2 # Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
17 # This module implements Poly1305 hash for PowerPC.
21 # Numbers are cycles per processed byte with poly1305_blocks alone,
22 # and improvement coefficients relative to gcc-generated code.
26 # Freescale e300 14.8/+80% -
28 # PPC970 7.00/+114% 3.51/+205%
29 # POWER7 3.75/+260% 1.93/+100%
32 # Do we need floating-point implementation for PPC? Results presented
33 # in poly1305_ieee754.c are tricky to compare to, because they are for
34 # compiler-generated code. On the other hand it's known that floating-
35 # point performance can be dominated by FPU latency, which means that
36 # there is limit even for ideally optimized (and even vectorized) code.
37 # And this limit is estimated to be higher than above -m64 results. Or
38 # in other words floating-point implementation can be meaningful to
39 # consider only in 32-bit application context. We probably have to
40 # recognize that 32-bit builds are getting less popular on high-end
41 # systems and therefore tend to target embedded ones, which might not
44 # On side note, Power ISA 2.07 enables vector base 2^26 implementation,
45 # and POWER8 might have capacity to break 1.0 cycle per byte barrier...
49 if ($flavour =~ /64/) {
56 } elsif ($flavour =~ /32/) {
63 } else { die "nonsense $flavour"; }
65 # Define endianness based on flavour
67 $LITTLE_ENDIAN = ($flavour=~/le$/) ? $SIZE_T : 0;
69 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
70 ( $xlate="${dir}ppc-xlate.pl" and -f $xlate ) or
71 ( $xlate="${dir}../../perlasm/ppc-xlate.pl" and -f $xlate) or
72 die "can't locate ppc-xlate.pl";
74 open STDOUT,"| $^X $xlate $flavour ".shift || die "can't call $xlate: $!";
79 my ($ctx,$inp,$len,$padbit) = map("r$_",(3..6));
80 my ($mac,$nonce)=($inp,$len);
87 if ($flavour =~ /64/) {
88 ###############################################################################
89 # base 2^64 implementation
91 my ($h0,$h1,$h2,$d0,$d1,$d2, $r0,$r1,$s1, $t0,$t1) = map("r$_",(7..12,27..31));
94 .globl .poly1305_init_int
98 std r0,0($ctx) # zero hash value
105 $code.=<<___ if ($LITTLE_ENDIAN);
106 ld $d0,0($inp) # load key material
109 $code.=<<___ if (!$LITTLE_ENDIAN);
111 lwbrx $d0,0,$inp # load key material
121 lis $h1,0xfff # 0x0fff0000
122 ori $h1,$h1,0xfffc # 0x0ffffffc
123 insrdi $h1,$h1,32,0 # 0x0ffffffc0ffffffc
124 ori $h0,$h1,3 # 0x0ffffffc0fffffff
129 std $d0,32($ctx) # store key
136 .byte 0,12,0x14,0,0,0,2,0
137 .size .poly1305_init_int,.-.poly1305_init_int
139 .globl .poly1305_blocks
145 $STU $sp,-$FRAME($sp)
147 $PUSH r27,`$FRAME-$SIZE_T*5`($sp)
148 $PUSH r28,`$FRAME-$SIZE_T*4`($sp)
149 $PUSH r29,`$FRAME-$SIZE_T*3`($sp)
150 $PUSH r30,`$FRAME-$SIZE_T*2`($sp)
151 $PUSH r31,`$FRAME-$SIZE_T*1`($sp)
152 $PUSH r0,`$FRAME+$LRSAVE`($sp)
154 ld $r0,32($ctx) # load key
157 ld $h0,0($ctx) # load hash value
163 add $s1,$s1,$r1 # s1 = r1 + r1>>2
170 $code.=<<___ if ($LITTLE_ENDIAN);
171 ld $t0,0($inp) # load input
174 $code.=<<___ if (!$LITTLE_ENDIAN);
176 lwbrx $t0,0,$inp # load input
188 addc $h0,$h0,$t0 # accumulate input
191 mulld $d0,$h0,$r0 # h0*r0
195 mulld $t0,$h1,$s1 # h1*5*r1
200 mulld $t0,$h0,$r1 # h0*r1
205 mulld $t0,$h1,$r0 # h1*r0
210 mulld $t0,$h2,$s1 # h2*5*r1
211 mulld $t1,$h2,$r0 # h2*r0
215 andc $t0,$d2,$mask # final reduction step
225 std $h0,0($ctx) # store hash value
229 $POP r27,`$FRAME-$SIZE_T*5`($sp)
230 $POP r28,`$FRAME-$SIZE_T*4`($sp)
231 $POP r29,`$FRAME-$SIZE_T*3`($sp)
232 $POP r30,`$FRAME-$SIZE_T*2`($sp)
233 $POP r31,`$FRAME-$SIZE_T*1`($sp)
238 .byte 0,12,4,1,0x80,5,4,0
239 .size .poly1305_blocks,.-.poly1305_blocks
241 .globl .poly1305_emit
244 ld $h0,0($ctx) # load hash
247 ld $padbit,0($nonce) # load nonce
250 addic $d0,$h0,5 # compare to modulus
254 srdi $mask,$d2,2 # did it carry/borrow?
264 $code.=<<___ if (!$LITTLE_ENDIAN);
265 rotldi $padbit,$padbit,32 # flip nonce words
266 rotldi $nonce,$nonce,32
269 addc $h0,$h0,$padbit # accumulate nonce
272 $code.=<<___ if ($LITTLE_ENDIAN);
273 std $h0,0($mac) # write result
276 $code.=<<___ if (!$LITTLE_ENDIAN);
279 stwbrx $h0,0,$mac # write result
290 .byte 0,12,0x14,0,0,0,3,0
291 .size .poly1305_emit,.-.poly1305_emit
294 ###############################################################################
295 # base 2^32 implementation
297 my ($h0,$h1,$h2,$h3,$h4, $r0,$r1,$r2,$r3, $s1,$s2,$s3,
298 $t0,$t1,$t2,$t3, $D0,$D1,$D2,$D3, $d0,$d1,$d2,$d3
299 ) = map("r$_",(7..12,14..31));
302 .globl .poly1305_init_int
306 stw r0,0($ctx) # zero hash value
315 $code.=<<___ if ($LITTLE_ENDIAN);
316 lw $h0,0($inp) # load key material
321 $code.=<<___ if (!$LITTLE_ENDIAN);
323 lwbrx $h0,0,$inp # load key material
331 lis $mask,0xf000 # 0xf0000000
333 andc $r0,$r0,$mask # 0x0ffffffc
340 stw $h0,32($ctx) # store key
349 .byte 0,12,0x14,0,0,0,2,0
350 .size .poly1305_init_int,.-.poly1305_init_int
352 .globl .poly1305_blocks
358 $STU $sp,-$FRAME($sp)
360 $PUSH r14,`$FRAME-$SIZE_T*18`($sp)
361 $PUSH r15,`$FRAME-$SIZE_T*17`($sp)
362 $PUSH r16,`$FRAME-$SIZE_T*16`($sp)
363 $PUSH r17,`$FRAME-$SIZE_T*15`($sp)
364 $PUSH r18,`$FRAME-$SIZE_T*14`($sp)
365 $PUSH r19,`$FRAME-$SIZE_T*13`($sp)
366 $PUSH r20,`$FRAME-$SIZE_T*12`($sp)
367 $PUSH r21,`$FRAME-$SIZE_T*11`($sp)
368 $PUSH r22,`$FRAME-$SIZE_T*10`($sp)
369 $PUSH r23,`$FRAME-$SIZE_T*9`($sp)
370 $PUSH r24,`$FRAME-$SIZE_T*8`($sp)
371 $PUSH r25,`$FRAME-$SIZE_T*7`($sp)
372 $PUSH r26,`$FRAME-$SIZE_T*6`($sp)
373 $PUSH r27,`$FRAME-$SIZE_T*5`($sp)
374 $PUSH r28,`$FRAME-$SIZE_T*4`($sp)
375 $PUSH r29,`$FRAME-$SIZE_T*3`($sp)
376 $PUSH r30,`$FRAME-$SIZE_T*2`($sp)
377 $PUSH r31,`$FRAME-$SIZE_T*1`($sp)
378 $PUSH r0,`$FRAME+$LRSAVE`($sp)
380 lwz $r0,32($ctx) # load key
385 lwz $h0,0($ctx) # load hash value
394 add $s1,$s1,$r1 # si = ri + ri>>2
404 $code.=<<___ if ($LITTLE_ENDIAN);
405 lwz $d0,0($inp) # load input
410 $code.=<<___ if (!$LITTLE_ENDIAN);
412 lwbrx $d0,0,$inp # load input
422 addc $h0,$h0,$d0 # accumulate input
426 mullw $d0,$h0,$r0 # h0*r0
429 mullw $d1,$h0,$r1 # h0*r1
432 mullw $d2,$h0,$r2 # h0*r2
438 mullw $d3,$h0,$r3 # h0*r3
441 mullw $t0,$h1,$s3 # h1*s3
444 mullw $t2,$h1,$r0 # h1*r0
449 mullw $t0,$h1,$r1 # h1*r1
454 mullw $t2,$h1,$r2 # h1*r2
459 mullw $t0,$h2,$s2 # h2*s2
464 mullw $t2,$h2,$s3 # h2*s3
469 mullw $t0,$h2,$r0 # h2*r0
474 mullw $t2,$h2,$r1 # h2*r1
479 mullw $t0,$h3,$s1 # h3*s1
484 mullw $t2,$h3,$s2 # h3*s2
489 mullw $t0,$h3,$s3 # h3*s3
494 mullw $t2,$h3,$r0 # h3*r0
499 mullw $t0,$h4,$s1 # h4*s1
504 mullw $t1,$h4,$s2 # h4*s2
509 mullw $t2,$h4,$s3 # h4*s3
513 mullw $h4,$h4,$r0 # h4*r0
520 andc $D0,$h4,$mask # final reduction step
532 stw $h0,0($ctx) # store hash value
538 $POP r14,`$FRAME-$SIZE_T*18`($sp)
539 $POP r15,`$FRAME-$SIZE_T*17`($sp)
540 $POP r16,`$FRAME-$SIZE_T*16`($sp)
541 $POP r17,`$FRAME-$SIZE_T*15`($sp)
542 $POP r18,`$FRAME-$SIZE_T*14`($sp)
543 $POP r19,`$FRAME-$SIZE_T*13`($sp)
544 $POP r20,`$FRAME-$SIZE_T*12`($sp)
545 $POP r21,`$FRAME-$SIZE_T*11`($sp)
546 $POP r22,`$FRAME-$SIZE_T*10`($sp)
547 $POP r23,`$FRAME-$SIZE_T*9`($sp)
548 $POP r24,`$FRAME-$SIZE_T*8`($sp)
549 $POP r25,`$FRAME-$SIZE_T*7`($sp)
550 $POP r26,`$FRAME-$SIZE_T*6`($sp)
551 $POP r27,`$FRAME-$SIZE_T*5`($sp)
552 $POP r28,`$FRAME-$SIZE_T*4`($sp)
553 $POP r29,`$FRAME-$SIZE_T*3`($sp)
554 $POP r30,`$FRAME-$SIZE_T*2`($sp)
555 $POP r31,`$FRAME-$SIZE_T*1`($sp)
560 .byte 0,12,4,1,0x80,18,4,0
561 .size .poly1305_blocks,.-.poly1305_blocks
563 .globl .poly1305_emit
566 $STU $sp,-$FRAME($sp)
568 $PUSH r28,`$FRAME-$SIZE_T*4`($sp)
569 $PUSH r29,`$FRAME-$SIZE_T*3`($sp)
570 $PUSH r30,`$FRAME-$SIZE_T*2`($sp)
571 $PUSH r31,`$FRAME-$SIZE_T*1`($sp)
572 $PUSH r0,`$FRAME+$LRSAVE`($sp)
574 lwz $h0,0($ctx) # load hash
580 addic $d0,$h0,5 # compare to modulus
586 srwi $mask,$mask,2 # did it carry/borrow?
594 lwz $d0,0($nonce) # load nonce
606 addc $h0,$h0,$d0 # accumulate nonce
611 $code.=<<___ if ($LITTLE_ENDIAN);
612 stw $h0,0($mac) # write result
617 $code.=<<___ if (!$LITTLE_ENDIAN);
619 stwbrx $h0,0,$mac # write result
627 $POP r28,`$FRAME-$SIZE_T*4`($sp)
628 $POP r29,`$FRAME-$SIZE_T*3`($sp)
629 $POP r30,`$FRAME-$SIZE_T*2`($sp)
630 $POP r31,`$FRAME-$SIZE_T*1`($sp)
634 .byte 0,12,4,1,0x80,4,3,0
635 .size .poly1305_emit,.-.poly1305_emit
639 .asciz "Poly1305 for PPC, CRYPTOGAMS by <appro\@openssl.org>"
642 $code =~ s/\`([^\`]*)\`/eval $1/gem;