x86-gf2m.pl 7.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324
  1. #! /usr/bin/env perl
  2. # Copyright 2011-2016 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. #
  9. # ====================================================================
  10. # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
  11. # project. The module is, however, dual licensed under OpenSSL and
  12. # CRYPTOGAMS licenses depending on where you obtain it. For further
  13. # details see http://www.openssl.org/~appro/cryptogams/.
  14. # ====================================================================
  15. #
  16. # May 2011
  17. #
  18. # The module implements bn_GF2m_mul_2x2 polynomial multiplication used
  19. # in bn_gf2m.c. It's kind of low-hanging mechanical port from C for
  20. # the time being... Except that it has three code paths: pure integer
  21. # code suitable for any x86 CPU, MMX code suitable for PIII and later
  22. # and PCLMULQDQ suitable for Westmere and later. Improvement varies
  23. # from one benchmark and µ-arch to another. Below are interval values
  24. # for 163- and 571-bit ECDH benchmarks relative to compiler-generated
  25. # code:
  26. #
  27. # PIII 16%-30%
  28. # P4 12%-12%
  29. # Opteron 18%-40%
  30. # Core2 19%-44%
  31. # Atom 38%-64%
  32. # Westmere 53%-121%(PCLMULQDQ)/20%-32%(MMX)
  33. # Sandy Bridge 72%-127%(PCLMULQDQ)/27%-23%(MMX)
  34. #
  35. # Note that above improvement coefficients are not coefficients for
  36. # bn_GF2m_mul_2x2 itself. For example 120% ECDH improvement is result
  37. # of bn_GF2m_mul_2x2 being >4x faster. As it gets faster, benchmark
  38. # is more and more dominated by other subroutines, most notably by
  39. # BN_GF2m_mod[_mul]_arr...
  40. $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
  41. push(@INC,"${dir}","${dir}../../perlasm");
  42. require "x86asm.pl";
  43. $output = pop and open STDOUT,">$output";
  44. &asm_init($ARGV[0],$x86only = $ARGV[$#ARGV] eq "386");
  45. $sse2=0;
  46. for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
  47. &external_label("OPENSSL_ia32cap_P") if ($sse2);
  48. $a="eax";
  49. $b="ebx";
  50. ($a1,$a2,$a4)=("ecx","edx","ebp");
  51. $R="mm0";
  52. @T=("mm1","mm2");
  53. ($A,$B,$B30,$B31)=("mm2","mm3","mm4","mm5");
  54. @i=("esi","edi");
  55. if (!$x86only) {
  56. &function_begin_B("_mul_1x1_mmx");
  57. &sub ("esp",32+4);
  58. &mov ($a1,$a);
  59. &lea ($a2,&DWP(0,$a,$a));
  60. &and ($a1,0x3fffffff);
  61. &lea ($a4,&DWP(0,$a2,$a2));
  62. &mov (&DWP(0*4,"esp"),0);
  63. &and ($a2,0x7fffffff);
  64. &movd ($A,$a);
  65. &movd ($B,$b);
  66. &mov (&DWP(1*4,"esp"),$a1); # a1
  67. &xor ($a1,$a2); # a1^a2
  68. &pxor ($B31,$B31);
  69. &pxor ($B30,$B30);
  70. &mov (&DWP(2*4,"esp"),$a2); # a2
  71. &xor ($a2,$a4); # a2^a4
  72. &mov (&DWP(3*4,"esp"),$a1); # a1^a2
  73. &pcmpgtd($B31,$A); # broadcast 31st bit
  74. &paddd ($A,$A); # $A<<=1
  75. &xor ($a1,$a2); # a1^a4=a1^a2^a2^a4
  76. &mov (&DWP(4*4,"esp"),$a4); # a4
  77. &xor ($a4,$a2); # a2=a4^a2^a4
  78. &pand ($B31,$B);
  79. &pcmpgtd($B30,$A); # broadcast 30th bit
  80. &mov (&DWP(5*4,"esp"),$a1); # a1^a4
  81. &xor ($a4,$a1); # a1^a2^a4
  82. &psllq ($B31,31);
  83. &pand ($B30,$B);
  84. &mov (&DWP(6*4,"esp"),$a2); # a2^a4
  85. &mov (@i[0],0x7);
  86. &mov (&DWP(7*4,"esp"),$a4); # a1^a2^a4
  87. &mov ($a4,@i[0]);
  88. &and (@i[0],$b);
  89. &shr ($b,3);
  90. &mov (@i[1],$a4);
  91. &psllq ($B30,30);
  92. &and (@i[1],$b);
  93. &shr ($b,3);
  94. &movd ($R,&DWP(0,"esp",@i[0],4));
  95. &mov (@i[0],$a4);
  96. &and (@i[0],$b);
  97. &shr ($b,3);
  98. for($n=1;$n<9;$n++) {
  99. &movd (@T[1],&DWP(0,"esp",@i[1],4));
  100. &mov (@i[1],$a4);
  101. &psllq (@T[1],3*$n);
  102. &and (@i[1],$b);
  103. &shr ($b,3);
  104. &pxor ($R,@T[1]);
  105. push(@i,shift(@i)); push(@T,shift(@T));
  106. }
  107. &movd (@T[1],&DWP(0,"esp",@i[1],4));
  108. &pxor ($R,$B30);
  109. &psllq (@T[1],3*$n++);
  110. &pxor ($R,@T[1]);
  111. &movd (@T[0],&DWP(0,"esp",@i[0],4));
  112. &pxor ($R,$B31);
  113. &psllq (@T[0],3*$n);
  114. &add ("esp",32+4);
  115. &pxor ($R,@T[0]);
  116. &ret ();
  117. &function_end_B("_mul_1x1_mmx");
  118. }
  119. ($lo,$hi)=("eax","edx");
  120. @T=("ecx","ebp");
  121. &function_begin_B("_mul_1x1_ialu");
  122. &sub ("esp",32+4);
  123. &mov ($a1,$a);
  124. &lea ($a2,&DWP(0,$a,$a));
  125. &lea ($a4,&DWP(0,"",$a,4));
  126. &and ($a1,0x3fffffff);
  127. &lea (@i[1],&DWP(0,$lo,$lo));
  128. &sar ($lo,31); # broadcast 31st bit
  129. &mov (&DWP(0*4,"esp"),0);
  130. &and ($a2,0x7fffffff);
  131. &mov (&DWP(1*4,"esp"),$a1); # a1
  132. &xor ($a1,$a2); # a1^a2
  133. &mov (&DWP(2*4,"esp"),$a2); # a2
  134. &xor ($a2,$a4); # a2^a4
  135. &mov (&DWP(3*4,"esp"),$a1); # a1^a2
  136. &xor ($a1,$a2); # a1^a4=a1^a2^a2^a4
  137. &mov (&DWP(4*4,"esp"),$a4); # a4
  138. &xor ($a4,$a2); # a2=a4^a2^a4
  139. &mov (&DWP(5*4,"esp"),$a1); # a1^a4
  140. &xor ($a4,$a1); # a1^a2^a4
  141. &sar (@i[1],31); # broadcast 30th bit
  142. &and ($lo,$b);
  143. &mov (&DWP(6*4,"esp"),$a2); # a2^a4
  144. &and (@i[1],$b);
  145. &mov (&DWP(7*4,"esp"),$a4); # a1^a2^a4
  146. &mov ($hi,$lo);
  147. &shl ($lo,31);
  148. &mov (@T[0],@i[1]);
  149. &shr ($hi,1);
  150. &mov (@i[0],0x7);
  151. &shl (@i[1],30);
  152. &and (@i[0],$b);
  153. &shr (@T[0],2);
  154. &xor ($lo,@i[1]);
  155. &shr ($b,3);
  156. &mov (@i[1],0x7); # 5-byte instruction!?
  157. &and (@i[1],$b);
  158. &shr ($b,3);
  159. &xor ($hi,@T[0]);
  160. &xor ($lo,&DWP(0,"esp",@i[0],4));
  161. &mov (@i[0],0x7);
  162. &and (@i[0],$b);
  163. &shr ($b,3);
  164. for($n=1;$n<9;$n++) {
  165. &mov (@T[1],&DWP(0,"esp",@i[1],4));
  166. &mov (@i[1],0x7);
  167. &mov (@T[0],@T[1]);
  168. &shl (@T[1],3*$n);
  169. &and (@i[1],$b);
  170. &shr (@T[0],32-3*$n);
  171. &xor ($lo,@T[1]);
  172. &shr ($b,3);
  173. &xor ($hi,@T[0]);
  174. push(@i,shift(@i)); push(@T,shift(@T));
  175. }
  176. &mov (@T[1],&DWP(0,"esp",@i[1],4));
  177. &mov (@T[0],@T[1]);
  178. &shl (@T[1],3*$n);
  179. &mov (@i[1],&DWP(0,"esp",@i[0],4));
  180. &shr (@T[0],32-3*$n); $n++;
  181. &mov (@i[0],@i[1]);
  182. &xor ($lo,@T[1]);
  183. &shl (@i[1],3*$n);
  184. &xor ($hi,@T[0]);
  185. &shr (@i[0],32-3*$n);
  186. &xor ($lo,@i[1]);
  187. &xor ($hi,@i[0]);
  188. &add ("esp",32+4);
  189. &ret ();
  190. &function_end_B("_mul_1x1_ialu");
  191. # void bn_GF2m_mul_2x2(BN_ULONG *r, BN_ULONG a1, BN_ULONG a0, BN_ULONG b1, BN_ULONG b0);
  192. &function_begin_B("bn_GF2m_mul_2x2");
  193. if (!$x86only) {
  194. &picmeup("edx","OPENSSL_ia32cap_P");
  195. &mov ("eax",&DWP(0,"edx"));
  196. &mov ("edx",&DWP(4,"edx"));
  197. &test ("eax",1<<23); # check MMX bit
  198. &jz (&label("ialu"));
  199. if ($sse2) {
  200. &test ("eax",1<<24); # check FXSR bit
  201. &jz (&label("mmx"));
  202. &test ("edx",1<<1); # check PCLMULQDQ bit
  203. &jz (&label("mmx"));
  204. &movups ("xmm0",&QWP(8,"esp"));
  205. &shufps ("xmm0","xmm0",0b10110001);
  206. &pclmulqdq ("xmm0","xmm0",1);
  207. &mov ("eax",&DWP(4,"esp"));
  208. &movups (&QWP(0,"eax"),"xmm0");
  209. &ret ();
  210. &set_label("mmx",16);
  211. }
  212. &push ("ebp");
  213. &push ("ebx");
  214. &push ("esi");
  215. &push ("edi");
  216. &mov ($a,&wparam(1));
  217. &mov ($b,&wparam(3));
  218. &call ("_mul_1x1_mmx"); # a1·b1
  219. &movq ("mm7",$R);
  220. &mov ($a,&wparam(2));
  221. &mov ($b,&wparam(4));
  222. &call ("_mul_1x1_mmx"); # a0·b0
  223. &movq ("mm6",$R);
  224. &mov ($a,&wparam(1));
  225. &mov ($b,&wparam(3));
  226. &xor ($a,&wparam(2));
  227. &xor ($b,&wparam(4));
  228. &call ("_mul_1x1_mmx"); # (a0+a1)·(b0+b1)
  229. &pxor ($R,"mm7");
  230. &mov ($a,&wparam(0));
  231. &pxor ($R,"mm6"); # (a0+a1)·(b0+b1)-a1·b1-a0·b0
  232. &movq ($A,$R);
  233. &psllq ($R,32);
  234. &pop ("edi");
  235. &psrlq ($A,32);
  236. &pop ("esi");
  237. &pxor ($R,"mm6");
  238. &pop ("ebx");
  239. &pxor ($A,"mm7");
  240. &movq (&QWP(0,$a),$R);
  241. &pop ("ebp");
  242. &movq (&QWP(8,$a),$A);
  243. &emms ();
  244. &ret ();
  245. &set_label("ialu",16);
  246. }
  247. &push ("ebp");
  248. &push ("ebx");
  249. &push ("esi");
  250. &push ("edi");
  251. &stack_push(4+1);
  252. &mov ($a,&wparam(1));
  253. &mov ($b,&wparam(3));
  254. &call ("_mul_1x1_ialu"); # a1·b1
  255. &mov (&DWP(8,"esp"),$lo);
  256. &mov (&DWP(12,"esp"),$hi);
  257. &mov ($a,&wparam(2));
  258. &mov ($b,&wparam(4));
  259. &call ("_mul_1x1_ialu"); # a0·b0
  260. &mov (&DWP(0,"esp"),$lo);
  261. &mov (&DWP(4,"esp"),$hi);
  262. &mov ($a,&wparam(1));
  263. &mov ($b,&wparam(3));
  264. &xor ($a,&wparam(2));
  265. &xor ($b,&wparam(4));
  266. &call ("_mul_1x1_ialu"); # (a0+a1)·(b0+b1)
  267. &mov ("ebp",&wparam(0));
  268. @r=("ebx","ecx","edi","esi");
  269. &mov (@r[0],&DWP(0,"esp"));
  270. &mov (@r[1],&DWP(4,"esp"));
  271. &mov (@r[2],&DWP(8,"esp"));
  272. &mov (@r[3],&DWP(12,"esp"));
  273. &xor ($lo,$hi);
  274. &xor ($hi,@r[1]);
  275. &xor ($lo,@r[0]);
  276. &mov (&DWP(0,"ebp"),@r[0]);
  277. &xor ($hi,@r[2]);
  278. &mov (&DWP(12,"ebp"),@r[3]);
  279. &xor ($lo,@r[3]);
  280. &stack_pop(4+1);
  281. &xor ($hi,@r[3]);
  282. &pop ("edi");
  283. &xor ($lo,$hi);
  284. &pop ("esi");
  285. &mov (&DWP(8,"ebp"),$hi);
  286. &pop ("ebx");
  287. &mov (&DWP(4,"ebp"),$lo);
  288. &pop ("ebp");
  289. &ret ();
  290. &function_end_B("bn_GF2m_mul_2x2");
  291. &asciz ("GF(2^m) Multiplication for x86, CRYPTOGAMS by <appro\@openssl.org>");
  292. &asm_finish();
  293. close STDOUT or die "error closing STDOUT";