H_m,8 # [2] H^3 + vsldoi M2h,zero,H2_m,8 # [2] H^4 + vsldoi Ml,H_m,zero,8 # [2] H^3 + vsldoi M2l,H2_m,zero,8 # [2] H^4 + vsldoi RP,RP,RP,8 # [1] H^3 + vsldoi RP2,RP2,RP2,8 # [1] H^4 + vxor H_h,H_h,Mh # [2] H^3 + vxor H2_h,H2_h,M2h # [2] H^4 + vxor H_l,H_l,Ml # [2] H^3 + vxor H2_l,H2_l,M2l # [2] H^4 + vxor H_l,H_l,RP # [1] H^3 + vxor H2_l,H2_l,RP2 # [1] H^4 + + # reduction second phase + vpmsumd RP,H_l,poly_l # H^3 + vpmsumd RP2,H2_l,poly_l # H^4 + vxor H_h,H_l,H_h # H^3 + vxor H2_h,H2_l,H2_h # H^4 + vxor H_h,H_h,RP # H^3 + vxor H2_h,H2_h,RP2 # H^4 + + vsldoi H2,H2_h,H2_h,8 # H^4 + vsldoi H,H_h,H_h,8 # H^3 + vsldoi H2l,zero,H2,8 # H^4 + vsldoi H2h,H2,zero,8 # H^4 + + # --- calculate [H^4.Hi⊕H^4.Lo:H^3.Hi⊕H^3.Lo] --- + + vperm H_Hh,H2,H,lodw_mask + vperm H_Hl,H2,H,hidw_mask + vxor H_H,H_Hh,H_Hl + + # --- store [H^4.Hi⊕H^4.Lo:H^3.Hi⊕H^3.Lo] --- + + li r8,6*TableElemAlign + li r9,7*TableElemAlign + li r10,8*TableElemAlign + stxvd2x VSR(H_Hh),r8,TABLE + stxvd2x VSR(H_H),r9,TABLE + stxvd2x VSR(H_Hl),r10,TABLE + + # --- calculate H^5,H^6 --- + + # polynomial multiplication "classical" + vpmsumd H_l,H_t,H2l # H^1l*H^4l + vpmsumd H_m,H_t,H2 # H^1h*H^4l⊕H^1l*H^4h + vpmsumd H_h,H_t,H2h # H^1h*H^4h + vpmsumd H2_l,H2_t,H2l # H^2l*H^4l + vpmsumd H2_m,H2_t,H2 # H^2h*H^4l⊕H^2l*H^4h + vpmsumd H2_h,H2_t,H2h # H^2h*H^4h + + # reduction first phase # [1] + vpmsumd RP,H_l,poly_h # [1] H^5 + vpmsumd RP2,H2_l,poly_h # [1] H^6 + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,H_m,8 # [2] H^5 + vsldoi M2h,zero,H2_m,8 # [2] H^6 + vsldoi Ml,H_m,zero,8 # [2] H^5 + vsldoi M2l,H2_m,zero,8 # [2] H^6 + vsldoi RP,RP,RP,8 # [1] H^5 + vsldoi RP2,RP2,RP2,8 # [1] H^6 + vxor H_h,H_h,Mh # [2] H^5 + vxor H2_h,H2_h,M2h # [2] H^6 + vxor H_l,H_l,Ml # [2] H^5 + vxor H2_l,H2_l,M2l # [2] H^6 + vxor H_l,H_l,RP # [1] H^5 + vxor H2_l,H2_l,RP2 # [1] H^6 + + # reduction second phase + vpmsumd RP,H_l,poly_l # H^5 + vpmsumd RP2,H2_l,poly_l # H^6 + vxor H_h,H_l,H_h # H^5 + vxor H2_h,H2_l,H2_h # H^6 + vxor H_h,H_h,RP # H^5 + vxor H2_h,H2_h,RP2 # H^6 + + vsldoi H2,H2_h,H2_h,8 # H^6 + vsldoi H,H_h,H_h,8 # H^5 + vsldoi H2l,zero,H2,8 # H^6 + vsldoi H2h,H2,zero,8 # H^6 + + # --- calculate [H^6.Hi⊕H^6.Lo:H^5.Hi⊕H^5.Lo] --- + + vperm H_Hh,H2,H,lodw_mask + vperm H_Hl,H2,H,hidw_mask + vxor H_H,H_Hh,H_Hl + + # --- store [H^6.Hi⊕H^6.Lo:H^5.Hi⊕H^5.Lo] --- + + li r8,9*TableElemAlign + li r9,10*TableElemAlign + li r10,11*TableElemAlign + stxvd2x VSR(H_Hh),r8,TABLE + stxvd2x VSR(H_H),r9,TABLE + stxvd2x VSR(H_Hl),r10,TABLE + + # --- calculate H^7,H^8 --- + + # polynomial multiplication "classical" + vpmsumd H_l,H_t,H2l # H^1l*H^6l + vpmsumd H_m,H_t,H2 # H^1h*H^6l⊕H^1l*H^6h + vpmsumd H_h,H_t,H2h # H^1h*H^6h + vpmsumd H2_l,H2_t,H2l # H^2l*H^6l + vpmsumd H2_m,H2_t,H2 # H^2h*H^6l⊕H^2l*H^6h + vpmsumd H2_h,H2_t,H2h # H^2h*H^6h + + # reduction first phase # [1] + vpmsumd RP,H_l,poly_h # [1] H^7 + vpmsumd RP2,H2_l,poly_h # [1] H^8 + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,H_m,8 # [2] H^7 + vsldoi M2h,zero,H2_m,8 # [2] H^8 + vsldoi Ml,H_m,zero,8 # [2] H^7 + vsldoi M2l,H2_m,zero,8 # [2] H^8 + vsldoi RP,RP,RP,8 # [1] H^7 + vsldoi RP2,RP2,RP2,8 # [1] H^8 + vxor H_h,H_h,Mh # [2] H^7 + vxor H2_h,H2_h,M2h # [2] H^8 + vxor H_l,H_l,Ml # [2] H^7 + vxor H2_l,H2_l,M2l # [2] H^8 + vxor H_l,H_l,RP # [1] H^7 + vxor H2_l,H2_l,RP2 # [1] H^8 + + # reduction second phase + vpmsumd RP,H_l,poly_l # H^7 + vpmsumd RP2,H2_l,poly_l # H^8 + vxor H_h,H_l,H_h # H^7 + vxor H2_h,H2_l,H2_h # H^8 + vxor H_h,H_h,RP # H^7 + vxor H2_h,H2_h,RP2 # H^8 + + vsldoi H,H_h,H_h,8 # H^7 + vsldoi H2,H2_h,H2_h,8 # H^8 + + # --- calculate [H^8.Hi⊕H^8.Lo:H^7.Hi⊕H^7.Lo] --- + + vperm H_Hh,H2,H,lodw_mask + vperm H_Hl,H2,H,hidw_mask + vxor H_H,H_Hh,H_Hl + + # --- store [H^8.Hi⊕H^8.Lo:H^7.Hi⊕H^7.Lo] --- + + li r8,12*TableElemAlign + li r9,13*TableElemAlign + li r10,14*TableElemAlign + stxvd2x VSR(H_Hh),r8,TABLE + stxvd2x VSR(H_H),r9,TABLE + stxvd2x VSR(H_Hl),r10,TABLE + + blr +EPILOGUE(_nettle_gcm_init_key) + + # void gcm_hash (const struct gcm_key *key, union gcm_block *x, + # size_t length, const uint8_t *data) + +define(`FUNC_ALIGN', `5') +PROLOGUE(_nettle_gcm_hash) + vxor zero,zero,zero + + DATA_LOAD_VEC(poly,.polynomial,r7) +IF_LE(`DATA_LOAD_VEC(swap_mask,.swap_mask,r7)') + DATA_LOAD_VEC(hidw_mask,.hidw_mask,r7) + DATA_LOAD_VEC(lodw_mask,.lodw_mask,r7) + + vsldoi poly_h,zero,poly,8 + vsldoi poly_l,poly_h,poly_h,8 + + lxvd2x VSR(C),0,X # load X +IF_LE(`vperm C,C,C,swap_mask') + + srdi r7,LENGTH,7 # 8x loop count + cmpldi r7,0 + beq L2x + + # backup registers + stdu SP,-224(SP) + std r28,216(SP) + std r29,208(SP) + std r30,200(SP) + std r31,192(SP) + li 8,176 + stvx 20,8,SP + subi 8,8,16 + stvx 21,8,SP + subi 8,8,16 + stvx 22,8,SP + subi 8,8,16 + stvx 23,8,SP + subi 8,8,16 + stvx 24,8,SP + subi 8,8,16 + stvx 25,8,SP + subi 8,8,16 + stvx 26,8,SP + subi 8,8,16 + stvx 27,8,SP + subi 8,8,16 + stvx 28,8,SP + subi 8,8,16 + stvx 29,8,SP + subi 8,8,16 + stvx 30,8,SP + subi 8,8,16 + stvx 31,8,SP + + # table loading + li r8,3*TableElemAlign + li r9,4*TableElemAlign + li r10,5*TableElemAlign + lxvd2x VSR(H21h),r8,TABLE + lxvd2x VSR(H21),r9,TABLE + lxvd2x VSR(H21l),r10,TABLE + li r8,6*TableElemAlign + li r9,7*TableElemAlign + li r10,8*TableElemAlign + lxvd2x VSR(H43h),r8,TABLE + lxvd2x VSR(H43),r9,TABLE + lxvd2x VSR(H43l),r10,TABLE + li r8,9*TableElemAlign + li r9,10*TableElemAlign + li r10,11*TableElemAlign + lxvd2x VSR(H65h),r8,TABLE + lxvd2x VSR(H65),r9,TABLE + lxvd2x VSR(H65l),r10,TABLE + li r8,12*TableElemAlign + li r9,13*TableElemAlign + li r10,14*TableElemAlign + lxvd2x VSR(H87h),r8,TABLE + lxvd2x VSR(H87),r9,TABLE + lxvd2x VSR(H87l),r10,TABLE + + li r8,0x10 + li r9,0x20 + li r10,0x30 + li r28,0x40 + li r29,0x50 + li r30,0x60 + li r31,0x70 + + mtctr r7 +.align 5 +L8x_loop: + # input loading + lxvd2x VSR(C0),0,DATA # load C0 + lxvd2x VSR(C1),r8,DATA # load C1 + lxvd2x VSR(C2),r9,DATA # load C2 + lxvd2x VSR(C3),r10,DATA # load C3 + + # swap permuting +IF_LE(`vperm C0,C0,C0,swap_mask + vperm C1,C1,C1,swap_mask + vperm C2,C2,C2,swap_mask + vperm C3,C3,C3,swap_mask') + + # previous digest combining + vxor C0,C0,C + + # polynomial multiplication "karatsuba" pre-processing + vperm C23h,C2,C3,hidw_mask + vperm C23l,C2,C3,lodw_mask + vperm C01h,C0,C1,hidw_mask + vperm C01l,C0,C1,lodw_mask + + # input loading + lxvd2x VSR(C4),r28,DATA # load C4 + lxvd2x VSR(C5),r29,DATA # load C5 + lxvd2x VSR(C6),r30,DATA # load C6 + lxvd2x VSR(C7),r31,DATA # load C7 + + # swap permuting +IF_LE(`vperm C4,C4,C4,swap_mask + vperm C5,C5,C5,swap_mask + vperm C6,C6,C6,swap_mask + vperm C7,C7,C7,swap_mask') + + # polynomial multiplication "karatsuba" pre-processing + vperm C45h,C4,C5,hidw_mask + vperm C45l,C4,C5,lodw_mask + vperm C67h,C6,C7,hidw_mask + vperm C67l,C6,C7,lodw_mask + vxor C23,C23h,C23l + vxor C01,C01h,C01l + vxor C45,C45h,C45l + vxor C67,C67h,C67l + + # polynomial multiplication "karatsuba" + vpmsumd C23h,C23h,H65h # H23 = H^6h*C2h⊕H^5h*C3h + vpmsumd C23l,C23l,H65l # L23 = H^6l*C2l⊕H^5l*C3l + vpmsumd C01h,C01h,H87h # H01 = H^8h*C0h⊕H^7h*C1h + vpmsumd C01l,C01l,H87l # L01 = H^8l*C0l⊕H^7l*C1l + vpmsumd C67h,C67h,H21h # H67 = H^2h*C6h⊕H^1h*C7h + vpmsumd C67l,C67l,H21l # L67 = H^2l*C6l⊕H^1l*C7l + vpmsumd C45h,C45h,H43h # H45 = H^4h*C4h⊕H^3h*C5h + vpmsumd C45l,C45l,H43l # L45 = H^4l*C4l⊕H^3l*C5l + vpmsumd C23,C23,H65 # M23 = (H^6h⊕H^5h)*(C2h⊕C3h)⊕(H^6l⊕H^5l)*(C2l⊕C3l) + vpmsumd C01,C01,H87 # M01 = (H^8h⊕H^7h)*(C0h⊕C1h)⊕(H^8l⊕H^7l)*(C0l⊕C1l) + vpmsumd C45,C45,H43 # M45 = (H^4h⊕H^3h)*(C4h⊕C5h)⊕(H^4l⊕H^3l)*(C4l⊕C5l) + vpmsumd C67,C67,H21 # M67 = (H^2h⊕H^1h)*(C6h⊕C7h)⊕(H^2l⊕H^1l)*(C6l⊕C7l) + + # polynomial multiplication "karatsuba" post-processing + vxor C23,C23,C23h + vxor C01,C01,C01h + vxor C45,C45,C45h + vxor C67,C67,C67h + vxor C23,C23,C23l + vxor C01,C01,C01l + vxor C45,C45,C45l + vxor C67,C67,C67l + + # deferred recombination of partial products + vxor C01h,C01h,C23h # H0 = H01⊕H23 + vxor C45h,C45h,C67h # H1 = H45⊕H67 + vxor C01l,C01l,C23l # L0 = L01⊕L23 + vxor C45l,C45l,C67l # L1 = L45⊕L45 + vxor C01,C01,C23 # M0 = M01⊕M23 + vxor C45,C45,C67 # M1 = M45⊕M45 + vxor C01h,C01h,C45h # H = H0⊕H1 + vxor C01l,C01l,C45l # L = L0⊕L1 + vxor C01,C01,C45 # M = M0⊕M1 + + # reduction first phase # [1] + vpmsumd RP,C01l,poly_h # [1] + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,C01,8 # [2] + vsldoi Ml,C01,zero,8 # [2] + vsldoi RP,RP,RP,8 # [1] + vxor C01h,C01h,Mh # [2] + vxor C01l,C01l,Ml # [2] + vxor C01l,C01l,RP # [1] + + # reduction second phase + vpmsumd RP,C01l,poly_l + vxor C01h,C01l,C01h + vxor C,C01h,RP + + addi DATA,DATA,0x80 + bdnz L8x_loop + + # restore registers + li 8,0 + lvx 31,8,SP + addi 8,8,16 + lvx 30,8,SP + addi 8,8,16 + lvx 29,8,SP + addi 8,8,16 + lvx 28,8,SP + addi 8,8,16 + lvx 27,8,SP + addi 8,8,16 + lvx 26,8,SP + addi 8,8,16 + lvx 25,8,SP + addi 8,8,16 + lvx 24,8,SP + addi 8,8,16 + lvx 23,8,SP + addi 8,8,16 + lvx 22,8,SP + addi 8,8,16 + lvx 21,8,SP + addi 8,8,16 + lvx 20,8,SP + ld r31,192(SP) + ld r30,200(SP) + ld r29,208(SP) + ld r28,216(SP) + addi SP,SP,224 + + clrldi LENGTH,LENGTH,57 +L2x: + srdi r7,LENGTH,5 + cmpldi r7,0 + beq L1x + + # table loading + li r8,3*TableElemAlign + li r9,4*TableElemAlign + li r10,5*TableElemAlign + lxvd2x VSR(H21h),r8,TABLE + lxvd2x VSR(H21),r9,TABLE + lxvd2x VSR(H21l),r10,TABLE + + li r10,0x10 + + mtctr r7 +.align 5 +L2x_loop: + # input loading + lxvd2x VSR(C0),0,DATA # load C0 + lxvd2x VSR(C1),r10,DATA # load C1 + + # swap permuting +IF_LE(`vperm C0,C0,C0,swap_mask + vperm C1,C1,C1,swap_mask') + + # previous digest combining + vxor C0,C0,C + + # polynomial multiplication "karatsuba" pre-processing + vperm C01h,C0,C1,hidw_mask + vperm C01l,C0,C1,lodw_mask + vxor C01,C01h,C01l + + # polynomial multiplication "karatsuba" + vpmsumd C01h,C01h,H21h # H01 = H^2h*C0h⊕H^1h*C1h + vpmsumd C01l,C01l,H21l # L01 = H^2l*C0l⊕H^1l*C1l + vpmsumd C01,C01,H21 # M01 = (H^2h⊕H^1h)*(C0h⊕C1h)⊕(H^2l⊕H^1l)*(C0l⊕C1l) + + # polynomial multiplication "karatsuba" post-processing + vxor C01,C01,C01h + vxor C01,C01,C01l + + # reduction first phase # [1] + vpmsumd RP,C01l,poly_h # [1] + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,C01,8 # [2] + vsldoi Ml,C01,zero,8 # [2] + vsldoi RP,RP,RP,8 # [1] + vxor C01h,C01h,Mh # [2] + vxor C01l,C01l,Ml # [2] + vxor C01l,C01l,RP # [1] + + # reduction second phase + vpmsumd RP,C01l,poly_l + vxor C01h,C01l,C01h + vxor C,C01h,RP + + addi DATA,DATA,0x20 + bdnz L2x_loop + + clrldi LENGTH,LENGTH,59 +L1x: + srdi r7,LENGTH,4 + cmpldi r7,0 + beq Lrem + + # table loading + li r9,1*TableElemAlign + li r10,2*TableElemAlign + lxvd2x VSR(Hl),0,TABLE + lxvd2x VSR(H), r9,TABLE + lxvd2x VSR(Hh),r10,TABLE + + # input loading + lxvd2x VSR(C0),0,DATA # load C0 + + # swap permuting +IF_LE(`vperm C0,C0,C0,swap_mask') + + # previous digest combining + vxor C0,C0,C + + vpmsumd Cl,C0,Hl # L = Hl*Cl + vpmsumd Cm,C0,H # M = Hh*Cl⊕Hl*Ch + vpmsumd Ch,C0,Hh # H = Hh*Ch + + # reduction first phase # [1] + vpmsumd RP,Cl,poly_h # [1] + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,Cm,8 # [2] + vsldoi Ml,Cm,zero,8 # [2] + vsldoi RP,RP,RP,8 # [1] + vxor Ch,Ch,Mh # [2] + vxor Cl,Cl,Ml # [2] + vxor Cl,Cl,RP # [1] + + # reduction second phase + vpmsumd RP,Cl,poly_l + vxor Ch,Cl,Ch + vxor C,Ch,RP + + addi DATA,DATA,0x10 + clrldi LENGTH,LENGTH,60 +Lrem: + cmpldi LENGTH,0 + beq Ldone + + # table loading + li r9,1*TableElemAlign + li r10,2*TableElemAlign + lxvd2x VSR(Hl),0,TABLE + lxvd2x VSR(H), r9,TABLE + lxvd2x VSR(Hh),r10,TABLE + + # input loading + stdu SP,-16(SP) + stvx zero,0,SP +Lst_loop: + subic. LENGTH,LENGTH,1 + lbzx r7,LENGTH,DATA + stbx r7,LENGTH,SP + bne Lst_loop + lxvd2x VSR(C0),0,SP + addi SP,SP,16 + + # swap permuting +IF_LE(`vperm C0,C0,C0,swap_mask') + + # previous digest combining + vxor C0,C0,C + + vpmsumd Cl,C0,Hl # L = Hl*Cl + vpmsumd Cm,C0,H # M = Hh*Cl⊕Hl*Ch + vpmsumd Ch,C0,Hh # H = Hh*Ch + + # reduction first phase # [1] + vpmsumd RP,Cl,poly_h # [1] + + # polynomial multiplication post-processing # [2] + vsldoi Mh,zero,Cm,8 # [2] + vsldoi Ml,Cm,zero,8 # [2] + vsldoi RP,RP,RP,8 # [1] + vxor Ch,Ch,Mh # [2] + vxor Cl,Cl,Ml # [2] + vxor Cl,Cl,RP # [1] + + # reduction second phase + vpmsumd RP,Cl,poly_l + vxor Ch,Cl,Ch + vxor C,Ch,RP + +Ldone: +IF_LE(`vperm C,C,C,swap_mask') + stxvd2x VSR(C),0,X # store C + blr +EPILOGUE(_nettle_gcm_hash) + + # gcm_fill (uint8_t *ctr, size_t blocks, union gcm_block *buffer) + +define(`FUNC_ALIGN', `5') +PROLOGUE(_nettle_gcm_fill) +IF_LE(`DATA_LOAD_VEC(swap_mask,.swap_mask,r6)') + + vxor zero,zero,zero + vspltisb I1,1 + vspltisb I2,2 + vspltisb I3,3 + vspltisb I4,4 + vspltisb I5,5 + vspltisb I6,6 + vspltisb I7,7 + vspltisb I8,8 + vsldoi I1,zero,I1,1 + vsldoi I2,zero,I2,1 + vsldoi I3,zero,I3,1 + vsldoi I4,zero,I4,1 + vsldoi I5,zero,I5,1 + vsldoi I6,zero,I6,1 + vsldoi I7,zero,I7,1 + vsldoi I8,zero,I8,1 + + lxvd2x VSR(CTR0),0,CTR + IF_LE(`vperm CTR0,CTR0,CTR0,swap_mask') + + srdi r6,BLOCKS,3 # 8x loop count + cmpldi r6,0 + beq Lfill_4x + + std r25,-56(SP); + std r26,-48(SP); + std r27,-40(SP); + std r28,-32(SP); + std r29,-24(SP); + std r30,-16(SP); + std r31,-8(SP); + + li r25,0x10 + li r26,0x20 + li r27,0x30 + li r28,0x40 + li r29,0x50 + li r30,0x60 + li r31,0x70 + + mtctr r6 + L8x_fill_loop: + vadduwm CTR1,CTR0,I1 + vadduwm CTR2,CTR0,I2 + vadduwm CTR3,CTR0,I3 + vadduwm CTR4,CTR0,I4 + vadduwm CTR5,CTR0,I5 + vadduwm CTR6,CTR0,I6 + vadduwm CTR7,CTR0,I7 + + IF_LE(`vperm CTR0S,CTR0,CTR0,swap_mask + vperm CTR1,CTR1,CTR1,swap_mask + vperm CTR2,CTR2,CTR2,swap_mask + vperm CTR3,CTR3,CTR3,swap_mask + vperm CTR4,CTR4,CTR4,swap_mask + vperm CTR5,CTR5,CTR5,swap_mask + vperm CTR6,CTR6,CTR6,swap_mask + vperm CTR7,CTR7,CTR7,swap_mask') + + IF_LE(`stxvd2x VSR(CTR0S),0,BUFFER') + IF_BE(`stxvd2x VSR(CTR0),0,BUFFER') + stxvd2x VSR(CTR1),r25,BUFFER + stxvd2x VSR(CTR2),r26,BUFFER + stxvd2x VSR(CTR3),r27,BUFFER + stxvd2x VSR(CTR4),r28,BUFFER + stxvd2x VSR(CTR5),r29,BUFFER + stxvd2x VSR(CTR6),r30,BUFFER + stxvd2x VSR(CTR7),r31,BUFFER + + vadduwm CTR0,CTR0,I8 + addi BUFFER,BUFFER,0x80 + bdnz L8x_fill_loop + + ld r25,-56(SP); + ld r26,-48(SP); + ld r27,-40(SP); + ld r28,-32(SP); + ld r29,-24(SP); + ld r30,-16(SP); + ld r31,-8(SP); + + clrldi BLOCKS,BLOCKS,61 + + Lfill_4x: + srdi r6,BLOCKS,2 + cmpldi r6,0 + beq Lfill_2x + + li r8,0x10 + li r9,0x20 + li r10,0x30 + + vadduwm CTR1,CTR0,I1 + vadduwm CTR2,CTR0,I2 + vadduwm CTR3,CTR0,I3 + + IF_LE(`vperm CTR0S,CTR0,CTR0,swap_mask + vperm CTR1,CTR1,CTR1,swap_mask + vperm CTR2,CTR2,CTR2,swap_mask + vperm CTR3,CTR3,CTR3,swap_mask') + + IF_LE(`stxvd2x VSR(CTR0S),0,BUFFER') + IF_BE(`stxvd2x VSR(CTR0),0,BUFFER') + stxvd2x VSR(CTR1),r8,BUFFER + stxvd2x VSR(CTR2),r9,BUFFER + stxvd2x VSR(CTR3),r10,BUFFER + + vadduwm CTR0,CTR0,I4 + addi BUFFER,BUFFER,0x40 + + clrldi BLOCKS,BLOCKS,62 + + Lfill_2x: + srdi r6,BLOCKS,1 + cmpldi r6,0 + beq Lfill_1x + + li r10,0x10 + + vadduwm CTR1,CTR0,I1 + + IF_LE(`vperm CTR0S,CTR0,CTR0,swap_mask + vperm CTR1,CTR1,CTR1,swap_mask') + + IF_LE(`stxvd2x VSR(CTR0S),0,BUFFER') + IF_BE(`stxvd2x VSR(CTR0),0,BUFFER') + stxvd2x VSR(CTR1),r10,BUFFER + + vadduwm CTR0,CTR0,I2 + addi BUFFER,BUFFER,0x20 + + clrldi BLOCKS,BLOCKS,63 + + Lfill_1x: + cmpldi BLOCKS,0 + beq Lfill_done + + IF_LE(`vperm CTR0S,CTR0,CTR0,swap_mask') + + IF_LE(`stxvd2x VSR(CTR0S),0,BUFFER') + IF_BE(`stxvd2x VSR(CTR0),0,BUFFER') + + vadduwm CTR0,CTR0,I1 + + Lfill_done: + IF_LE(`vperm CTR0,CTR0,CTR0,swap_mask') + stxvd2x VSR(CTR0),0,CTR + + blr +EPILOGUE(_nettle_gcm_fill) + + .data +IF_LE(`.align 4 +.polynomial: + .byte 1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0xc2 + .align 4 +.swap_mask: + .byte 8,9,10,11,12,13,14,15,0,1,2,3,4,5,6,7 + .align 4 +.hidw_mask: + .byte 23,22,21,20,19,18,17,16,7,6,5,4,3,2,1,0 + .align 4 +.lodw_mask: + .byte 31,30,29,28,27,26,25,24,15,14,13,12,11,10,9,8') +IF_BE(`.align 4 +.polynomial: + .byte 0xc2,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1 + .align 4 +.hidw_mask: + .byte 0,1,2,3,4,5,6,7,16,17,18,19,20,21,22,23 + .align 4 +.lodw_mask: + .byte 8,9,10,11,12,13,14,15,24,25,26,27,28,29,30,31') -- 2.17.1

2 4

[PATCH] "PowerPC64" Use explicit register names
by Maamoun TK 23 Sep '20

23 Sep '20

This patch is built upon ppc-m4-macrology.patch. Using explicit register names is working as expected now. --- powerpc64/machine.m4 | 11 +- powerpc64/p8/aes-decrypt-internal.asm | 194 +++++++++++++++++----------------- powerpc64/p8/aes-encrypt-internal.asm | 192 ++++++++++++++++----------------- 3 files changed, 200 insertions(+), 197 deletions(-) diff --git a/powerpc64/machine.m4 b/powerpc64/machine.m4 index ae161d79..f867ec01 100644 --- a/powerpc64/machine.m4 +++ b/powerpc64/machine.m4 @@ -24,7 +24,10 @@ define(`EPILOGUE', C Get vector-scalar register from vector register C VSR(VR) -define(`VSR',`32+$1') +define(`VSR',`ifelse(ASM_PPC_WANT_R_REGISTERS,no, +`eval(32+$1)', +``vs'eval(32+substr($1,1,len($1)))' +)') C Load the quadword in DATA_SRC storage into C VEC_DST. GPR is general-purpose register @@ -32,19 +35,19 @@ C used to obtain the effective address of C DATA_SRC storage. C DATA_LOAD_VEC(VEC_DST, DATA_SRC, GPR) define(`DATA_LOAD_VEC', -`ld $3,$2@got(2) +`ld $3,$2@got(r2) lvx $1,0,$3') dnl Usage: r0 ... r31, cr0 ... cr7 dnl dnl Registers names, either left as "r0" etc or mapped to plain 0 etc, -dnl according to the result of the GMP_ASM_POWERPC_REGISTERS configure +dnl according to the result of the ASM_PPC_WANT_R_REGISTERS configure dnl test. ifelse(ASM_PPC_WANT_R_REGISTERS,no,` forloop(i,0,31,`deflit(`r'i,i)') forloop(i,0,31,`deflit(`v'i,i)') +forloop(i,0,63,`deflit(`vs'i,i)') forloop(i,0,31,`deflit(`f'i,i)') forloop(i,0,7, `deflit(`cr'i,i)') ') - diff --git a/powerpc64/p8/aes-decrypt-internal.asm b/powerpc64/p8/aes-decrypt-internal.asm index acdbc1bd..7c79ffcb 100644 --- a/powerpc64/p8/aes-decrypt-internal.asm +++ b/powerpc64/p8/aes-decrypt-internal.asm @@ -31,32 +31,32 @@ ifelse(` C Register usage: -define(`SP', `1') -define(`TOCP', `2') - -define(`ROUNDS', `3') -define(`KEYS', `4') -define(`LENGTH', `6') -define(`DST', `7') -define(`SRC', `8') - -define(`swap_mask', `0') - -define(`K', `1') -define(`S0', `2') -define(`S1', `3') -define(`S2', `4') -define(`S3', `5') -define(`S4', `6') -define(`S5', `7') -define(`S6', `8') -define(`S7', `9') +define(`SP', `r1') +define(`TOCP', `r2') + +define(`ROUNDS', `r3') +define(`KEYS', `r4') +define(`LENGTH', `r6') +define(`DST', `r7') +define(`SRC', `r8') + +define(`swap_mask', `v0') + +define(`K', `v1') +define(`S0', `v2') +define(`S1', `v3') +define(`S2', `v4') +define(`S3', `v5') +define(`S4', `v6') +define(`S5', `v7') +define(`S6', `v8') +define(`S7', `v9') C ZERO vector register is used in place of RoundKey C for vncipher instruction because the order of InvMixColumns C and Xor processes are flipped in that instruction. C The Xor process with RoundKey is executed afterward. -define(`ZERO', `10') +define(`ZERO', `v10') .file "aes-decrypt-internal.asm" @@ -71,30 +71,30 @@ define(`FUNC_ALIGN', `5') PROLOGUE(_nettle_aes_decrypt) vxor ZERO,ZERO,ZERO - DATA_LOAD_VEC(swap_mask,.swap_mask,5) + DATA_LOAD_VEC(swap_mask,.swap_mask,r5) subi ROUNDS,ROUNDS,1 srdi LENGTH,LENGTH,4 - srdi 5,LENGTH,3 #8x loop count - cmpldi 5,0 + srdi r5,LENGTH,3 #8x loop count + cmpldi r5,0 beq L4x - std 25,-56(SP); - std 26,-48(SP); - std 27,-40(SP); - std 28,-32(SP); - std 29,-24(SP); - std 30,-16(SP); - std 31,-8(SP); - - li 25,0x10 - li 26,0x20 - li 27,0x30 - li 28,0x40 - li 29,0x50 - li 30,0x60 - li 31,0x70 + std r25,-56(SP); + std r26,-48(SP); + std r27,-40(SP); + std r28,-32(SP); + std r29,-24(SP); + std r30,-16(SP); + std r31,-8(SP); + + li r25,0x10 + li r26,0x20 + li r27,0x30 + li r28,0x40 + li r29,0x50 + li r30,0x60 + li r31,0x70 .align 5 Lx8_loop: @@ -102,13 +102,13 @@ Lx8_loop: vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - lxvd2x VSR(S1),25,SRC - lxvd2x VSR(S2),26,SRC - lxvd2x VSR(S3),27,SRC - lxvd2x VSR(S4),28,SRC - lxvd2x VSR(S5),29,SRC - lxvd2x VSR(S6),30,SRC - lxvd2x VSR(S7),31,SRC + lxvd2x VSR(S1),r25,SRC + lxvd2x VSR(S2),r26,SRC + lxvd2x VSR(S3),r27,SRC + lxvd2x VSR(S4),r28,SRC + lxvd2x VSR(S5),r29,SRC + lxvd2x VSR(S6),r30,SRC + lxvd2x VSR(S7),r31,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -129,10 +129,10 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S7,S7,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L8x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -150,10 +150,10 @@ L8x_round_loop: vxor S5,S5,K vxor S6,S6,K vxor S7,S7,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L8x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -174,44 +174,44 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S7,S7,S7,swap_mask') stxvd2x VSR(S0),0,DST - stxvd2x VSR(S1),25,DST - stxvd2x VSR(S2),26,DST - stxvd2x VSR(S3),27,DST - stxvd2x VSR(S4),28,DST - stxvd2x VSR(S5),29,DST - stxvd2x VSR(S6),30,DST - stxvd2x VSR(S7),31,DST + stxvd2x VSR(S1),r25,DST + stxvd2x VSR(S2),r26,DST + stxvd2x VSR(S3),r27,DST + stxvd2x VSR(S4),r28,DST + stxvd2x VSR(S5),r29,DST + stxvd2x VSR(S6),r30,DST + stxvd2x VSR(S7),r31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 - subic. 5,5,1 + subic. r5,r5,1 bne Lx8_loop - ld 25,-56(SP); - ld 26,-48(SP); - ld 27,-40(SP); - ld 28,-32(SP); - ld 29,-24(SP); - ld 30,-16(SP); - ld 31,-8(SP); + ld r25,-56(SP); + ld r26,-48(SP); + ld r27,-40(SP); + ld r28,-32(SP); + ld r29,-24(SP); + ld r30,-16(SP); + ld r31,-8(SP); clrldi LENGTH,LENGTH,61 L4x: - srdi 5,LENGTH,2 - cmpldi 5,0 + srdi r5,LENGTH,2 + cmpldi r5,0 beq L2x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S2),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S3),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S2),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S3),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -224,10 +224,10 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S3,S3,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L4x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -237,10 +237,10 @@ L4x_round_loop: vxor S1,S1,K vxor S2,S2,K vxor S3,S3,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L4x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -253,12 +253,12 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S3,S3,S3,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST - addi 9,9,0x10 - stxvd2x VSR(S2),9,DST - addi 9,9,0x10 - stxvd2x VSR(S3),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S2),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S3),r9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -266,16 +266,16 @@ IF_LE(`vperm S0,S0,S0,swap_mask clrldi LENGTH,LENGTH,62 L2x: - srdi 5,LENGTH,1 - cmpldi 5,0 + srdi r5,LENGTH,1 + cmpldi r5,0 beq L1x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') @@ -284,19 +284,19 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S1,S1,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L2x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO vxor S0,S0,K vxor S1,S1,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L2x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -305,8 +305,8 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -327,17 +327,17 @@ IF_LE(`vperm S0,S0,S0,swap_mask') vxor S0,S0,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L1x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vxor S0,S0,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L1x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K diff --git a/powerpc64/p8/aes-encrypt-internal.asm b/powerpc64/p8/aes-encrypt-internal.asm index 482dff25..3dd6e7b5 100644 --- a/powerpc64/p8/aes-encrypt-internal.asm +++ b/powerpc64/p8/aes-encrypt-internal.asm @@ -31,26 +31,26 @@ ifelse(` C Register usage: -define(`SP', `1') -define(`TOCP', `2') - -define(`ROUNDS', `3') -define(`KEYS', `4') -define(`LENGTH', `6') -define(`DST', `7') -define(`SRC', `8') - -define(`swap_mask', `0') - -define(`K', `1') -define(`S0', `2') -define(`S1', `3') -define(`S2', `4') -define(`S3', `5') -define(`S4', `6') -define(`S5', `7') -define(`S6', `8') -define(`S7', `9') +define(`SP', `r1') +define(`TOCP', `r2') + +define(`ROUNDS', `r3') +define(`KEYS', `r4') +define(`LENGTH', `r6') +define(`DST', `r7') +define(`SRC', `r8') + +define(`swap_mask', `v0') + +define(`K', `v1') +define(`S0', `v2') +define(`S1', `v3') +define(`S2', `v4') +define(`S3', `v5') +define(`S4', `v6') +define(`S5', `v7') +define(`S6', `v8') +define(`S7', `v9') .file "aes-encrypt-internal.asm" @@ -63,30 +63,30 @@ define(`S7', `9') define(`FUNC_ALIGN', `5') PROLOGUE(_nettle_aes_encrypt) - DATA_LOAD_VEC(swap_mask,.swap_mask,5) + DATA_LOAD_VEC(swap_mask,.swap_mask,r5) subi ROUNDS,ROUNDS,1 srdi LENGTH,LENGTH,4 - srdi 5,LENGTH,3 #8x loop count - cmpldi 5,0 + srdi r5,LENGTH,3 #8x loop count + cmpldi r5,0 beq L4x - std 25,-56(SP); - std 26,-48(SP); - std 27,-40(SP); - std 28,-32(SP); - std 29,-24(SP); - std 30,-16(SP); - std 31,-8(SP); - - li 25,0x10 - li 26,0x20 - li 27,0x30 - li 28,0x40 - li 29,0x50 - li 30,0x60 - li 31,0x70 + std r25,-56(SP); + std r26,-48(SP); + std r27,-40(SP); + std r28,-32(SP); + std r29,-24(SP); + std r30,-16(SP); + std r31,-8(SP); + + li r25,0x10 + li r26,0x20 + li r27,0x30 + li r28,0x40 + li r29,0x50 + li r30,0x60 + li r31,0x70 .align 5 Lx8_loop: @@ -94,13 +94,13 @@ Lx8_loop: vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - lxvd2x VSR(S1),25,SRC - lxvd2x VSR(S2),26,SRC - lxvd2x VSR(S3),27,SRC - lxvd2x VSR(S4),28,SRC - lxvd2x VSR(S5),29,SRC - lxvd2x VSR(S6),30,SRC - lxvd2x VSR(S7),31,SRC + lxvd2x VSR(S1),r25,SRC + lxvd2x VSR(S2),r26,SRC + lxvd2x VSR(S3),r27,SRC + lxvd2x VSR(S4),r28,SRC + lxvd2x VSR(S5),r29,SRC + lxvd2x VSR(S6),r30,SRC + lxvd2x VSR(S7),r31,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -121,10 +121,10 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S7,S7,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L8x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K @@ -134,10 +134,10 @@ L8x_round_loop: vcipher S5,S5,K vcipher S6,S6,K vcipher S7,S7,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L8x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -158,44 +158,44 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S7,S7,S7,swap_mask') stxvd2x VSR(S0),0,DST - stxvd2x VSR(S1),25,DST - stxvd2x VSR(S2),26,DST - stxvd2x VSR(S3),27,DST - stxvd2x VSR(S4),28,DST - stxvd2x VSR(S5),29,DST - stxvd2x VSR(S6),30,DST - stxvd2x VSR(S7),31,DST + stxvd2x VSR(S1),r25,DST + stxvd2x VSR(S2),r26,DST + stxvd2x VSR(S3),r27,DST + stxvd2x VSR(S4),r28,DST + stxvd2x VSR(S5),r29,DST + stxvd2x VSR(S6),r30,DST + stxvd2x VSR(S7),r31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 - subic. 5,5,1 + subic. r5,r5,1 bne Lx8_loop - ld 25,-56(SP); - ld 26,-48(SP); - ld 27,-40(SP); - ld 28,-32(SP); - ld 29,-24(SP); - ld 30,-16(SP); - ld 31,-8(SP); + ld r25,-56(SP); + ld r26,-48(SP); + ld r27,-40(SP); + ld r28,-32(SP); + ld r29,-24(SP); + ld r30,-16(SP); + ld r31,-8(SP); clrldi LENGTH,LENGTH,61 L4x: - srdi 5,LENGTH,2 - cmpldi 5,0 + srdi r5,LENGTH,2 + cmpldi r5,0 beq L2x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S2),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S3),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S2),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S3),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -208,19 +208,19 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S3,S3,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L4x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K vcipher S2,S2,K vcipher S3,S3,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L4x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -233,12 +233,12 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S3,S3,S3,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST - addi 9,9,0x10 - stxvd2x VSR(S2),9,DST - addi 9,9,0x10 - stxvd2x VSR(S3),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S2),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S3),r9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -246,16 +246,16 @@ IF_LE(`vperm S0,S0,S0,swap_mask clrldi LENGTH,LENGTH,62 L2x: - srdi 5,LENGTH,1 - cmpldi 5,0 + srdi r5,LENGTH,1 + cmpldi r5,0 beq L1x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') @@ -264,17 +264,17 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S1,S1,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L2x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L2x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -283,8 +283,8 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -305,16 +305,16 @@ IF_LE(`vperm S0,S0,S0,swap_mask') vxor S0,S0,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L1x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L1x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K -- 2.17.1

2 1

Re: NAPLES standup
by Jaak Ristioja 21 Sep '20

21 Sep '20

On esmaspäev, 21. september 2020 13:33:10 EEST Angela Sahk wrote: > Ma olen hetkel Zoomi VMRis... > > > On September 21, 2020 at 1:32 PM Angela Sahk <angela.sahk(a)cyber.ee> wrote: > > Hei, > > > > > > Kuna meie vahel Matrix ei toimi, siis kirjutan siia... kas sa liitud > > täna? > > > > > > Angela Meanwhile in matrix: [13:32:01] <J> hei! Naples-vormsi standup ikka toimub? ma ei näe VMR02-s kedagi [13:33:19] <J> muidugi seal taskis on hoopis mingi muu pexipi link, mis annab HTTP 404: https://pexip.me/meet/53256948/ J

1 1

[PATCH] "PowerPC64" Use same register convention in VSR macro
by Maamoun TK 19 Sep '20

19 Sep '20

--- powerpc64/machine.m4 | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/powerpc64/machine.m4 b/powerpc64/machine.m4 index f867ec01..e2383201 100644 --- a/powerpc64/machine.m4 +++ b/powerpc64/machine.m4 @@ -24,10 +24,9 @@ define(`EPILOGUE', C Get vector-scalar register from vector register C VSR(VR) -define(`VSR',`ifelse(ASM_PPC_WANT_R_REGISTERS,no, -`eval(32+$1)', -``vs'eval(32+substr($1,1,len($1)))' -)') +define(`VSR',`ifelse(substr($1,0,1),`v', +``vs'eval(32+substr($1,1,len($1)))', +`eval(32+$1)')') C Load the quadword in DATA_SRC storage into C VEC_DST. GPR is general-purpose register -- 2.17.1

1 0

[PATCH] "PowerPC64" Use register names explicitly
by Maamoun TK 18 Sep '20

18 Sep '20

Use explicit register names to improve the syntax of assembly files and pass -mregnames to the assembler to allow building the assembly files. I will make a stand-alone patch for GCM which brings all the accumulated modifications so it can be directly merged. --- configure.ac | 4 +- powerpc64/machine.m4 | 4 +- powerpc64/p8/aes-decrypt-internal.asm | 194 +++++++++++++++++----------------- powerpc64/p8/aes-encrypt-internal.asm | 192 ++++++++++++++++----------------- 4 files changed, 198 insertions(+), 196 deletions(-) diff --git a/configure.ac b/configure.ac index 666b2f4a..6ab32f03 100644 --- a/configure.ac +++ b/configure.ac @@ -458,10 +458,12 @@ if test "x$enable_assembler" = xyes ; then if test "$ABI" = 64 ; then asm_path="powerpc64" if test "x$enable_fat" = xyes ; then - asm_path="powerpc64/fat $asm_path" + CFLAGS="$CFLAGS -Wa,-mregnames" + asm_path="powerpc64/fat $asm_path" OPT_NETTLE_SOURCES="fat-ppc.c $OPT_NETTLE_SOURCES" FAT_TEST_LIST="none crypto_ext" elif test "x$enable_power_crypto_ext" = xyes ; then + CFLAGS="$CFLAGS -Wa,-mregnames" asm_path="powerpc64/p8 $asm_path" fi fi diff --git a/powerpc64/machine.m4 b/powerpc64/machine.m4 index 221fa523..cefabc9b 100644 --- a/powerpc64/machine.m4 +++ b/powerpc64/machine.m4 @@ -24,7 +24,7 @@ define(`EPILOGUE', C Get vector-scalar register from vector register C VSR(VR) -define(`VSR',`32+$1') +define(`VSR',``vs'eval(32+substr($1,1,len($1)))') C Load the quadword in DATA_SRC storage into C VEC_DST. GPR is general-purpose register @@ -32,5 +32,5 @@ C used to obtain the effective address of C DATA_SRC storage. C DATA_LOAD_VEC(VEC_DST, DATA_SRC, GPR) define(`DATA_LOAD_VEC', -`ld $3,$2@got(2) +`ld $3,$2@got(r2) lvx $1,0,$3') diff --git a/powerpc64/p8/aes-decrypt-internal.asm b/powerpc64/p8/aes-decrypt-internal.asm index acdbc1bd..7c79ffcb 100644 --- a/powerpc64/p8/aes-decrypt-internal.asm +++ b/powerpc64/p8/aes-decrypt-internal.asm @@ -31,32 +31,32 @@ ifelse(` C Register usage: -define(`SP', `1') -define(`TOCP', `2') - -define(`ROUNDS', `3') -define(`KEYS', `4') -define(`LENGTH', `6') -define(`DST', `7') -define(`SRC', `8') - -define(`swap_mask', `0') - -define(`K', `1') -define(`S0', `2') -define(`S1', `3') -define(`S2', `4') -define(`S3', `5') -define(`S4', `6') -define(`S5', `7') -define(`S6', `8') -define(`S7', `9') +define(`SP', `r1') +define(`TOCP', `r2') + +define(`ROUNDS', `r3') +define(`KEYS', `r4') +define(`LENGTH', `r6') +define(`DST', `r7') +define(`SRC', `r8') + +define(`swap_mask', `v0') + +define(`K', `v1') +define(`S0', `v2') +define(`S1', `v3') +define(`S2', `v4') +define(`S3', `v5') +define(`S4', `v6') +define(`S5', `v7') +define(`S6', `v8') +define(`S7', `v9') C ZERO vector register is used in place of RoundKey C for vncipher instruction because the order of InvMixColumns C and Xor processes are flipped in that instruction. C The Xor process with RoundKey is executed afterward. -define(`ZERO', `10') +define(`ZERO', `v10') .file "aes-decrypt-internal.asm" @@ -71,30 +71,30 @@ define(`FUNC_ALIGN', `5') PROLOGUE(_nettle_aes_decrypt) vxor ZERO,ZERO,ZERO - DATA_LOAD_VEC(swap_mask,.swap_mask,5) + DATA_LOAD_VEC(swap_mask,.swap_mask,r5) subi ROUNDS,ROUNDS,1 srdi LENGTH,LENGTH,4 - srdi 5,LENGTH,3 #8x loop count - cmpldi 5,0 + srdi r5,LENGTH,3 #8x loop count + cmpldi r5,0 beq L4x - std 25,-56(SP); - std 26,-48(SP); - std 27,-40(SP); - std 28,-32(SP); - std 29,-24(SP); - std 30,-16(SP); - std 31,-8(SP); - - li 25,0x10 - li 26,0x20 - li 27,0x30 - li 28,0x40 - li 29,0x50 - li 30,0x60 - li 31,0x70 + std r25,-56(SP); + std r26,-48(SP); + std r27,-40(SP); + std r28,-32(SP); + std r29,-24(SP); + std r30,-16(SP); + std r31,-8(SP); + + li r25,0x10 + li r26,0x20 + li r27,0x30 + li r28,0x40 + li r29,0x50 + li r30,0x60 + li r31,0x70 .align 5 Lx8_loop: @@ -102,13 +102,13 @@ Lx8_loop: vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - lxvd2x VSR(S1),25,SRC - lxvd2x VSR(S2),26,SRC - lxvd2x VSR(S3),27,SRC - lxvd2x VSR(S4),28,SRC - lxvd2x VSR(S5),29,SRC - lxvd2x VSR(S6),30,SRC - lxvd2x VSR(S7),31,SRC + lxvd2x VSR(S1),r25,SRC + lxvd2x VSR(S2),r26,SRC + lxvd2x VSR(S3),r27,SRC + lxvd2x VSR(S4),r28,SRC + lxvd2x VSR(S5),r29,SRC + lxvd2x VSR(S6),r30,SRC + lxvd2x VSR(S7),r31,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -129,10 +129,10 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S7,S7,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L8x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -150,10 +150,10 @@ L8x_round_loop: vxor S5,S5,K vxor S6,S6,K vxor S7,S7,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L8x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -174,44 +174,44 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S7,S7,S7,swap_mask') stxvd2x VSR(S0),0,DST - stxvd2x VSR(S1),25,DST - stxvd2x VSR(S2),26,DST - stxvd2x VSR(S3),27,DST - stxvd2x VSR(S4),28,DST - stxvd2x VSR(S5),29,DST - stxvd2x VSR(S6),30,DST - stxvd2x VSR(S7),31,DST + stxvd2x VSR(S1),r25,DST + stxvd2x VSR(S2),r26,DST + stxvd2x VSR(S3),r27,DST + stxvd2x VSR(S4),r28,DST + stxvd2x VSR(S5),r29,DST + stxvd2x VSR(S6),r30,DST + stxvd2x VSR(S7),r31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 - subic. 5,5,1 + subic. r5,r5,1 bne Lx8_loop - ld 25,-56(SP); - ld 26,-48(SP); - ld 27,-40(SP); - ld 28,-32(SP); - ld 29,-24(SP); - ld 30,-16(SP); - ld 31,-8(SP); + ld r25,-56(SP); + ld r26,-48(SP); + ld r27,-40(SP); + ld r28,-32(SP); + ld r29,-24(SP); + ld r30,-16(SP); + ld r31,-8(SP); clrldi LENGTH,LENGTH,61 L4x: - srdi 5,LENGTH,2 - cmpldi 5,0 + srdi r5,LENGTH,2 + cmpldi r5,0 beq L2x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S2),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S3),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S2),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S3),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -224,10 +224,10 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S3,S3,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L4x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -237,10 +237,10 @@ L4x_round_loop: vxor S1,S1,K vxor S2,S2,K vxor S3,S3,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L4x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -253,12 +253,12 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S3,S3,S3,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST - addi 9,9,0x10 - stxvd2x VSR(S2),9,DST - addi 9,9,0x10 - stxvd2x VSR(S3),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S2),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S3),r9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -266,16 +266,16 @@ IF_LE(`vperm S0,S0,S0,swap_mask clrldi LENGTH,LENGTH,62 L2x: - srdi 5,LENGTH,1 - cmpldi 5,0 + srdi r5,LENGTH,1 + cmpldi r5,0 beq L1x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') @@ -284,19 +284,19 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S1,S1,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L2x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO vxor S0,S0,K vxor S1,S1,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L2x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -305,8 +305,8 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -327,17 +327,17 @@ IF_LE(`vperm S0,S0,S0,swap_mask') vxor S0,S0,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L1x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vxor S0,S0,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L1x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K diff --git a/powerpc64/p8/aes-encrypt-internal.asm b/powerpc64/p8/aes-encrypt-internal.asm index 482dff25..3dd6e7b5 100644 --- a/powerpc64/p8/aes-encrypt-internal.asm +++ b/powerpc64/p8/aes-encrypt-internal.asm @@ -31,26 +31,26 @@ ifelse(` C Register usage: -define(`SP', `1') -define(`TOCP', `2') - -define(`ROUNDS', `3') -define(`KEYS', `4') -define(`LENGTH', `6') -define(`DST', `7') -define(`SRC', `8') - -define(`swap_mask', `0') - -define(`K', `1') -define(`S0', `2') -define(`S1', `3') -define(`S2', `4') -define(`S3', `5') -define(`S4', `6') -define(`S5', `7') -define(`S6', `8') -define(`S7', `9') +define(`SP', `r1') +define(`TOCP', `r2') + +define(`ROUNDS', `r3') +define(`KEYS', `r4') +define(`LENGTH', `r6') +define(`DST', `r7') +define(`SRC', `r8') + +define(`swap_mask', `v0') + +define(`K', `v1') +define(`S0', `v2') +define(`S1', `v3') +define(`S2', `v4') +define(`S3', `v5') +define(`S4', `v6') +define(`S5', `v7') +define(`S6', `v8') +define(`S7', `v9') .file "aes-encrypt-internal.asm" @@ -63,30 +63,30 @@ define(`S7', `9') define(`FUNC_ALIGN', `5') PROLOGUE(_nettle_aes_encrypt) - DATA_LOAD_VEC(swap_mask,.swap_mask,5) + DATA_LOAD_VEC(swap_mask,.swap_mask,r5) subi ROUNDS,ROUNDS,1 srdi LENGTH,LENGTH,4 - srdi 5,LENGTH,3 #8x loop count - cmpldi 5,0 + srdi r5,LENGTH,3 #8x loop count + cmpldi r5,0 beq L4x - std 25,-56(SP); - std 26,-48(SP); - std 27,-40(SP); - std 28,-32(SP); - std 29,-24(SP); - std 30,-16(SP); - std 31,-8(SP); - - li 25,0x10 - li 26,0x20 - li 27,0x30 - li 28,0x40 - li 29,0x50 - li 30,0x60 - li 31,0x70 + std r25,-56(SP); + std r26,-48(SP); + std r27,-40(SP); + std r28,-32(SP); + std r29,-24(SP); + std r30,-16(SP); + std r31,-8(SP); + + li r25,0x10 + li r26,0x20 + li r27,0x30 + li r28,0x40 + li r29,0x50 + li r30,0x60 + li r31,0x70 .align 5 Lx8_loop: @@ -94,13 +94,13 @@ Lx8_loop: vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - lxvd2x VSR(S1),25,SRC - lxvd2x VSR(S2),26,SRC - lxvd2x VSR(S3),27,SRC - lxvd2x VSR(S4),28,SRC - lxvd2x VSR(S5),29,SRC - lxvd2x VSR(S6),30,SRC - lxvd2x VSR(S7),31,SRC + lxvd2x VSR(S1),r25,SRC + lxvd2x VSR(S2),r26,SRC + lxvd2x VSR(S3),r27,SRC + lxvd2x VSR(S4),r28,SRC + lxvd2x VSR(S5),r29,SRC + lxvd2x VSR(S6),r30,SRC + lxvd2x VSR(S7),r31,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -121,10 +121,10 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S7,S7,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L8x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K @@ -134,10 +134,10 @@ L8x_round_loop: vcipher S5,S5,K vcipher S6,S6,K vcipher S7,S7,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L8x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -158,44 +158,44 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S7,S7,S7,swap_mask') stxvd2x VSR(S0),0,DST - stxvd2x VSR(S1),25,DST - stxvd2x VSR(S2),26,DST - stxvd2x VSR(S3),27,DST - stxvd2x VSR(S4),28,DST - stxvd2x VSR(S5),29,DST - stxvd2x VSR(S6),30,DST - stxvd2x VSR(S7),31,DST + stxvd2x VSR(S1),r25,DST + stxvd2x VSR(S2),r26,DST + stxvd2x VSR(S3),r27,DST + stxvd2x VSR(S4),r28,DST + stxvd2x VSR(S5),r29,DST + stxvd2x VSR(S6),r30,DST + stxvd2x VSR(S7),r31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 - subic. 5,5,1 + subic. r5,r5,1 bne Lx8_loop - ld 25,-56(SP); - ld 26,-48(SP); - ld 27,-40(SP); - ld 28,-32(SP); - ld 29,-24(SP); - ld 30,-16(SP); - ld 31,-8(SP); + ld r25,-56(SP); + ld r26,-48(SP); + ld r27,-40(SP); + ld r28,-32(SP); + ld r29,-24(SP); + ld r30,-16(SP); + ld r31,-8(SP); clrldi LENGTH,LENGTH,61 L4x: - srdi 5,LENGTH,2 - cmpldi 5,0 + srdi r5,LENGTH,2 + cmpldi r5,0 beq L2x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S2),9,SRC - addi 9,9,0x10 - lxvd2x VSR(S3),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S2),r9,SRC + addi r9,r9,0x10 + lxvd2x VSR(S3),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -208,19 +208,19 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S3,S3,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L4x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K vcipher S2,S2,K vcipher S3,S3,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L4x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -233,12 +233,12 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S3,S3,S3,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST - addi 9,9,0x10 - stxvd2x VSR(S2),9,DST - addi 9,9,0x10 - stxvd2x VSR(S3),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S2),r9,DST + addi r9,r9,0x10 + stxvd2x VSR(S3),r9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -246,16 +246,16 @@ IF_LE(`vperm S0,S0,S0,swap_mask clrldi LENGTH,LENGTH,62 L2x: - srdi 5,LENGTH,1 - cmpldi 5,0 + srdi r5,LENGTH,1 + cmpldi r5,0 beq L1x lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask lxvd2x VSR(S0),0,SRC - li 9,0x10 - lxvd2x VSR(S1),9,SRC + li r9,0x10 + lxvd2x VSR(S1),r9,SRC IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') @@ -264,17 +264,17 @@ IF_LE(`vperm S0,S0,S0,swap_mask vxor S1,S1,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L2x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L2x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -283,8 +283,8 @@ IF_LE(`vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask') stxvd2x VSR(S0),0,DST - li 9,0x10 - stxvd2x VSR(S1),9,DST + li r9,0x10 + stxvd2x VSR(S1),r9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -305,16 +305,16 @@ IF_LE(`vperm S0,S0,S0,swap_mask') vxor S0,S0,K mtctr ROUNDS - li 10,0x10 + li r10,0x10 .align 5 L1x_round_loop: - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K - addi 10,10,0x10 + addi r10,r10,0x10 bdnz L1x_round_loop - lxvd2x VSR(K),10,KEYS + lxvd2x VSR(K),r10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K -- 2.17.1

2 2

The m4 quote characters
by nisse＠lysator.liu.se 18 Sep '20

18 Sep '20

To adopt the m4 macrology used in GMP, for optionally substituting r0-->0, r1-->1, etc, I tried to copy the m4 macros, including an m4 forloop. But that didn't work out of the box, and it seems that one complication is that Nettle's uses <> as m4 quote characters. I've used them since I introduced m4 preprocessing back in 2002, and I honestly don't remember why I thought that was a good idea at the time. I guess I found `' ugly, and the autoconf choice of [] didn't work well with assembly syntax (in particular on sparc). In a few places nettle needs to use < as an operator in m4 eval, and there are workarounds for that using local changequote, with the curious hack define(<W64_ENTRY>, < changequote([,])dnl ifelse(<<<<<<<<<<<<<<<<<< ignored; only for balancing) ifelse(W64_ABI,yes,[ dnl unconditionally push %rdi, making %rsp 16-byte aligned push %rdi dnl Save %xmm6, ..., if needed ifelse(eval($2 > 6), 1, [ sub [$]eval(16*($2 - 6)), %rsp movdqa %xmm6, 0(%rsp) ]) ifelse(eval($2 > 7), 1, [ movdqa %xmm7, 16(%rsp) ]) ... So I'm considering changing that, and instead stick to m4 default quotes. Opinions? Regards, /Niels -- Niels Möller. PGP-encrypted email is preferred. Keyid 368C6677. Internet email is subject to wholesale government surveillance.

2 3

[PATCH] "PowerPC64" AES improve syntax
by Maamoun TK 08 Sep '20

08 Sep '20

This patch adds "VSR" macro to improve the syntax of assembly code, I will create a separate patch for gcm-hash since it hasn't merged yet to the master. I also removed the TODO from README because I tried to use "lxv/stxv" in POWER9 instead of "lxvd2x/stxvd2x" but gcc produced "lxvd2x/stxvd2x" in the binary. I'm not sure if it's variant issue of gcc but this will be problematic since "lxvd2x/stxvd2x" need permuting in little-endian mode while "lxv/stxv" is endianness aware. --- powerpc64/README | 2 - powerpc64/machine.m4 | 4 ++ powerpc64/p8/aes-decrypt-internal.asm | 97 ++++++++++++++++------------------- powerpc64/p8/aes-encrypt-internal.asm | 97 ++++++++++++++++------------------- 4 files changed, 90 insertions(+), 110 deletions(-) diff --git a/powerpc64/README b/powerpc64/README index 5410791f..7301953b 100644 --- a/powerpc64/README +++ b/powerpc64/README @@ -53,8 +53,6 @@ in [3] to see an example of accessing unaligned storage operands. "lxvd2x/stxvd2x" can be used to load/store data into unaligned storage operands but permuting is needed for loading and storing data in little-endian mode VSX registers are defined with "X" suffix -TODO: use architecture 3.0 instructions "lxv/stxv" instead for POWER9 - and newer Function Prologue diff --git a/powerpc64/machine.m4 b/powerpc64/machine.m4 index 2f91adec..b76bb8b1 100644 --- a/powerpc64/machine.m4 +++ b/powerpc64/machine.m4 @@ -22,6 +22,10 @@ define(<EPILOGUE>, <.size .C_NAME($1), . - .C_NAME($1) .size C_NAME($1), . - .C_NAME($1)>)>) +C Get vector-scalar register from vector register +C VSR(VR) +define(<VSR>,<32+$1>) + C Load the quadword in DATA_SRC storage into C VEC_DST. GPR is general-purpose register C used to obtain the effective address of diff --git a/powerpc64/p8/aes-decrypt-internal.asm b/powerpc64/p8/aes-decrypt-internal.asm index 7d518cd9..bfedb32b 100644 --- a/powerpc64/p8/aes-decrypt-internal.asm +++ b/powerpc64/p8/aes-decrypt-internal.asm @@ -1,4 +1,4 @@ -C powerpc64/P8/aes-decrypt-internal.asm +C powerpc64/p8/aes-decrypt-internal.asm ifelse(< Copyright (C) 2020 Mamone Tarsha @@ -52,16 +52,6 @@ define(<S5>, <7>) define(<S6>, <8>) define(<S7>, <9>) -define(<KX>, <33>) -define(<S0X>, <34>) -define(<S1X>, <35>) -define(<S2X>, <36>) -define(<S3X>, <37>) -define(<S4X>, <38>) -define(<S5X>, <39>) -define(<S6X>, <40>) -define(<S7X>, <41>) - C ZERO vector register is used in place of RoundKey C for vncipher instruction because the order of InvMixColumns C and Xor processes are flipped in that instruction. @@ -70,7 +60,6 @@ define(<ZERO>, <10>) .file "aes-decrypt-internal.asm" -IF_LE(<.abiversion 2>) .text C _aes_decrypt(unsigned rounds, const uint32_t *keys, @@ -109,17 +98,17 @@ PROLOGUE(_nettle_aes_decrypt) .align 5 Lx8_loop: - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC - lxvd2x S1X,25,SRC - lxvd2x S2X,26,SRC - lxvd2x S3X,27,SRC - lxvd2x S4X,28,SRC - lxvd2x S5X,29,SRC - lxvd2x S6X,30,SRC - lxvd2x S7X,31,SRC + lxvd2x VSR(S0),0,SRC + lxvd2x VSR(S1),25,SRC + lxvd2x VSR(S2),26,SRC + lxvd2x VSR(S3),27,SRC + lxvd2x VSR(S4),28,SRC + lxvd2x VSR(S5),29,SRC + lxvd2x VSR(S6),30,SRC + lxvd2x VSR(S7),31,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -143,7 +132,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L8x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -164,7 +153,7 @@ L8x_round_loop: addi 10,10,0x10 bdnz L8x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -184,14 +173,14 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S6,S6,S6,swap_mask vperm S7,S7,S7,swap_mask>) - stxvd2x S0X,0,DST - stxvd2x S1X,25,DST - stxvd2x S2X,26,DST - stxvd2x S3X,27,DST - stxvd2x S4X,28,DST - stxvd2x S5X,29,DST - stxvd2x S6X,30,DST - stxvd2x S7X,31,DST + stxvd2x VSR(S0),0,DST + stxvd2x VSR(S1),25,DST + stxvd2x VSR(S2),26,DST + stxvd2x VSR(S3),27,DST + stxvd2x VSR(S4),28,DST + stxvd2x VSR(S5),29,DST + stxvd2x VSR(S6),30,DST + stxvd2x VSR(S7),31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 @@ -213,16 +202,16 @@ L4x: cmpldi 5,0 beq L2x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC addi 9,9,0x10 - lxvd2x S2X,9,SRC + lxvd2x VSR(S2),9,SRC addi 9,9,0x10 - lxvd2x S3X,9,SRC + lxvd2x VSR(S3),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -238,7 +227,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L4x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -251,7 +240,7 @@ L4x_round_loop: addi 10,10,0x10 bdnz L4x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -263,13 +252,13 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S2,S2,S2,swap_mask vperm S3,S3,S3,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi 9,9,0x10 - stxvd2x S2X,9,DST + stxvd2x VSR(S2),9,DST addi 9,9,0x10 - stxvd2x S3X,9,DST + stxvd2x VSR(S3),9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -281,12 +270,12 @@ L2x: cmpldi 5,0 beq L1x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) @@ -298,7 +287,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L2x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -307,7 +296,7 @@ L2x_round_loop: addi 10,10,0x10 bdnz L2x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -315,9 +304,9 @@ L2x_round_loop: IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -328,10 +317,10 @@ L1x: cmpldi LENGTH,0 beq Ldone - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC IF_LE(<vperm S0,S0,S0,swap_mask>) @@ -341,20 +330,20 @@ IF_LE(<vperm S0,S0,S0,swap_mask>) li 10,0x10 .align 5 L1x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vxor S0,S0,K addi 10,10,0x10 bdnz L1x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K IF_LE(<vperm S0,S0,S0,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST Ldone: blr diff --git a/powerpc64/p8/aes-encrypt-internal.asm b/powerpc64/p8/aes-encrypt-internal.asm index c696a4a3..67c7e597 100644 --- a/powerpc64/p8/aes-encrypt-internal.asm +++ b/powerpc64/p8/aes-encrypt-internal.asm @@ -1,4 +1,4 @@ -C powerpc64/P8/aes-encrypt-internal.asm +C powerpc64/p8/aes-encrypt-internal.asm ifelse(< Copyright (C) 2020 Mamone Tarsha @@ -52,19 +52,8 @@ define(<S5>, <7>) define(<S6>, <8>) define(<S7>, <9>) -define(<KX>, <33>) -define(<S0X>, <34>) -define(<S1X>, <35>) -define(<S2X>, <36>) -define(<S3X>, <37>) -define(<S4X>, <38>) -define(<S5X>, <39>) -define(<S6X>, <40>) -define(<S7X>, <41>) - .file "aes-encrypt-internal.asm" -IF_LE(<.abiversion 2>) .text C _aes_encrypt(unsigned rounds, const uint32_t *keys, @@ -101,17 +90,17 @@ PROLOGUE(_nettle_aes_encrypt) .align 5 Lx8_loop: - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC - lxvd2x S1X,25,SRC - lxvd2x S2X,26,SRC - lxvd2x S3X,27,SRC - lxvd2x S4X,28,SRC - lxvd2x S5X,29,SRC - lxvd2x S6X,30,SRC - lxvd2x S7X,31,SRC + lxvd2x VSR(S0),0,SRC + lxvd2x VSR(S1),25,SRC + lxvd2x VSR(S2),26,SRC + lxvd2x VSR(S3),27,SRC + lxvd2x VSR(S4),28,SRC + lxvd2x VSR(S5),29,SRC + lxvd2x VSR(S6),30,SRC + lxvd2x VSR(S7),31,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -135,7 +124,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L8x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K @@ -148,7 +137,7 @@ L8x_round_loop: addi 10,10,0x10 bdnz L8x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -168,14 +157,14 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S6,S6,S6,swap_mask vperm S7,S7,S7,swap_mask>) - stxvd2x S0X,0,DST - stxvd2x S1X,25,DST - stxvd2x S2X,26,DST - stxvd2x S3X,27,DST - stxvd2x S4X,28,DST - stxvd2x S5X,29,DST - stxvd2x S6X,30,DST - stxvd2x S7X,31,DST + stxvd2x VSR(S0),0,DST + stxvd2x VSR(S1),25,DST + stxvd2x VSR(S2),26,DST + stxvd2x VSR(S3),27,DST + stxvd2x VSR(S4),28,DST + stxvd2x VSR(S5),29,DST + stxvd2x VSR(S6),30,DST + stxvd2x VSR(S7),31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 @@ -197,16 +186,16 @@ L4x: cmpldi 5,0 beq L2x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC addi 9,9,0x10 - lxvd2x S2X,9,SRC + lxvd2x VSR(S2),9,SRC addi 9,9,0x10 - lxvd2x S3X,9,SRC + lxvd2x VSR(S3),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -222,7 +211,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L4x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K @@ -231,7 +220,7 @@ L4x_round_loop: addi 10,10,0x10 bdnz L4x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -243,13 +232,13 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S2,S2,S2,swap_mask vperm S3,S3,S3,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi 9,9,0x10 - stxvd2x S2X,9,DST + stxvd2x VSR(S2),9,DST addi 9,9,0x10 - stxvd2x S3X,9,DST + stxvd2x VSR(S3),9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -261,12 +250,12 @@ L2x: cmpldi 5,0 beq L1x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) @@ -278,14 +267,14 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L2x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K addi 10,10,0x10 bdnz L2x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -293,9 +282,9 @@ L2x_round_loop: IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -306,10 +295,10 @@ L1x: cmpldi LENGTH,0 beq Ldone - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC IF_LE(<vperm S0,S0,S0,swap_mask>) @@ -319,19 +308,19 @@ IF_LE(<vperm S0,S0,S0,swap_mask>) li 10,0x10 .align 5 L1x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K addi 10,10,0x10 bdnz L1x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K IF_LE(<vperm S0,S0,S0,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST Ldone: blr -- 2.17.1

2 4

[Patch] "PowerPC64" Add README (Reformatted)
by Maamoun TK 29 Aug '20

29 Aug '20

--- powerpc64/README | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 powerpc64/README diff --git a/powerpc64/README b/powerpc64/README new file mode 100644 index 00000000..19351be8 --- /dev/null +++ b/powerpc64/README @@ -0,0 +1,73 @@ +General-Purpose Register Conventions + +Register Status Use + +GPR0 volatile In function prologs. +GPR1 dedicated Stack pointer. +GPR2 dedicated Table of Contents (TOC) pointer. +GPR3 volatile First word of a function's argument list; + first word of a scalar function return. +GPR4 volatile Second word of a function's argument list; + second word of a scalar function return. +GPR5 volatile Third word of a function's argument list. +GPR6 volatile Fourth word of a function's argument list. +GPR7 volatile Fifth word of a function's argument list. +GPR8 volatile Sixth word of a function's argument list. +GPR9 volatile Seventh word of a function's argument list. +GPR10 volatile Eighth word of a function's argument list. +GPR11 volatile In calls by pointer and as an environment pointer + for languages that require it (for example, PASCAL). +GPR12 volatile For special exception handling required by certain + languages and in glink code. +GPR13 reserved Reserved under 64-bit environment; + not restored across system calls. +GPR14:GPR31 nonvolatile These registers must be preserved across + a function call. + +Vector Register Conventions + +Register Status + +VR0:V19 Volatile +VR20:VR31 Nonvolatile (extended ABI mode) their values are preserved + across function calls + +Addressing memory + +There are many ways to reference data, in the sake of writing +position-independent code the current implementation uses GOT-indirect +addressing (Accessing data through the global offset table): +1. Define data in .data section +2. Load the address of data into register from the global offset table + e.g. ld 7, my_var@got(2) +3. Use the address to load the value of data into register + e.g. ld 3, 0(7) +Refer to [2] for more information about referencing data + +VSX instructions "lxvd2x/stxvd2x" are used to load and store data to +memory instead of VR instructions "lvx/stvx" as it produces a fewer +instructions "lvx/stvx" can be used to load/store data into storage +operands but additional instructions are needed to access unaligned +storage operands, refer to "6.4.1 Accessing Unaligned Storage Operands" +in [3] to see an example of accessing unaligned storage operands. +"lxvd2x/stxvd2x" can be used to load/store data into unaligned storage +operands but permuting is needed for loading and storing data in +little-endian mode VSX registers are defined with "X" suffix +TODO: use architecture 3.0 instructions "lxv/stxv" instead for POWER9 + and newer + +Function Prologue + +Big-endian systems only support ELFv1 ABI which requires the following +steps in the function prologue: +1. Write the "official procedure descriptor" in ".opd","aw" section +2. Write procedure description for .my_func in my_func label +3. Switch back to ".text" section for program code +4. Label the beginning of the code .my_func +Refer to [1] for more information +Little-endian systems are compatible with ELFv2 ABI, an example of +function prologue for ELFv2 ABI can be seen in [2] + +[1] http://www.ibm.com/developerworks/linux/library/l-powasm1.html +[2] https://openpowerfoundation.org/?resource_lib=64-bit-elf-v2-abi-specificati… +[3] https://openpowerfoundation.org/?resource_lib=ibm-power-isa-version-2-07-b -- 2.17.1

3 5

[PATCH 4/6] "PowerPC64" Add fat build
by Maamoun TK 20 Aug '20

20 Aug '20

--- aes-decrypt-internal.c | 10 ++ aes-encrypt-internal.c | 10 ++ fat-ppc.c | 173 +++++++++++++++++++++++++++++++ fat-setup.h | 9 ++ powerpc64/fat/aes-decrypt-internal-2.asm | 37 +++++++ powerpc64/fat/aes-encrypt-internal-2.asm | 37 +++++++ powerpc64/fat/gcm-hash.asm | 40 +++++++ 7 files changed, 316 insertions(+) create mode 100644 fat-ppc.c create mode 100644 powerpc64/fat/aes-decrypt-internal-2.asm create mode 100644 powerpc64/fat/aes-encrypt-internal-2.asm create mode 100644 powerpc64/fat/gcm-hash.asm diff --git a/aes-decrypt-internal.c b/aes-decrypt-internal.c index 709c52f9..6326befb 100644 --- a/aes-decrypt-internal.c +++ b/aes-decrypt-internal.c @@ -40,6 +40,16 @@ #include "aes-internal.h" #include "macros.h" +/* For fat builds */ +#if HAVE_NATIVE_aes_decrypt +void +_nettle_aes_decrypt_c(unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src); +#define _nettle_aes_decrypt _nettle_aes_decrypt_c +#endif + void _nettle_aes_decrypt(unsigned rounds, const uint32_t *keys, const struct aes_table *T, diff --git a/aes-encrypt-internal.c b/aes-encrypt-internal.c index 9f61386d..7ff4ca40 100644 --- a/aes-encrypt-internal.c +++ b/aes-encrypt-internal.c @@ -40,6 +40,16 @@ #include "aes-internal.h" #include "macros.h" +/* For fat builds */ +#if HAVE_NATIVE_aes_encrypt +void +_nettle_aes_encrypt_c(unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src); +#define _nettle_aes_encrypt _nettle_aes_encrypt_c +#endif + void _nettle_aes_encrypt(unsigned rounds, const uint32_t *keys, const struct aes_table *T, diff --git a/fat-ppc.c b/fat-ppc.c new file mode 100644 index 00000000..e09b2097 --- /dev/null +++ b/fat-ppc.c @@ -0,0 +1,173 @@ +/* fat-ppc.c + + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#define _GNU_SOURCE + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <assert.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#if defined(__FreeBSD__) && __FreeBSD__ < 12 +#include <sys/sysctl.h> +#else +#include <sys/auxv.h> +#endif + +#include "nettle-types.h" + +#include "aes-internal.h" +#include "gcm.h" +#include "fat-setup.h" + +/* Define from arch/powerpc/include/uapi/asm/cputable.h in Linux kernel */ +#ifndef PPC_FEATURE2_VEC_CRYPTO +#define PPC_FEATURE2_VEC_CRYPTO 0x02000000 +#endif + +struct ppc_features +{ + int have_crypto_ext; +}; + +static void +get_ppc_features (struct ppc_features *features) +{ + unsigned long hwcap2 = 0; +#if defined(__FreeBSD__) +#if __FreeBSD__ < 12 + size_t len = sizeof(hwcap2); + sysctlbyname("hw.cpu_features2", &hwcap2, &len, NULL, 0); +#else + elf_aux_info(AT_HWCAP2, &hwcap2, sizeof(hwcap2)); +#endif +#else + hwcap2 = getauxval(AT_HWCAP2); +#endif + features->have_crypto_ext = + (hwcap2 & PPC_FEATURE2_VEC_CRYPTO) == PPC_FEATURE2_VEC_CRYPTO ? 1 : 0; +} + +DECLARE_FAT_FUNC(_nettle_aes_encrypt, aes_crypt_internal_func) +DECLARE_FAT_FUNC_VAR(aes_encrypt, aes_crypt_internal_func, c) +DECLARE_FAT_FUNC_VAR(aes_encrypt, aes_crypt_internal_func, ppc64) + +DECLARE_FAT_FUNC(_nettle_aes_decrypt, aes_crypt_internal_func) +DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, c) +DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, ppc64) + +#if GCM_TABLE_BITS == 8 +DECLARE_FAT_FUNC(_nettle_gcm_init_key, gcm_init_key_func) +DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, c) +DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, ppc64) + +DECLARE_FAT_FUNC(_nettle_gcm_hash, gcm_hash_func) +DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, c) +DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, ppc64) +#endif /* GCM_TABLE_BITS == 8 */ + +DECLARE_FAT_FUNC(_nettle_gcm_fill, gcm_fill_func) +DECLARE_FAT_FUNC_VAR(gcm_fill, gcm_fill_func, c) +DECLARE_FAT_FUNC_VAR(gcm_fill, gcm_fill_func, ppc64) + +static void CONSTRUCTOR +fat_init (void) +{ + struct ppc_features features; + int verbose; + + get_ppc_features (&features); + + verbose = getenv (ENV_VERBOSE) != NULL; + if (verbose) + fprintf (stderr, "libnettle: cpu features: %s\n", + features.have_crypto_ext ? "crypto extensions" : ""); + + if (features.have_crypto_ext) + { + if (verbose) + fprintf (stderr, "libnettle: enabling arch 2.07 code.\n"); + _nettle_aes_encrypt_vec = _nettle_aes_encrypt_ppc64; + _nettle_aes_decrypt_vec = _nettle_aes_decrypt_ppc64; +#if GCM_TABLE_BITS == 8 + /* Make sure _nettle_gcm_init_key_vec function is compatible + with _nettle_gcm_hash_vec function e.g. _nettle_gcm_init_key_c() + fills gcm_key table with values that are incompatible with + _nettle_gcm_hash_ppc64() */ + _nettle_gcm_init_key_vec = _nettle_gcm_init_key_ppc64; + _nettle_gcm_hash_vec = _nettle_gcm_hash_ppc64; +#endif /* GCM_TABLE_BITS == 8 */ + _nettle_gcm_fill_vec = _nettle_gcm_fill_ppc64; + } + else + { + _nettle_aes_encrypt_vec = _nettle_aes_encrypt_c; + _nettle_aes_decrypt_vec = _nettle_aes_decrypt_c; +#if GCM_TABLE_BITS == 8 + _nettle_gcm_init_key_vec = _nettle_gcm_init_key_c; + _nettle_gcm_hash_vec = _nettle_gcm_hash_c; +#endif /* GCM_TABLE_BITS == 8 */ + _nettle_gcm_fill_vec = _nettle_gcm_fill_c; + } +} + +DEFINE_FAT_FUNC(_nettle_aes_encrypt, void, + (unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src), + (rounds, keys, T, length, dst, src)) + +DEFINE_FAT_FUNC(_nettle_aes_decrypt, void, + (unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src), + (rounds, keys, T, length, dst, src)) + +#if GCM_TABLE_BITS == 8 +DEFINE_FAT_FUNC(_nettle_gcm_init_key, void, + (union nettle_block16 *table), + (table)) + +DEFINE_FAT_FUNC(_nettle_gcm_hash, void, + (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data), + (key, x, length, data)) +#endif /* GCM_TABLE_BITS == 8 */ + +DEFINE_FAT_FUNC(_nettle_gcm_fill, void, + (uint8_t *ctr, size_t blocks, + union nettle_block16 *buffer), + (ctr, blocks, buffer)) diff --git a/fat-setup.h b/fat-setup.h index 58b687fd..9793eebb 100644 --- a/fat-setup.h +++ b/fat-setup.h @@ -161,6 +161,15 @@ typedef void aes_crypt_internal_func (unsigned rounds, const uint32_t *keys, size_t length, uint8_t *dst, const uint8_t *src); +#if GCM_TABLE_BITS == 8 +typedef void gcm_init_key_func (union nettle_block16 *table); + +typedef void gcm_hash_func (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data); + +typedef void gcm_fill_func (uint8_t *ctr, size_t blocks, union nettle_block16 *buffer); +#endif /* GCM_TABLE_BITS == 8 */ + typedef void *(memxor_func)(void *dst, const void *src, size_t n); typedef void salsa20_core_func (uint32_t *dst, const uint32_t *src, unsigned rounds); diff --git a/powerpc64/fat/aes-decrypt-internal-2.asm b/powerpc64/fat/aes-decrypt-internal-2.asm new file mode 100644 index 00000000..593bf6cf --- /dev/null +++ b/powerpc64/fat/aes-decrypt-internal-2.asm @@ -0,0 +1,37 @@ +C powerpc64/fat/aes-decrypt-internal-2.asm + + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl PROLOGUE(_nettle_aes_decrypt) picked up by configure + +define(<fat_transform>, <$1_ppc64>) +include_src(<powerpc64/P8/aes-decrypt-internal.asm>) diff --git a/powerpc64/fat/aes-encrypt-internal-2.asm b/powerpc64/fat/aes-encrypt-internal-2.asm new file mode 100644 index 00000000..73a4d543 --- /dev/null +++ b/powerpc64/fat/aes-encrypt-internal-2.asm @@ -0,0 +1,37 @@ +C powerpc64/fat/aes-encrypt-internal-2.asm + + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl PROLOGUE(_nettle_aes_encrypt) picked up by configure + +define(<fat_transform>, <$1_ppc64>) +include_src(<powerpc64/P8/aes-encrypt-internal.asm>) diff --git a/powerpc64/fat/gcm-hash.asm b/powerpc64/fat/gcm-hash.asm new file mode 100644 index 00000000..dbb827db --- /dev/null +++ b/powerpc64/fat/gcm-hash.asm @@ -0,0 +1,40 @@ +C powerpc64/fat/gcm-hash.asm + + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl picked up by configure +dnl PROLOGUE(_nettle_gcm_init_key) +dnl PROLOGUE(_nettle_gcm_hash) +dnl PROLOGUE(_nettle_gcm_fill) + +define(<fat_transform>, <$1_ppc64>) +include_src(<powerpc64/P8/gcm-hash.asm>) -- 2.17.1

3 5

[PATCH] "PowerPC64" Detect and check ABI
by Maamoun TK 20 Aug '20

20 Aug '20

--- configure.ac | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/configure.ac b/configure.ac index 49db7af1..6db3fc42 100644 --- a/configure.ac +++ b/configure.ac @@ -322,6 +322,17 @@ case "$host_cpu" in AC_TRY_COMPILE([ #if defined(__sgi) && defined(__LP64__) #error 64-bit mips +#endif + ], [], [ + ABI=32 + ], [ + ABI=64 + ]) + ;; + powerpc*) + AC_TRY_COMPILE([ +#if defined(__PPC64__) +#error 64-bit powerpc #endif ], [], [ ABI=32 @@ -438,13 +449,15 @@ if test "x$enable_assembler" = xyes ; then fi fi ;; - *powerpc64*) - if test "x$enable_fat" = xyes ; then - asm_path="powerpc64/fat powerpc64" - OPT_NETTLE_SOURCES="fat-ppc.c $OPT_NETTLE_SOURCES" - else - if test "x$enable_power_crypto_ext" = xyes ; then - asm_path="powerpc64/P8 powerpc64" + powerpc*) + if test "$ABI" = 64 ; then + if test "x$enable_fat" = xyes ; then + asm_path="powerpc64/fat powerpc64" + OPT_NETTLE_SOURCES="fat-ppc.c $OPT_NETTLE_SOURCES" + else + if test "x$enable_power_crypto_ext" = xyes ; then + asm_path="powerpc64/p8 powerpc64" + fi fi fi ;; -- 2.17.1

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs