nettle-bugs August 2020

nettle-bugs@lists.lysator.liu.se

3 participants
8 discussions

Curve point decompression
by Wim Lewis 10 Nov '21

10 Nov '21

I'm looking at implementing elliptic curve point compression a la SEC1 (admittedly, mostly to reduce the number of "feature not supported" code paths in a library, but it seems like a somewhat useful ability). Nettle/Hogweed already implements it internally for curve25519, but I want to implement it for the "secp" curves as well. Point compression is easy enough, but point decompression requires some curve math, potentially dependent on the specific curve, and some of it is redundant with what's already done in ecc_point_set(). So I was thinking about moving this functionality into Hogweed as a function along the lines of ecc_point_set_compressed(), which would take, instead of a y-coordinate, an int containing the sign/parity of the y-coordinate. So my question for the list and for the maintainers is, is this a reasonable API to add to Hogweed? Is there interest in including it in Hogweed if I were to take the time to turn it into a tidy patch?

3 10

[PATCH] "PowerPC64" AES improve syntax
by Maamoun TK 08 Sep '20

08 Sep '20

This patch adds "VSR" macro to improve the syntax of assembly code, I will create a separate patch for gcm-hash since it hasn't merged yet to the master. I also removed the TODO from README because I tried to use "lxv/stxv" in POWER9 instead of "lxvd2x/stxvd2x" but gcc produced "lxvd2x/stxvd2x" in the binary. I'm not sure if it's variant issue of gcc but this will be problematic since "lxvd2x/stxvd2x" need permuting in little-endian mode while "lxv/stxv" is endianness aware. --- powerpc64/README | 2 - powerpc64/machine.m4 | 4 ++ powerpc64/p8/aes-decrypt-internal.asm | 97 ++++++++++++++++------------------- powerpc64/p8/aes-encrypt-internal.asm | 97 ++++++++++++++++------------------- 4 files changed, 90 insertions(+), 110 deletions(-) diff --git a/powerpc64/README b/powerpc64/README index 5410791f..7301953b 100644 --- a/powerpc64/README +++ b/powerpc64/README @@ -53,8 +53,6 @@ in [3] to see an example of accessing unaligned storage operands. "lxvd2x/stxvd2x" can be used to load/store data into unaligned storage operands but permuting is needed for loading and storing data in little-endian mode VSX registers are defined with "X" suffix -TODO: use architecture 3.0 instructions "lxv/stxv" instead for POWER9 - and newer Function Prologue diff --git a/powerpc64/machine.m4 b/powerpc64/machine.m4 index 2f91adec..b76bb8b1 100644 --- a/powerpc64/machine.m4 +++ b/powerpc64/machine.m4 @@ -22,6 +22,10 @@ define(<EPILOGUE>, <.size .C_NAME($1), . - .C_NAME($1) .size C_NAME($1), . - .C_NAME($1)>)>) +C Get vector-scalar register from vector register +C VSR(VR) +define(<VSR>,<32+$1>) + C Load the quadword in DATA_SRC storage into C VEC_DST. GPR is general-purpose register C used to obtain the effective address of diff --git a/powerpc64/p8/aes-decrypt-internal.asm b/powerpc64/p8/aes-decrypt-internal.asm index 7d518cd9..bfedb32b 100644 --- a/powerpc64/p8/aes-decrypt-internal.asm +++ b/powerpc64/p8/aes-decrypt-internal.asm @@ -1,4 +1,4 @@ -C powerpc64/P8/aes-decrypt-internal.asm +C powerpc64/p8/aes-decrypt-internal.asm ifelse(< Copyright (C) 2020 Mamone Tarsha @@ -52,16 +52,6 @@ define(<S5>, <7>) define(<S6>, <8>) define(<S7>, <9>) -define(<KX>, <33>) -define(<S0X>, <34>) -define(<S1X>, <35>) -define(<S2X>, <36>) -define(<S3X>, <37>) -define(<S4X>, <38>) -define(<S5X>, <39>) -define(<S6X>, <40>) -define(<S7X>, <41>) - C ZERO vector register is used in place of RoundKey C for vncipher instruction because the order of InvMixColumns C and Xor processes are flipped in that instruction. @@ -70,7 +60,6 @@ define(<ZERO>, <10>) .file "aes-decrypt-internal.asm" -IF_LE(<.abiversion 2>) .text C _aes_decrypt(unsigned rounds, const uint32_t *keys, @@ -109,17 +98,17 @@ PROLOGUE(_nettle_aes_decrypt) .align 5 Lx8_loop: - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC - lxvd2x S1X,25,SRC - lxvd2x S2X,26,SRC - lxvd2x S3X,27,SRC - lxvd2x S4X,28,SRC - lxvd2x S5X,29,SRC - lxvd2x S6X,30,SRC - lxvd2x S7X,31,SRC + lxvd2x VSR(S0),0,SRC + lxvd2x VSR(S1),25,SRC + lxvd2x VSR(S2),26,SRC + lxvd2x VSR(S3),27,SRC + lxvd2x VSR(S4),28,SRC + lxvd2x VSR(S5),29,SRC + lxvd2x VSR(S6),30,SRC + lxvd2x VSR(S7),31,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -143,7 +132,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L8x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -164,7 +153,7 @@ L8x_round_loop: addi 10,10,0x10 bdnz L8x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -184,14 +173,14 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S6,S6,S6,swap_mask vperm S7,S7,S7,swap_mask>) - stxvd2x S0X,0,DST - stxvd2x S1X,25,DST - stxvd2x S2X,26,DST - stxvd2x S3X,27,DST - stxvd2x S4X,28,DST - stxvd2x S5X,29,DST - stxvd2x S6X,30,DST - stxvd2x S7X,31,DST + stxvd2x VSR(S0),0,DST + stxvd2x VSR(S1),25,DST + stxvd2x VSR(S2),26,DST + stxvd2x VSR(S3),27,DST + stxvd2x VSR(S4),28,DST + stxvd2x VSR(S5),29,DST + stxvd2x VSR(S6),30,DST + stxvd2x VSR(S7),31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 @@ -213,16 +202,16 @@ L4x: cmpldi 5,0 beq L2x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC addi 9,9,0x10 - lxvd2x S2X,9,SRC + lxvd2x VSR(S2),9,SRC addi 9,9,0x10 - lxvd2x S3X,9,SRC + lxvd2x VSR(S3),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -238,7 +227,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L4x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -251,7 +240,7 @@ L4x_round_loop: addi 10,10,0x10 bdnz L4x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -263,13 +252,13 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S2,S2,S2,swap_mask vperm S3,S3,S3,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi 9,9,0x10 - stxvd2x S2X,9,DST + stxvd2x VSR(S2),9,DST addi 9,9,0x10 - stxvd2x S3X,9,DST + stxvd2x VSR(S3),9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -281,12 +270,12 @@ L2x: cmpldi 5,0 beq L1x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) @@ -298,7 +287,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L2x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vncipher S1,S1,ZERO @@ -307,7 +296,7 @@ L2x_round_loop: addi 10,10,0x10 bdnz L2x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K vncipherlast S1,S1,K @@ -315,9 +304,9 @@ L2x_round_loop: IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -328,10 +317,10 @@ L1x: cmpldi LENGTH,0 beq Ldone - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC IF_LE(<vperm S0,S0,S0,swap_mask>) @@ -341,20 +330,20 @@ IF_LE(<vperm S0,S0,S0,swap_mask>) li 10,0x10 .align 5 L1x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipher S0,S0,ZERO vxor S0,S0,K addi 10,10,0x10 bdnz L1x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vncipherlast S0,S0,K IF_LE(<vperm S0,S0,S0,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST Ldone: blr diff --git a/powerpc64/p8/aes-encrypt-internal.asm b/powerpc64/p8/aes-encrypt-internal.asm index c696a4a3..67c7e597 100644 --- a/powerpc64/p8/aes-encrypt-internal.asm +++ b/powerpc64/p8/aes-encrypt-internal.asm @@ -1,4 +1,4 @@ -C powerpc64/P8/aes-encrypt-internal.asm +C powerpc64/p8/aes-encrypt-internal.asm ifelse(< Copyright (C) 2020 Mamone Tarsha @@ -52,19 +52,8 @@ define(<S5>, <7>) define(<S6>, <8>) define(<S7>, <9>) -define(<KX>, <33>) -define(<S0X>, <34>) -define(<S1X>, <35>) -define(<S2X>, <36>) -define(<S3X>, <37>) -define(<S4X>, <38>) -define(<S5X>, <39>) -define(<S6X>, <40>) -define(<S7X>, <41>) - .file "aes-encrypt-internal.asm" -IF_LE(<.abiversion 2>) .text C _aes_encrypt(unsigned rounds, const uint32_t *keys, @@ -101,17 +90,17 @@ PROLOGUE(_nettle_aes_encrypt) .align 5 Lx8_loop: - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC - lxvd2x S1X,25,SRC - lxvd2x S2X,26,SRC - lxvd2x S3X,27,SRC - lxvd2x S4X,28,SRC - lxvd2x S5X,29,SRC - lxvd2x S6X,30,SRC - lxvd2x S7X,31,SRC + lxvd2x VSR(S0),0,SRC + lxvd2x VSR(S1),25,SRC + lxvd2x VSR(S2),26,SRC + lxvd2x VSR(S3),27,SRC + lxvd2x VSR(S4),28,SRC + lxvd2x VSR(S5),29,SRC + lxvd2x VSR(S6),30,SRC + lxvd2x VSR(S7),31,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -135,7 +124,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L8x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K @@ -148,7 +137,7 @@ L8x_round_loop: addi 10,10,0x10 bdnz L8x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -168,14 +157,14 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S6,S6,S6,swap_mask vperm S7,S7,S7,swap_mask>) - stxvd2x S0X,0,DST - stxvd2x S1X,25,DST - stxvd2x S2X,26,DST - stxvd2x S3X,27,DST - stxvd2x S4X,28,DST - stxvd2x S5X,29,DST - stxvd2x S6X,30,DST - stxvd2x S7X,31,DST + stxvd2x VSR(S0),0,DST + stxvd2x VSR(S1),25,DST + stxvd2x VSR(S2),26,DST + stxvd2x VSR(S3),27,DST + stxvd2x VSR(S4),28,DST + stxvd2x VSR(S5),29,DST + stxvd2x VSR(S6),30,DST + stxvd2x VSR(S7),31,DST addi SRC,SRC,0x80 addi DST,DST,0x80 @@ -197,16 +186,16 @@ L4x: cmpldi 5,0 beq L2x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC addi 9,9,0x10 - lxvd2x S2X,9,SRC + lxvd2x VSR(S2),9,SRC addi 9,9,0x10 - lxvd2x S3X,9,SRC + lxvd2x VSR(S3),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask @@ -222,7 +211,7 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L4x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K @@ -231,7 +220,7 @@ L4x_round_loop: addi 10,10,0x10 bdnz L4x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -243,13 +232,13 @@ IF_LE(<vperm S0,S0,S0,swap_mask vperm S2,S2,S2,swap_mask vperm S3,S3,S3,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi 9,9,0x10 - stxvd2x S2X,9,DST + stxvd2x VSR(S2),9,DST addi 9,9,0x10 - stxvd2x S3X,9,DST + stxvd2x VSR(S3),9,DST addi SRC,SRC,0x40 addi DST,DST,0x40 @@ -261,12 +250,12 @@ L2x: cmpldi 5,0 beq L1x - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC li 9,0x10 - lxvd2x S1X,9,SRC + lxvd2x VSR(S1),9,SRC IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) @@ -278,14 +267,14 @@ IF_LE(<vperm S0,S0,S0,swap_mask li 10,0x10 .align 5 L2x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K vcipher S1,S1,K addi 10,10,0x10 bdnz L2x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K vcipherlast S1,S1,K @@ -293,9 +282,9 @@ L2x_round_loop: IF_LE(<vperm S0,S0,S0,swap_mask vperm S1,S1,S1,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST li 9,0x10 - stxvd2x S1X,9,DST + stxvd2x VSR(S1),9,DST addi SRC,SRC,0x20 addi DST,DST,0x20 @@ -306,10 +295,10 @@ L1x: cmpldi LENGTH,0 beq Ldone - lxvd2x KX,0,KEYS + lxvd2x VSR(K),0,KEYS vperm K,K,K,swap_mask - lxvd2x S0X,0,SRC + lxvd2x VSR(S0),0,SRC IF_LE(<vperm S0,S0,S0,swap_mask>) @@ -319,19 +308,19 @@ IF_LE(<vperm S0,S0,S0,swap_mask>) li 10,0x10 .align 5 L1x_round_loop: - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipher S0,S0,K addi 10,10,0x10 bdnz L1x_round_loop - lxvd2x KX,10,KEYS + lxvd2x VSR(K),10,KEYS vperm K,K,K,swap_mask vcipherlast S0,S0,K IF_LE(<vperm S0,S0,S0,swap_mask>) - stxvd2x S0X,0,DST + stxvd2x VSR(S0),0,DST Ldone: blr -- 2.17.1

2 4

[Patch] "PowerPC64" Add README (Reformatted)
by Maamoun TK 29 Aug '20

29 Aug '20

--- powerpc64/README | 73 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 powerpc64/README diff --git a/powerpc64/README b/powerpc64/README new file mode 100644 index 00000000..19351be8 --- /dev/null +++ b/powerpc64/README @@ -0,0 +1,73 @@ +General-Purpose Register Conventions + +Register Status Use + +GPR0 volatile In function prologs. +GPR1 dedicated Stack pointer. +GPR2 dedicated Table of Contents (TOC) pointer. +GPR3 volatile First word of a function's argument list; + first word of a scalar function return. +GPR4 volatile Second word of a function's argument list; + second word of a scalar function return. +GPR5 volatile Third word of a function's argument list. +GPR6 volatile Fourth word of a function's argument list. +GPR7 volatile Fifth word of a function's argument list. +GPR8 volatile Sixth word of a function's argument list. +GPR9 volatile Seventh word of a function's argument list. +GPR10 volatile Eighth word of a function's argument list. +GPR11 volatile In calls by pointer and as an environment pointer + for languages that require it (for example, PASCAL). +GPR12 volatile For special exception handling required by certain + languages and in glink code. +GPR13 reserved Reserved under 64-bit environment; + not restored across system calls. +GPR14:GPR31 nonvolatile These registers must be preserved across + a function call. + +Vector Register Conventions + +Register Status + +VR0:V19 Volatile +VR20:VR31 Nonvolatile (extended ABI mode) their values are preserved + across function calls + +Addressing memory + +There are many ways to reference data, in the sake of writing +position-independent code the current implementation uses GOT-indirect +addressing (Accessing data through the global offset table): +1. Define data in .data section +2. Load the address of data into register from the global offset table + e.g. ld 7, my_var@got(2) +3. Use the address to load the value of data into register + e.g. ld 3, 0(7) +Refer to [2] for more information about referencing data + +VSX instructions "lxvd2x/stxvd2x" are used to load and store data to +memory instead of VR instructions "lvx/stvx" as it produces a fewer +instructions "lvx/stvx" can be used to load/store data into storage +operands but additional instructions are needed to access unaligned +storage operands, refer to "6.4.1 Accessing Unaligned Storage Operands" +in [3] to see an example of accessing unaligned storage operands. +"lxvd2x/stxvd2x" can be used to load/store data into unaligned storage +operands but permuting is needed for loading and storing data in +little-endian mode VSX registers are defined with "X" suffix +TODO: use architecture 3.0 instructions "lxv/stxv" instead for POWER9 + and newer + +Function Prologue + +Big-endian systems only support ELFv1 ABI which requires the following +steps in the function prologue: +1. Write the "official procedure descriptor" in ".opd","aw" section +2. Write procedure description for .my_func in my_func label +3. Switch back to ".text" section for program code +4. Label the beginning of the code .my_func +Refer to [1] for more information +Little-endian systems are compatible with ELFv2 ABI, an example of +function prologue for ELFv2 ABI can be seen in [2] + +[1] http://www.ibm.com/developerworks/linux/library/l-powasm1.html +[2] https://openpowerfoundation.org/?resource_lib=64-bit-elf-v2-abi-specificati… +[3] https://openpowerfoundation.org/?resource_lib=ibm-power-isa-version-2-07-b -- 2.17.1

3 5

[PATCH 4/6] "PowerPC64" Add fat build
by Maamoun TK 20 Aug '20

20 Aug '20

--- aes-decrypt-internal.c | 10 ++ aes-encrypt-internal.c | 10 ++ fat-ppc.c | 173 +++++++++++++++++++++++++++++++ fat-setup.h | 9 ++ powerpc64/fat/aes-decrypt-internal-2.asm | 37 +++++++ powerpc64/fat/aes-encrypt-internal-2.asm | 37 +++++++ powerpc64/fat/gcm-hash.asm | 40 +++++++ 7 files changed, 316 insertions(+) create mode 100644 fat-ppc.c create mode 100644 powerpc64/fat/aes-decrypt-internal-2.asm create mode 100644 powerpc64/fat/aes-encrypt-internal-2.asm create mode 100644 powerpc64/fat/gcm-hash.asm diff --git a/aes-decrypt-internal.c b/aes-decrypt-internal.c index 709c52f9..6326befb 100644 --- a/aes-decrypt-internal.c +++ b/aes-decrypt-internal.c @@ -40,6 +40,16 @@ #include "aes-internal.h" #include "macros.h" +/* For fat builds */ +#if HAVE_NATIVE_aes_decrypt +void +_nettle_aes_decrypt_c(unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src); +#define _nettle_aes_decrypt _nettle_aes_decrypt_c +#endif + void _nettle_aes_decrypt(unsigned rounds, const uint32_t *keys, const struct aes_table *T, diff --git a/aes-encrypt-internal.c b/aes-encrypt-internal.c index 9f61386d..7ff4ca40 100644 --- a/aes-encrypt-internal.c +++ b/aes-encrypt-internal.c @@ -40,6 +40,16 @@ #include "aes-internal.h" #include "macros.h" +/* For fat builds */ +#if HAVE_NATIVE_aes_encrypt +void +_nettle_aes_encrypt_c(unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src); +#define _nettle_aes_encrypt _nettle_aes_encrypt_c +#endif + void _nettle_aes_encrypt(unsigned rounds, const uint32_t *keys, const struct aes_table *T, diff --git a/fat-ppc.c b/fat-ppc.c new file mode 100644 index 00000000..e09b2097 --- /dev/null +++ b/fat-ppc.c @@ -0,0 +1,173 @@ +/* fat-ppc.c + + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +*/ + +#define _GNU_SOURCE + +#if HAVE_CONFIG_H +# include "config.h" +#endif + +#include <assert.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#if defined(__FreeBSD__) && __FreeBSD__ < 12 +#include <sys/sysctl.h> +#else +#include <sys/auxv.h> +#endif + +#include "nettle-types.h" + +#include "aes-internal.h" +#include "gcm.h" +#include "fat-setup.h" + +/* Define from arch/powerpc/include/uapi/asm/cputable.h in Linux kernel */ +#ifndef PPC_FEATURE2_VEC_CRYPTO +#define PPC_FEATURE2_VEC_CRYPTO 0x02000000 +#endif + +struct ppc_features +{ + int have_crypto_ext; +}; + +static void +get_ppc_features (struct ppc_features *features) +{ + unsigned long hwcap2 = 0; +#if defined(__FreeBSD__) +#if __FreeBSD__ < 12 + size_t len = sizeof(hwcap2); + sysctlbyname("hw.cpu_features2", &hwcap2, &len, NULL, 0); +#else + elf_aux_info(AT_HWCAP2, &hwcap2, sizeof(hwcap2)); +#endif +#else + hwcap2 = getauxval(AT_HWCAP2); +#endif + features->have_crypto_ext = + (hwcap2 & PPC_FEATURE2_VEC_CRYPTO) == PPC_FEATURE2_VEC_CRYPTO ? 1 : 0; +} + +DECLARE_FAT_FUNC(_nettle_aes_encrypt, aes_crypt_internal_func) +DECLARE_FAT_FUNC_VAR(aes_encrypt, aes_crypt_internal_func, c) +DECLARE_FAT_FUNC_VAR(aes_encrypt, aes_crypt_internal_func, ppc64) + +DECLARE_FAT_FUNC(_nettle_aes_decrypt, aes_crypt_internal_func) +DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, c) +DECLARE_FAT_FUNC_VAR(aes_decrypt, aes_crypt_internal_func, ppc64) + +#if GCM_TABLE_BITS == 8 +DECLARE_FAT_FUNC(_nettle_gcm_init_key, gcm_init_key_func) +DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, c) +DECLARE_FAT_FUNC_VAR(gcm_init_key, gcm_init_key_func, ppc64) + +DECLARE_FAT_FUNC(_nettle_gcm_hash, gcm_hash_func) +DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, c) +DECLARE_FAT_FUNC_VAR(gcm_hash, gcm_hash_func, ppc64) +#endif /* GCM_TABLE_BITS == 8 */ + +DECLARE_FAT_FUNC(_nettle_gcm_fill, gcm_fill_func) +DECLARE_FAT_FUNC_VAR(gcm_fill, gcm_fill_func, c) +DECLARE_FAT_FUNC_VAR(gcm_fill, gcm_fill_func, ppc64) + +static void CONSTRUCTOR +fat_init (void) +{ + struct ppc_features features; + int verbose; + + get_ppc_features (&features); + + verbose = getenv (ENV_VERBOSE) != NULL; + if (verbose) + fprintf (stderr, "libnettle: cpu features: %s\n", + features.have_crypto_ext ? "crypto extensions" : ""); + + if (features.have_crypto_ext) + { + if (verbose) + fprintf (stderr, "libnettle: enabling arch 2.07 code.\n"); + _nettle_aes_encrypt_vec = _nettle_aes_encrypt_ppc64; + _nettle_aes_decrypt_vec = _nettle_aes_decrypt_ppc64; +#if GCM_TABLE_BITS == 8 + /* Make sure _nettle_gcm_init_key_vec function is compatible + with _nettle_gcm_hash_vec function e.g. _nettle_gcm_init_key_c() + fills gcm_key table with values that are incompatible with + _nettle_gcm_hash_ppc64() */ + _nettle_gcm_init_key_vec = _nettle_gcm_init_key_ppc64; + _nettle_gcm_hash_vec = _nettle_gcm_hash_ppc64; +#endif /* GCM_TABLE_BITS == 8 */ + _nettle_gcm_fill_vec = _nettle_gcm_fill_ppc64; + } + else + { + _nettle_aes_encrypt_vec = _nettle_aes_encrypt_c; + _nettle_aes_decrypt_vec = _nettle_aes_decrypt_c; +#if GCM_TABLE_BITS == 8 + _nettle_gcm_init_key_vec = _nettle_gcm_init_key_c; + _nettle_gcm_hash_vec = _nettle_gcm_hash_c; +#endif /* GCM_TABLE_BITS == 8 */ + _nettle_gcm_fill_vec = _nettle_gcm_fill_c; + } +} + +DEFINE_FAT_FUNC(_nettle_aes_encrypt, void, + (unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src), + (rounds, keys, T, length, dst, src)) + +DEFINE_FAT_FUNC(_nettle_aes_decrypt, void, + (unsigned rounds, const uint32_t *keys, + const struct aes_table *T, + size_t length, uint8_t *dst, + const uint8_t *src), + (rounds, keys, T, length, dst, src)) + +#if GCM_TABLE_BITS == 8 +DEFINE_FAT_FUNC(_nettle_gcm_init_key, void, + (union nettle_block16 *table), + (table)) + +DEFINE_FAT_FUNC(_nettle_gcm_hash, void, + (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data), + (key, x, length, data)) +#endif /* GCM_TABLE_BITS == 8 */ + +DEFINE_FAT_FUNC(_nettle_gcm_fill, void, + (uint8_t *ctr, size_t blocks, + union nettle_block16 *buffer), + (ctr, blocks, buffer)) diff --git a/fat-setup.h b/fat-setup.h index 58b687fd..9793eebb 100644 --- a/fat-setup.h +++ b/fat-setup.h @@ -161,6 +161,15 @@ typedef void aes_crypt_internal_func (unsigned rounds, const uint32_t *keys, size_t length, uint8_t *dst, const uint8_t *src); +#if GCM_TABLE_BITS == 8 +typedef void gcm_init_key_func (union nettle_block16 *table); + +typedef void gcm_hash_func (const struct gcm_key *key, union nettle_block16 *x, + size_t length, const uint8_t *data); + +typedef void gcm_fill_func (uint8_t *ctr, size_t blocks, union nettle_block16 *buffer); +#endif /* GCM_TABLE_BITS == 8 */ + typedef void *(memxor_func)(void *dst, const void *src, size_t n); typedef void salsa20_core_func (uint32_t *dst, const uint32_t *src, unsigned rounds); diff --git a/powerpc64/fat/aes-decrypt-internal-2.asm b/powerpc64/fat/aes-decrypt-internal-2.asm new file mode 100644 index 00000000..593bf6cf --- /dev/null +++ b/powerpc64/fat/aes-decrypt-internal-2.asm @@ -0,0 +1,37 @@ +C powerpc64/fat/aes-decrypt-internal-2.asm + + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl PROLOGUE(_nettle_aes_decrypt) picked up by configure + +define(<fat_transform>, <$1_ppc64>) +include_src(<powerpc64/P8/aes-decrypt-internal.asm>) diff --git a/powerpc64/fat/aes-encrypt-internal-2.asm b/powerpc64/fat/aes-encrypt-internal-2.asm new file mode 100644 index 00000000..73a4d543 --- /dev/null +++ b/powerpc64/fat/aes-encrypt-internal-2.asm @@ -0,0 +1,37 @@ +C powerpc64/fat/aes-encrypt-internal-2.asm + + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl PROLOGUE(_nettle_aes_encrypt) picked up by configure + +define(<fat_transform>, <$1_ppc64>) +include_src(<powerpc64/P8/aes-encrypt-internal.asm>) diff --git a/powerpc64/fat/gcm-hash.asm b/powerpc64/fat/gcm-hash.asm new file mode 100644 index 00000000..dbb827db --- /dev/null +++ b/powerpc64/fat/gcm-hash.asm @@ -0,0 +1,40 @@ +C powerpc64/fat/gcm-hash.asm + + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +dnl picked up by configure +dnl PROLOGUE(_nettle_gcm_init_key) +dnl PROLOGUE(_nettle_gcm_hash) +dnl PROLOGUE(_nettle_gcm_fill) + +define(<fat_transform>, <$1_ppc64>) +include_src(<powerpc64/P8/gcm-hash.asm>) -- 2.17.1

3 5

[PATCH] "PowerPC64" Detect and check ABI
by Maamoun TK 20 Aug '20

20 Aug '20

--- configure.ac | 27 ++++++++++++++++++++------- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/configure.ac b/configure.ac index 49db7af1..6db3fc42 100644 --- a/configure.ac +++ b/configure.ac @@ -322,6 +322,17 @@ case "$host_cpu" in AC_TRY_COMPILE([ #if defined(__sgi) && defined(__LP64__) #error 64-bit mips +#endif + ], [], [ + ABI=32 + ], [ + ABI=64 + ]) + ;; + powerpc*) + AC_TRY_COMPILE([ +#if defined(__PPC64__) +#error 64-bit powerpc #endif ], [], [ ABI=32 @@ -438,13 +449,15 @@ if test "x$enable_assembler" = xyes ; then fi fi ;; - *powerpc64*) - if test "x$enable_fat" = xyes ; then - asm_path="powerpc64/fat powerpc64" - OPT_NETTLE_SOURCES="fat-ppc.c $OPT_NETTLE_SOURCES" - else - if test "x$enable_power_crypto_ext" = xyes ; then - asm_path="powerpc64/P8 powerpc64" + powerpc*) + if test "$ABI" = 64 ; then + if test "x$enable_fat" = xyes ; then + asm_path="powerpc64/fat powerpc64" + OPT_NETTLE_SOURCES="fat-ppc.c $OPT_NETTLE_SOURCES" + else + if test "x$enable_power_crypto_ext" = xyes ; then + asm_path="powerpc64/p8 powerpc64" + fi fi fi ;; -- 2.17.1

1 0

[PATCH] Check for ENV_OVERRIDE in get_ppc_features()
by Maamoun TK 02 Aug '20

02 Aug '20

This patch doesn't add FAT_TEST_LIST to ppc in configure.ac because the check-fat patch hasn't merged to the power-asm-wip branch. It can be enabled easily by adding FAT_TEST_LIST="crypto_ext" to the ppc condition in configure.ac once both patches are merged together. Regards, Mamone --- fat-ppc.c | 38 ++++++++++++++++++++++++++++++-------- 1 file changed, 30 insertions(+), 8 deletions(-) diff --git a/fat-ppc.c b/fat-ppc.c index eca689fe..e0b50199 100644 --- a/fat-ppc.c +++ b/fat-ppc.c @@ -68,26 +68,48 @@ struct ppc_features int have_crypto_ext; }; +#define MATCH(s, slen, literal, llen) \ + ((slen) == (llen) && memcmp ((s), (literal), llen) == 0) + static void get_ppc_features (struct ppc_features *features) { + const char *s; + features->have_crypto_ext = 0; + + s = secure_getenv (ENV_OVERRIDE); + if (s) + for (;;) + { + const char *sep = strchr (s, ','); + size_t length = sep ? (size_t) (sep - s) : strlen(s); + + if (MATCH (s, length, "crypto_ext", 10)) + features->have_crypto_ext = 1; + if (!sep) + break; + s = sep + 1; + } + else + { #if defined(_AIX) && defined(__power_8_andup) - features->have_crypto_ext = __power_8_andup() != 0 ? 1 : 0; + features->have_crypto_ext = __power_8_andup() != 0 ? 1 : 0; #else - unsigned long hwcap2 = 0; + unsigned long hwcap2 = 0; #if defined(__linux__) - hwcap2 = getauxval(AT_HWCAP2); + hwcap2 = getauxval(AT_HWCAP2); #elif defined(__FreeBSD__) #if __FreeBSD__ >= 12 - elf_aux_info(AT_HWCAP2, &hwcap2, sizeof(hwcap2)); + elf_aux_info(AT_HWCAP2, &hwcap2, sizeof(hwcap2)); #else - size_t len = sizeof(hwcap2); - sysctlbyname("hw.cpu_features2", &hwcap2, &len, NULL, 0); + size_t len = sizeof(hwcap2); + sysctlbyname("hw.cpu_features2", &hwcap2, &len, NULL, 0); #endif #endif - features->have_crypto_ext = - (hwcap2 & PPC_FEATURE2_VEC_CRYPTO) == PPC_FEATURE2_VEC_CRYPTO ? 1 : 0; + features->have_crypto_ext = + (hwcap2 & PPC_FEATURE2_VEC_CRYPTO) == PPC_FEATURE2_VEC_CRYPTO ? 1 : 0; #endif + } } DECLARE_FAT_FUNC(_nettle_aes_encrypt, aes_crypt_internal_func) -- 2.17.1

1 0

[PATCH 2/6] "PowerPC64" Add optimized AES [Enc|Dec]
by Maamoun TK 01 Aug '20

01 Aug '20

I measured the latency and throughput of vcipher/vncipher/vxor instructions for POWER8 vcipher/vncipher throughput 6 instructions per cycle latency 0.91 clock cycles vxor throughput 6 instructions per cycle latency 0.32 clock cycles So the ideal option for POWER8 is processing 8 blocks, it has +12% performance over processing 4 blocks. --- powerpc64/P8/aes-decrypt-internal.asm | 367 ++++++++++++++++++++++++++++++++++ powerpc64/P8/aes-encrypt-internal.asm | 344 +++++++++++++++++++++++++++++++ 2 files changed, 711 insertions(+) create mode 100644 powerpc64/P8/aes-decrypt-internal.asm create mode 100644 powerpc64/P8/aes-encrypt-internal.asm diff --git a/powerpc64/P8/aes-decrypt-internal.asm b/powerpc64/P8/aes-decrypt-internal.asm new file mode 100644 index 00000000..f5d64548 --- /dev/null +++ b/powerpc64/P8/aes-decrypt-internal.asm @@ -0,0 +1,367 @@ +C powerpc64/P8/aes-decrypt-internal.asm + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +C Register usage: + +define(<SP>, <1>) +define(<TOCP>, <2>) + +define(<ROUNDS>, <3>) +define(<KEYS>, <4>) +define(<LENGTH>, <6>) +define(<DST>, <7>) +define(<SRC>, <8>) + +define(<swap_mask>, <0>) + +define(<K>, <1>) +define(<S0>, <2>) +define(<S1>, <3>) +define(<S2>, <4>) +define(<S3>, <5>) +define(<S4>, <6>) +define(<S5>, <7>) +define(<S6>, <8>) +define(<S7>, <9>) + +define(<KX>, <33>) +define(<S0X>, <34>) +define(<S1X>, <35>) +define(<S2X>, <36>) +define(<S3X>, <37>) +define(<S4X>, <38>) +define(<S5X>, <39>) +define(<S6X>, <40>) +define(<S7X>, <41>) + +C ZERO vector register is used in place of RoundKey +C for vncipher instruction because the order of InvMixColumns +C and Xor processes are flipped in that instruction. +C The Xor process with RoundKey is executed afterward. +define(<ZERO>, <10>) + +.file "aes-decrypt-internal.asm" + +IF_LE(<.abiversion 2>) +.text + + C _aes_decrypt(unsigned rounds, const uint32_t *keys, + C const struct aes_table *T, + C size_t length, uint8_t *dst, + C uint8_t *src) + +define(<FUNC_ALIGN>, <5>) +PROLOGUE(_nettle_aes_decrypt) + vxor ZERO,ZERO,ZERO + + DATA_LOAD_VEC(swap_mask,.swap_mask,5) + + subi ROUNDS,ROUNDS,1 + srdi LENGTH,LENGTH,4 + + srdi 5,LENGTH,3 #8x loop count + cmpldi 5,0 + beq L4x + + std 25,-56(SP); + std 26,-48(SP); + std 27,-40(SP); + std 28,-32(SP); + std 29,-24(SP); + std 30,-16(SP); + std 31,-8(SP); + + li 25,0x10 + li 26,0x20 + li 27,0x30 + li 28,0x40 + li 29,0x50 + li 30,0x60 + li 31,0x70 + +.align 5 +Lx8_loop: + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + lxvd2x S1X,25,SRC + lxvd2x S2X,26,SRC + lxvd2x S3X,27,SRC + lxvd2x S4X,28,SRC + lxvd2x S5X,29,SRC + lxvd2x S6X,30,SRC + lxvd2x S7X,31,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask + vperm S4,S4,S4,swap_mask + vperm S5,S5,S5,swap_mask + vperm S6,S6,S6,swap_mask + vperm S7,S7,S7,swap_mask>) + + vxor S0,S0,K + vxor S1,S1,K + vxor S2,S2,K + vxor S3,S3,K + vxor S4,S4,K + vxor S5,S5,K + vxor S6,S6,K + vxor S7,S7,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L8x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipher S0,S0,ZERO + vncipher S1,S1,ZERO + vncipher S2,S2,ZERO + vncipher S3,S3,ZERO + vncipher S4,S4,ZERO + vncipher S5,S5,ZERO + vncipher S6,S6,ZERO + vncipher S7,S7,ZERO + vxor S0,S0,K + vxor S1,S1,K + vxor S2,S2,K + vxor S3,S3,K + vxor S4,S4,K + vxor S5,S5,K + vxor S6,S6,K + vxor S7,S7,K + addi 10,10,0x10 + bdnz L8x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipherlast S0,S0,K + vncipherlast S1,S1,K + vncipherlast S2,S2,K + vncipherlast S3,S3,K + vncipherlast S4,S4,K + vncipherlast S5,S5,K + vncipherlast S6,S6,K + vncipherlast S7,S7,K + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask + vperm S4,S4,S4,swap_mask + vperm S5,S5,S5,swap_mask + vperm S6,S6,S6,swap_mask + vperm S7,S7,S7,swap_mask>) + + stxvd2x S0X,0,DST + stxvd2x S1X,25,DST + stxvd2x S2X,26,DST + stxvd2x S3X,27,DST + stxvd2x S4X,28,DST + stxvd2x S5X,29,DST + stxvd2x S6X,30,DST + stxvd2x S7X,31,DST + + addi SRC,SRC,0x80 + addi DST,DST,0x80 + subic. 5,5,1 + bne Lx8_loop + + ld 25,-56(SP); + ld 26,-48(SP); + ld 27,-40(SP); + ld 28,-32(SP); + ld 29,-24(SP); + ld 30,-16(SP); + ld 31,-8(SP); + + clrldi LENGTH,LENGTH,61 + +L4x: + srdi 5,LENGTH,2 + cmpldi 5,0 + beq L2x + + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + li 9,0x10 + lxvd2x S1X,9,SRC + addi 9,9,0x10 + lxvd2x S2X,9,SRC + addi 9,9,0x10 + lxvd2x S3X,9,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask>) + + vxor S0,S0,K + vxor S1,S1,K + vxor S2,S2,K + vxor S3,S3,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L4x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipher S0,S0,ZERO + vncipher S1,S1,ZERO + vncipher S2,S2,ZERO + vncipher S3,S3,ZERO + vxor S0,S0,K + vxor S1,S1,K + vxor S2,S2,K + vxor S3,S3,K + addi 10,10,0x10 + bdnz L4x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipherlast S0,S0,K + vncipherlast S1,S1,K + vncipherlast S2,S2,K + vncipherlast S3,S3,K + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask>) + + stxvd2x S0X,0,DST + li 9,0x10 + stxvd2x S1X,9,DST + addi 9,9,0x10 + stxvd2x S2X,9,DST + addi 9,9,0x10 + stxvd2x S3X,9,DST + + addi SRC,SRC,0x40 + addi DST,DST,0x40 + + clrldi LENGTH,LENGTH,62 + +L2x: + srdi 5,LENGTH,1 + cmpldi 5,0 + beq L1x + + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + li 9,0x10 + lxvd2x S1X,9,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask>) + + vxor S0,S0,K + vxor S1,S1,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L2x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipher S0,S0,ZERO + vncipher S1,S1,ZERO + vxor S0,S0,K + vxor S1,S1,K + addi 10,10,0x10 + bdnz L2x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipherlast S0,S0,K + vncipherlast S1,S1,K + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask>) + + stxvd2x S0X,0,DST + li 9,0x10 + stxvd2x S1X,9,DST + + addi SRC,SRC,0x20 + addi DST,DST,0x20 + + clrldi LENGTH,LENGTH,63 + +L1x: + cmpldi LENGTH,0 + beq Ldone + + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask>) + + vxor S0,S0,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L1x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipher S0,S0,ZERO + vxor S0,S0,K + addi 10,10,0x10 + bdnz L1x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vncipherlast S0,S0,K + +IF_LE(<vperm S0,S0,S0,swap_mask>) + + stxvd2x S0X,0,DST + +Ldone: + blr +EPILOGUE(_nettle_aes_decrypt) + + .data + .align 4 +.swap_mask: +IF_LE(<.byte 8,9,10,11,12,13,14,15,0,1,2,3,4,5,6,7>) +IF_BE(<.byte 3,2,1,0,7,6,5,4,11,10,9,8,15,14,13,12>) diff --git a/powerpc64/P8/aes-encrypt-internal.asm b/powerpc64/P8/aes-encrypt-internal.asm new file mode 100644 index 00000000..3e0fa6f0 --- /dev/null +++ b/powerpc64/P8/aes-encrypt-internal.asm @@ -0,0 +1,344 @@ +C powerpc64/P8/aes-encrypt-internal.asm + +ifelse(< + Copyright (C) 2020 Mamone Tarsha + This file is part of GNU Nettle. + + GNU Nettle is free software: you can redistribute it and/or + modify it under the terms of either: + + * the GNU Lesser General Public License as published by the Free + Software Foundation; either version 3 of the License, or (at your + option) any later version. + + or + + * the GNU General Public License as published by the Free + Software Foundation; either version 2 of the License, or (at your + option) any later version. + + or both in parallel, as here. + + GNU Nettle is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received copies of the GNU General Public License and + the GNU Lesser General Public License along with this program. If + not, see http://www.gnu.org/licenses/. +>) + +C Register usage: + +define(<SP>, <1>) +define(<TOCP>, <2>) + +define(<ROUNDS>, <3>) +define(<KEYS>, <4>) +define(<LENGTH>, <6>) +define(<DST>, <7>) +define(<SRC>, <8>) + +define(<swap_mask>, <0>) + +define(<K>, <1>) +define(<S0>, <2>) +define(<S1>, <3>) +define(<S2>, <4>) +define(<S3>, <5>) +define(<S4>, <6>) +define(<S5>, <7>) +define(<S6>, <8>) +define(<S7>, <9>) + +define(<KX>, <33>) +define(<S0X>, <34>) +define(<S1X>, <35>) +define(<S2X>, <36>) +define(<S3X>, <37>) +define(<S4X>, <38>) +define(<S5X>, <39>) +define(<S6X>, <40>) +define(<S7X>, <41>) + +.file "aes-encrypt-internal.asm" + +IF_LE(<.abiversion 2>) +.text + + C _aes_encrypt(unsigned rounds, const uint32_t *keys, + C const struct aes_table *T, + C size_t length, uint8_t *dst, + C uint8_t *src) + +define(<FUNC_ALIGN>, <5>) +PROLOGUE(_nettle_aes_encrypt) + DATA_LOAD_VEC(swap_mask,.swap_mask,5) + + subi ROUNDS,ROUNDS,1 + srdi LENGTH,LENGTH,4 + + srdi 5,LENGTH,3 #8x loop count + cmpldi 5,0 + beq L4x + + std 25,-56(SP); + std 26,-48(SP); + std 27,-40(SP); + std 28,-32(SP); + std 29,-24(SP); + std 30,-16(SP); + std 31,-8(SP); + + li 25,0x10 + li 26,0x20 + li 27,0x30 + li 28,0x40 + li 29,0x50 + li 30,0x60 + li 31,0x70 + +.align 5 +Lx8_loop: + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + lxvd2x S1X,25,SRC + lxvd2x S2X,26,SRC + lxvd2x S3X,27,SRC + lxvd2x S4X,28,SRC + lxvd2x S5X,29,SRC + lxvd2x S6X,30,SRC + lxvd2x S7X,31,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask + vperm S4,S4,S4,swap_mask + vperm S5,S5,S5,swap_mask + vperm S6,S6,S6,swap_mask + vperm S7,S7,S7,swap_mask>) + + vxor S0,S0,K + vxor S1,S1,K + vxor S2,S2,K + vxor S3,S3,K + vxor S4,S4,K + vxor S5,S5,K + vxor S6,S6,K + vxor S7,S7,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L8x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipher S0,S0,K + vcipher S1,S1,K + vcipher S2,S2,K + vcipher S3,S3,K + vcipher S4,S4,K + vcipher S5,S5,K + vcipher S6,S6,K + vcipher S7,S7,K + addi 10,10,0x10 + bdnz L8x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipherlast S0,S0,K + vcipherlast S1,S1,K + vcipherlast S2,S2,K + vcipherlast S3,S3,K + vcipherlast S4,S4,K + vcipherlast S5,S5,K + vcipherlast S6,S6,K + vcipherlast S7,S7,K + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask + vperm S4,S4,S4,swap_mask + vperm S5,S5,S5,swap_mask + vperm S6,S6,S6,swap_mask + vperm S7,S7,S7,swap_mask>) + + stxvd2x S0X,0,DST + stxvd2x S1X,25,DST + stxvd2x S2X,26,DST + stxvd2x S3X,27,DST + stxvd2x S4X,28,DST + stxvd2x S5X,29,DST + stxvd2x S6X,30,DST + stxvd2x S7X,31,DST + + addi SRC,SRC,0x80 + addi DST,DST,0x80 + subic. 5,5,1 + bne Lx8_loop + + ld 25,-56(SP); + ld 26,-48(SP); + ld 27,-40(SP); + ld 28,-32(SP); + ld 29,-24(SP); + ld 30,-16(SP); + ld 31,-8(SP); + + clrldi LENGTH,LENGTH,61 + +L4x: + srdi 5,LENGTH,2 + cmpldi 5,0 + beq L2x + + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + li 9,0x10 + lxvd2x S1X,9,SRC + addi 9,9,0x10 + lxvd2x S2X,9,SRC + addi 9,9,0x10 + lxvd2x S3X,9,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask>) + + vxor S0,S0,K + vxor S1,S1,K + vxor S2,S2,K + vxor S3,S3,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L4x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipher S0,S0,K + vcipher S1,S1,K + vcipher S2,S2,K + vcipher S3,S3,K + addi 10,10,0x10 + bdnz L4x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipherlast S0,S0,K + vcipherlast S1,S1,K + vcipherlast S2,S2,K + vcipherlast S3,S3,K + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask + vperm S2,S2,S2,swap_mask + vperm S3,S3,S3,swap_mask>) + + stxvd2x S0X,0,DST + li 9,0x10 + stxvd2x S1X,9,DST + addi 9,9,0x10 + stxvd2x S2X,9,DST + addi 9,9,0x10 + stxvd2x S3X,9,DST + + addi SRC,SRC,0x40 + addi DST,DST,0x40 + + clrldi LENGTH,LENGTH,62 + +L2x: + srdi 5,LENGTH,1 + cmpldi 5,0 + beq L1x + + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + li 9,0x10 + lxvd2x S1X,9,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask>) + + vxor S0,S0,K + vxor S1,S1,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L2x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipher S0,S0,K + vcipher S1,S1,K + addi 10,10,0x10 + bdnz L2x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipherlast S0,S0,K + vcipherlast S1,S1,K + +IF_LE(<vperm S0,S0,S0,swap_mask + vperm S1,S1,S1,swap_mask>) + + stxvd2x S0X,0,DST + li 9,0x10 + stxvd2x S1X,9,DST + + addi SRC,SRC,0x20 + addi DST,DST,0x20 + + clrldi LENGTH,LENGTH,63 + +L1x: + cmpldi LENGTH,0 + beq Ldone + + lxvd2x KX,0,KEYS + vperm K,K,K,swap_mask + + lxvd2x S0X,0,SRC + +IF_LE(<vperm S0,S0,S0,swap_mask>) + + vxor S0,S0,K + + mtctr ROUNDS + li 10,0x10 +.align 5 +L1x_round_loop: + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipher S0,S0,K + addi 10,10,0x10 + bdnz L1x_round_loop + + lxvd2x KX,10,KEYS + vperm K,K,K,swap_mask + vcipherlast S0,S0,K + +IF_LE(<vperm S0,S0,S0,swap_mask>) + + stxvd2x S0X,0,DST + +Ldone: + blr +EPILOGUE(_nettle_aes_encrypt) + + .data + .align 4 +.swap_mask: +IF_LE(<.byte 8,9,10,11,12,13,14,15,0,1,2,3,4,5,6,7>) +IF_BE(<.byte 3,2,1,0,7,6,5,4,11,10,9,8,15,14,13,12>) -- 2.17.1

2 10

[PATCH] "PowerPC64" Add README
by Maamoun TK 01 Aug '20

01 Aug '20

--- powerpc64/README | 86 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 powerpc64/README diff --git a/powerpc64/README b/powerpc64/README new file mode 100644 index 00000000..6d6f3fbb --- /dev/null +++ b/powerpc64/README @@ -0,0 +1,86 @@ +General-Purpose Register Conventions + +Register Status Use + +GPR0 volatile In function prologs. +GPR1 dedicated Stack pointer. +GPR2 dedicated Table of Contents (TOC) pointer. +GPR3 volatile First word of a function's argument list; + first word of a scalar function return. +GPR4 volatile Second word of a function's argument list; + second word of a scalar function return. +GPR5 volatile Third word of a function's argument list. +GPR6 volatile Fourth word of a function's argument list. +GPR7 volatile Fifth word of a function's argument list. +GPR8 volatile Sixth word of a function's argument list. +GPR9 volatile Seventh word of a function's argument list. +GPR10 volatile Eighth word of a function's argument list. +GPR11 volatile In calls by pointer and as an environment pointer for languages + that require it (for example, PASCAL). +GPR12 volatile For special exception handling required by certain languages and in + glink code. +GPR13 reserved Reserved under 64-bit environment; not restored across system calls. +GPR14:GPR31 nonvolatile These registers must be preserved across a function call. + +Vector Register Conventions + +Register Status + +VR0 Volatile +VR1 Volatile +VR2 Volatile +VR3 Volatile +VR4 Volatile +VR5 Volatile +VR6 Volatile +VR7 Volatile +VR8 Volatile +VR9 Volatile +VR10 Volatile +VR11 Volatile +VR12 Volatile +VR13 Volatile +VR14 Volatile +VR15 Volatile +VR16 Volatile +VR17 Volatile +VR18 Volatile +VR19 Volatile +VR20:31 Nonvolatile (extended ABI mode) their values are preserved across function calls + +Addressing memory + +There are many ways to reference data, in the sake of writing position-independent code +the current implementations uses GOT-indirect addressing (Accessing data through the global +offset table): +1. Define data in .data section +2. Load the address of data into register from the global offset table e.g. ld 7, my_var@got(2) +3. Use the address to load the value of data into register e.g. ld 3, 0(7) +Refer to [2] for more information + +VSX instructions "lxvd2x/stxvd2x" are used to load and store data to memory +instead of VR instructions "lvx/stvx" as it produces a fewer instructions +"lvx/stvx" can be used to load/store data into storage operands +but additional instructions are needed to access unaligned storage operands, refer +to "6.4.1 Accessing Unaligned Storage Operands" in [3] +to see an example of accessing unaligned storage operands. "lxvd2x/stxvd2x" can +be used to load/store data into unaligned storage operands but permuting is needed +for loading and storing data in little-endian mode +VSX registers are defined with "X" suffix +TODO: use architecture 3.0 instructions "lxv/stxv" instead for POWER9 and newer + +Function Prologue + +Big-endian systems only support ELFv1 ABI which requires the following steps in the +function prologue: +1. Write the "official procedure descriptor" in ".opd","aw" section +2. Write procedure description for .my_func in my_func label +3. Switch back to ".text" section for program code +4. Label the beginning of the code .my_func +Refer to [1] for more information +Little-endian systems are compatible with ELFv2 ABI, an example of function prologue +for ELFv2 ABI can be seen in [2] + +[1] http://www.ibm.com/developerworks/linux/library/l-powasm1.html +[2] https://openpowerfoundation.org/?resource_lib=64-bit-elf-v2-abi-specificati… +[3] https://openpowerfoundation.org/?resource_lib=ibm-power-isa-version-2-07-b -- 2.17.1

2 2

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs August 2020