| blob | eff2f414e22b7e1700a7f9dac730a644f0f8c7f4 |
1 /*
2 * Poly1305 authenticator algorithm, RFC7539, x64 AVX2 functions
3 *
4 * Copyright (C) 2015 Martin Willi
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 2 of the License, or
9 * (at your option) any later version.
10 */
12 #include <linux/linkage.h>
14 .data
15 .align 32
17 ANMASK: .octa 0x0000000003ffffff0000000003ffffff
18 .octa 0x0000000003ffffff0000000003ffffff
19 ORMASK: .octa 0x00000000010000000000000001000000
20 .octa 0x00000000010000000000000001000000
22 .text
24 #define h0 0x00(%rdi)
25 #define h1 0x04(%rdi)
26 #define h2 0x08(%rdi)
27 #define h3 0x0c(%rdi)
28 #define h4 0x10(%rdi)
29 #define r0 0x00(%rdx)
30 #define r1 0x04(%rdx)
31 #define r2 0x08(%rdx)
32 #define r3 0x0c(%rdx)
33 #define r4 0x10(%rdx)
34 #define u0 0x00(%r8)
35 #define u1 0x04(%r8)
36 #define u2 0x08(%r8)
37 #define u3 0x0c(%r8)
38 #define u4 0x10(%r8)
39 #define w0 0x14(%r8)
40 #define w1 0x18(%r8)
41 #define w2 0x1c(%r8)
42 #define w3 0x20(%r8)
43 #define w4 0x24(%r8)
44 #define y0 0x28(%r8)
45 #define y1 0x2c(%r8)
46 #define y2 0x30(%r8)
47 #define y3 0x34(%r8)
48 #define y4 0x38(%r8)
49 #define m %rsi
50 #define hc0 %ymm0
51 #define hc1 %ymm1
52 #define hc2 %ymm2
53 #define hc3 %ymm3
54 #define hc4 %ymm4
55 #define hc0x %xmm0
56 #define hc1x %xmm1
57 #define hc2x %xmm2
58 #define hc3x %xmm3
59 #define hc4x %xmm4
60 #define t1 %ymm5
61 #define t2 %ymm6
62 #define t1x %xmm5
63 #define t2x %xmm6
64 #define ruwy0 %ymm7
65 #define ruwy1 %ymm8
66 #define ruwy2 %ymm9
67 #define ruwy3 %ymm10
68 #define ruwy4 %ymm11
69 #define ruwy0x %xmm7
70 #define ruwy1x %xmm8
71 #define ruwy2x %xmm9
72 #define ruwy3x %xmm10
73 #define ruwy4x %xmm11
74 #define svxz1 %ymm12
75 #define svxz2 %ymm13
76 #define svxz3 %ymm14
77 #define svxz4 %ymm15
78 #define d0 %r9
79 #define d1 %r10
80 #define d2 %r11
81 #define d3 %r12
82 #define d4 %r13
84 ENTRY(poly1305_4block_avx2)
85 # %rdi: Accumulator h[5]
86 # %rsi: 64 byte input block m
87 # %rdx: Poly1305 key r[5]
88 # %rcx: Quadblock count
89 # %r8: Poly1305 derived key r^2 u[5], r^3 w[5], r^4 y[5],
91 # This four-block variant uses loop unrolled block processing. It
92 # requires 4 Poly1305 keys: r, r^2, r^3 and r^4:
93 # h = (h + m) * r => h = (h + m1) * r^4 + m2 * r^3 + m3 * r^2 + m4 * r
95 vzeroupper
96 push %rbx
97 push %r12
98 push %r13
100 # combine r0,u0,w0,y0
101 vmovd y0,ruwy0x
102 vmovd w0,t1x
103 vpunpcklqdq t1,ruwy0,ruwy0
104 vmovd u0,t1x
105 vmovd r0,t2x
106 vpunpcklqdq t2,t1,t1
107 vperm2i128 $0x20,t1,ruwy0,ruwy0
109 # combine r1,u1,w1,y1 and s1=r1*5,v1=u1*5,x1=w1*5,z1=y1*5
110 vmovd y1,ruwy1x
111 vmovd w1,t1x
112 vpunpcklqdq t1,ruwy1,ruwy1
113 vmovd u1,t1x
114 vmovd r1,t2x
115 vpunpcklqdq t2,t1,t1
116 vperm2i128 $0x20,t1,ruwy1,ruwy1
117 vpslld $2,ruwy1,svxz1
118 vpaddd ruwy1,svxz1,svxz1
120 # combine r2,u2,w2,y2 and s2=r2*5,v2=u2*5,x2=w2*5,z2=y2*5
121 vmovd y2,ruwy2x
122 vmovd w2,t1x
123 vpunpcklqdq t1,ruwy2,ruwy2
124 vmovd u2,t1x
125 vmovd r2,t2x
126 vpunpcklqdq t2,t1,t1
127 vperm2i128 $0x20,t1,ruwy2,ruwy2
128 vpslld $2,ruwy2,svxz2
129 vpaddd ruwy2,svxz2,svxz2
131 # combine r3,u3,w3,y3 and s3=r3*5,v3=u3*5,x3=w3*5,z3=y3*5
132 vmovd y3,ruwy3x
133 vmovd w3,t1x
134 vpunpcklqdq t1,ruwy3,ruwy3
135 vmovd u3,t1x
136 vmovd r3,t2x
137 vpunpcklqdq t2,t1,t1
138 vperm2i128 $0x20,t1,ruwy3,ruwy3
139 vpslld $2,ruwy3,svxz3
140 vpaddd ruwy3,svxz3,svxz3
142 # combine r4,u4,w4,y4 and s4=r4*5,v4=u4*5,x4=w4*5,z4=y4*5
143 vmovd y4,ruwy4x
144 vmovd w4,t1x
145 vpunpcklqdq t1,ruwy4,ruwy4
146 vmovd u4,t1x
147 vmovd r4,t2x
148 vpunpcklqdq t2,t1,t1
149 vperm2i128 $0x20,t1,ruwy4,ruwy4
150 vpslld $2,ruwy4,svxz4
151 vpaddd ruwy4,svxz4,svxz4
153 .Ldoblock4:
154 # hc0 = [m[48-51] & 0x3ffffff, m[32-35] & 0x3ffffff,
155 # m[16-19] & 0x3ffffff, m[ 0- 3] & 0x3ffffff + h0]
156 vmovd 0x00(m),hc0x
157 vmovd 0x10(m),t1x
158 vpunpcklqdq t1,hc0,hc0
159 vmovd 0x20(m),t1x
160 vmovd 0x30(m),t2x
161 vpunpcklqdq t2,t1,t1
162 vperm2i128 $0x20,t1,hc0,hc0
163 vpand ANMASK(%rip),hc0,hc0
164 vmovd h0,t1x
165 vpaddd t1,hc0,hc0
166 # hc1 = [(m[51-54] >> 2) & 0x3ffffff, (m[35-38] >> 2) & 0x3ffffff,
167 # (m[19-22] >> 2) & 0x3ffffff, (m[ 3- 6] >> 2) & 0x3ffffff + h1]
168 vmovd 0x03(m),hc1x
169 vmovd 0x13(m),t1x
170 vpunpcklqdq t1,hc1,hc1
171 vmovd 0x23(m),t1x
172 vmovd 0x33(m),t2x
173 vpunpcklqdq t2,t1,t1
174 vperm2i128 $0x20,t1,hc1,hc1
175 vpsrld $2,hc1,hc1
176 vpand ANMASK(%rip),hc1,hc1
177 vmovd h1,t1x
178 vpaddd t1,hc1,hc1
179 # hc2 = [(m[54-57] >> 4) & 0x3ffffff, (m[38-41] >> 4) & 0x3ffffff,
180 # (m[22-25] >> 4) & 0x3ffffff, (m[ 6- 9] >> 4) & 0x3ffffff + h2]
181 vmovd 0x06(m),hc2x
182 vmovd 0x16(m),t1x
183 vpunpcklqdq t1,hc2,hc2
184 vmovd 0x26(m),t1x
185 vmovd 0x36(m),t2x
186 vpunpcklqdq t2,t1,t1
187 vperm2i128 $0x20,t1,hc2,hc2
188 vpsrld $4,hc2,hc2
189 vpand ANMASK(%rip),hc2,hc2
190 vmovd h2,t1x
191 vpaddd t1,hc2,hc2
192 # hc3 = [(m[57-60] >> 6) & 0x3ffffff, (m[41-44] >> 6) & 0x3ffffff,
193 # (m[25-28] >> 6) & 0x3ffffff, (m[ 9-12] >> 6) & 0x3ffffff + h3]
194 vmovd 0x09(m),hc3x
195 vmovd 0x19(m),t1x
196 vpunpcklqdq t1,hc3,hc3
197 vmovd 0x29(m),t1x
198 vmovd 0x39(m),t2x
199 vpunpcklqdq t2,t1,t1
200 vperm2i128 $0x20,t1,hc3,hc3
201 vpsrld $6,hc3,hc3
202 vpand ANMASK(%rip),hc3,hc3
203 vmovd h3,t1x
204 vpaddd t1,hc3,hc3
205 # hc4 = [(m[60-63] >> 8) | (1<<24), (m[44-47] >> 8) | (1<<24),
206 # (m[28-31] >> 8) | (1<<24), (m[12-15] >> 8) | (1<<24) + h4]
207 vmovd 0x0c(m),hc4x
208 vmovd 0x1c(m),t1x
209 vpunpcklqdq t1,hc4,hc4
210 vmovd 0x2c(m),t1x
211 vmovd 0x3c(m),t2x
212 vpunpcklqdq t2,t1,t1
213 vperm2i128 $0x20,t1,hc4,hc4
214 vpsrld $8,hc4,hc4
215 vpor ORMASK(%rip),hc4,hc4
216 vmovd h4,t1x
217 vpaddd t1,hc4,hc4
219 # t1 = [ hc0[3] * r0, hc0[2] * u0, hc0[1] * w0, hc0[0] * y0 ]
220 vpmuludq hc0,ruwy0,t1
221 # t1 += [ hc1[3] * s4, hc1[2] * v4, hc1[1] * x4, hc1[0] * z4 ]
222 vpmuludq hc1,svxz4,t2
223 vpaddq t2,t1,t1
224 # t1 += [ hc2[3] * s3, hc2[2] * v3, hc2[1] * x3, hc2[0] * z3 ]
225 vpmuludq hc2,svxz3,t2
226 vpaddq t2,t1,t1
227 # t1 += [ hc3[3] * s2, hc3[2] * v2, hc3[1] * x2, hc3[0] * z2 ]
228 vpmuludq hc3,svxz2,t2
229 vpaddq t2,t1,t1
230 # t1 += [ hc4[3] * s1, hc4[2] * v1, hc4[1] * x1, hc4[0] * z1 ]
231 vpmuludq hc4,svxz1,t2
232 vpaddq t2,t1,t1
233 # d0 = t1[0] + t1[1] + t[2] + t[3]
234 vpermq $0xee,t1,t2
235 vpaddq t2,t1,t1
236 vpsrldq $8,t1,t2
237 vpaddq t2,t1,t1
238 vmovq t1x,d0
240 # t1 = [ hc0[3] * r1, hc0[2] * u1,hc0[1] * w1, hc0[0] * y1 ]
241 vpmuludq hc0,ruwy1,t1
242 # t1 += [ hc1[3] * r0, hc1[2] * u0, hc1[1] * w0, hc1[0] * y0 ]
243 vpmuludq hc1,ruwy0,t2
244 vpaddq t2,t1,t1
245 # t1 += [ hc2[3] * s4, hc2[2] * v4, hc2[1] * x4, hc2[0] * z4 ]
246 vpmuludq hc2,svxz4,t2
247 vpaddq t2,t1,t1
248 # t1 += [ hc3[3] * s3, hc3[2] * v3, hc3[1] * x3, hc3[0] * z3 ]
249 vpmuludq hc3,svxz3,t2
250 vpaddq t2,t1,t1
251 # t1 += [ hc4[3] * s2, hc4[2] * v2, hc4[1] * x2, hc4[0] * z2 ]
252 vpmuludq hc4,svxz2,t2
253 vpaddq t2,t1,t1
254 # d1 = t1[0] + t1[1] + t1[3] + t1[4]
255 vpermq $0xee,t1,t2
256 vpaddq t2,t1,t1
257 vpsrldq $8,t1,t2
258 vpaddq t2,t1,t1
259 vmovq t1x,d1
261 # t1 = [ hc0[3] * r2, hc0[2] * u2, hc0[1] * w2, hc0[0] * y2 ]
262 vpmuludq hc0,ruwy2,t1
263 # t1 += [ hc1[3] * r1, hc1[2] * u1, hc1[1] * w1, hc1[0] * y1 ]
264 vpmuludq hc1,ruwy1,t2
265 vpaddq t2,t1,t1
266 # t1 += [ hc2[3] * r0, hc2[2] * u0, hc2[1] * w0, hc2[0] * y0 ]
267 vpmuludq hc2,ruwy0,t2
268 vpaddq t2,t1,t1
269 # t1 += [ hc3[3] * s4, hc3[2] * v4, hc3[1] * x4, hc3[0] * z4 ]
270 vpmuludq hc3,svxz4,t2
271 vpaddq t2,t1,t1
272 # t1 += [ hc4[3] * s3, hc4[2] * v3, hc4[1] * x3, hc4[0] * z3 ]
273 vpmuludq hc4,svxz3,t2
274 vpaddq t2,t1,t1
275 # d2 = t1[0] + t1[1] + t1[2] + t1[3]
276 vpermq $0xee,t1,t2
277 vpaddq t2,t1,t1
278 vpsrldq $8,t1,t2
279 vpaddq t2,t1,t1
280 vmovq t1x,d2
282 # t1 = [ hc0[3] * r3, hc0[2] * u3, hc0[1] * w3, hc0[0] * y3 ]
283 vpmuludq hc0,ruwy3,t1
284 # t1 += [ hc1[3] * r2, hc1[2] * u2, hc1[1] * w2, hc1[0] * y2 ]
285 vpmuludq hc1,ruwy2,t2
286 vpaddq t2,t1,t1
287 # t1 += [ hc2[3] * r1, hc2[2] * u1, hc2[1] * w1, hc2[0] * y1 ]
288 vpmuludq hc2,ruwy1,t2
289 vpaddq t2,t1,t1
290 # t1 += [ hc3[3] * r0, hc3[2] * u0, hc3[1] * w0, hc3[0] * y0 ]
291 vpmuludq hc3,ruwy0,t2
292 vpaddq t2,t1,t1
293 # t1 += [ hc4[3] * s4, hc4[2] * v4, hc4[1] * x4, hc4[0] * z4 ]
294 vpmuludq hc4,svxz4,t2
295 vpaddq t2,t1,t1
296 # d3 = t1[0] + t1[1] + t1[2] + t1[3]
297 vpermq $0xee,t1,t2
298 vpaddq t2,t1,t1
299 vpsrldq $8,t1,t2
300 vpaddq t2,t1,t1
301 vmovq t1x,d3
303 # t1 = [ hc0[3] * r4, hc0[2] * u4, hc0[1] * w4, hc0[0] * y4 ]
304 vpmuludq hc0,ruwy4,t1
305 # t1 += [ hc1[3] * r3, hc1[2] * u3, hc1[1] * w3, hc1[0] * y3 ]
306 vpmuludq hc1,ruwy3,t2
307 vpaddq t2,t1,t1
308 # t1 += [ hc2[3] * r2, hc2[2] * u2, hc2[1] * w2, hc2[0] * y2 ]
309 vpmuludq hc2,ruwy2,t2
310 vpaddq t2,t1,t1
311 # t1 += [ hc3[3] * r1, hc3[2] * u1, hc3[1] * w1, hc3[0] * y1 ]
312 vpmuludq hc3,ruwy1,t2
313 vpaddq t2,t1,t1
314 # t1 += [ hc4[3] * r0, hc4[2] * u0, hc4[1] * w0, hc4[0] * y0 ]
315 vpmuludq hc4,ruwy0,t2
316 vpaddq t2,t1,t1
317 # d4 = t1[0] + t1[1] + t1[2] + t1[3]
318 vpermq $0xee,t1,t2
319 vpaddq t2,t1,t1
320 vpsrldq $8,t1,t2
321 vpaddq t2,t1,t1
322 vmovq t1x,d4
324 # d1 += d0 >> 26
325 mov d0,%rax
326 shr $26,%rax
327 add %rax,d1
328 # h0 = d0 & 0x3ffffff
329 mov d0,%rbx
330 and $0x3ffffff,%ebx
332 # d2 += d1 >> 26
333 mov d1,%rax
334 shr $26,%rax
335 add %rax,d2
336 # h1 = d1 & 0x3ffffff
337 mov d1,%rax
338 and $0x3ffffff,%eax
339 mov %eax,h1
341 # d3 += d2 >> 26
342 mov d2,%rax
343 shr $26,%rax
344 add %rax,d3
345 # h2 = d2 & 0x3ffffff
346 mov d2,%rax
347 and $0x3ffffff,%eax
348 mov %eax,h2
350 # d4 += d3 >> 26
351 mov d3,%rax
352 shr $26,%rax
353 add %rax,d4
354 # h3 = d3 & 0x3ffffff
355 mov d3,%rax
356 and $0x3ffffff,%eax
357 mov %eax,h3
359 # h0 += (d4 >> 26) * 5
360 mov d4,%rax
361 shr $26,%rax
362 lea (%eax,%eax,4),%eax
363 add %eax,%ebx
364 # h4 = d4 & 0x3ffffff
365 mov d4,%rax
366 and $0x3ffffff,%eax
367 mov %eax,h4
369 # h1 += h0 >> 26
370 mov %ebx,%eax
371 shr $26,%eax
372 add %eax,h1
373 # h0 = h0 & 0x3ffffff
374 andl $0x3ffffff,%ebx
375 mov %ebx,h0
377 add $0x40,m
378 dec %rcx
379 jnz .Ldoblock4
381 vzeroupper
382 pop %r13
383 pop %r12
384 pop %rbx
385 ret
386 ENDPROC(poly1305_4block_avx2)