| 1 | #! /usr/bin/env perl
|
|---|
| 2 | # Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 3 | #
|
|---|
| 4 | # Licensed under the OpenSSL license (the "License"). You may not use
|
|---|
| 5 | # this file except in compliance with the License. You can obtain a copy
|
|---|
| 6 | # in the file LICENSE in the source distribution or at
|
|---|
| 7 | # https://www.openssl.org/source/license.html
|
|---|
| 8 |
|
|---|
| 9 | #
|
|---|
| 10 | # ====================================================================
|
|---|
| 11 | # Written by Andy Polyakov <[email protected]> for the OpenSSL
|
|---|
| 12 | # project. The module is, however, dual licensed under OpenSSL and
|
|---|
| 13 | # CRYPTOGAMS licenses depending on where you obtain it. For further
|
|---|
| 14 | # details see http://www.openssl.org/~appro/cryptogams/.
|
|---|
| 15 | # ====================================================================
|
|---|
| 16 | #
|
|---|
| 17 | # May 2011
|
|---|
| 18 | #
|
|---|
| 19 | # The module implements bn_GF2m_mul_2x2 polynomial multiplication used
|
|---|
| 20 | # in bn_gf2m.c. It's kind of low-hanging mechanical port from C for
|
|---|
| 21 | # the time being... gcc 4.3 appeared to generate poor code, therefore
|
|---|
| 22 | # the effort. And indeed, the module delivers 55%-90%(*) improvement
|
|---|
| 23 | # on haviest ECDSA verify and ECDH benchmarks for 163- and 571-bit
|
|---|
| 24 | # key lengths on z990, 30%-55%(*) - on z10, and 70%-110%(*) - on z196.
|
|---|
| 25 | # This is for 64-bit build. In 32-bit "highgprs" case improvement is
|
|---|
| 26 | # even higher, for example on z990 it was measured 80%-150%. ECDSA
|
|---|
| 27 | # sign is modest 9%-12% faster. Keep in mind that these coefficients
|
|---|
| 28 | # are not ones for bn_GF2m_mul_2x2 itself, as not all CPU time is
|
|---|
| 29 | # burnt in it...
|
|---|
| 30 | #
|
|---|
| 31 | # (*) gcc 4.1 was observed to deliver better results than gcc 4.3,
|
|---|
| 32 | # so that improvement coefficients can vary from one specific
|
|---|
| 33 | # setup to another.
|
|---|
| 34 |
|
|---|
| 35 | $flavour = shift;
|
|---|
| 36 |
|
|---|
| 37 | if ($flavour =~ /3[12]/) {
|
|---|
| 38 | $SIZE_T=4;
|
|---|
| 39 | $g="";
|
|---|
| 40 | } else {
|
|---|
| 41 | $SIZE_T=8;
|
|---|
| 42 | $g="g";
|
|---|
| 43 | }
|
|---|
| 44 |
|
|---|
| 45 | while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
|
|---|
| 46 | open STDOUT,">$output";
|
|---|
| 47 |
|
|---|
| 48 | $stdframe=16*$SIZE_T+4*8;
|
|---|
| 49 |
|
|---|
| 50 | $rp="%r2";
|
|---|
| 51 | $a1="%r3";
|
|---|
| 52 | $a0="%r4";
|
|---|
| 53 | $b1="%r5";
|
|---|
| 54 | $b0="%r6";
|
|---|
| 55 |
|
|---|
| 56 | $ra="%r14";
|
|---|
| 57 | $sp="%r15";
|
|---|
| 58 |
|
|---|
| 59 | @T=("%r0","%r1");
|
|---|
| 60 | @i=("%r12","%r13");
|
|---|
| 61 |
|
|---|
| 62 | ($a1,$a2,$a4,$a8,$a12,$a48)=map("%r$_",(6..11));
|
|---|
| 63 | ($lo,$hi,$b)=map("%r$_",(3..5)); $a=$lo; $mask=$a8;
|
|---|
| 64 |
|
|---|
| 65 | $code.=<<___;
|
|---|
| 66 | .text
|
|---|
| 67 |
|
|---|
| 68 | .type _mul_1x1,\@function
|
|---|
| 69 | .align 16
|
|---|
| 70 | _mul_1x1:
|
|---|
| 71 | lgr $a1,$a
|
|---|
| 72 | sllg $a2,$a,1
|
|---|
| 73 | sllg $a4,$a,2
|
|---|
| 74 | sllg $a8,$a,3
|
|---|
| 75 |
|
|---|
| 76 | srag $lo,$a1,63 # broadcast 63rd bit
|
|---|
| 77 | nihh $a1,0x1fff
|
|---|
| 78 | srag @i[0],$a2,63 # broadcast 62nd bit
|
|---|
| 79 | nihh $a2,0x3fff
|
|---|
| 80 | srag @i[1],$a4,63 # broadcast 61st bit
|
|---|
| 81 | nihh $a4,0x7fff
|
|---|
| 82 | ngr $lo,$b
|
|---|
| 83 | ngr @i[0],$b
|
|---|
| 84 | ngr @i[1],$b
|
|---|
| 85 |
|
|---|
| 86 | lghi @T[0],0
|
|---|
| 87 | lgr $a12,$a1
|
|---|
| 88 | stg @T[0],`$stdframe+0*8`($sp) # tab[0]=0
|
|---|
| 89 | xgr $a12,$a2
|
|---|
| 90 | stg $a1,`$stdframe+1*8`($sp) # tab[1]=a1
|
|---|
| 91 | lgr $a48,$a4
|
|---|
| 92 | stg $a2,`$stdframe+2*8`($sp) # tab[2]=a2
|
|---|
| 93 | xgr $a48,$a8
|
|---|
| 94 | stg $a12,`$stdframe+3*8`($sp) # tab[3]=a1^a2
|
|---|
| 95 | xgr $a1,$a4
|
|---|
| 96 |
|
|---|
| 97 | stg $a4,`$stdframe+4*8`($sp) # tab[4]=a4
|
|---|
| 98 | xgr $a2,$a4
|
|---|
| 99 | stg $a1,`$stdframe+5*8`($sp) # tab[5]=a1^a4
|
|---|
| 100 | xgr $a12,$a4
|
|---|
| 101 | stg $a2,`$stdframe+6*8`($sp) # tab[6]=a2^a4
|
|---|
| 102 | xgr $a1,$a48
|
|---|
| 103 | stg $a12,`$stdframe+7*8`($sp) # tab[7]=a1^a2^a4
|
|---|
| 104 | xgr $a2,$a48
|
|---|
| 105 |
|
|---|
| 106 | stg $a8,`$stdframe+8*8`($sp) # tab[8]=a8
|
|---|
| 107 | xgr $a12,$a48
|
|---|
| 108 | stg $a1,`$stdframe+9*8`($sp) # tab[9]=a1^a8
|
|---|
| 109 | xgr $a1,$a4
|
|---|
| 110 | stg $a2,`$stdframe+10*8`($sp) # tab[10]=a2^a8
|
|---|
| 111 | xgr $a2,$a4
|
|---|
| 112 | stg $a12,`$stdframe+11*8`($sp) # tab[11]=a1^a2^a8
|
|---|
| 113 |
|
|---|
| 114 | xgr $a12,$a4
|
|---|
| 115 | stg $a48,`$stdframe+12*8`($sp) # tab[12]=a4^a8
|
|---|
| 116 | srlg $hi,$lo,1
|
|---|
| 117 | stg $a1,`$stdframe+13*8`($sp) # tab[13]=a1^a4^a8
|
|---|
| 118 | sllg $lo,$lo,63
|
|---|
| 119 | stg $a2,`$stdframe+14*8`($sp) # tab[14]=a2^a4^a8
|
|---|
| 120 | srlg @T[0],@i[0],2
|
|---|
| 121 | stg $a12,`$stdframe+15*8`($sp) # tab[15]=a1^a2^a4^a8
|
|---|
| 122 |
|
|---|
| 123 | lghi $mask,`0xf<<3`
|
|---|
| 124 | sllg $a1,@i[0],62
|
|---|
| 125 | sllg @i[0],$b,3
|
|---|
| 126 | srlg @T[1],@i[1],3
|
|---|
| 127 | ngr @i[0],$mask
|
|---|
| 128 | sllg $a2,@i[1],61
|
|---|
| 129 | srlg @i[1],$b,4-3
|
|---|
| 130 | xgr $hi,@T[0]
|
|---|
| 131 | ngr @i[1],$mask
|
|---|
| 132 | xgr $lo,$a1
|
|---|
| 133 | xgr $hi,@T[1]
|
|---|
| 134 | xgr $lo,$a2
|
|---|
| 135 |
|
|---|
| 136 | xg $lo,$stdframe(@i[0],$sp)
|
|---|
| 137 | srlg @i[0],$b,8-3
|
|---|
| 138 | ngr @i[0],$mask
|
|---|
| 139 | ___
|
|---|
| 140 | for($n=1;$n<14;$n++) {
|
|---|
| 141 | $code.=<<___;
|
|---|
| 142 | lg @T[1],$stdframe(@i[1],$sp)
|
|---|
| 143 | srlg @i[1],$b,`($n+2)*4`-3
|
|---|
| 144 | sllg @T[0],@T[1],`$n*4`
|
|---|
| 145 | ngr @i[1],$mask
|
|---|
| 146 | srlg @T[1],@T[1],`64-$n*4`
|
|---|
| 147 | xgr $lo,@T[0]
|
|---|
| 148 | xgr $hi,@T[1]
|
|---|
| 149 | ___
|
|---|
| 150 | push(@i,shift(@i)); push(@T,shift(@T));
|
|---|
| 151 | }
|
|---|
| 152 | $code.=<<___;
|
|---|
| 153 | lg @T[1],$stdframe(@i[1],$sp)
|
|---|
| 154 | sllg @T[0],@T[1],`$n*4`
|
|---|
| 155 | srlg @T[1],@T[1],`64-$n*4`
|
|---|
| 156 | xgr $lo,@T[0]
|
|---|
| 157 | xgr $hi,@T[1]
|
|---|
| 158 |
|
|---|
| 159 | lg @T[0],$stdframe(@i[0],$sp)
|
|---|
| 160 | sllg @T[1],@T[0],`($n+1)*4`
|
|---|
| 161 | srlg @T[0],@T[0],`64-($n+1)*4`
|
|---|
| 162 | xgr $lo,@T[1]
|
|---|
| 163 | xgr $hi,@T[0]
|
|---|
| 164 |
|
|---|
| 165 | br $ra
|
|---|
| 166 | .size _mul_1x1,.-_mul_1x1
|
|---|
| 167 |
|
|---|
| 168 | .globl bn_GF2m_mul_2x2
|
|---|
| 169 | .type bn_GF2m_mul_2x2,\@function
|
|---|
| 170 | .align 16
|
|---|
| 171 | bn_GF2m_mul_2x2:
|
|---|
| 172 | stm${g} %r3,%r15,3*$SIZE_T($sp)
|
|---|
| 173 |
|
|---|
| 174 | lghi %r1,-$stdframe-128
|
|---|
| 175 | la %r0,0($sp)
|
|---|
| 176 | la $sp,0(%r1,$sp) # alloca
|
|---|
| 177 | st${g} %r0,0($sp) # back chain
|
|---|
| 178 | ___
|
|---|
| 179 | if ($SIZE_T==8) {
|
|---|
| 180 | my @r=map("%r$_",(6..9));
|
|---|
| 181 | $code.=<<___;
|
|---|
| 182 | bras $ra,_mul_1x1 # a1·b1
|
|---|
| 183 | stmg $lo,$hi,16($rp)
|
|---|
| 184 |
|
|---|
| 185 | lg $a,`$stdframe+128+4*$SIZE_T`($sp)
|
|---|
| 186 | lg $b,`$stdframe+128+6*$SIZE_T`($sp)
|
|---|
| 187 | bras $ra,_mul_1x1 # a0·b0
|
|---|
| 188 | stmg $lo,$hi,0($rp)
|
|---|
| 189 |
|
|---|
| 190 | lg $a,`$stdframe+128+3*$SIZE_T`($sp)
|
|---|
| 191 | lg $b,`$stdframe+128+5*$SIZE_T`($sp)
|
|---|
| 192 | xg $a,`$stdframe+128+4*$SIZE_T`($sp)
|
|---|
| 193 | xg $b,`$stdframe+128+6*$SIZE_T`($sp)
|
|---|
| 194 | bras $ra,_mul_1x1 # (a0+a1)·(b0+b1)
|
|---|
| 195 | lmg @r[0],@r[3],0($rp)
|
|---|
| 196 |
|
|---|
| 197 | xgr $lo,$hi
|
|---|
| 198 | xgr $hi,@r[1]
|
|---|
| 199 | xgr $lo,@r[0]
|
|---|
| 200 | xgr $hi,@r[2]
|
|---|
| 201 | xgr $lo,@r[3]
|
|---|
| 202 | xgr $hi,@r[3]
|
|---|
| 203 | xgr $lo,$hi
|
|---|
| 204 | stg $hi,16($rp)
|
|---|
| 205 | stg $lo,8($rp)
|
|---|
| 206 | ___
|
|---|
| 207 | } else {
|
|---|
| 208 | $code.=<<___;
|
|---|
| 209 | sllg %r3,%r3,32
|
|---|
| 210 | sllg %r5,%r5,32
|
|---|
| 211 | or %r3,%r4
|
|---|
| 212 | or %r5,%r6
|
|---|
| 213 | bras $ra,_mul_1x1
|
|---|
| 214 | rllg $lo,$lo,32
|
|---|
| 215 | rllg $hi,$hi,32
|
|---|
| 216 | stmg $lo,$hi,0($rp)
|
|---|
| 217 | ___
|
|---|
| 218 | }
|
|---|
| 219 | $code.=<<___;
|
|---|
| 220 | lm${g} %r6,%r15,`$stdframe+128+6*$SIZE_T`($sp)
|
|---|
| 221 | br $ra
|
|---|
| 222 | .size bn_GF2m_mul_2x2,.-bn_GF2m_mul_2x2
|
|---|
| 223 | .string "GF(2^m) Multiplication for s390x, CRYPTOGAMS by <appro\@openssl.org>"
|
|---|
| 224 | ___
|
|---|
| 225 |
|
|---|
| 226 | $code =~ s/\`([^\`]*)\`/eval($1)/gem;
|
|---|
| 227 | print $code;
|
|---|
| 228 | close STDOUT;
|
|---|
