| 1 | #! /usr/bin/env perl
|
|---|
| 2 | # Copyright 2010-2016 The OpenSSL Project Authors. All Rights Reserved.
|
|---|
| 3 | #
|
|---|
| 4 | # Licensed under the OpenSSL license (the "License"). You may not use
|
|---|
| 5 | # this file except in compliance with the License. You can obtain a copy
|
|---|
| 6 | # in the file LICENSE in the source distribution or at
|
|---|
| 7 | # https://www.openssl.org/source/license.html
|
|---|
| 8 |
|
|---|
| 9 |
|
|---|
| 10 | # ====================================================================
|
|---|
| 11 | # Written by Andy Polyakov <[email protected]> for the OpenSSL
|
|---|
| 12 | # project. The module is, however, dual licensed under OpenSSL and
|
|---|
| 13 | # CRYPTOGAMS licenses depending on where you obtain it. For further
|
|---|
| 14 | # details see http://www.openssl.org/~appro/cryptogams/.
|
|---|
| 15 | # ====================================================================
|
|---|
| 16 |
|
|---|
| 17 | # September 2010.
|
|---|
| 18 | #
|
|---|
| 19 | # The module implements "4-bit" GCM GHASH function and underlying
|
|---|
| 20 | # single multiplication operation in GF(2^128). "4-bit" means that it
|
|---|
| 21 | # uses 256 bytes per-key table [+128 bytes shared table]. Performance
|
|---|
| 22 | # was measured to be ~18 cycles per processed byte on z10, which is
|
|---|
| 23 | # almost 40% better than gcc-generated code. It should be noted that
|
|---|
| 24 | # 18 cycles is worse result than expected: loop is scheduled for 12
|
|---|
| 25 | # and the result should be close to 12. In the lack of instruction-
|
|---|
| 26 | # level profiling data it's impossible to tell why...
|
|---|
| 27 |
|
|---|
| 28 | # November 2010.
|
|---|
| 29 | #
|
|---|
| 30 | # Adapt for -m31 build. If kernel supports what's called "highgprs"
|
|---|
| 31 | # feature on Linux [see /proc/cpuinfo], it's possible to use 64-bit
|
|---|
| 32 | # instructions and achieve "64-bit" performance even in 31-bit legacy
|
|---|
| 33 | # application context. The feature is not specific to any particular
|
|---|
| 34 | # processor, as long as it's "z-CPU". Latter implies that the code
|
|---|
| 35 | # remains z/Architecture specific. On z990 it was measured to perform
|
|---|
| 36 | # 2.8x better than 32-bit code generated by gcc 4.3.
|
|---|
| 37 |
|
|---|
| 38 | # March 2011.
|
|---|
| 39 | #
|
|---|
| 40 | # Support for hardware KIMD-GHASH is verified to produce correct
|
|---|
| 41 | # result and therefore is engaged. On z196 it was measured to process
|
|---|
| 42 | # 8KB buffer ~7 faster than software implementation. It's not as
|
|---|
| 43 | # impressive for smaller buffer sizes and for smallest 16-bytes buffer
|
|---|
| 44 | # it's actually almost 2 times slower. Which is the reason why
|
|---|
| 45 | # KIMD-GHASH is not used in gcm_gmult_4bit.
|
|---|
| 46 |
|
|---|
| 47 | $flavour = shift;
|
|---|
| 48 |
|
|---|
| 49 | if ($flavour =~ /3[12]/) {
|
|---|
| 50 | $SIZE_T=4;
|
|---|
| 51 | $g="";
|
|---|
| 52 | } else {
|
|---|
| 53 | $SIZE_T=8;
|
|---|
| 54 | $g="g";
|
|---|
| 55 | }
|
|---|
| 56 |
|
|---|
| 57 | while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
|
|---|
| 58 | open STDOUT,">$output";
|
|---|
| 59 |
|
|---|
| 60 | $softonly=0;
|
|---|
| 61 |
|
|---|
| 62 | $Zhi="%r0";
|
|---|
| 63 | $Zlo="%r1";
|
|---|
| 64 |
|
|---|
| 65 | $Xi="%r2"; # argument block
|
|---|
| 66 | $Htbl="%r3";
|
|---|
| 67 | $inp="%r4";
|
|---|
| 68 | $len="%r5";
|
|---|
| 69 |
|
|---|
| 70 | $rem0="%r6"; # variables
|
|---|
| 71 | $rem1="%r7";
|
|---|
| 72 | $nlo="%r8";
|
|---|
| 73 | $nhi="%r9";
|
|---|
| 74 | $xi="%r10";
|
|---|
| 75 | $cnt="%r11";
|
|---|
| 76 | $tmp="%r12";
|
|---|
| 77 | $x78="%r13";
|
|---|
| 78 | $rem_4bit="%r14";
|
|---|
| 79 |
|
|---|
| 80 | $sp="%r15";
|
|---|
| 81 |
|
|---|
| 82 | $code.=<<___;
|
|---|
| 83 | .text
|
|---|
| 84 |
|
|---|
| 85 | .globl gcm_gmult_4bit
|
|---|
| 86 | .align 32
|
|---|
| 87 | gcm_gmult_4bit:
|
|---|
| 88 | ___
|
|---|
| 89 | $code.=<<___ if(!$softonly && 0); # hardware is slow for single block...
|
|---|
| 90 | larl %r1,OPENSSL_s390xcap_P
|
|---|
| 91 | lghi %r0,0
|
|---|
| 92 | lg %r1,24(%r1) # load second word of kimd capabilities vector
|
|---|
| 93 | tmhh %r1,0x4000 # check for function 65
|
|---|
| 94 | jz .Lsoft_gmult
|
|---|
| 95 | stg %r0,16($sp) # arrange 16 bytes of zero input
|
|---|
| 96 | stg %r0,24($sp)
|
|---|
| 97 | lghi %r0,65 # function 65
|
|---|
| 98 | la %r1,0($Xi) # H lies right after Xi in gcm128_context
|
|---|
| 99 | la $inp,16($sp)
|
|---|
| 100 | lghi $len,16
|
|---|
| 101 | .long 0xb93e0004 # kimd %r0,$inp
|
|---|
| 102 | brc 1,.-4 # pay attention to "partial completion"
|
|---|
| 103 | br %r14
|
|---|
| 104 | .align 32
|
|---|
| 105 | .Lsoft_gmult:
|
|---|
| 106 | ___
|
|---|
| 107 | $code.=<<___;
|
|---|
| 108 | stm${g} %r6,%r14,6*$SIZE_T($sp)
|
|---|
| 109 |
|
|---|
| 110 | aghi $Xi,-1
|
|---|
| 111 | lghi $len,1
|
|---|
| 112 | lghi $x78,`0xf<<3`
|
|---|
| 113 | larl $rem_4bit,rem_4bit
|
|---|
| 114 |
|
|---|
| 115 | lg $Zlo,8+1($Xi) # Xi
|
|---|
| 116 | j .Lgmult_shortcut
|
|---|
| 117 | .type gcm_gmult_4bit,\@function
|
|---|
| 118 | .size gcm_gmult_4bit,(.-gcm_gmult_4bit)
|
|---|
| 119 |
|
|---|
| 120 | .globl gcm_ghash_4bit
|
|---|
| 121 | .align 32
|
|---|
| 122 | gcm_ghash_4bit:
|
|---|
| 123 | ___
|
|---|
| 124 | $code.=<<___ if(!$softonly);
|
|---|
| 125 | larl %r1,OPENSSL_s390xcap_P
|
|---|
| 126 | lg %r0,24(%r1) # load second word of kimd capabilities vector
|
|---|
| 127 | tmhh %r0,0x4000 # check for function 65
|
|---|
| 128 | jz .Lsoft_ghash
|
|---|
| 129 | lghi %r0,65 # function 65
|
|---|
| 130 | la %r1,0($Xi) # H lies right after Xi in gcm128_context
|
|---|
| 131 | .long 0xb93e0004 # kimd %r0,$inp
|
|---|
| 132 | brc 1,.-4 # pay attention to "partial completion"
|
|---|
| 133 | br %r14
|
|---|
| 134 | .align 32
|
|---|
| 135 | .Lsoft_ghash:
|
|---|
| 136 | ___
|
|---|
| 137 | $code.=<<___ if ($flavour =~ /3[12]/);
|
|---|
| 138 | llgfr $len,$len
|
|---|
| 139 | ___
|
|---|
| 140 | $code.=<<___;
|
|---|
| 141 | stm${g} %r6,%r14,6*$SIZE_T($sp)
|
|---|
| 142 |
|
|---|
| 143 | aghi $Xi,-1
|
|---|
| 144 | srlg $len,$len,4
|
|---|
| 145 | lghi $x78,`0xf<<3`
|
|---|
| 146 | larl $rem_4bit,rem_4bit
|
|---|
| 147 |
|
|---|
| 148 | lg $Zlo,8+1($Xi) # Xi
|
|---|
| 149 | lg $Zhi,0+1($Xi)
|
|---|
| 150 | lghi $tmp,0
|
|---|
| 151 | .Louter:
|
|---|
| 152 | xg $Zhi,0($inp) # Xi ^= inp
|
|---|
| 153 | xg $Zlo,8($inp)
|
|---|
| 154 | xgr $Zhi,$tmp
|
|---|
| 155 | stg $Zlo,8+1($Xi)
|
|---|
| 156 | stg $Zhi,0+1($Xi)
|
|---|
| 157 |
|
|---|
| 158 | .Lgmult_shortcut:
|
|---|
| 159 | lghi $tmp,0xf0
|
|---|
| 160 | sllg $nlo,$Zlo,4
|
|---|
| 161 | srlg $xi,$Zlo,8 # extract second byte
|
|---|
| 162 | ngr $nlo,$tmp
|
|---|
| 163 | lgr $nhi,$Zlo
|
|---|
| 164 | lghi $cnt,14
|
|---|
| 165 | ngr $nhi,$tmp
|
|---|
| 166 |
|
|---|
| 167 | lg $Zlo,8($nlo,$Htbl)
|
|---|
| 168 | lg $Zhi,0($nlo,$Htbl)
|
|---|
| 169 |
|
|---|
| 170 | sllg $nlo,$xi,4
|
|---|
| 171 | sllg $rem0,$Zlo,3
|
|---|
| 172 | ngr $nlo,$tmp
|
|---|
| 173 | ngr $rem0,$x78
|
|---|
| 174 | ngr $xi,$tmp
|
|---|
| 175 |
|
|---|
| 176 | sllg $tmp,$Zhi,60
|
|---|
| 177 | srlg $Zlo,$Zlo,4
|
|---|
| 178 | srlg $Zhi,$Zhi,4
|
|---|
| 179 | xg $Zlo,8($nhi,$Htbl)
|
|---|
| 180 | xg $Zhi,0($nhi,$Htbl)
|
|---|
| 181 | lgr $nhi,$xi
|
|---|
| 182 | sllg $rem1,$Zlo,3
|
|---|
| 183 | xgr $Zlo,$tmp
|
|---|
| 184 | ngr $rem1,$x78
|
|---|
| 185 | sllg $tmp,$Zhi,60
|
|---|
| 186 | j .Lghash_inner
|
|---|
| 187 | .align 16
|
|---|
| 188 | .Lghash_inner:
|
|---|
| 189 | srlg $Zlo,$Zlo,4
|
|---|
| 190 | srlg $Zhi,$Zhi,4
|
|---|
| 191 | xg $Zlo,8($nlo,$Htbl)
|
|---|
| 192 | llgc $xi,0($cnt,$Xi)
|
|---|
| 193 | xg $Zhi,0($nlo,$Htbl)
|
|---|
| 194 | sllg $nlo,$xi,4
|
|---|
| 195 | xg $Zhi,0($rem0,$rem_4bit)
|
|---|
| 196 | nill $nlo,0xf0
|
|---|
| 197 | sllg $rem0,$Zlo,3
|
|---|
| 198 | xgr $Zlo,$tmp
|
|---|
| 199 | ngr $rem0,$x78
|
|---|
| 200 | nill $xi,0xf0
|
|---|
| 201 |
|
|---|
| 202 | sllg $tmp,$Zhi,60
|
|---|
| 203 | srlg $Zlo,$Zlo,4
|
|---|
| 204 | srlg $Zhi,$Zhi,4
|
|---|
| 205 | xg $Zlo,8($nhi,$Htbl)
|
|---|
| 206 | xg $Zhi,0($nhi,$Htbl)
|
|---|
| 207 | lgr $nhi,$xi
|
|---|
| 208 | xg $Zhi,0($rem1,$rem_4bit)
|
|---|
| 209 | sllg $rem1,$Zlo,3
|
|---|
| 210 | xgr $Zlo,$tmp
|
|---|
| 211 | ngr $rem1,$x78
|
|---|
| 212 | sllg $tmp,$Zhi,60
|
|---|
| 213 | brct $cnt,.Lghash_inner
|
|---|
| 214 |
|
|---|
| 215 | srlg $Zlo,$Zlo,4
|
|---|
| 216 | srlg $Zhi,$Zhi,4
|
|---|
| 217 | xg $Zlo,8($nlo,$Htbl)
|
|---|
| 218 | xg $Zhi,0($nlo,$Htbl)
|
|---|
| 219 | sllg $xi,$Zlo,3
|
|---|
| 220 | xg $Zhi,0($rem0,$rem_4bit)
|
|---|
| 221 | xgr $Zlo,$tmp
|
|---|
| 222 | ngr $xi,$x78
|
|---|
| 223 |
|
|---|
| 224 | sllg $tmp,$Zhi,60
|
|---|
| 225 | srlg $Zlo,$Zlo,4
|
|---|
| 226 | srlg $Zhi,$Zhi,4
|
|---|
| 227 | xg $Zlo,8($nhi,$Htbl)
|
|---|
| 228 | xg $Zhi,0($nhi,$Htbl)
|
|---|
| 229 | xgr $Zlo,$tmp
|
|---|
| 230 | xg $Zhi,0($rem1,$rem_4bit)
|
|---|
| 231 |
|
|---|
| 232 | lg $tmp,0($xi,$rem_4bit)
|
|---|
| 233 | la $inp,16($inp)
|
|---|
| 234 | sllg $tmp,$tmp,4 # correct last rem_4bit[rem]
|
|---|
| 235 | brctg $len,.Louter
|
|---|
| 236 |
|
|---|
| 237 | xgr $Zhi,$tmp
|
|---|
| 238 | stg $Zlo,8+1($Xi)
|
|---|
| 239 | stg $Zhi,0+1($Xi)
|
|---|
| 240 | lm${g} %r6,%r14,6*$SIZE_T($sp)
|
|---|
| 241 | br %r14
|
|---|
| 242 | .type gcm_ghash_4bit,\@function
|
|---|
| 243 | .size gcm_ghash_4bit,(.-gcm_ghash_4bit)
|
|---|
| 244 |
|
|---|
| 245 | .align 64
|
|---|
| 246 | rem_4bit:
|
|---|
| 247 | .long `0x0000<<12`,0,`0x1C20<<12`,0,`0x3840<<12`,0,`0x2460<<12`,0
|
|---|
| 248 | .long `0x7080<<12`,0,`0x6CA0<<12`,0,`0x48C0<<12`,0,`0x54E0<<12`,0
|
|---|
| 249 | .long `0xE100<<12`,0,`0xFD20<<12`,0,`0xD940<<12`,0,`0xC560<<12`,0
|
|---|
| 250 | .long `0x9180<<12`,0,`0x8DA0<<12`,0,`0xA9C0<<12`,0,`0xB5E0<<12`,0
|
|---|
| 251 | .type rem_4bit,\@object
|
|---|
| 252 | .size rem_4bit,(.-rem_4bit)
|
|---|
| 253 | .string "GHASH for s390x, CRYPTOGAMS by <appro\@openssl.org>"
|
|---|
| 254 | ___
|
|---|
| 255 |
|
|---|
| 256 | $code =~ s/\`([^\`]*)\`/eval $1/gem;
|
|---|
| 257 | print $code;
|
|---|
| 258 | close STDOUT;
|
|---|
