x86-gf2m.pl 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325
  1. #! /usr/bin/env perl
  2. # Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the OpenSSL license (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. #
  9. # ====================================================================
  10. # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
  11. # project. The module is, however, dual licensed under OpenSSL and
  12. # CRYPTOGAMS licenses depending on where you obtain it. For further
  13. # details see http://www.openssl.org/~appro/cryptogams/.
  14. # ====================================================================
  15. #
  16. # May 2011
  17. #
  18. # The module implements bn_GF2m_mul_2x2 polynomial multiplication used
  19. # in bn_gf2m.c. It's kind of low-hanging mechanical port from C for
  20. # the time being... Except that it has three code paths: pure integer
  21. # code suitable for any x86 CPU, MMX code suitable for PIII and later
  22. # and PCLMULQDQ suitable for Westmere and later. Improvement varies
  23. # from one benchmark and µ-arch to another. Below are interval values
  24. # for 163- and 571-bit ECDH benchmarks relative to compiler-generated
  25. # code:
  26. #
  27. # PIII 16%-30%
  28. # P4 12%-12%
  29. # Opteron 18%-40%
  30. # Core2 19%-44%
  31. # Atom 38%-64%
  32. # Westmere 53%-121%(PCLMULQDQ)/20%-32%(MMX)
  33. # Sandy Bridge 72%-127%(PCLMULQDQ)/27%-23%(MMX)
  34. #
  35. # Note that above improvement coefficients are not coefficients for
  36. # bn_GF2m_mul_2x2 itself. For example 120% ECDH improvement is result
  37. # of bn_GF2m_mul_2x2 being >4x faster. As it gets faster, benchmark
  38. # is more and more dominated by other subroutines, most notably by
  39. # BN_GF2m_mod[_mul]_arr...
  40. $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
  41. push(@INC,"${dir}","${dir}../../perlasm");
  42. require "x86asm.pl";
  43. $output = pop;
  44. open STDOUT,">$output";
  45. &asm_init($ARGV[0],$x86only = $ARGV[$#ARGV] eq "386");
  46. $sse2=0;
  47. for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
  48. &external_label("OPENSSL_ia32cap_P") if ($sse2);
  49. $a="eax";
  50. $b="ebx";
  51. ($a1,$a2,$a4)=("ecx","edx","ebp");
  52. $R="mm0";
  53. @T=("mm1","mm2");
  54. ($A,$B,$B30,$B31)=("mm2","mm3","mm4","mm5");
  55. @i=("esi","edi");
  56. if (!$x86only) {
  57. &function_begin_B("_mul_1x1_mmx");
  58. &sub ("esp",32+4);
  59. &mov ($a1,$a);
  60. &lea ($a2,&DWP(0,$a,$a));
  61. &and ($a1,0x3fffffff);
  62. &lea ($a4,&DWP(0,$a2,$a2));
  63. &mov (&DWP(0*4,"esp"),0);
  64. &and ($a2,0x7fffffff);
  65. &movd ($A,$a);
  66. &movd ($B,$b);
  67. &mov (&DWP(1*4,"esp"),$a1); # a1
  68. &xor ($a1,$a2); # a1^a2
  69. &pxor ($B31,$B31);
  70. &pxor ($B30,$B30);
  71. &mov (&DWP(2*4,"esp"),$a2); # a2
  72. &xor ($a2,$a4); # a2^a4
  73. &mov (&DWP(3*4,"esp"),$a1); # a1^a2
  74. &pcmpgtd($B31,$A); # broadcast 31st bit
  75. &paddd ($A,$A); # $A<<=1
  76. &xor ($a1,$a2); # a1^a4=a1^a2^a2^a4
  77. &mov (&DWP(4*4,"esp"),$a4); # a4
  78. &xor ($a4,$a2); # a2=a4^a2^a4
  79. &pand ($B31,$B);
  80. &pcmpgtd($B30,$A); # broadcast 30th bit
  81. &mov (&DWP(5*4,"esp"),$a1); # a1^a4
  82. &xor ($a4,$a1); # a1^a2^a4
  83. &psllq ($B31,31);
  84. &pand ($B30,$B);
  85. &mov (&DWP(6*4,"esp"),$a2); # a2^a4
  86. &mov (@i[0],0x7);
  87. &mov (&DWP(7*4,"esp"),$a4); # a1^a2^a4
  88. &mov ($a4,@i[0]);
  89. &and (@i[0],$b);
  90. &shr ($b,3);
  91. &mov (@i[1],$a4);
  92. &psllq ($B30,30);
  93. &and (@i[1],$b);
  94. &shr ($b,3);
  95. &movd ($R,&DWP(0,"esp",@i[0],4));
  96. &mov (@i[0],$a4);
  97. &and (@i[0],$b);
  98. &shr ($b,3);
  99. for($n=1;$n<9;$n++) {
  100. &movd (@T[1],&DWP(0,"esp",@i[1],4));
  101. &mov (@i[1],$a4);
  102. &psllq (@T[1],3*$n);
  103. &and (@i[1],$b);
  104. &shr ($b,3);
  105. &pxor ($R,@T[1]);
  106. push(@i,shift(@i)); push(@T,shift(@T));
  107. }
  108. &movd (@T[1],&DWP(0,"esp",@i[1],4));
  109. &pxor ($R,$B30);
  110. &psllq (@T[1],3*$n++);
  111. &pxor ($R,@T[1]);
  112. &movd (@T[0],&DWP(0,"esp",@i[0],4));
  113. &pxor ($R,$B31);
  114. &psllq (@T[0],3*$n);
  115. &add ("esp",32+4);
  116. &pxor ($R,@T[0]);
  117. &ret ();
  118. &function_end_B("_mul_1x1_mmx");
  119. }
  120. ($lo,$hi)=("eax","edx");
  121. @T=("ecx","ebp");
  122. &function_begin_B("_mul_1x1_ialu");
  123. &sub ("esp",32+4);
  124. &mov ($a1,$a);
  125. &lea ($a2,&DWP(0,$a,$a));
  126. &lea ($a4,&DWP(0,"",$a,4));
  127. &and ($a1,0x3fffffff);
  128. &lea (@i[1],&DWP(0,$lo,$lo));
  129. &sar ($lo,31); # broadcast 31st bit
  130. &mov (&DWP(0*4,"esp"),0);
  131. &and ($a2,0x7fffffff);
  132. &mov (&DWP(1*4,"esp"),$a1); # a1
  133. &xor ($a1,$a2); # a1^a2
  134. &mov (&DWP(2*4,"esp"),$a2); # a2
  135. &xor ($a2,$a4); # a2^a4
  136. &mov (&DWP(3*4,"esp"),$a1); # a1^a2
  137. &xor ($a1,$a2); # a1^a4=a1^a2^a2^a4
  138. &mov (&DWP(4*4,"esp"),$a4); # a4
  139. &xor ($a4,$a2); # a2=a4^a2^a4
  140. &mov (&DWP(5*4,"esp"),$a1); # a1^a4
  141. &xor ($a4,$a1); # a1^a2^a4
  142. &sar (@i[1],31); # broadcast 30th bit
  143. &and ($lo,$b);
  144. &mov (&DWP(6*4,"esp"),$a2); # a2^a4
  145. &and (@i[1],$b);
  146. &mov (&DWP(7*4,"esp"),$a4); # a1^a2^a4
  147. &mov ($hi,$lo);
  148. &shl ($lo,31);
  149. &mov (@T[0],@i[1]);
  150. &shr ($hi,1);
  151. &mov (@i[0],0x7);
  152. &shl (@i[1],30);
  153. &and (@i[0],$b);
  154. &shr (@T[0],2);
  155. &xor ($lo,@i[1]);
  156. &shr ($b,3);
  157. &mov (@i[1],0x7); # 5-byte instruction!?
  158. &and (@i[1],$b);
  159. &shr ($b,3);
  160. &xor ($hi,@T[0]);
  161. &xor ($lo,&DWP(0,"esp",@i[0],4));
  162. &mov (@i[0],0x7);
  163. &and (@i[0],$b);
  164. &shr ($b,3);
  165. for($n=1;$n<9;$n++) {
  166. &mov (@T[1],&DWP(0,"esp",@i[1],4));
  167. &mov (@i[1],0x7);
  168. &mov (@T[0],@T[1]);
  169. &shl (@T[1],3*$n);
  170. &and (@i[1],$b);
  171. &shr (@T[0],32-3*$n);
  172. &xor ($lo,@T[1]);
  173. &shr ($b,3);
  174. &xor ($hi,@T[0]);
  175. push(@i,shift(@i)); push(@T,shift(@T));
  176. }
  177. &mov (@T[1],&DWP(0,"esp",@i[1],4));
  178. &mov (@T[0],@T[1]);
  179. &shl (@T[1],3*$n);
  180. &mov (@i[1],&DWP(0,"esp",@i[0],4));
  181. &shr (@T[0],32-3*$n); $n++;
  182. &mov (@i[0],@i[1]);
  183. &xor ($lo,@T[1]);
  184. &shl (@i[1],3*$n);
  185. &xor ($hi,@T[0]);
  186. &shr (@i[0],32-3*$n);
  187. &xor ($lo,@i[1]);
  188. &xor ($hi,@i[0]);
  189. &add ("esp",32+4);
  190. &ret ();
  191. &function_end_B("_mul_1x1_ialu");
  192. # void bn_GF2m_mul_2x2(BN_ULONG *r, BN_ULONG a1, BN_ULONG a0, BN_ULONG b1, BN_ULONG b0);
  193. &function_begin_B("bn_GF2m_mul_2x2");
  194. if (!$x86only) {
  195. &picmeup("edx","OPENSSL_ia32cap_P");
  196. &mov ("eax",&DWP(0,"edx"));
  197. &mov ("edx",&DWP(4,"edx"));
  198. &test ("eax",1<<23); # check MMX bit
  199. &jz (&label("ialu"));
  200. if ($sse2) {
  201. &test ("eax",1<<24); # check FXSR bit
  202. &jz (&label("mmx"));
  203. &test ("edx",1<<1); # check PCLMULQDQ bit
  204. &jz (&label("mmx"));
  205. &movups ("xmm0",&QWP(8,"esp"));
  206. &shufps ("xmm0","xmm0",0b10110001);
  207. &pclmulqdq ("xmm0","xmm0",1);
  208. &mov ("eax",&DWP(4,"esp"));
  209. &movups (&QWP(0,"eax"),"xmm0");
  210. &ret ();
  211. &set_label("mmx",16);
  212. }
  213. &push ("ebp");
  214. &push ("ebx");
  215. &push ("esi");
  216. &push ("edi");
  217. &mov ($a,&wparam(1));
  218. &mov ($b,&wparam(3));
  219. &call ("_mul_1x1_mmx"); # a1·b1
  220. &movq ("mm7",$R);
  221. &mov ($a,&wparam(2));
  222. &mov ($b,&wparam(4));
  223. &call ("_mul_1x1_mmx"); # a0·b0
  224. &movq ("mm6",$R);
  225. &mov ($a,&wparam(1));
  226. &mov ($b,&wparam(3));
  227. &xor ($a,&wparam(2));
  228. &xor ($b,&wparam(4));
  229. &call ("_mul_1x1_mmx"); # (a0+a1)·(b0+b1)
  230. &pxor ($R,"mm7");
  231. &mov ($a,&wparam(0));
  232. &pxor ($R,"mm6"); # (a0+a1)·(b0+b1)-a1·b1-a0·b0
  233. &movq ($A,$R);
  234. &psllq ($R,32);
  235. &pop ("edi");
  236. &psrlq ($A,32);
  237. &pop ("esi");
  238. &pxor ($R,"mm6");
  239. &pop ("ebx");
  240. &pxor ($A,"mm7");
  241. &movq (&QWP(0,$a),$R);
  242. &pop ("ebp");
  243. &movq (&QWP(8,$a),$A);
  244. &emms ();
  245. &ret ();
  246. &set_label("ialu",16);
  247. }
  248. &push ("ebp");
  249. &push ("ebx");
  250. &push ("esi");
  251. &push ("edi");
  252. &stack_push(4+1);
  253. &mov ($a,&wparam(1));
  254. &mov ($b,&wparam(3));
  255. &call ("_mul_1x1_ialu"); # a1·b1
  256. &mov (&DWP(8,"esp"),$lo);
  257. &mov (&DWP(12,"esp"),$hi);
  258. &mov ($a,&wparam(2));
  259. &mov ($b,&wparam(4));
  260. &call ("_mul_1x1_ialu"); # a0·b0
  261. &mov (&DWP(0,"esp"),$lo);
  262. &mov (&DWP(4,"esp"),$hi);
  263. &mov ($a,&wparam(1));
  264. &mov ($b,&wparam(3));
  265. &xor ($a,&wparam(2));
  266. &xor ($b,&wparam(4));
  267. &call ("_mul_1x1_ialu"); # (a0+a1)·(b0+b1)
  268. &mov ("ebp",&wparam(0));
  269. @r=("ebx","ecx","edi","esi");
  270. &mov (@r[0],&DWP(0,"esp"));
  271. &mov (@r[1],&DWP(4,"esp"));
  272. &mov (@r[2],&DWP(8,"esp"));
  273. &mov (@r[3],&DWP(12,"esp"));
  274. &xor ($lo,$hi);
  275. &xor ($hi,@r[1]);
  276. &xor ($lo,@r[0]);
  277. &mov (&DWP(0,"ebp"),@r[0]);
  278. &xor ($hi,@r[2]);
  279. &mov (&DWP(12,"ebp"),@r[3]);
  280. &xor ($lo,@r[3]);
  281. &stack_pop(4+1);
  282. &xor ($hi,@r[3]);
  283. &pop ("edi");
  284. &xor ($lo,$hi);
  285. &pop ("esi");
  286. &mov (&DWP(8,"ebp"),$hi);
  287. &pop ("ebx");
  288. &mov (&DWP(4,"ebp"),$lo);
  289. &pop ("ebp");
  290. &ret ();
  291. &function_end_B("bn_GF2m_mul_2x2");
  292. &asciz ("GF(2^m) Multiplication for x86, CRYPTOGAMS by <appro\@openssl.org>");
  293. &asm_finish();
  294. close STDOUT;