]>
git.ipfire.org Git - thirdparty/openssl.git/blob - crypto/chacha/asm/chacha-s390x.pl
2 # Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the OpenSSL license (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
10 # ====================================================================
11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12 # project. The module is, however, dual licensed under OpenSSL and
13 # CRYPTOGAMS licenses depending on where you obtain it. For further
14 # details see http://www.openssl.org/~appro/cryptogams/.
15 # ====================================================================
21 # 3 times faster than compiler-generated code.
25 if ($flavour =~ /3[12]/) {
33 while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
34 open STDOUT
,">$output";
36 sub AUTOLOAD
() # thunk [simplified] x86-style perlasm
37 { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://;
38 $code .= "\t$opcode\t".join(',',@_)."\n";
43 my $stdframe=16*$SIZE_T+4*8;
44 my $frame=$stdframe+4*20;
46 my ($out,$inp,$len,$key,$counter)=map("%r$_",(2..6));
48 my @x=map("%r$_",(0..7,"x","x","x","x",(10..13)));
49 my @t=map("%r$_",(8,9));
52 my ($a0,$b0,$c0,$d0)=@_;
53 my ($a1,$b1,$c1,$d1)=map(($_&~3)+(($_+1)&3),($a0,$b0,$c0,$d0));
54 my ($a2,$b2,$c2,$d2)=map(($_&~3)+(($_+1)&3),($a1,$b1,$c1,$d1));
55 my ($a3,$b3,$c3,$d3)=map(($_&~3)+(($_+1)&3),($a2,$b2,$c2,$d2));
56 my ($xc,$xc_)=map("\"$_\"",@t);
57 my @x=map("\"$_\"",@x);
59 # Consider order in which variables are addressed by their
64 # 0 4 8 12 < even round
68 # 0 5 10 15 < odd round
73 # 'a', 'b' and 'd's are permanently allocated in registers,
74 # @x[0..7,12..15], while 'c's are maintained in memory. If
75 # you observe 'c' column, you'll notice that pair of 'c's is
76 # invariant between rounds. This means that we have to reload
77 # them once per round, in the middle. This is why you'll see
78 # 'c' stores and loads in the middle, but none in the beginning
82 "&alr (@x[$a0],@x[$b0])", # Q1
83 "&alr (@x[$a1],@x[$b1])", # Q2
84 "&xr (@x[$d0],@x[$a0])",
85 "&xr (@x[$d1],@x[$a1])",
86 "&rll (@x[$d0],@x[$d0],16)",
87 "&rll (@x[$d1],@x[$d1],16)",
90 "&alr ($xc_,@x[$d1])",
93 "&rll (@x[$b0],@x[$b0],12)",
94 "&rll (@x[$b1],@x[$b1],12)",
96 "&alr (@x[$a0],@x[$b0])",
97 "&alr (@x[$a1],@x[$b1])",
98 "&xr (@x[$d0],@x[$a0])",
99 "&xr (@x[$d1],@x[$a1])",
100 "&rll (@x[$d0],@x[$d0],8)",
101 "&rll (@x[$d1],@x[$d1],8)",
103 "&alr ($xc,@x[$d0])",
104 "&alr ($xc_,@x[$d1])",
106 "&xr (@x[$b1],$xc_)",
107 "&rll (@x[$b0],@x[$b0],7)",
108 "&rll (@x[$b1],@x[$b1],7)",
110 "&stm ($xc,$xc_,'$stdframe+4*8+4*$c0($sp)')", # reload pair of 'c's
111 "&lm ($xc,$xc_,'$stdframe+4*8+4*$c2($sp)')",
113 "&alr (@x[$a2],@x[$b2])", # Q3
114 "&alr (@x[$a3],@x[$b3])", # Q4
115 "&xr (@x[$d2],@x[$a2])",
116 "&xr (@x[$d3],@x[$a3])",
117 "&rll (@x[$d2],@x[$d2],16)",
118 "&rll (@x[$d3],@x[$d3],16)",
120 "&alr ($xc,@x[$d2])",
121 "&alr ($xc_,@x[$d3])",
123 "&xr (@x[$b3],$xc_)",
124 "&rll (@x[$b2],@x[$b2],12)",
125 "&rll (@x[$b3],@x[$b3],12)",
127 "&alr (@x[$a2],@x[$b2])",
128 "&alr (@x[$a3],@x[$b3])",
129 "&xr (@x[$d2],@x[$a2])",
130 "&xr (@x[$d3],@x[$a3])",
131 "&rll (@x[$d2],@x[$d2],8)",
132 "&rll (@x[$d3],@x[$d3],8)",
134 "&alr ($xc,@x[$d2])",
135 "&alr ($xc_,@x[$d3])",
137 "&xr (@x[$b3],$xc_)",
138 "&rll (@x[$b2],@x[$b2],7)",
139 "&rll (@x[$b3],@x[$b3],7)"
146 .globl ChaCha20_ctr32
147 .type ChaCha20_ctr32
,\
@function
150 cl
${g
}ije
$len,0,.Lno_data
# $len==0?
153 stm
${g
} %r6,%r15,`6*$SIZE_T`($sp)
154 sl
${g
}r
$out,$inp # difference
155 la
$len,0($inp,$len) # end of input minus 64
161 lmg
%r8,%r11,0($key) # load key
162 lmg
%r12,%r13,0($counter) # load counter
163 lmg
%r6,%r7,0(%r7) # load sigma constant
166 st
${g
} $out,$frame+3*$SIZE_T($sp)
167 st
${g
} $len,$frame+4*$SIZE_T($sp)
168 stmg
%r6,%r13,$stdframe($sp) # copy key schedule to stack
169 srlg
@x[12],%r12,32 # 32-bit counter value
174 lm
@x[0],@x[7],$stdframe+4*0($sp) # load x[0]-x[7]
175 lm
@t[0],@t[1],$stdframe+4*10($sp) # load x[10]-x[11]
176 lm
@x[13],@x[15],$stdframe+4*13($sp) # load x[13]-x[15]
177 stm
@t[0],@t[1],$stdframe+4*8+4*10($sp) # offload x[10]-x[11]
178 lm
@t[0],@t[1],$stdframe+4*8($sp) # load x[8]-x[9]
179 st
@x[12],$stdframe+4*12($sp) # save counter
180 st
${g
} %r14,$frame+2*$SIZE_T($sp) # save input pointer
187 foreach (&ROUND
(0, 4, 8,12)) { eval; }
188 foreach (&ROUND
(0, 5,10,15)) { eval; }
192 l
${g
} %r14,$frame+2*$SIZE_T($sp) # pull input pointer
193 stm
@t[0],@t[1],$stdframe+4*8+4*8($sp) # offload x[8]-x[9]
194 lm
${g
} @t[0],@t[1],$frame+3*$SIZE_T($sp)
196 al
@x[0],$stdframe+4*0($sp) # accumulate key schedule
197 al
@x[1],$stdframe+4*1($sp)
198 al
@x[2],$stdframe+4*2($sp)
199 al
@x[3],$stdframe+4*3($sp)
200 al
@x[4],$stdframe+4*4($sp)
201 al
@x[5],$stdframe+4*5($sp)
202 al
@x[6],$stdframe+4*6($sp)
203 al
@x[7],$stdframe+4*7($sp)
212 al
@x[12],$stdframe+4*12($sp)
213 al
@x[13],$stdframe+4*13($sp)
214 al
@x[14],$stdframe+4*14($sp)
215 al
@x[15],$stdframe+4*15($sp)
221 la
@t[0],0(@t[0],%r14) # reconstruct output pointer
225 x
@x[0],4*0(%r14) # xor with input
227 st
@x[0],4*0(@t[0]) # store output
234 lm
@x[0],@x[3],$stdframe+4*8+4*8($sp) # load x[8]-x[11]
238 al
@x[0],$stdframe+4*8($sp)
241 al
@x[1],$stdframe+4*9($sp)
244 al
@x[2],$stdframe+4*10($sp)
247 al
@x[3],$stdframe+4*11($sp)
248 st
@x[12],4*12(@t[0])
250 st
@x[13],4*13(@t[0])
252 st
@x[14],4*14(@t[0])
254 st
@x[15],4*15(@t[0])
260 al
@x[12],$stdframe+4*12($sp) # increment counter
269 cl
${g
}r
%r14,@t[1] # done yet?
278 stmg
%r0,%r3,$stdframe+4*4($sp) # wipe key copy
279 stmg
%r0,%r3,$stdframe+4*12($sp)
281 lm
${g
} %r6,%r15,`$frame+6*$SIZE_T`($sp)
288 stm
@x[0],@x[7],$stdframe+4*0($sp)
290 lm
@x[0],@x[3],$stdframe+4*8+4*8($sp)
292 stm
@x[12],@x[15],$stdframe+4*12($sp)
293 al
@x[0],$stdframe+4*8($sp)
294 al
@x[1],$stdframe+4*9($sp)
295 al
@x[2],$stdframe+4*10($sp)
296 al
@x[3],$stdframe+4*11($sp)
301 stm
@x[0],@x[3],$stdframe+4*8($sp)
304 llgc
@x[4],0(@x[6],%r14)
305 llgc
@x[5],$stdframe(@x[6],$sp)
307 stc
@x[5],0(@x[6],@t[0])
309 brct
@t[1],.Loop_tail
312 .size ChaCha20_ctr32
,.-ChaCha20_ctr32
316 .long
0x61707865,0x3320646e,0x79622d32,0x6b206574 # endian-neutral
317 .asciz
"ChaCha20 for s390x, CRYPTOGAMS by <appro\@openssl.org>"
321 foreach (split("\n",$code)) {
322 s/\`([^\`]*)\`/eval $1/ge;