You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
257 lines
6.8 KiB
257 lines
6.8 KiB
// This file is generated from a similarly-named Perl script in the BoringSSL |
|
// source tree. Do not edit by hand. |
|
|
|
#if !defined(__has_feature) |
|
#define __has_feature(x) 0 |
|
#endif |
|
#if __has_feature(memory_sanitizer) && !defined(OPENSSL_NO_ASM) |
|
#define OPENSSL_NO_ASM |
|
#endif |
|
|
|
#if !defined(OPENSSL_NO_ASM) |
|
#if defined(__aarch64__) |
|
#if defined(BORINGSSL_PREFIX) |
|
#include <boringssl_prefix_symbols_asm.h> |
|
#endif |
|
#include <openssl/arm_arch.h> |
|
|
|
.text |
|
.arch armv8-a+crypto |
|
.globl gcm_init_v8 |
|
|
|
.def gcm_init_v8 |
|
.type 32 |
|
.endef |
|
.align 4 |
|
gcm_init_v8: |
|
AARCH64_VALID_CALL_TARGET |
|
ld1 {v17.2d},[x1] //load input H |
|
movi v19.16b,#0xe1 |
|
shl v19.2d,v19.2d,#57 //0xc2.0 |
|
ext v3.16b,v17.16b,v17.16b,#8 |
|
ushr v18.2d,v19.2d,#63 |
|
dup v17.4s,v17.s[1] |
|
ext v16.16b,v18.16b,v19.16b,#8 //t0=0xc2....01 |
|
ushr v18.2d,v3.2d,#63 |
|
sshr v17.4s,v17.4s,#31 //broadcast carry bit |
|
and v18.16b,v18.16b,v16.16b |
|
shl v3.2d,v3.2d,#1 |
|
ext v18.16b,v18.16b,v18.16b,#8 |
|
and v16.16b,v16.16b,v17.16b |
|
orr v3.16b,v3.16b,v18.16b //H<<<=1 |
|
eor v20.16b,v3.16b,v16.16b //twisted H |
|
st1 {v20.2d},[x0],#16 //store Htable[0] |
|
|
|
//calculate H^2 |
|
ext v16.16b,v20.16b,v20.16b,#8 //Karatsuba pre-processing |
|
pmull v0.1q,v20.1d,v20.1d |
|
eor v16.16b,v16.16b,v20.16b |
|
pmull2 v2.1q,v20.2d,v20.2d |
|
pmull v1.1q,v16.1d,v16.1d |
|
|
|
ext v17.16b,v0.16b,v2.16b,#8 //Karatsuba post-processing |
|
eor v18.16b,v0.16b,v2.16b |
|
eor v1.16b,v1.16b,v17.16b |
|
eor v1.16b,v1.16b,v18.16b |
|
pmull v18.1q,v0.1d,v19.1d //1st phase |
|
|
|
ins v2.d[0],v1.d[1] |
|
ins v1.d[1],v0.d[0] |
|
eor v0.16b,v1.16b,v18.16b |
|
|
|
ext v18.16b,v0.16b,v0.16b,#8 //2nd phase |
|
pmull v0.1q,v0.1d,v19.1d |
|
eor v18.16b,v18.16b,v2.16b |
|
eor v22.16b,v0.16b,v18.16b |
|
|
|
ext v17.16b,v22.16b,v22.16b,#8 //Karatsuba pre-processing |
|
eor v17.16b,v17.16b,v22.16b |
|
ext v21.16b,v16.16b,v17.16b,#8 //pack Karatsuba pre-processed |
|
st1 {v21.2d,v22.2d},[x0] //store Htable[1..2] |
|
|
|
ret |
|
|
|
.globl gcm_gmult_v8 |
|
|
|
.def gcm_gmult_v8 |
|
.type 32 |
|
.endef |
|
.align 4 |
|
gcm_gmult_v8: |
|
AARCH64_VALID_CALL_TARGET |
|
ld1 {v17.2d},[x0] //load Xi |
|
movi v19.16b,#0xe1 |
|
ld1 {v20.2d,v21.2d},[x1] //load twisted H, ... |
|
shl v19.2d,v19.2d,#57 |
|
#ifndef __ARMEB__ |
|
rev64 v17.16b,v17.16b |
|
#endif |
|
ext v3.16b,v17.16b,v17.16b,#8 |
|
|
|
pmull v0.1q,v20.1d,v3.1d //H.lo·Xi.lo |
|
eor v17.16b,v17.16b,v3.16b //Karatsuba pre-processing |
|
pmull2 v2.1q,v20.2d,v3.2d //H.hi·Xi.hi |
|
pmull v1.1q,v21.1d,v17.1d //(H.lo+H.hi)·(Xi.lo+Xi.hi) |
|
|
|
ext v17.16b,v0.16b,v2.16b,#8 //Karatsuba post-processing |
|
eor v18.16b,v0.16b,v2.16b |
|
eor v1.16b,v1.16b,v17.16b |
|
eor v1.16b,v1.16b,v18.16b |
|
pmull v18.1q,v0.1d,v19.1d //1st phase of reduction |
|
|
|
ins v2.d[0],v1.d[1] |
|
ins v1.d[1],v0.d[0] |
|
eor v0.16b,v1.16b,v18.16b |
|
|
|
ext v18.16b,v0.16b,v0.16b,#8 //2nd phase of reduction |
|
pmull v0.1q,v0.1d,v19.1d |
|
eor v18.16b,v18.16b,v2.16b |
|
eor v0.16b,v0.16b,v18.16b |
|
|
|
#ifndef __ARMEB__ |
|
rev64 v0.16b,v0.16b |
|
#endif |
|
ext v0.16b,v0.16b,v0.16b,#8 |
|
st1 {v0.2d},[x0] //write out Xi |
|
|
|
ret |
|
|
|
.globl gcm_ghash_v8 |
|
|
|
.def gcm_ghash_v8 |
|
.type 32 |
|
.endef |
|
.align 4 |
|
gcm_ghash_v8: |
|
AARCH64_VALID_CALL_TARGET |
|
ld1 {v0.2d},[x0] //load [rotated] Xi |
|
//"[rotated]" means that |
|
//loaded value would have |
|
//to be rotated in order to |
|
//make it appear as in |
|
//algorithm specification |
|
subs x3,x3,#32 //see if x3 is 32 or larger |
|
mov x12,#16 //x12 is used as post- |
|
//increment for input pointer; |
|
//as loop is modulo-scheduled |
|
//x12 is zeroed just in time |
|
//to preclude overstepping |
|
//inp[len], which means that |
|
//last block[s] are actually |
|
//loaded twice, but last |
|
//copy is not processed |
|
ld1 {v20.2d,v21.2d},[x1],#32 //load twisted H, ..., H^2 |
|
movi v19.16b,#0xe1 |
|
ld1 {v22.2d},[x1] |
|
csel x12,xzr,x12,eq //is it time to zero x12? |
|
ext v0.16b,v0.16b,v0.16b,#8 //rotate Xi |
|
ld1 {v16.2d},[x2],#16 //load [rotated] I[0] |
|
shl v19.2d,v19.2d,#57 //compose 0xc2.0 constant |
|
#ifndef __ARMEB__ |
|
rev64 v16.16b,v16.16b |
|
rev64 v0.16b,v0.16b |
|
#endif |
|
ext v3.16b,v16.16b,v16.16b,#8 //rotate I[0] |
|
b.lo Lodd_tail_v8 //x3 was less than 32 |
|
ld1 {v17.2d},[x2],x12 //load [rotated] I[1] |
|
#ifndef __ARMEB__ |
|
rev64 v17.16b,v17.16b |
|
#endif |
|
ext v7.16b,v17.16b,v17.16b,#8 |
|
eor v3.16b,v3.16b,v0.16b //I[i]^=Xi |
|
pmull v4.1q,v20.1d,v7.1d //H·Ii+1 |
|
eor v17.16b,v17.16b,v7.16b //Karatsuba pre-processing |
|
pmull2 v6.1q,v20.2d,v7.2d |
|
b Loop_mod2x_v8 |
|
|
|
.align 4 |
|
Loop_mod2x_v8: |
|
ext v18.16b,v3.16b,v3.16b,#8 |
|
subs x3,x3,#32 //is there more data? |
|
pmull v0.1q,v22.1d,v3.1d //H^2.lo·Xi.lo |
|
csel x12,xzr,x12,lo //is it time to zero x12? |
|
|
|
pmull v5.1q,v21.1d,v17.1d |
|
eor v18.16b,v18.16b,v3.16b //Karatsuba pre-processing |
|
pmull2 v2.1q,v22.2d,v3.2d //H^2.hi·Xi.hi |
|
eor v0.16b,v0.16b,v4.16b //accumulate |
|
pmull2 v1.1q,v21.2d,v18.2d //(H^2.lo+H^2.hi)·(Xi.lo+Xi.hi) |
|
ld1 {v16.2d},[x2],x12 //load [rotated] I[i+2] |
|
|
|
eor v2.16b,v2.16b,v6.16b |
|
csel x12,xzr,x12,eq //is it time to zero x12? |
|
eor v1.16b,v1.16b,v5.16b |
|
|
|
ext v17.16b,v0.16b,v2.16b,#8 //Karatsuba post-processing |
|
eor v18.16b,v0.16b,v2.16b |
|
eor v1.16b,v1.16b,v17.16b |
|
ld1 {v17.2d},[x2],x12 //load [rotated] I[i+3] |
|
#ifndef __ARMEB__ |
|
rev64 v16.16b,v16.16b |
|
#endif |
|
eor v1.16b,v1.16b,v18.16b |
|
pmull v18.1q,v0.1d,v19.1d //1st phase of reduction |
|
|
|
#ifndef __ARMEB__ |
|
rev64 v17.16b,v17.16b |
|
#endif |
|
ins v2.d[0],v1.d[1] |
|
ins v1.d[1],v0.d[0] |
|
ext v7.16b,v17.16b,v17.16b,#8 |
|
ext v3.16b,v16.16b,v16.16b,#8 |
|
eor v0.16b,v1.16b,v18.16b |
|
pmull v4.1q,v20.1d,v7.1d //H·Ii+1 |
|
eor v3.16b,v3.16b,v2.16b //accumulate v3.16b early |
|
|
|
ext v18.16b,v0.16b,v0.16b,#8 //2nd phase of reduction |
|
pmull v0.1q,v0.1d,v19.1d |
|
eor v3.16b,v3.16b,v18.16b |
|
eor v17.16b,v17.16b,v7.16b //Karatsuba pre-processing |
|
eor v3.16b,v3.16b,v0.16b |
|
pmull2 v6.1q,v20.2d,v7.2d |
|
b.hs Loop_mod2x_v8 //there was at least 32 more bytes |
|
|
|
eor v2.16b,v2.16b,v18.16b |
|
ext v3.16b,v16.16b,v16.16b,#8 //re-construct v3.16b |
|
adds x3,x3,#32 //re-construct x3 |
|
eor v0.16b,v0.16b,v2.16b //re-construct v0.16b |
|
b.eq Ldone_v8 //is x3 zero? |
|
Lodd_tail_v8: |
|
ext v18.16b,v0.16b,v0.16b,#8 |
|
eor v3.16b,v3.16b,v0.16b //inp^=Xi |
|
eor v17.16b,v16.16b,v18.16b //v17.16b is rotated inp^Xi |
|
|
|
pmull v0.1q,v20.1d,v3.1d //H.lo·Xi.lo |
|
eor v17.16b,v17.16b,v3.16b //Karatsuba pre-processing |
|
pmull2 v2.1q,v20.2d,v3.2d //H.hi·Xi.hi |
|
pmull v1.1q,v21.1d,v17.1d //(H.lo+H.hi)·(Xi.lo+Xi.hi) |
|
|
|
ext v17.16b,v0.16b,v2.16b,#8 //Karatsuba post-processing |
|
eor v18.16b,v0.16b,v2.16b |
|
eor v1.16b,v1.16b,v17.16b |
|
eor v1.16b,v1.16b,v18.16b |
|
pmull v18.1q,v0.1d,v19.1d //1st phase of reduction |
|
|
|
ins v2.d[0],v1.d[1] |
|
ins v1.d[1],v0.d[0] |
|
eor v0.16b,v1.16b,v18.16b |
|
|
|
ext v18.16b,v0.16b,v0.16b,#8 //2nd phase of reduction |
|
pmull v0.1q,v0.1d,v19.1d |
|
eor v18.16b,v18.16b,v2.16b |
|
eor v0.16b,v0.16b,v18.16b |
|
|
|
Ldone_v8: |
|
#ifndef __ARMEB__ |
|
rev64 v0.16b,v0.16b |
|
#endif |
|
ext v0.16b,v0.16b,v0.16b,#8 |
|
st1 {v0.2d},[x0] //write out Xi |
|
|
|
ret |
|
|
|
.byte 71,72,65,83,72,32,102,111,114,32,65,82,77,118,56,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0 |
|
.align 2 |
|
.align 2 |
|
#endif |
|
#endif // !OPENSSL_NO_ASM
|
|
|