Latest update and remove TLSv1.3 draft
This commit is contained in:
+1
-10
@@ -52,13 +52,4 @@ INCLUDE[bsaes-armv7.o]=..
|
||||
GENERATE[aes-s390x.S]=asm/aes-s390x.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[aes-s390x.o]=..
|
||||
|
||||
BEGINRAW[Makefile]
|
||||
##### AES assembler implementations
|
||||
|
||||
# GNU make "catch all"
|
||||
{- $builddir -}/aes-%.S: {- $sourcedir -}/asm/aes-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
{- $builddir -}/bsaes-%.S: {- $sourcedir -}/asm/bsaes-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
|
||||
ENDRAW[Makefile]
|
||||
GENERATE[aes-c64xplus.S]=asm/aes-c64xplus.pl $(PERLASM_SCHEME)
|
||||
@@ -32,7 +32,7 @@ EVP_PKEY *d2i_PublicKey(int type, EVP_PKEY **a, const unsigned char **pp,
|
||||
} else
|
||||
ret = *a;
|
||||
|
||||
if (!EVP_PKEY_set_type(ret, type)) {
|
||||
if (type != EVP_PKEY_id(ret) && !EVP_PKEY_set_type(ret, type)) {
|
||||
ASN1err(ASN1_F_D2I_PUBLICKEY, ERR_R_EVP_LIB);
|
||||
goto err;
|
||||
}
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -49,6 +49,7 @@ struct blake2s_ctx_st {
|
||||
uint32_t f[2];
|
||||
uint8_t buf[BLAKE2S_BLOCKBYTES];
|
||||
size_t buflen;
|
||||
size_t outlen;
|
||||
};
|
||||
|
||||
struct blake2b_param_st {
|
||||
@@ -73,6 +74,7 @@ struct blake2b_ctx_st {
|
||||
uint64_t f[2];
|
||||
uint8_t buf[BLAKE2B_BLOCKBYTES];
|
||||
size_t buflen;
|
||||
size_t outlen;
|
||||
};
|
||||
|
||||
#define BLAKE2B_DIGEST_LENGTH 64
|
||||
@@ -81,10 +83,29 @@ struct blake2b_ctx_st {
|
||||
typedef struct blake2s_ctx_st BLAKE2S_CTX;
|
||||
typedef struct blake2b_ctx_st BLAKE2B_CTX;
|
||||
|
||||
int BLAKE2b_Init(BLAKE2B_CTX *c);
|
||||
int BLAKE2b_Init(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P);
|
||||
int BLAKE2b_Init_key(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P, const void *key);
|
||||
int BLAKE2b_Update(BLAKE2B_CTX *c, const void *data, size_t datalen);
|
||||
int BLAKE2b_Final(unsigned char *md, BLAKE2B_CTX *c);
|
||||
|
||||
int BLAKE2s_Init(BLAKE2S_CTX *c);
|
||||
/*
|
||||
* These setters are internal and do not check the validity of their parameters.
|
||||
* See blake2b_mac_ctrl for validation logic.
|
||||
*/
|
||||
|
||||
void blake2b_param_init(BLAKE2B_PARAM *P);
|
||||
void blake2b_param_set_digest_length(BLAKE2B_PARAM *P, uint8_t outlen);
|
||||
void blake2b_param_set_key_length(BLAKE2B_PARAM *P, uint8_t keylen);
|
||||
void blake2b_param_set_personal(BLAKE2B_PARAM *P, const uint8_t *personal, size_t length);
|
||||
void blake2b_param_set_salt(BLAKE2B_PARAM *P, const uint8_t *salt, size_t length);
|
||||
|
||||
int BLAKE2s_Init(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P);
|
||||
int BLAKE2s_Init_key(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P, const void *key);
|
||||
int BLAKE2s_Update(BLAKE2S_CTX *c, const void *data, size_t datalen);
|
||||
int BLAKE2s_Final(unsigned char *md, BLAKE2S_CTX *c);
|
||||
|
||||
void blake2s_param_init(BLAKE2S_PARAM *P);
|
||||
void blake2s_param_set_digest_length(BLAKE2S_PARAM *P, uint8_t outlen);
|
||||
void blake2s_param_set_key_length(BLAKE2S_PARAM *P, uint8_t keylen);
|
||||
void blake2s_param_set_personal(BLAKE2S_PARAM *P, const uint8_t *personal, size_t length);
|
||||
void blake2s_param_set_salt(BLAKE2S_PARAM *P, const uint8_t *salt, size_t length);
|
||||
+69
-9
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -62,12 +62,14 @@ static ossl_inline void blake2b_init0(BLAKE2B_CTX *S)
|
||||
}
|
||||
}
|
||||
|
||||
/* init xors IV with input parameter block */
|
||||
/* init xors IV with input parameter block and sets the output length */
|
||||
static void blake2b_init_param(BLAKE2B_CTX *S, const BLAKE2B_PARAM *P)
|
||||
{
|
||||
size_t i;
|
||||
const uint8_t *p = (const uint8_t *)(P);
|
||||
|
||||
blake2b_init0(S);
|
||||
S->outlen = P->digest_length;
|
||||
|
||||
/* The param struct is carefully hand packed, and should be 64 bytes on
|
||||
* every platform. */
|
||||
@@ -78,10 +80,9 @@ static void blake2b_init_param(BLAKE2B_CTX *S, const BLAKE2B_PARAM *P)
|
||||
}
|
||||
}
|
||||
|
||||
/* Initialize the hashing context. Always returns 1. */
|
||||
int BLAKE2b_Init(BLAKE2B_CTX *c)
|
||||
/* Initialize the parameter block with default values */
|
||||
void blake2b_param_init(BLAKE2B_PARAM *P)
|
||||
{
|
||||
BLAKE2B_PARAM P[1];
|
||||
P->digest_length = BLAKE2B_DIGEST_LENGTH;
|
||||
P->key_length = 0;
|
||||
P->fanout = 1;
|
||||
@@ -93,10 +94,60 @@ int BLAKE2b_Init(BLAKE2B_CTX *c)
|
||||
memset(P->reserved, 0, sizeof(P->reserved));
|
||||
memset(P->salt, 0, sizeof(P->salt));
|
||||
memset(P->personal, 0, sizeof(P->personal));
|
||||
}
|
||||
|
||||
void blake2b_param_set_digest_length(BLAKE2B_PARAM *P, uint8_t outlen)
|
||||
{
|
||||
P->digest_length = outlen;
|
||||
}
|
||||
|
||||
void blake2b_param_set_key_length(BLAKE2B_PARAM *P, uint8_t keylen)
|
||||
{
|
||||
P->key_length = keylen;
|
||||
}
|
||||
|
||||
void blake2b_param_set_personal(BLAKE2B_PARAM *P, const uint8_t *personal, size_t len)
|
||||
{
|
||||
memcpy(P->personal, personal, len);
|
||||
memset(P->personal + len, 0, BLAKE2B_PERSONALBYTES - len);
|
||||
}
|
||||
|
||||
void blake2b_param_set_salt(BLAKE2B_PARAM *P, const uint8_t *salt, size_t len)
|
||||
{
|
||||
memcpy(P->salt, salt, len);
|
||||
memset(P->salt + len, 0, BLAKE2B_SALTBYTES - len);
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize the hashing context with the given parameter block.
|
||||
* Always returns 1.
|
||||
*/
|
||||
int BLAKE2b_Init(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P)
|
||||
{
|
||||
blake2b_init_param(c, P);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize the hashing context with the given parameter block and key.
|
||||
* Always returns 1.
|
||||
*/
|
||||
int BLAKE2b_Init_key(BLAKE2B_CTX *c, const BLAKE2B_PARAM *P, const void *key)
|
||||
{
|
||||
blake2b_init_param(c, P);
|
||||
|
||||
/* Pad the key to form first data block */
|
||||
{
|
||||
uint8_t block[BLAKE2B_BLOCKBYTES] = {0};
|
||||
|
||||
memcpy(block, key, P->key_length);
|
||||
BLAKE2b_Update(c, block, BLAKE2B_BLOCKBYTES);
|
||||
OPENSSL_cleanse(block, BLAKE2B_BLOCKBYTES);
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Permute the state while xoring in the block of data. */
|
||||
static void blake2b_compress(BLAKE2B_CTX *S,
|
||||
const uint8_t *blocks,
|
||||
@@ -252,17 +303,26 @@ int BLAKE2b_Update(BLAKE2B_CTX *c, const void *data, size_t datalen)
|
||||
*/
|
||||
int BLAKE2b_Final(unsigned char *md, BLAKE2B_CTX *c)
|
||||
{
|
||||
uint8_t outbuffer[BLAKE2B_OUTBYTES] = {0};
|
||||
uint8_t *target = outbuffer;
|
||||
int iter = (c->outlen + 7) / 8;
|
||||
int i;
|
||||
|
||||
/* Avoid writing to the temporary buffer if possible */
|
||||
if ((c->outlen % sizeof(c->h[0])) == 0)
|
||||
target = md;
|
||||
|
||||
blake2b_set_lastblock(c);
|
||||
/* Padding */
|
||||
memset(c->buf + c->buflen, 0, sizeof(c->buf) - c->buflen);
|
||||
blake2b_compress(c, c->buf, c->buflen);
|
||||
|
||||
/* Output full hash to message digest */
|
||||
for (i = 0; i < 8; ++i) {
|
||||
store64(md + sizeof(c->h[i]) * i, c->h[i]);
|
||||
}
|
||||
/* Output full hash to buffer */
|
||||
for (i = 0; i < iter; ++i)
|
||||
store64(target + sizeof(c->h[i]) * i, c->h[i]);
|
||||
|
||||
if (target != md)
|
||||
memcpy(md, target, c->outlen);
|
||||
|
||||
OPENSSL_cleanse(c, sizeof(BLAKE2B_CTX));
|
||||
return 1;
|
||||
|
||||
@@ -0,0 +1,190 @@
|
||||
/*
|
||||
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#ifndef OPENSSL_NO_BLAKE2
|
||||
|
||||
# include <openssl/evp.h>
|
||||
# include "blake2_locl.h"
|
||||
# include "internal/cryptlib.h"
|
||||
# include "internal/evp_int.h"
|
||||
|
||||
/* typedef EVP_MAC_IMPL */
|
||||
struct evp_mac_impl_st {
|
||||
BLAKE2B_CTX ctx;
|
||||
BLAKE2B_PARAM params;
|
||||
unsigned char key[BLAKE2B_KEYBYTES];
|
||||
};
|
||||
|
||||
static EVP_MAC_IMPL *blake2b_mac_new(void)
|
||||
{
|
||||
EVP_MAC_IMPL *macctx = OPENSSL_zalloc(sizeof(*macctx));
|
||||
if (macctx != NULL) {
|
||||
blake2b_param_init(&macctx->params);
|
||||
/* ctx initialization is deferred to BLAKE2b_Init() */
|
||||
}
|
||||
return macctx;
|
||||
}
|
||||
|
||||
static void blake2b_mac_free(EVP_MAC_IMPL *macctx)
|
||||
{
|
||||
if (macctx != NULL) {
|
||||
OPENSSL_cleanse(macctx->key, sizeof(macctx->key));
|
||||
OPENSSL_free(macctx);
|
||||
}
|
||||
}
|
||||
|
||||
static int blake2b_mac_copy(EVP_MAC_IMPL *dst, EVP_MAC_IMPL *src)
|
||||
{
|
||||
*dst = *src;
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int blake2b_mac_init(EVP_MAC_IMPL *macctx)
|
||||
{
|
||||
/* Check key has been set */
|
||||
if (macctx->params.key_length == 0) {
|
||||
EVPerr(EVP_F_BLAKE2B_MAC_INIT, EVP_R_NO_KEY_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
return BLAKE2b_Init_key(&macctx->ctx, &macctx->params, macctx->key);
|
||||
}
|
||||
|
||||
static int blake2b_mac_update(EVP_MAC_IMPL *macctx, const unsigned char *data,
|
||||
size_t datalen)
|
||||
{
|
||||
return BLAKE2b_Update(&macctx->ctx, data, datalen);
|
||||
}
|
||||
|
||||
static int blake2b_mac_final(EVP_MAC_IMPL *macctx, unsigned char *out)
|
||||
{
|
||||
return BLAKE2b_Final(out, &macctx->ctx);
|
||||
}
|
||||
|
||||
/*
|
||||
* ALL Ctrl functions should be set before init().
|
||||
*/
|
||||
static int blake2b_mac_ctrl(EVP_MAC_IMPL *macctx, int cmd, va_list args)
|
||||
{
|
||||
const unsigned char *p;
|
||||
size_t len;
|
||||
size_t size;
|
||||
|
||||
switch (cmd) {
|
||||
case EVP_MAC_CTRL_SET_SIZE:
|
||||
size = va_arg(args, size_t);
|
||||
if (size < 1 || size > BLAKE2B_OUTBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2b_param_set_digest_length(&macctx->params, (uint8_t)size);
|
||||
return 1;
|
||||
|
||||
case EVP_MAC_CTRL_SET_KEY:
|
||||
p = va_arg(args, const unsigned char *);
|
||||
len = va_arg(args, size_t);
|
||||
if (len < 1 || len > BLAKE2B_KEYBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_INVALID_KEY_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2b_param_set_key_length(&macctx->params, (uint8_t)len);
|
||||
memcpy(macctx->key, p, len);
|
||||
memset(macctx->key + len, 0, BLAKE2B_KEYBYTES - len);
|
||||
return 1;
|
||||
|
||||
case EVP_MAC_CTRL_SET_CUSTOM:
|
||||
p = va_arg(args, const unsigned char *);
|
||||
len = va_arg(args, size_t);
|
||||
if (len > BLAKE2B_PERSONALBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_INVALID_CUSTOM_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2b_param_set_personal(&macctx->params, p, len);
|
||||
return 1;
|
||||
|
||||
case EVP_MAC_CTRL_SET_SALT:
|
||||
p = va_arg(args, const unsigned char *);
|
||||
len = va_arg(args, size_t);
|
||||
if (len > BLAKE2B_SALTBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2B_MAC_CTRL, EVP_R_INVALID_SALT_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2b_param_set_salt(&macctx->params, p, len);
|
||||
return 1;
|
||||
|
||||
default:
|
||||
return -2;
|
||||
}
|
||||
}
|
||||
|
||||
static int blake2b_mac_ctrl_int(EVP_MAC_IMPL *macctx, int cmd, ...)
|
||||
{
|
||||
int rv;
|
||||
va_list args;
|
||||
|
||||
va_start(args, cmd);
|
||||
rv = blake2b_mac_ctrl(macctx, cmd, args);
|
||||
va_end(args);
|
||||
|
||||
return rv;
|
||||
}
|
||||
|
||||
static int blake2b_mac_ctrl_str_cb(void *macctx, int cmd, void *buf, size_t buflen)
|
||||
{
|
||||
return blake2b_mac_ctrl_int(macctx, cmd, buf, buflen);
|
||||
}
|
||||
|
||||
static int blake2b_mac_ctrl_str(EVP_MAC_IMPL *macctx, const char *type,
|
||||
const char *value)
|
||||
{
|
||||
if (value == NULL)
|
||||
return 0;
|
||||
|
||||
if (strcmp(type, "outlen") == 0)
|
||||
return blake2b_mac_ctrl_int(macctx, EVP_MAC_CTRL_SET_SIZE, (size_t)atoi(value));
|
||||
if (strcmp(type, "key") == 0)
|
||||
return EVP_str2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
|
||||
value);
|
||||
if (strcmp(type, "hexkey") == 0)
|
||||
return EVP_hex2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
|
||||
value);
|
||||
if (strcmp(type, "custom") == 0)
|
||||
return EVP_str2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
|
||||
value);
|
||||
if (strcmp(type, "hexcustom") == 0)
|
||||
return EVP_hex2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
|
||||
value);
|
||||
if (strcmp(type, "salt") == 0)
|
||||
return EVP_str2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
|
||||
value);
|
||||
if (strcmp(type, "hexsalt") == 0)
|
||||
return EVP_hex2ctrl(blake2b_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
|
||||
value);
|
||||
return -2;
|
||||
}
|
||||
|
||||
static size_t blake2b_mac_size(EVP_MAC_IMPL *macctx)
|
||||
{
|
||||
return macctx->params.digest_length;
|
||||
}
|
||||
|
||||
const EVP_MAC blake2b_mac_meth = {
|
||||
EVP_MAC_BLAKE2B,
|
||||
blake2b_mac_new,
|
||||
blake2b_mac_copy,
|
||||
blake2b_mac_free,
|
||||
blake2b_mac_size,
|
||||
blake2b_mac_init,
|
||||
blake2b_mac_update,
|
||||
blake2b_mac_final,
|
||||
blake2b_mac_ctrl,
|
||||
blake2b_mac_ctrl_str
|
||||
};
|
||||
|
||||
#endif
|
||||
+69
-12
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -58,27 +58,26 @@ static ossl_inline void blake2s_init0(BLAKE2S_CTX *S)
|
||||
}
|
||||
}
|
||||
|
||||
/* init2 xors IV with input parameter block */
|
||||
/* init xors IV with input parameter block and sets the output length */
|
||||
static void blake2s_init_param(BLAKE2S_CTX *S, const BLAKE2S_PARAM *P)
|
||||
{
|
||||
const uint8_t *p = (const uint8_t *)(P);
|
||||
size_t i;
|
||||
const uint8_t *p = (const uint8_t *)(P);
|
||||
|
||||
blake2s_init0(S);
|
||||
S->outlen = P->digest_length;
|
||||
|
||||
/* The param struct is carefully hand packed, and should be 32 bytes on
|
||||
* every platform. */
|
||||
assert(sizeof(BLAKE2S_PARAM) == 32);
|
||||
blake2s_init0(S);
|
||||
/* IV XOR ParamBlock */
|
||||
for (i = 0; i < 8; ++i) {
|
||||
S->h[i] ^= load32(&p[i*4]);
|
||||
}
|
||||
}
|
||||
|
||||
/* Initialize the hashing context. Always returns 1. */
|
||||
int BLAKE2s_Init(BLAKE2S_CTX *c)
|
||||
void blake2s_param_init(BLAKE2S_PARAM *P)
|
||||
{
|
||||
BLAKE2S_PARAM P[1];
|
||||
|
||||
P->digest_length = BLAKE2S_DIGEST_LENGTH;
|
||||
P->key_length = 0;
|
||||
P->fanout = 1;
|
||||
@@ -89,10 +88,59 @@ int BLAKE2s_Init(BLAKE2S_CTX *c)
|
||||
P->inner_length = 0;
|
||||
memset(P->salt, 0, sizeof(P->salt));
|
||||
memset(P->personal, 0, sizeof(P->personal));
|
||||
}
|
||||
|
||||
void blake2s_param_set_digest_length(BLAKE2S_PARAM *P, uint8_t outlen)
|
||||
{
|
||||
P->digest_length = outlen;
|
||||
}
|
||||
|
||||
void blake2s_param_set_key_length(BLAKE2S_PARAM *P, uint8_t keylen)
|
||||
{
|
||||
P->key_length = keylen;
|
||||
}
|
||||
|
||||
void blake2s_param_set_personal(BLAKE2S_PARAM *P, const uint8_t *personal, size_t len)
|
||||
{
|
||||
memcpy(P->personal, personal, len);
|
||||
memset(P->personal + len, 0, BLAKE2S_PERSONALBYTES - len);
|
||||
}
|
||||
|
||||
void blake2s_param_set_salt(BLAKE2S_PARAM *P, const uint8_t *salt, size_t len)
|
||||
{
|
||||
memcpy(P->salt, salt, len);
|
||||
memset(P->salt + len, 0, BLAKE2S_SALTBYTES - len);}
|
||||
|
||||
/*
|
||||
* Initialize the hashing context with the given parameter block.
|
||||
* Always returns 1.
|
||||
*/
|
||||
int BLAKE2s_Init(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P)
|
||||
{
|
||||
blake2s_init_param(c, P);
|
||||
return 1;
|
||||
}
|
||||
|
||||
/*
|
||||
* Initialize the hashing context with the given parameter block and key.
|
||||
* Always returns 1.
|
||||
*/
|
||||
int BLAKE2s_Init_key(BLAKE2S_CTX *c, const BLAKE2S_PARAM *P, const void *key)
|
||||
{
|
||||
blake2s_init_param(c, P);
|
||||
|
||||
/* Pad the key to form first data block */
|
||||
{
|
||||
uint8_t block[BLAKE2S_BLOCKBYTES] = {0};
|
||||
|
||||
memcpy(block, key, P->key_length);
|
||||
BLAKE2s_Update(c, block, BLAKE2S_BLOCKBYTES);
|
||||
OPENSSL_cleanse(block, BLAKE2S_BLOCKBYTES);
|
||||
}
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
/* Permute the state while xoring in the block of data. */
|
||||
static void blake2s_compress(BLAKE2S_CTX *S,
|
||||
const uint8_t *blocks,
|
||||
@@ -246,17 +294,26 @@ int BLAKE2s_Update(BLAKE2S_CTX *c, const void *data, size_t datalen)
|
||||
*/
|
||||
int BLAKE2s_Final(unsigned char *md, BLAKE2S_CTX *c)
|
||||
{
|
||||
uint8_t outbuffer[BLAKE2S_OUTBYTES] = {0};
|
||||
uint8_t *target = outbuffer;
|
||||
int iter = (c->outlen + 3) / 4;
|
||||
int i;
|
||||
|
||||
/* Avoid writing to the temporary buffer if possible */
|
||||
if ((c->outlen % sizeof(c->h[0])) == 0)
|
||||
target = md;
|
||||
|
||||
blake2s_set_lastblock(c);
|
||||
/* Padding */
|
||||
memset(c->buf + c->buflen, 0, sizeof(c->buf) - c->buflen);
|
||||
blake2s_compress(c, c->buf, c->buflen);
|
||||
|
||||
/* Output full hash to temp buffer */
|
||||
for (i = 0; i < 8; ++i) {
|
||||
store32(md + sizeof(c->h[i]) * i, c->h[i]);
|
||||
}
|
||||
/* Output full hash to buffer */
|
||||
for (i = 0; i < iter; ++i)
|
||||
store32(target + sizeof(c->h[i]) * i, c->h[i]);
|
||||
|
||||
if (target != md)
|
||||
memcpy(md, target, c->outlen);
|
||||
|
||||
OPENSSL_cleanse(c, sizeof(BLAKE2S_CTX));
|
||||
return 1;
|
||||
|
||||
@@ -0,0 +1,190 @@
|
||||
/*
|
||||
* Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
* in the file LICENSE in the source distribution or at
|
||||
* https://www.openssl.org/source/license.html
|
||||
*/
|
||||
|
||||
#ifndef OPENSSL_NO_BLAKE2
|
||||
|
||||
# include <openssl/evp.h>
|
||||
# include "blake2_locl.h"
|
||||
# include "internal/cryptlib.h"
|
||||
# include "internal/evp_int.h"
|
||||
|
||||
/* typedef EVP_MAC_IMPL */
|
||||
struct evp_mac_impl_st {
|
||||
BLAKE2S_CTX ctx;
|
||||
BLAKE2S_PARAM params;
|
||||
unsigned char key[BLAKE2S_KEYBYTES];
|
||||
};
|
||||
|
||||
static EVP_MAC_IMPL *blake2s_mac_new(void)
|
||||
{
|
||||
EVP_MAC_IMPL *macctx = OPENSSL_zalloc(sizeof(*macctx));
|
||||
if (macctx != NULL) {
|
||||
blake2s_param_init(&macctx->params);
|
||||
/* ctx initialization is deferred to BLAKE2s_Init() */
|
||||
}
|
||||
return macctx;
|
||||
}
|
||||
|
||||
static void blake2s_mac_free(EVP_MAC_IMPL *macctx)
|
||||
{
|
||||
if (macctx != NULL) {
|
||||
OPENSSL_cleanse(macctx->key, sizeof(macctx->key));
|
||||
OPENSSL_free(macctx);
|
||||
}
|
||||
}
|
||||
|
||||
static int blake2s_mac_copy(EVP_MAC_IMPL *dst, EVP_MAC_IMPL *src)
|
||||
{
|
||||
*dst = *src;
|
||||
return 1;
|
||||
}
|
||||
|
||||
static int blake2s_mac_init(EVP_MAC_IMPL *macctx)
|
||||
{
|
||||
/* Check key has been set */
|
||||
if (macctx->params.key_length == 0) {
|
||||
EVPerr(EVP_F_BLAKE2S_MAC_INIT, EVP_R_NO_KEY_SET);
|
||||
return 0;
|
||||
}
|
||||
|
||||
return BLAKE2s_Init_key(&macctx->ctx, &macctx->params, macctx->key);
|
||||
}
|
||||
|
||||
static int blake2s_mac_update(EVP_MAC_IMPL *macctx, const unsigned char *data,
|
||||
size_t datalen)
|
||||
{
|
||||
return BLAKE2s_Update(&macctx->ctx, data, datalen);
|
||||
}
|
||||
|
||||
static int blake2s_mac_final(EVP_MAC_IMPL *macctx, unsigned char *out)
|
||||
{
|
||||
return BLAKE2s_Final(out, &macctx->ctx);
|
||||
}
|
||||
|
||||
/*
|
||||
* ALL Ctrl functions should be set before init().
|
||||
*/
|
||||
static int blake2s_mac_ctrl(EVP_MAC_IMPL *macctx, int cmd, va_list args)
|
||||
{
|
||||
const unsigned char *p;
|
||||
size_t len;
|
||||
size_t size;
|
||||
|
||||
switch (cmd) {
|
||||
case EVP_MAC_CTRL_SET_SIZE:
|
||||
size = va_arg(args, size_t);
|
||||
if (size < 1 || size > BLAKE2S_OUTBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2s_param_set_digest_length(&macctx->params, (uint8_t)size);
|
||||
return 1;
|
||||
|
||||
case EVP_MAC_CTRL_SET_KEY:
|
||||
p = va_arg(args, const unsigned char *);
|
||||
len = va_arg(args, size_t);
|
||||
if (len < 1 || len > BLAKE2S_KEYBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_INVALID_KEY_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2s_param_set_key_length(&macctx->params, (uint8_t)len);
|
||||
memcpy(macctx->key, p, len);
|
||||
memset(macctx->key + len, 0, BLAKE2S_KEYBYTES - len);
|
||||
return 1;
|
||||
|
||||
case EVP_MAC_CTRL_SET_CUSTOM:
|
||||
p = va_arg(args, const unsigned char *);
|
||||
len = va_arg(args, size_t);
|
||||
if (len > BLAKE2S_PERSONALBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_INVALID_CUSTOM_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2s_param_set_personal(&macctx->params, p, len);
|
||||
return 1;
|
||||
|
||||
case EVP_MAC_CTRL_SET_SALT:
|
||||
p = va_arg(args, const unsigned char *);
|
||||
len = va_arg(args, size_t);
|
||||
if (len > BLAKE2S_SALTBYTES) {
|
||||
EVPerr(EVP_F_BLAKE2S_MAC_CTRL, EVP_R_INVALID_SALT_LENGTH);
|
||||
return 0;
|
||||
}
|
||||
blake2s_param_set_salt(&macctx->params, p, len);
|
||||
return 1;
|
||||
|
||||
default:
|
||||
return -2;
|
||||
}
|
||||
}
|
||||
|
||||
static int blake2s_mac_ctrl_int(EVP_MAC_IMPL *macctx, int cmd, ...)
|
||||
{
|
||||
int rv;
|
||||
va_list args;
|
||||
|
||||
va_start(args, cmd);
|
||||
rv = blake2s_mac_ctrl(macctx, cmd, args);
|
||||
va_end(args);
|
||||
|
||||
return rv;
|
||||
}
|
||||
|
||||
static int blake2s_mac_ctrl_str_cb(void *macctx, int cmd, void *buf, size_t buflen)
|
||||
{
|
||||
return blake2s_mac_ctrl_int(macctx, cmd, buf, buflen);
|
||||
}
|
||||
|
||||
static int blake2s_mac_ctrl_str(EVP_MAC_IMPL *macctx, const char *type,
|
||||
const char *value)
|
||||
{
|
||||
if (value == NULL)
|
||||
return 0;
|
||||
|
||||
if (strcmp(type, "outlen") == 0)
|
||||
return blake2s_mac_ctrl_int(macctx, EVP_MAC_CTRL_SET_SIZE, (size_t)atoi(value));
|
||||
if (strcmp(type, "key") == 0)
|
||||
return EVP_str2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
|
||||
value);
|
||||
if (strcmp(type, "hexkey") == 0)
|
||||
return EVP_hex2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_KEY,
|
||||
value);
|
||||
if (strcmp(type, "custom") == 0)
|
||||
return EVP_str2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
|
||||
value);
|
||||
if (strcmp(type, "hexcustom") == 0)
|
||||
return EVP_hex2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_CUSTOM,
|
||||
value);
|
||||
if (strcmp(type, "salt") == 0)
|
||||
return EVP_str2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
|
||||
value);
|
||||
if (strcmp(type, "hexsalt") == 0)
|
||||
return EVP_hex2ctrl(blake2s_mac_ctrl_str_cb, macctx, EVP_MAC_CTRL_SET_SALT,
|
||||
value);
|
||||
return -2;
|
||||
}
|
||||
|
||||
static size_t blake2s_mac_size(EVP_MAC_IMPL *macctx)
|
||||
{
|
||||
return macctx->params.digest_length;
|
||||
}
|
||||
|
||||
const EVP_MAC blake2s_mac_meth = {
|
||||
EVP_MAC_BLAKE2S,
|
||||
blake2s_mac_new,
|
||||
blake2s_mac_copy,
|
||||
blake2s_mac_free,
|
||||
blake2s_mac_size,
|
||||
blake2s_mac_init,
|
||||
blake2s_mac_update,
|
||||
blake2s_mac_final,
|
||||
blake2s_mac_ctrl,
|
||||
blake2s_mac_ctrl_str
|
||||
};
|
||||
|
||||
#endif
|
||||
@@ -1,3 +1,3 @@
|
||||
LIBS=../../libcrypto
|
||||
SOURCE[../../libcrypto]=\
|
||||
blake2b.c blake2s.c m_blake2b.c m_blake2s.c
|
||||
blake2b.c blake2s.c blake2b_mac.c blake2s_mac.c m_blake2b.c m_blake2s.c
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -25,7 +25,9 @@
|
||||
|
||||
static int init(EVP_MD_CTX *ctx)
|
||||
{
|
||||
return BLAKE2b_Init(EVP_MD_CTX_md_data(ctx));
|
||||
BLAKE2B_PARAM P;
|
||||
blake2b_param_init(&P);
|
||||
return BLAKE2b_Init(EVP_MD_CTX_md_data(ctx), &P);
|
||||
}
|
||||
|
||||
static int update(EVP_MD_CTX *ctx, const void *data, size_t count)
|
||||
@@ -49,7 +51,7 @@ static const EVP_MD blake2b_md = {
|
||||
NULL,
|
||||
NULL,
|
||||
BLAKE2B_BLOCKBYTES,
|
||||
sizeof(EVP_MD *) + sizeof(BLAKE2B_CTX),
|
||||
sizeof(BLAKE2B_CTX),
|
||||
};
|
||||
|
||||
const EVP_MD *EVP_blake2b512(void)
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
|
||||
* Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
|
||||
*
|
||||
* Licensed under the Apache License 2.0 (the "License"). You may not use
|
||||
* this file except in compliance with the License. You can obtain a copy
|
||||
@@ -25,7 +25,9 @@
|
||||
|
||||
static int init(EVP_MD_CTX *ctx)
|
||||
{
|
||||
return BLAKE2s_Init(EVP_MD_CTX_md_data(ctx));
|
||||
BLAKE2S_PARAM P;
|
||||
blake2s_param_init(&P);
|
||||
return BLAKE2s_Init(EVP_MD_CTX_md_data(ctx), &P);
|
||||
}
|
||||
|
||||
static int update(EVP_MD_CTX *ctx, const void *data, size_t count)
|
||||
@@ -49,7 +51,7 @@ static const EVP_MD blake2s_md = {
|
||||
NULL,
|
||||
NULL,
|
||||
BLAKE2S_BLOCKBYTES,
|
||||
sizeof(EVP_MD *) + sizeof(BLAKE2S_CTX),
|
||||
sizeof(BLAKE2S_CTX),
|
||||
};
|
||||
|
||||
const EVP_MD *EVP_blake2s256(void)
|
||||
|
||||
@@ -47,7 +47,7 @@
|
||||
// on Itanium2! What to do? Reschedule loops for Itanium2? But then
|
||||
// Itanium would exhibit anti-scalability. So I've chosen to reschedule
|
||||
// for worst latency for every instruction aiming for best *all-round*
|
||||
// performance.
|
||||
// performance.
|
||||
|
||||
// Q. How much faster does it get?
|
||||
// A. Here is the output from 'openssl speed rsa dsa' for vanilla
|
||||
@@ -471,7 +471,7 @@ bn_mul_add_words:
|
||||
.global bn_sqr_words#
|
||||
.proc bn_sqr_words#
|
||||
.align 64
|
||||
.skip 32 // makes the loop body aligned at 64-byte boundary
|
||||
.skip 32 // makes the loop body aligned at 64-byte boundary
|
||||
bn_sqr_words:
|
||||
.prologue
|
||||
.save ar.pfs,r2
|
||||
|
||||
@@ -154,9 +154,9 @@
|
||||
.register %g2,#scratch
|
||||
.register %g3,#scratch
|
||||
# define FRAME_SIZE -192
|
||||
#else
|
||||
#else
|
||||
# define FRAME_SIZE -96
|
||||
#endif
|
||||
#endif
|
||||
/*
|
||||
* GNU assembler can't stand stuw:-(
|
||||
*/
|
||||
|
||||
+2
-2
@@ -256,7 +256,7 @@ static int BN_STACK_push(BN_STACK *st, unsigned int idx)
|
||||
unsigned int newsize =
|
||||
st->size ? (st->size * 3 / 2) : BN_CTX_START_FRAMES;
|
||||
unsigned int *newitems;
|
||||
|
||||
|
||||
if ((newitems = OPENSSL_malloc(sizeof(*newitems) * newsize)) == NULL) {
|
||||
BNerr(BN_F_BN_STACK_PUSH, ERR_R_MALLOC_FAILURE);
|
||||
return 0;
|
||||
@@ -310,7 +310,7 @@ static BIGNUM *BN_POOL_get(BN_POOL *p, int flag)
|
||||
/* Full; allocate a new pool item and link it in. */
|
||||
if (p->used == p->size) {
|
||||
BN_POOL_ITEM *item;
|
||||
|
||||
|
||||
if ((item = OPENSSL_malloc(sizeof(*item))) == NULL) {
|
||||
BNerr(BN_F_BN_POOL_GET, ERR_R_MALLOC_FAILURE);
|
||||
return NULL;
|
||||
|
||||
@@ -14,9 +14,6 @@ SOURCE[../libcrypto]=\
|
||||
threads_pthread.c threads_win.c threads_none.c getenv.c \
|
||||
o_init.c o_fips.c mem_sec.c init.c {- $target{cpuid_asm_src} -} \
|
||||
{- $target{uplink_aux_src} -}
|
||||
EXTRA= ../ms/uplink-x86.pl ../ms/uplink.c ../ms/applink.c \
|
||||
x86cpuid.pl x86_64cpuid.pl ia64cpuid.S \
|
||||
ppccpuid.pl pariscid.pl alphacpuid.pl arm64cpuid.pl armv4cpuid.pl
|
||||
|
||||
DEPEND[cversion.o]=buildinf.h
|
||||
GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(LIB_CFLAGS) $(CPPFLAGS_Q)" "$(PLATFORM)"
|
||||
|
||||
@@ -10,10 +10,5 @@ INCLUDE[chacha-armv4.o]=..
|
||||
GENERATE[chacha-armv8.S]=asm/chacha-armv8.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[chacha-armv8.o]=..
|
||||
INCLUDE[chacha-s390x.o]=..
|
||||
|
||||
BEGINRAW[Makefile(unix)]
|
||||
##### CHACHA assembler implementations
|
||||
|
||||
{- $builddir -}/chacha-%.S: {- $sourcedir -}/asm/chacha-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
ENDRAW[Makefile(unix)]
|
||||
GENERATE[chacha-c64xplus.S]=asm/chacha-c64xplus.pl $(PERLASM_SCHEME)
|
||||
GENERATE[chacha-s390x.S]=asm/chacha-s390x.pl $(PERLASM_SCHEME)
|
||||
+3
-3
@@ -352,9 +352,9 @@ void OPENSSL_showfatal(const char *fmta, ...)
|
||||
|
||||
/*
|
||||
* TODO: (For non GUI and no std error cases)
|
||||
* Add event logging feature here.
|
||||
* Add event logging feature here.
|
||||
*/
|
||||
|
||||
|
||||
# if !defined(NDEBUG)
|
||||
/*
|
||||
* We are in a situation where we tried to report a critical
|
||||
@@ -393,7 +393,7 @@ void OPENSSL_showfatal(const char *fmta, ...)
|
||||
# endif
|
||||
# else
|
||||
MessageBox(NULL, buf, _T("OpenSSL: FATAL"), MB_OK | MB_ICONERROR);
|
||||
# endif
|
||||
# endif
|
||||
}
|
||||
#else
|
||||
void OPENSSL_showfatal(const char *fmta, ...)
|
||||
|
||||
@@ -311,7 +311,7 @@ $4:
|
||||
sll out1, 28, out1 ! rotate
|
||||
xor $1, local1, $1 ! 1 finished, local1 now sbox 7
|
||||
|
||||
ld [global2+local2], local2 ! 2
|
||||
ld [global2+local2], local2 ! 2
|
||||
srl out0, 24, local1 ! 7
|
||||
or out1, local0, out1 ! rotate
|
||||
|
||||
@@ -1390,7 +1390,7 @@ DES_ncbc_encrypt:
|
||||
add %o7,global1,global1
|
||||
sub global1,.PIC.DES_SPtrans-.des_and,out2
|
||||
|
||||
cmp in5, 0 ! enc
|
||||
cmp in5, 0 ! enc
|
||||
|
||||
be .ncbc.dec
|
||||
STPTR in4, IVEC
|
||||
|
||||
@@ -174,9 +174,7 @@ static int pkey_dsa_ctrl_str(EVP_PKEY_CTX *ctx,
|
||||
}
|
||||
if (strcmp(type, "dsa_paramgen_q_bits") == 0) {
|
||||
int qbits = atoi(value);
|
||||
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DSA, EVP_PKEY_OP_PARAMGEN,
|
||||
EVP_PKEY_CTRL_DSA_PARAMGEN_Q_BITS, qbits,
|
||||
NULL);
|
||||
return EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, qbits);
|
||||
}
|
||||
if (strcmp(type, "dsa_paramgen_md") == 0) {
|
||||
const EVP_MD *md = EVP_get_digestbyname(value);
|
||||
@@ -185,9 +183,7 @@ static int pkey_dsa_ctrl_str(EVP_PKEY_CTX *ctx,
|
||||
DSAerr(DSA_F_PKEY_DSA_CTRL_STR, DSA_R_INVALID_DIGEST_TYPE);
|
||||
return 0;
|
||||
}
|
||||
return EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_DSA, EVP_PKEY_OP_PARAMGEN,
|
||||
EVP_PKEY_CTRL_DSA_PARAMGEN_MD, 0,
|
||||
(void *)md);
|
||||
return EVP_PKEY_CTX_set_dsa_paramgen_md(ctx, md);
|
||||
}
|
||||
return -2;
|
||||
}
|
||||
|
||||
@@ -29,11 +29,6 @@ GENERATE[ecp_nistz256-ppc64.s]=asm/ecp_nistz256-ppc64.pl $(PERLASM_SCHEME)
|
||||
GENERATE[x25519-x86_64.s]=asm/x25519-x86_64.pl $(PERLASM_SCHEME)
|
||||
GENERATE[x25519-ppc64.s]=asm/x25519-ppc64.pl $(PERLASM_SCHEME)
|
||||
|
||||
BEGINRAW[Makefile]
|
||||
{- $builddir -}/ecp_nistz256-%.S: {- $sourcedir -}/asm/ecp_nistz256-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
ENDRAW[Makefile]
|
||||
|
||||
INCLUDE[curve448/arch_32/f_impl.o]=curve448/arch_32 curve448
|
||||
INCLUDE[curve448/f_generic.o]=curve448/arch_32 curve448
|
||||
INCLUDE[curve448/scalar.o]=curve448/arch_32 curve448
|
||||
|
||||
@@ -116,7 +116,7 @@ void curve448_scalar_encode(unsigned char ser[C448_SCALAR_BYTES],
|
||||
|
||||
/*
|
||||
* Add two scalars. |a|, |b| and |out| may alias each other.
|
||||
*
|
||||
*
|
||||
* a (in): One scalar.
|
||||
* b (in): Another scalar.
|
||||
* out (out): a+b.
|
||||
@@ -135,7 +135,7 @@ void curve448_scalar_sub(curve448_scalar_t out,
|
||||
|
||||
/*
|
||||
* Multiply two scalars. |a|, |b| and |out| may alias each other.
|
||||
*
|
||||
*
|
||||
* a (in): One scalar.
|
||||
* b (in): Another scalar.
|
||||
* out (out): a*b.
|
||||
@@ -145,7 +145,7 @@ void curve448_scalar_mul(curve448_scalar_t out,
|
||||
|
||||
/*
|
||||
* Halve a scalar. |a| and |out| may alias each other.
|
||||
*
|
||||
*
|
||||
* a (in): A scalar.
|
||||
* out (out): a/2.
|
||||
*/
|
||||
@@ -154,7 +154,7 @@ void curve448_scalar_halve(curve448_scalar_t out, const curve448_scalar_t a);
|
||||
/*
|
||||
* Copy a scalar. The scalars may alias each other, in which case this
|
||||
* function does nothing.
|
||||
*
|
||||
*
|
||||
* a (in): A scalar.
|
||||
* out (out): Will become a copy of a.
|
||||
*/
|
||||
@@ -183,7 +183,7 @@ static ossl_inline void curve448_point_copy(curve448_point_t a,
|
||||
*
|
||||
* a (in): A point.
|
||||
* b (in): Another point.
|
||||
*
|
||||
*
|
||||
* Returns:
|
||||
* C448_TRUE: The points are equal.
|
||||
* C448_FALSE: The points are not equal.
|
||||
@@ -243,7 +243,7 @@ void curve448_point_mul_by_ratio_and_encode_like_x448(
|
||||
/*
|
||||
* RFC 7748 Diffie-Hellman base point scalarmul. This function uses a different
|
||||
* (non-Decaf) encoding.
|
||||
*
|
||||
*
|
||||
* out (out): The scaled point base*scalar
|
||||
* scalar (in): The scalar to multiply by.
|
||||
*/
|
||||
@@ -273,7 +273,7 @@ void curve448_precomputed_scalarmul(curve448_point_t scaled,
|
||||
* base2 (in): A second point to be scaled.
|
||||
* scalar2 (in) A second scalar to multiply by.
|
||||
*
|
||||
* Warning: This function takes variable time, and may leak the scalars used.
|
||||
* Warning: This function takes variable time, and may leak the scalars used.
|
||||
* It is designed for signature verification.
|
||||
*/
|
||||
void curve448_base_double_scalarmul_non_secret(curve448_point_t combo,
|
||||
|
||||
@@ -26,7 +26,7 @@ algorithm/mode pair are;
|
||||
EVP_EncryptInit(&ctx, cipher, key, iv);
|
||||
[ ... use EVP_EncryptUpdate() and EVP_EncryptFinal() ...]
|
||||
|
||||
(ii) indirectly;
|
||||
(ii) indirectly;
|
||||
OpenSSL_add_all_ciphers();
|
||||
cipher = EVP_get_cipherbyname("des_cbc");
|
||||
EVP_EncryptInit(&ctx, cipher, key, iv);
|
||||
|
||||
@@ -124,7 +124,7 @@ static int int_cleanup_check(int create)
|
||||
static ENGINE_CLEANUP_ITEM *int_cleanup_item(ENGINE_CLEANUP_CB *cb)
|
||||
{
|
||||
ENGINE_CLEANUP_ITEM *item;
|
||||
|
||||
|
||||
if ((item = OPENSSL_malloc(sizeof(*item))) == NULL) {
|
||||
ENGINEerr(ENGINE_F_INT_CLEANUP_ITEM, ERR_R_MALLOC_FAILURE);
|
||||
return NULL;
|
||||
|
||||
@@ -730,6 +730,10 @@ EVP_F_ARIA_GCM_CTRL:197:aria_gcm_ctrl
|
||||
EVP_F_ARIA_GCM_INIT_KEY:176:aria_gcm_init_key
|
||||
EVP_F_ARIA_INIT_KEY:185:aria_init_key
|
||||
EVP_F_B64_NEW:198:b64_new
|
||||
EVP_F_BLAKE2B_MAC_CTRL:220:blake2b_mac_ctrl
|
||||
EVP_F_BLAKE2B_MAC_INIT:221:blake2b_mac_init
|
||||
EVP_F_BLAKE2S_MAC_CTRL:222:blake2s_mac_ctrl
|
||||
EVP_F_BLAKE2S_MAC_INIT:223:blake2s_mac_init
|
||||
EVP_F_CAMELLIA_INIT_KEY:159:camellia_init_key
|
||||
EVP_F_CHACHA20_POLY1305_CTRL:182:chacha20_poly1305_ctrl
|
||||
EVP_F_CMLL_T4_INIT_KEY:179:cmll_t4_init_key
|
||||
@@ -2263,6 +2267,7 @@ EVP_R_INVALID_FIPS_MODE:168:invalid fips mode
|
||||
EVP_R_INVALID_KEY:163:invalid key
|
||||
EVP_R_INVALID_KEY_LENGTH:130:invalid key length
|
||||
EVP_R_INVALID_OPERATION:148:invalid operation
|
||||
EVP_R_INVALID_SALT_LENGTH:186:invalid salt length
|
||||
EVP_R_KEYGEN_FAILURE:120:keygen failure
|
||||
EVP_R_KEY_SETUP_FAILED:180:key setup failed
|
||||
EVP_R_MEMORY_LIMIT_EXCEEDED:172:memory limit exceeded
|
||||
|
||||
@@ -12,6 +12,10 @@
|
||||
|
||||
void openssl_add_all_macs_int(void)
|
||||
{
|
||||
#ifndef OPENSSL_NO_BLAKE2
|
||||
EVP_add_mac(&blake2b_mac_meth);
|
||||
EVP_add_mac(&blake2s_mac_meth);
|
||||
#endif
|
||||
#ifndef OPENSSL_NO_CMAC
|
||||
EVP_add_mac(&cmac_meth);
|
||||
#endif
|
||||
|
||||
+1
-1
@@ -3081,7 +3081,7 @@ static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
|
||||
if (out != in
|
||||
|| len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))
|
||||
return -1;
|
||||
|
||||
|
||||
/*
|
||||
* Check for too many keys as per FIPS 140-2 IG A.5 "Key/IV Pair Uniqueness
|
||||
* Requirements from SP 800-38D". The requirements is for one party to the
|
||||
|
||||
@@ -27,6 +27,10 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_GCM_INIT_KEY, 0), "aria_gcm_init_key"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_ARIA_INIT_KEY, 0), "aria_init_key"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_B64_NEW, 0), "b64_new"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2B_MAC_CTRL, 0), "blake2b_mac_ctrl"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2B_MAC_INIT, 0), "blake2b_mac_init"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2S_MAC_CTRL, 0), "blake2s_mac_ctrl"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_BLAKE2S_MAC_INIT, 0), "blake2s_mac_init"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_CAMELLIA_INIT_KEY, 0), "camellia_init_key"},
|
||||
{ERR_PACK(ERR_LIB_EVP, EVP_F_CHACHA20_POLY1305_CTRL, 0),
|
||||
"chacha20_poly1305_ctrl"},
|
||||
@@ -226,6 +230,8 @@ static const ERR_STRING_DATA EVP_str_reasons[] = {
|
||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_KEY), "invalid key"},
|
||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_KEY_LENGTH), "invalid key length"},
|
||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_OPERATION), "invalid operation"},
|
||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_INVALID_SALT_LENGTH),
|
||||
"invalid salt length"},
|
||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_KEYGEN_FAILURE), "keygen failure"},
|
||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_KEY_SETUP_FAILED), "key setup failed"},
|
||||
{ERR_PACK(ERR_LIB_EVP, 0, EVP_R_MEMORY_LIMIT_EXCEEDED),
|
||||
|
||||
@@ -128,6 +128,8 @@ struct evp_mac_st {
|
||||
int (*ctrl_str) (EVP_MAC_IMPL *macctx, const char *type, const char *value);
|
||||
};
|
||||
|
||||
extern const EVP_MAC blake2b_mac_meth;
|
||||
extern const EVP_MAC blake2s_mac_meth;
|
||||
extern const EVP_MAC cmac_meth;
|
||||
extern const EVP_MAC gmac_meth;
|
||||
extern const EVP_MAC hmac_meth;
|
||||
|
||||
@@ -22,9 +22,4 @@ GENERATE[ghashv8-armx.S]=asm/ghashv8-armx.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[ghashv8-armx.o]=..
|
||||
GENERATE[ghash-s390x.S]=asm/ghash-s390x.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[ghash-s390x.o]=..
|
||||
|
||||
BEGINRAW[Makefile]
|
||||
# GNU make "catch all"
|
||||
{- $builddir -}/ghash-%.S: {- $sourcedir -}/asm/ghash-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
ENDRAW[Makefile]
|
||||
GENERATE[ghash-c64xplus.S]=asm/ghash-c64xplus.pl $(PERLASM_SCHEME)
|
||||
@@ -1079,7 +1079,7 @@ static const unsigned char so[7767] = {
|
||||
0x28,0xCC,0x45,0x03,0x04, /* [ 7761] OBJ_gmac */
|
||||
};
|
||||
|
||||
#define NUM_NID 1202
|
||||
#define NUM_NID 1204
|
||||
static const ASN1_OBJECT nid_objs[NUM_NID] = {
|
||||
{"UNDEF", "undefined", NID_undef},
|
||||
{"rsadsi", "RSA Data Security, Inc.", NID_rsadsi, 6, &so[0]},
|
||||
@@ -2282,10 +2282,12 @@ static const ASN1_OBJECT nid_objs[NUM_NID] = {
|
||||
{"AES-128-SIV", "aes-128-siv", NID_aes_128_siv},
|
||||
{"AES-192-SIV", "aes-192-siv", NID_aes_192_siv},
|
||||
{"AES-256-SIV", "aes-256-siv", NID_aes_256_siv},
|
||||
{"BLAKE2BMAC", "blake2bmac", NID_blake2bmac},
|
||||
{"BLAKE2SMAC", "blake2smac", NID_blake2smac},
|
||||
{"ChaCha20-Poly1305-D", "chacha20-poly1305-draft", NID_chacha20_poly1305_draft },
|
||||
};
|
||||
|
||||
#define NUM_SN 1193
|
||||
#define NUM_SN 1195
|
||||
static const unsigned int sn_objs[NUM_SN] = {
|
||||
364, /* "AD_DVCS" */
|
||||
419, /* "AES-128-CBC" */
|
||||
@@ -2363,6 +2365,8 @@ static const unsigned int sn_objs[NUM_SN] = {
|
||||
93, /* "BF-CFB" */
|
||||
92, /* "BF-ECB" */
|
||||
94, /* "BF-OFB" */
|
||||
1201, /* "BLAKE2BMAC" */
|
||||
1202, /* "BLAKE2SMAC" */
|
||||
1056, /* "BLAKE2b512" */
|
||||
1057, /* "BLAKE2s256" */
|
||||
14, /* "C" */
|
||||
@@ -2406,7 +2410,7 @@ static const unsigned int sn_objs[NUM_SN] = {
|
||||
417, /* "CSPName" */
|
||||
1019, /* "ChaCha20" */
|
||||
1018, /* "ChaCha20-Poly1305" */
|
||||
1201, /* "chacha20-poly1305-draft" */
|
||||
1203, /* "chacha20-poly1305-draft" */
|
||||
367, /* "CrlID" */
|
||||
391, /* "DC" */
|
||||
31, /* "DES-CBC" */
|
||||
@@ -3482,7 +3486,7 @@ static const unsigned int sn_objs[NUM_SN] = {
|
||||
1093, /* "x509ExtAdmission" */
|
||||
};
|
||||
|
||||
#define NUM_LN 1193
|
||||
#define NUM_LN 1195
|
||||
static const unsigned int ln_objs[NUM_LN] = {
|
||||
363, /* "AD Time Stamping" */
|
||||
405, /* "ANSI X9.62" */
|
||||
@@ -3784,7 +3788,9 @@ static const unsigned int ln_objs[NUM_LN] = {
|
||||
92, /* "bf-ecb" */
|
||||
94, /* "bf-ofb" */
|
||||
1056, /* "blake2b512" */
|
||||
1201, /* "blake2bmac" */
|
||||
1057, /* "blake2s256" */
|
||||
1202, /* "blake2smac" */
|
||||
921, /* "brainpoolP160r1" */
|
||||
922, /* "brainpoolP160t1" */
|
||||
923, /* "brainpoolP192r1" */
|
||||
@@ -3864,7 +3870,7 @@ static const unsigned int ln_objs[NUM_LN] = {
|
||||
883, /* "certificateRevocationList" */
|
||||
1019, /* "chacha20" */
|
||||
1018, /* "chacha20-poly1305" */
|
||||
1201, /* "ChaCha20-Poly1305-D" */
|
||||
1203, /* "ChaCha20-Poly1305-D" */
|
||||
54, /* "challengePassword" */
|
||||
407, /* "characteristic-two-field" */
|
||||
395, /* "clearance" */
|
||||
|
||||
@@ -1198,4 +1198,6 @@ kmac256 1197
|
||||
aes_128_siv 1198
|
||||
aes_192_siv 1199
|
||||
aes_256_siv 1200
|
||||
chacha20_poly1305_draft 1201
|
||||
blake2bmac 1201
|
||||
blake2smac 1202
|
||||
chacha20_poly1305_draft 1203
|
||||
@@ -17,7 +17,9 @@ iso 0 9797 3 4 : GMAC : gmac
|
||||
# There are no OIDs for these yet...
|
||||
: KMAC128 : kmac128
|
||||
: KMAC256 : kmac256
|
||||
|
||||
: BLAKE2BMAC : blake2bmac
|
||||
: BLAKE2SMAC : blake2smac
|
||||
|
||||
# HMAC OIDs
|
||||
identified-organization 6 1 5 5 8 1 1 : HMAC-MD5 : hmac-md5
|
||||
identified-organization 6 1 5 5 8 1 2 : HMAC-SHA1 : hmac-sha1
|
||||
|
||||
@@ -297,7 +297,7 @@ int PEM_X509_INFO_write_bio(BIO *bp, X509_INFO *xi, EVP_CIPHER *enc,
|
||||
goto err;
|
||||
}
|
||||
|
||||
/* Create the right magic header stuff */
|
||||
/* Create the right magic header stuff */
|
||||
buf[0] = '\0';
|
||||
PEM_proc_type(buf, PEM_TYPE_ENCRYPTED);
|
||||
PEM_dek_info(buf, objstr, EVP_CIPHER_iv_length(enc),
|
||||
|
||||
@@ -273,6 +273,8 @@ my $mtvrwz = sub {
|
||||
my ($f, $vrt, $ra) = @_;
|
||||
" .long ".sprintf "0x%X",(31<<26)|($vrt<<21)|($ra<<16)|(243<<1)|1;
|
||||
};
|
||||
my $lvwzx_u = sub { vsxmem_op(@_, 12); }; # lxsiwzx
|
||||
my $stvwx_u = sub { vsxmem_op(@_, 140); }; # stxsiwx
|
||||
|
||||
# PowerISA 3.0 stuff
|
||||
my $maddhdu = sub { vfour(@_,49); };
|
||||
|
||||
+1440
-108
@@ -8,10 +8,10 @@
|
||||
|
||||
#
|
||||
# ====================================================================
|
||||
# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
|
||||
# project. The module is, however, dual licensed under OpenSSL and
|
||||
# CRYPTOGAMS licenses depending on where you obtain it. For further
|
||||
# details see http://www.openssl.org/~appro/cryptogams/.
|
||||
# Written by Andy Polyakov, @dot-asm, initially for use in the OpenSSL
|
||||
# project. The module is dual licensed under OpenSSL and CRYPTOGAMS
|
||||
# licenses depending on where you obtain it. For further details see
|
||||
# https://github.com/dot-asm/cryptogams/.
|
||||
# ====================================================================
|
||||
#
|
||||
# This module implements Poly1305 hash for PowerPC.
|
||||
@@ -44,6 +44,13 @@
|
||||
#
|
||||
# On side note, Power ISA 2.07 enables vector base 2^26 implementation,
|
||||
# and POWER8 might have capacity to break 1.0 cycle per byte barrier...
|
||||
#
|
||||
# January 2019
|
||||
#
|
||||
# ... Unfortunately not:-( Estimate was a projection of ARM result,
|
||||
# but ARM has vector multiply-n-add instruction, while PowerISA does
|
||||
# not, not one usable in the context. Improvement is ~40% over -m64
|
||||
# result above and is ~1.43 on little-endian systems.
|
||||
|
||||
$flavour = shift;
|
||||
|
||||
@@ -99,6 +106,7 @@ $code.=<<___;
|
||||
std r0,0($ctx) # zero hash value
|
||||
std r0,8($ctx)
|
||||
std r0,16($ctx)
|
||||
stw r0,24($ctx) # clear is_base2_26
|
||||
|
||||
$UCMP $inp,r0
|
||||
beq- Lno_key
|
||||
@@ -140,6 +148,7 @@ Lno_key:
|
||||
.globl .poly1305_blocks
|
||||
.align 4
|
||||
.poly1305_blocks:
|
||||
Lpoly1305_blocks:
|
||||
srdi. $len,$len,4
|
||||
beq- Labort
|
||||
|
||||
@@ -238,60 +247,120 @@ Labort:
|
||||
.long 0
|
||||
.byte 0,12,4,1,0x80,5,4,0
|
||||
.size .poly1305_blocks,.-.poly1305_blocks
|
||||
___
|
||||
{
|
||||
my ($h0,$h1,$h2,$h3,$h4,$t0) = map("r$_",(7..12));
|
||||
|
||||
$code.=<<___;
|
||||
.globl .poly1305_emit
|
||||
.align 4
|
||||
.align 5
|
||||
.poly1305_emit:
|
||||
ld $h0,0($ctx) # load hash
|
||||
ld $h1,8($ctx)
|
||||
ld $h2,16($ctx)
|
||||
ld $padbit,0($nonce) # load nonce
|
||||
ld $nonce,8($nonce)
|
||||
lwz $h0,0($ctx) # load hash value base 2^26
|
||||
lwz $h1,4($ctx)
|
||||
lwz $h2,8($ctx)
|
||||
lwz $h3,12($ctx)
|
||||
lwz $h4,16($ctx)
|
||||
lwz r0,24($ctx) # is_base2_26
|
||||
|
||||
addic $d0,$h0,5 # compare to modulus
|
||||
addze $d1,$h1
|
||||
addze $d2,$h2
|
||||
sldi $h1,$h1,26 # base 2^26 -> base 2^64
|
||||
sldi $t0,$h2,52
|
||||
srdi $h2,$h2,12
|
||||
sldi $h3,$h3,14
|
||||
add $h0,$h0,$h1
|
||||
addc $h0,$h0,$t0
|
||||
sldi $t0,$h4,40
|
||||
srdi $h4,$h4,24
|
||||
adde $h1,$h2,$h3
|
||||
addc $h1,$h1,$t0
|
||||
addze $h2,$h4
|
||||
|
||||
srdi $mask,$d2,2 # did it carry/borrow?
|
||||
neg $mask,$mask
|
||||
ld $h3,0($ctx) # load hash value base 2^64
|
||||
ld $h4,8($ctx)
|
||||
ld $t0,16($ctx)
|
||||
|
||||
neg r0,r0
|
||||
xor $h0,$h0,$h3 # choose between radixes
|
||||
xor $h1,$h1,$h4
|
||||
xor $h2,$h2,$t0
|
||||
and $h0,$h0,r0
|
||||
and $h1,$h1,r0
|
||||
and $h2,$h2,r0
|
||||
xor $h0,$h0,$h3
|
||||
xor $h1,$h1,$h4
|
||||
xor $h2,$h2,$t0
|
||||
|
||||
addic $h3,$h0,5 # compare to modulus
|
||||
addze $h4,$h1
|
||||
addze $t0,$h2
|
||||
|
||||
srdi $t0,$t0,2 # see if it carried/borrowed
|
||||
neg $t0,$t0
|
||||
|
||||
andc $h0,$h0,$t0
|
||||
and $h3,$h3,$t0
|
||||
andc $h1,$h1,$t0
|
||||
and $h4,$h4,$t0
|
||||
or $h0,$h0,$h3
|
||||
or $h1,$h1,$h4
|
||||
|
||||
lwz $t0,4($nonce)
|
||||
lwz $h2,12($nonce)
|
||||
lwz $h3,0($nonce)
|
||||
lwz $h4,8($nonce)
|
||||
|
||||
insrdi $h3,$t0,32,0
|
||||
insrdi $h4,$h2,32,0
|
||||
|
||||
addc $h0,$h0,$h3 # accumulate nonce
|
||||
adde $h1,$h1,$h4
|
||||
|
||||
addi $ctx,$mac,-1
|
||||
addi $mac,$mac,7
|
||||
|
||||
stbu $h0,1($ctx) # write [little-endian] result
|
||||
srdi $h0,$h0,8
|
||||
stbu $h1,1($mac)
|
||||
srdi $h1,$h1,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srdi $h0,$h0,8
|
||||
stbu $h1,1($mac)
|
||||
srdi $h1,$h1,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srdi $h0,$h0,8
|
||||
stbu $h1,1($mac)
|
||||
srdi $h1,$h1,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srdi $h0,$h0,8
|
||||
stbu $h1,1($mac)
|
||||
srdi $h1,$h1,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srdi $h0,$h0,8
|
||||
stbu $h1,1($mac)
|
||||
srdi $h1,$h1,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srdi $h0,$h0,8
|
||||
stbu $h1,1($mac)
|
||||
srdi $h1,$h1,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srdi $h0,$h0,8
|
||||
stbu $h1,1($mac)
|
||||
srdi $h1,$h1,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
stbu $h1,1($mac)
|
||||
|
||||
andc $h0,$h0,$mask
|
||||
and $d0,$d0,$mask
|
||||
andc $h1,$h1,$mask
|
||||
and $d1,$d1,$mask
|
||||
or $h0,$h0,$d0
|
||||
or $h1,$h1,$d1
|
||||
___
|
||||
$code.=<<___ if (!$LITTLE_ENDIAN);
|
||||
rotldi $padbit,$padbit,32 # flip nonce words
|
||||
rotldi $nonce,$nonce,32
|
||||
___
|
||||
$code.=<<___;
|
||||
addc $h0,$h0,$padbit # accumulate nonce
|
||||
adde $h1,$h1,$nonce
|
||||
___
|
||||
$code.=<<___ if ($LITTLE_ENDIAN);
|
||||
std $h0,0($mac) # write result
|
||||
std $h1,8($mac)
|
||||
___
|
||||
$code.=<<___ if (!$LITTLE_ENDIAN);
|
||||
extrdi r0,$h0,32,0
|
||||
li $d0,4
|
||||
stwbrx $h0,0,$mac # write result
|
||||
extrdi $h0,$h1,32,0
|
||||
li $d1,8
|
||||
stwbrx r0,$d0,$mac
|
||||
li $d2,12
|
||||
stwbrx $h1,$d1,$mac
|
||||
stwbrx $h0,$d2,$mac
|
||||
___
|
||||
$code.=<<___;
|
||||
blr
|
||||
.long 0
|
||||
.byte 0,12,0x14,0,0,0,3,0
|
||||
.size .poly1305_emit,.-.poly1305_emit
|
||||
___
|
||||
} else {
|
||||
} } else {
|
||||
###############################################################################
|
||||
# base 2^32 implementation
|
||||
|
||||
@@ -309,6 +378,7 @@ $code.=<<___;
|
||||
stw r0,8($ctx)
|
||||
stw r0,12($ctx)
|
||||
stw r0,16($ctx)
|
||||
stw r0,24($ctx) # clear is_base2_26
|
||||
|
||||
$UCMP $inp,r0
|
||||
beq- Lno_key
|
||||
@@ -353,6 +423,7 @@ Lno_key:
|
||||
.globl .poly1305_blocks
|
||||
.align 4
|
||||
.poly1305_blocks:
|
||||
Lpoly1305_blocks:
|
||||
srwi. $len,$len,4
|
||||
beq- Labort
|
||||
|
||||
@@ -560,17 +631,389 @@ Labort:
|
||||
.long 0
|
||||
.byte 0,12,4,1,0x80,18,4,0
|
||||
.size .poly1305_blocks,.-.poly1305_blocks
|
||||
___
|
||||
{
|
||||
my ($h0,$h1,$h2,$h3,$h4,$t0,$t1) = map("r$_",(6..12));
|
||||
|
||||
$code.=<<___;
|
||||
.globl .poly1305_emit
|
||||
.align 4
|
||||
.align 5
|
||||
.poly1305_emit:
|
||||
$STU $sp,-$FRAME($sp)
|
||||
lwz r0,24($ctx) # is_base2_26
|
||||
lwz $h0,0($ctx) # load hash value
|
||||
lwz $h1,4($ctx)
|
||||
lwz $h2,8($ctx)
|
||||
lwz $h3,12($ctx)
|
||||
lwz $h4,16($ctx)
|
||||
cmplwi r0,0
|
||||
beq Lemit_base2_32
|
||||
|
||||
slwi $t0,$h1,26 # base 2^26 -> base 2^32
|
||||
srwi $h1,$h1,6
|
||||
slwi $t1,$h2,20
|
||||
srwi $h2,$h2,12
|
||||
addc $h0,$h0,$t0
|
||||
slwi $t0,$h3,14
|
||||
srwi $h3,$h3,18
|
||||
adde $h1,$h1,$t1
|
||||
slwi $t1,$h4,8
|
||||
srwi $h4,$h4,24
|
||||
adde $h2,$h2,$t0
|
||||
adde $h3,$h3,$t1
|
||||
addze $h4,$h4
|
||||
|
||||
Lemit_base2_32:
|
||||
addic r0,$h0,5 # compare to modulus
|
||||
addze r0,$h1
|
||||
addze r0,$h2
|
||||
addze r0,$h3
|
||||
addze r0,$h4
|
||||
|
||||
srwi r0,r0,2 # see if it carried/borrowed
|
||||
neg r0,r0
|
||||
andi. r0,r0,5
|
||||
|
||||
addc $h0,$h0,r0
|
||||
lwz r0,0($nonce)
|
||||
addze $h1,$h1
|
||||
lwz $t0,4($nonce)
|
||||
addze $h2,$h2
|
||||
lwz $t1,8($nonce)
|
||||
addze $h3,$h3
|
||||
lwz $h4,12($nonce)
|
||||
|
||||
addc $h0,$h0,r0 # accumulate nonce
|
||||
adde $h1,$h1,$t0
|
||||
adde $h2,$h2,$t1
|
||||
adde $h3,$h3,$h4
|
||||
|
||||
addi $ctx,$mac,-1
|
||||
addi $mac,$mac,7
|
||||
|
||||
stbu $h0,1($ctx) # write [little-endian] result
|
||||
srwi $h0,$h0,8
|
||||
stbu $h2,1($mac)
|
||||
srwi $h2,$h2,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srwi $h0,$h0,8
|
||||
stbu $h2,1($mac)
|
||||
srwi $h2,$h2,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
srwi $h0,$h0,8
|
||||
stbu $h2,1($mac)
|
||||
srwi $h2,$h2,8
|
||||
|
||||
stbu $h0,1($ctx)
|
||||
stbu $h2,1($mac)
|
||||
|
||||
stbu $h1,1($ctx)
|
||||
srwi $h1,$h1,8
|
||||
stbu $h3,1($mac)
|
||||
srwi $h3,$h3,8
|
||||
|
||||
stbu $h1,1($ctx)
|
||||
srwi $h1,$h1,8
|
||||
stbu $h3,1($mac)
|
||||
srwi $h3,$h3,8
|
||||
|
||||
stbu $h1,1($ctx)
|
||||
srwi $h1,$h1,8
|
||||
stbu $h3,1($mac)
|
||||
srwi $h3,$h3,8
|
||||
|
||||
stbu $h1,1($ctx)
|
||||
stbu $h3,1($mac)
|
||||
|
||||
blr
|
||||
.long 0
|
||||
.byte 0,12,0x14,0,0,0,3,0
|
||||
.size .poly1305_emit,.-.poly1305_emit
|
||||
___
|
||||
} }
|
||||
{{{
|
||||
########################################################################
|
||||
# PowerISA 2.07/VSX section #
|
||||
########################################################################
|
||||
|
||||
my $LOCALS= 6*$SIZE_T;
|
||||
my $VSXFRAME = $LOCALS + 6*$SIZE_T;
|
||||
$VSXFRAME += 128; # local variables
|
||||
$VSXFRAME += 13*16; # v20-v31 offload
|
||||
|
||||
my $BIG_ENDIAN = ($flavour !~ /le/) ? 4 : 0;
|
||||
|
||||
########################################################################
|
||||
# Layout of opaque area is following:
|
||||
#
|
||||
# unsigned __int32 h[5]; # current hash value base 2^26
|
||||
# unsigned __int32 pad;
|
||||
# unsigned __int32 is_base2_26, pad;
|
||||
# unsigned __int64 r[2]; # key value base 2^64
|
||||
# struct { unsigned __int32 r^2, r^4, r^1, r^3; } r[9];
|
||||
#
|
||||
# where r^n are base 2^26 digits of powers of multiplier key. There are
|
||||
# 5 digits, but last four are interleaved with multiples of 5, totalling
|
||||
# in 9 elements: r0, r1, 5*r1, r2, 5*r2, r3, 5*r3, r4, 5*r4. Order of
|
||||
# powers is as they appear in register, not memory.
|
||||
|
||||
my ($H0, $H1, $H2, $H3, $H4) = map("v$_",(0..4));
|
||||
my ($I0, $I1, $I2, $I3, $I4) = map("v$_",(5..9));
|
||||
my ($R0, $R1, $S1, $R2, $S2) = map("v$_",(10..14));
|
||||
my ($R3, $S3, $R4, $S4) = ($R1, $S1, $R2, $S2);
|
||||
my ($ACC0, $ACC1, $ACC2, $ACC3, $ACC4) = map("v$_",(15..19));
|
||||
my ($T0, $T1, $T2, $T3, $T4) = map("v$_",(20..24));
|
||||
my ($_26,$_4,$_40,$_14,$mask26,$padbits,$I2perm) = map("v$_",(25..31));
|
||||
my ($x00,$x60,$x70,$x10,$x20,$x30,$x40,$x50) = (0, map("r$_",(7,8,27..31)));
|
||||
my ($ctx_,$_ctx,$const) = map("r$_",(10..12));
|
||||
|
||||
if ($flavour =~ /64/) {
|
||||
###############################################################################
|
||||
# setup phase of poly1305_blocks_vsx is different on 32- and 64-bit platforms,
|
||||
# but the base 2^26 computational part is same...
|
||||
|
||||
my ($h0,$h1,$h2,$d0,$d1,$d2, $r0,$r1,$s1, $t0,$t1) = map("r$_",(6..11,27..31));
|
||||
my $mask = "r0";
|
||||
|
||||
$code.=<<___;
|
||||
.globl .poly1305_blocks_vsx
|
||||
.align 5
|
||||
.poly1305_blocks_vsx:
|
||||
lwz r7,24($ctx) # is_base2_26
|
||||
cmpldi $len,128
|
||||
bge __poly1305_blocks_vsx
|
||||
|
||||
neg r0,r7 # is_base2_26 as mask
|
||||
lwz r7,0($ctx) # load hash base 2^26
|
||||
lwz r8,4($ctx)
|
||||
lwz r9,8($ctx)
|
||||
lwz r10,12($ctx)
|
||||
lwz r11,16($ctx)
|
||||
|
||||
sldi r8,r8,26 # base 2^26 -> base 2^64
|
||||
sldi r12,r9,52
|
||||
add r7,r7,r8
|
||||
srdi r9,r9,12
|
||||
sldi r10,r10,14
|
||||
addc r7,r7,r12
|
||||
sldi r8,r11,40
|
||||
adde r9,r9,r10
|
||||
srdi r11,r11,24
|
||||
addc r9,r9,r8
|
||||
addze r11,r11
|
||||
|
||||
ld r8,0($ctx) # load hash base 2^64
|
||||
ld r10,8($ctx)
|
||||
ld r12,16($ctx)
|
||||
|
||||
xor r7,r7,r8 # select between radixes
|
||||
xor r9,r9,r10
|
||||
xor r11,r11,r12
|
||||
and r7,r7,r0
|
||||
and r9,r9,r0
|
||||
and r11,r11,r0
|
||||
xor r7,r7,r8
|
||||
xor r9,r9,r10
|
||||
xor r11,r11,r12
|
||||
|
||||
li r0,0
|
||||
std r7,0($ctx) # store hash base 2^64
|
||||
std r9,8($ctx)
|
||||
std r11,16($ctx)
|
||||
stw r0,24($ctx) # clear is_base2_26
|
||||
|
||||
b Lpoly1305_blocks
|
||||
.long 0
|
||||
.byte 0,12,0x14,0,0,0,4,0
|
||||
.size .poly1305_blocks_vsx,.-.poly1305_blocks_vsx
|
||||
|
||||
.align 5
|
||||
__poly1305_mul:
|
||||
mulld $d0,$h0,$r0 # h0*r0
|
||||
mulhdu $d1,$h0,$r0
|
||||
|
||||
mulld $t0,$h1,$s1 # h1*5*r1
|
||||
mulhdu $t1,$h1,$s1
|
||||
addc $d0,$d0,$t0
|
||||
adde $d1,$d1,$t1
|
||||
|
||||
mulld $t0,$h0,$r1 # h0*r1
|
||||
mulhdu $d2,$h0,$r1
|
||||
addc $d1,$d1,$t0
|
||||
addze $d2,$d2
|
||||
|
||||
mulld $t0,$h1,$r0 # h1*r0
|
||||
mulhdu $t1,$h1,$r0
|
||||
addc $d1,$d1,$t0
|
||||
adde $d2,$d2,$t1
|
||||
|
||||
mulld $t0,$h2,$s1 # h2*5*r1
|
||||
mulld $t1,$h2,$r0 # h2*r0
|
||||
addc $d1,$d1,$t0
|
||||
adde $d2,$d2,$t1
|
||||
|
||||
andc $t0,$d2,$mask # final reduction step
|
||||
and $h2,$d2,$mask
|
||||
srdi $t1,$t0,2
|
||||
add $t0,$t0,$t1
|
||||
addc $h0,$d0,$t0
|
||||
addze $h1,$d1
|
||||
addze $h2,$h2
|
||||
|
||||
blr
|
||||
.long 0
|
||||
.byte 0,12,0x14,0,0,0,0,0
|
||||
.size __poly1305_mul,.-__poly1305_mul
|
||||
|
||||
.align 5
|
||||
__poly1305_splat:
|
||||
extrdi $d0,$h0,26,38
|
||||
extrdi $d1,$h0,26,12
|
||||
stw $d0,0x00($t1)
|
||||
|
||||
extrdi $d2,$h0,12,0
|
||||
slwi $d0,$d1,2
|
||||
stw $d1,0x10($t1)
|
||||
add $d0,$d0,$d1 # * 5
|
||||
stw $d0,0x20($t1)
|
||||
|
||||
insrdi $d2,$h1,14,38
|
||||
slwi $d0,$d2,2
|
||||
stw $d2,0x30($t1)
|
||||
add $d0,$d0,$d2 # * 5
|
||||
stw $d0,0x40($t1)
|
||||
|
||||
extrdi $d1,$h1,26,24
|
||||
extrdi $d2,$h1,24,0
|
||||
slwi $d0,$d1,2
|
||||
stw $d1,0x50($t1)
|
||||
add $d0,$d0,$d1 # * 5
|
||||
stw $d0,0x60($t1)
|
||||
|
||||
insrdi $d2,$h2,3,37
|
||||
slwi $d0,$d2,2
|
||||
stw $d2,0x70($t1)
|
||||
add $d0,$d0,$d2 # * 5
|
||||
stw $d0,0x80($t1)
|
||||
|
||||
blr
|
||||
.long 0
|
||||
.byte 0,12,0x14,0,0,0,0,0
|
||||
.size __poly1305_splat,.-__poly1305_splat
|
||||
|
||||
.align 5
|
||||
__poly1305_blocks_vsx:
|
||||
$STU $sp,-$VSXFRAME($sp)
|
||||
mflr r0
|
||||
$PUSH r28,`$FRAME-$SIZE_T*4`($sp)
|
||||
$PUSH r29,`$FRAME-$SIZE_T*3`($sp)
|
||||
$PUSH r30,`$FRAME-$SIZE_T*2`($sp)
|
||||
$PUSH r31,`$FRAME-$SIZE_T*1`($sp)
|
||||
$PUSH r0,`$FRAME+$LRSAVE`($sp)
|
||||
li r10,`15+$LOCALS+128`
|
||||
li r11,`31+$LOCALS+128`
|
||||
mfspr r12,256
|
||||
stvx v20,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v21,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v22,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v23,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v24,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v25,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v26,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v27,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v28,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v29,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v30,r10,$sp
|
||||
stvx v31,r11,$sp
|
||||
stw r12,`$VSXFRAME-$SIZE_T*5-4`($sp)# save vrsave
|
||||
li r12,-1
|
||||
mtspr 256,r12 # preserve all AltiVec registers
|
||||
$PUSH r27,`$VSXFRAME-$SIZE_T*5`($sp)
|
||||
$PUSH r28,`$VSXFRAME-$SIZE_T*4`($sp)
|
||||
$PUSH r29,`$VSXFRAME-$SIZE_T*3`($sp)
|
||||
$PUSH r30,`$VSXFRAME-$SIZE_T*2`($sp)
|
||||
$PUSH r31,`$VSXFRAME-$SIZE_T*1`($sp)
|
||||
$PUSH r0,`$VSXFRAME+$LRSAVE`($sp)
|
||||
|
||||
bl LPICmeup
|
||||
|
||||
li $x10,0x10
|
||||
li $x20,0x20
|
||||
li $x30,0x30
|
||||
li $x40,0x40
|
||||
li $x50,0x50
|
||||
lvx_u $mask26,$x00,$const
|
||||
lvx_u $_26,$x10,$const
|
||||
lvx_u $_40,$x20,$const
|
||||
lvx_u $I2perm,$x30,$const
|
||||
lvx_u $padbits,$x40,$const
|
||||
|
||||
cmplwi r7,0 # is_base2_26?
|
||||
bne Lskip_init_vsx
|
||||
|
||||
ld $r0,32($ctx) # load key base 2^64
|
||||
ld $r1,40($ctx)
|
||||
srdi $s1,$r1,2
|
||||
li $mask,3
|
||||
add $s1,$s1,$r1 # s1 = r1 + r1>>2
|
||||
|
||||
mr $h0,$r0 # "calculate" r^1
|
||||
mr $h1,$r1
|
||||
li $h2,0
|
||||
addi $t1,$ctx,`48+(12^$BIG_ENDIAN)`
|
||||
bl __poly1305_splat
|
||||
|
||||
bl __poly1305_mul # caclulate r^2
|
||||
addi $t1,$ctx,`48+(4^$BIG_ENDIAN)`
|
||||
bl __poly1305_splat
|
||||
|
||||
bl __poly1305_mul # caclulate r^3
|
||||
addi $t1,$ctx,`48+(8^$BIG_ENDIAN)`
|
||||
bl __poly1305_splat
|
||||
|
||||
bl __poly1305_mul # caclulate r^4
|
||||
addi $t1,$ctx,`48+(0^$BIG_ENDIAN)`
|
||||
bl __poly1305_splat
|
||||
|
||||
ld $h0,0($ctx) # load hash
|
||||
ld $h1,8($ctx)
|
||||
ld $h2,16($ctx)
|
||||
|
||||
extrdi $d0,$h0,26,38 # base 2^64 -> base 2^26
|
||||
extrdi $d1,$h0,26,12
|
||||
extrdi $d2,$h0,12,0
|
||||
mtvrwz $H0,$d0
|
||||
insrdi $d2,$h1,14,38
|
||||
mtvrwz $H1,$d1
|
||||
extrdi $d1,$h1,26,24
|
||||
mtvrwz $H2,$d2
|
||||
extrdi $d2,$h1,24,0
|
||||
mtvrwz $H3,$d1
|
||||
insrdi $d2,$h2,3,37
|
||||
mtvrwz $H4,$d2
|
||||
___
|
||||
} else {
|
||||
###############################################################################
|
||||
# 32-bit initialization
|
||||
|
||||
my ($h0,$h1,$h2,$h3,$h4,$t0,$t1) = map("r$_",(7..11,0,12));
|
||||
my ($R3,$S3,$R4,$S4)=($I1,$I2,$I3,$I4);
|
||||
|
||||
$code.=<<___;
|
||||
.globl .poly1305_blocks_vsx
|
||||
.align 5
|
||||
.poly1305_blocks_vsx:
|
||||
lwz r7,24($ctx) # is_base2_26
|
||||
cmplwi $len,128
|
||||
bge __poly1305_blocks_vsx
|
||||
cmplwi r7,0
|
||||
beq Lpoly1305_blocks
|
||||
|
||||
lwz $h0,0($ctx) # load hash
|
||||
lwz $h1,4($ctx)
|
||||
@@ -578,68 +1021,957 @@ Labort:
|
||||
lwz $h3,12($ctx)
|
||||
lwz $h4,16($ctx)
|
||||
|
||||
addic $d0,$h0,5 # compare to modulus
|
||||
addze $d1,$h1
|
||||
addze $d2,$h2
|
||||
addze $d3,$h3
|
||||
addze $mask,$h4
|
||||
slwi $t0,$h1,26 # base 2^26 -> base 2^32
|
||||
srwi $h1,$h1,6
|
||||
slwi $t1,$h2,20
|
||||
srwi $h2,$h2,12
|
||||
addc $h0,$h0,$t0
|
||||
slwi $t0,$h3,14
|
||||
srwi $h3,$h3,18
|
||||
adde $h1,$h1,$t1
|
||||
slwi $t1,$h4,8
|
||||
srwi $h4,$h4,24
|
||||
adde $h2,$h2,$t0
|
||||
li $t0,0
|
||||
adde $h3,$h3,$t1
|
||||
addze $h4,$h4
|
||||
|
||||
srwi $mask,$mask,2 # did it carry/borrow?
|
||||
neg $mask,$mask
|
||||
stw $h0,0($ctx) # store hash base 2^32
|
||||
stw $h1,4($ctx)
|
||||
stw $h2,8($ctx)
|
||||
stw $h3,12($ctx)
|
||||
stw $h4,16($ctx)
|
||||
stw $t0,24($ctx) # clear is_base2_26
|
||||
|
||||
andc $h0,$h0,$mask
|
||||
and $d0,$d0,$mask
|
||||
andc $h1,$h1,$mask
|
||||
and $d1,$d1,$mask
|
||||
or $h0,$h0,$d0
|
||||
lwz $d0,0($nonce) # load nonce
|
||||
andc $h2,$h2,$mask
|
||||
and $d2,$d2,$mask
|
||||
or $h1,$h1,$d1
|
||||
lwz $d1,4($nonce)
|
||||
andc $h3,$h3,$mask
|
||||
and $d3,$d3,$mask
|
||||
or $h2,$h2,$d2
|
||||
lwz $d2,8($nonce)
|
||||
or $h3,$h3,$d3
|
||||
lwz $d3,12($nonce)
|
||||
b Lpoly1305_blocks
|
||||
.long 0
|
||||
.byte 0,12,0x14,0,0,0,4,0
|
||||
.size .poly1305_blocks_vsx,.-.poly1305_blocks_vsx
|
||||
|
||||
.align 5
|
||||
__poly1305_mul:
|
||||
vmulouw $ACC0,$H0,$R0
|
||||
vmulouw $ACC1,$H1,$R0
|
||||
vmulouw $ACC2,$H2,$R0
|
||||
vmulouw $ACC3,$H3,$R0
|
||||
vmulouw $ACC4,$H4,$R0
|
||||
|
||||
vmulouw $T0,$H4,$S1
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H0,$R1
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H1,$R1
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H2,$R1
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H3,$R1
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vmulouw $T0,$H3,$S2
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H4,$S2
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H0,$R2
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H1,$R2
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H2,$R2
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vmulouw $T0,$H2,$S3
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H3,$S3
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H4,$S3
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H0,$R3
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H1,$R3
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vmulouw $T0,$H1,$S4
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H2,$S4
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H3,$S4
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H4,$S4
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H0,$R4
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
################################################################
|
||||
# lazy reduction
|
||||
|
||||
vspltisb $T0,2
|
||||
vsrd $H4,$ACC3,$_26
|
||||
vsrd $H1,$ACC0,$_26
|
||||
vand $H3,$ACC3,$mask26
|
||||
vand $H0,$ACC0,$mask26
|
||||
vaddudm $H4,$H4,$ACC4 # h3 -> h4
|
||||
vaddudm $H1,$H1,$ACC1 # h0 -> h1
|
||||
|
||||
vsrd $ACC4,$H4,$_26
|
||||
vsrd $ACC1,$H1,$_26
|
||||
vand $H4,$H4,$mask26
|
||||
vand $H1,$H1,$mask26
|
||||
vaddudm $H0,$H0,$ACC4
|
||||
vaddudm $H2,$ACC2,$ACC1 # h1 -> h2
|
||||
|
||||
vsld $ACC4,$ACC4,$T0 # <<2
|
||||
vsrd $ACC2,$H2,$_26
|
||||
vand $H2,$H2,$mask26
|
||||
vaddudm $H0,$H0,$ACC4 # h4 -> h0
|
||||
vaddudm $H3,$H3,$ACC2 # h2 -> h3
|
||||
|
||||
vsrd $ACC0,$H0,$_26
|
||||
vsrd $ACC3,$H3,$_26
|
||||
vand $H0,$H0,$mask26
|
||||
vand $H3,$H3,$mask26
|
||||
vaddudm $H1,$H1,$ACC0 # h0 -> h1
|
||||
vaddudm $H4,$H4,$ACC3 # h3 -> h4
|
||||
|
||||
addc $h0,$h0,$d0 # accumulate nonce
|
||||
adde $h1,$h1,$d1
|
||||
adde $h2,$h2,$d2
|
||||
adde $h3,$h3,$d3
|
||||
___
|
||||
$code.=<<___ if ($LITTLE_ENDIAN);
|
||||
stw $h0,0($mac) # write result
|
||||
stw $h1,4($mac)
|
||||
stw $h2,8($mac)
|
||||
stw $h3,12($mac)
|
||||
___
|
||||
$code.=<<___ if (!$LITTLE_ENDIAN);
|
||||
li $d1,4
|
||||
stwbrx $h0,0,$mac # write result
|
||||
li $d2,8
|
||||
stwbrx $h1,$d1,$mac
|
||||
li $d3,12
|
||||
stwbrx $h2,$d2,$mac
|
||||
stwbrx $h3,$d3,$mac
|
||||
___
|
||||
$code.=<<___;
|
||||
$POP r28,`$FRAME-$SIZE_T*4`($sp)
|
||||
$POP r29,`$FRAME-$SIZE_T*3`($sp)
|
||||
$POP r30,`$FRAME-$SIZE_T*2`($sp)
|
||||
$POP r31,`$FRAME-$SIZE_T*1`($sp)
|
||||
addi $sp,$sp,$FRAME
|
||||
blr
|
||||
.long 0
|
||||
.byte 0,12,4,1,0x80,4,3,0
|
||||
.size .poly1305_emit,.-.poly1305_emit
|
||||
.byte 0,12,0x14,0,0,0,0,0
|
||||
.size __poly1305_mul,.-__poly1305_mul
|
||||
|
||||
.align 5
|
||||
__poly1305_blocks_vsx:
|
||||
$STU $sp,-$VSXFRAME($sp)
|
||||
mflr r0
|
||||
li r10,`15+$LOCALS+128`
|
||||
li r11,`31+$LOCALS+128`
|
||||
mfspr r12,256
|
||||
stvx v20,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v21,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v22,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v23,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v24,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v25,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v26,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v27,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v28,r10,$sp
|
||||
addi r10,r10,32
|
||||
stvx v29,r11,$sp
|
||||
addi r11,r11,32
|
||||
stvx v30,r10,$sp
|
||||
stvx v31,r11,$sp
|
||||
stw r12,`$VSXFRAME-$SIZE_T*5-4`($sp)# save vrsave
|
||||
li r12,-1
|
||||
mtspr 256,r12 # preserve all AltiVec registers
|
||||
$PUSH r27,`$VSXFRAME-$SIZE_T*5`($sp)
|
||||
$PUSH r28,`$VSXFRAME-$SIZE_T*4`($sp)
|
||||
$PUSH r29,`$VSXFRAME-$SIZE_T*3`($sp)
|
||||
$PUSH r30,`$VSXFRAME-$SIZE_T*2`($sp)
|
||||
$PUSH r31,`$VSXFRAME-$SIZE_T*1`($sp)
|
||||
$PUSH r0,`$VSXFRAME+$LRSAVE`($sp)
|
||||
|
||||
bl LPICmeup
|
||||
|
||||
li $x10,0x10
|
||||
li $x20,0x20
|
||||
li $x30,0x30
|
||||
li $x40,0x40
|
||||
li $x50,0x50
|
||||
lvx_u $mask26,$x00,$const
|
||||
lvx_u $_26,$x10,$const
|
||||
lvx_u $_40,$x20,$const
|
||||
lvx_u $I2perm,$x30,$const
|
||||
lvx_u $padbits,$x40,$const
|
||||
|
||||
cmplwi r7,0 # is_base2_26?
|
||||
bne Lskip_init_vsx
|
||||
|
||||
lwz $h1,32($ctx) # load key base 2^32
|
||||
lwz $h2,36($ctx)
|
||||
lwz $h3,40($ctx)
|
||||
lwz $h4,44($ctx)
|
||||
|
||||
extrwi $h0,$h1,26,6 # base 2^32 -> base 2^26
|
||||
extrwi $h1,$h1,6,0
|
||||
insrwi $h1,$h2,20,6
|
||||
extrwi $h2,$h2,12,0
|
||||
insrwi $h2,$h3,14,6
|
||||
extrwi $h3,$h3,18,0
|
||||
insrwi $h3,$h4,8,6
|
||||
extrwi $h4,$h4,24,0
|
||||
|
||||
mtvrwz $R0,$h0
|
||||
slwi $h0,$h1,2
|
||||
mtvrwz $R1,$h1
|
||||
add $h1,$h1,$h0
|
||||
mtvrwz $S1,$h1
|
||||
slwi $h1,$h2,2
|
||||
mtvrwz $R2,$h2
|
||||
add $h2,$h2,$h1
|
||||
mtvrwz $S2,$h2
|
||||
slwi $h2,$h3,2
|
||||
mtvrwz $R3,$h3
|
||||
add $h3,$h3,$h2
|
||||
mtvrwz $S3,$h3
|
||||
slwi $h3,$h4,2
|
||||
mtvrwz $R4,$h4
|
||||
add $h4,$h4,$h3
|
||||
mtvrwz $S4,$h4
|
||||
|
||||
vmr $H0,$R0
|
||||
vmr $H1,$R1
|
||||
vmr $H2,$R2
|
||||
vmr $H3,$R3
|
||||
vmr $H4,$R4
|
||||
|
||||
bl __poly1305_mul # r^1:- * r^1:-
|
||||
|
||||
vpermdi $R0,$H0,$R0,0b00
|
||||
vpermdi $R1,$H1,$R1,0b00
|
||||
vpermdi $R2,$H2,$R2,0b00
|
||||
vpermdi $R3,$H3,$R3,0b00
|
||||
vpermdi $R4,$H4,$R4,0b00
|
||||
vpermdi $H0,$H0,$H0,0b00
|
||||
vpermdi $H1,$H1,$H1,0b00
|
||||
vpermdi $H2,$H2,$H2,0b00
|
||||
vpermdi $H3,$H3,$H3,0b00
|
||||
vpermdi $H4,$H4,$H4,0b00
|
||||
vsld $S1,$R1,$T0 # <<2
|
||||
vsld $S2,$R2,$T0
|
||||
vsld $S3,$R3,$T0
|
||||
vsld $S4,$R4,$T0
|
||||
vaddudm $S1,$S1,$R1
|
||||
vaddudm $S2,$S2,$R2
|
||||
vaddudm $S3,$S3,$R3
|
||||
vaddudm $S4,$S4,$R4
|
||||
|
||||
bl __poly1305_mul # r^2:r^2 * r^2:r^1
|
||||
|
||||
addi $h0,$ctx,0x60
|
||||
lwz $h1,0($ctx) # load hash
|
||||
lwz $h2,4($ctx)
|
||||
lwz $h3,8($ctx)
|
||||
lwz $h4,12($ctx)
|
||||
lwz $t0,16($ctx)
|
||||
|
||||
vmrgow $R0,$R0,$H0 # r^2:r^4:r^1:r^3
|
||||
vmrgow $R1,$R1,$H1
|
||||
vmrgow $R2,$R2,$H2
|
||||
vmrgow $R3,$R3,$H3
|
||||
vmrgow $R4,$R4,$H4
|
||||
vslw $S1,$R1,$T0 # <<2
|
||||
vslw $S2,$R2,$T0
|
||||
vslw $S3,$R3,$T0
|
||||
vslw $S4,$R4,$T0
|
||||
vadduwm $S1,$S1,$R1
|
||||
vadduwm $S2,$S2,$R2
|
||||
vadduwm $S3,$S3,$R3
|
||||
vadduwm $S4,$S4,$R4
|
||||
|
||||
stvx_u $R0,$x30,$ctx
|
||||
stvx_u $R1,$x40,$ctx
|
||||
stvx_u $S1,$x50,$ctx
|
||||
stvx_u $R2,$x00,$h0
|
||||
stvx_u $S2,$x10,$h0
|
||||
stvx_u $R3,$x20,$h0
|
||||
stvx_u $S3,$x30,$h0
|
||||
stvx_u $R4,$x40,$h0
|
||||
stvx_u $S4,$x50,$h0
|
||||
|
||||
extrwi $h0,$h1,26,6 # base 2^32 -> base 2^26
|
||||
extrwi $h1,$h1,6,0
|
||||
mtvrwz $H0,$h0
|
||||
insrwi $h1,$h2,20,6
|
||||
extrwi $h2,$h2,12,0
|
||||
mtvrwz $H1,$h1
|
||||
insrwi $h2,$h3,14,6
|
||||
extrwi $h3,$h3,18,0
|
||||
mtvrwz $H2,$h2
|
||||
insrwi $h3,$h4,8,6
|
||||
extrwi $h4,$h4,24,0
|
||||
mtvrwz $H3,$h3
|
||||
insrwi $h4,$t0,3,5
|
||||
mtvrwz $H4,$h4
|
||||
___
|
||||
}
|
||||
$code.=<<___;
|
||||
.asciz "Poly1305 for PPC, CRYPTOGAMS by <appro\@openssl.org>"
|
||||
li r0,1
|
||||
stw r0,24($ctx) # set is_base2_26
|
||||
b Loaded_vsx
|
||||
|
||||
.align 4
|
||||
Lskip_init_vsx:
|
||||
li $x10,4
|
||||
li $x20,8
|
||||
li $x30,12
|
||||
li $x40,16
|
||||
lvwzx_u $H0,$x00,$ctx
|
||||
lvwzx_u $H1,$x10,$ctx
|
||||
lvwzx_u $H2,$x20,$ctx
|
||||
lvwzx_u $H3,$x30,$ctx
|
||||
lvwzx_u $H4,$x40,$ctx
|
||||
|
||||
Loaded_vsx:
|
||||
li $x10,0x10
|
||||
li $x20,0x20
|
||||
li $x30,0x30
|
||||
li $x40,0x40
|
||||
li $x50,0x50
|
||||
li $x60,0x60
|
||||
li $x70,0x70
|
||||
addi $ctx_,$ctx,64 # &ctx->r[1]
|
||||
addi $_ctx,$sp,`$LOCALS+15` # &ctx->r[1], r^2:r^4 shadow
|
||||
|
||||
vxor $T0,$T0,$T0 # ensure second half is zero
|
||||
vpermdi $H0,$H0,$T0,0b00
|
||||
vpermdi $H1,$H1,$T0,0b00
|
||||
vpermdi $H2,$H2,$T0,0b00
|
||||
vpermdi $H3,$H3,$T0,0b00
|
||||
vpermdi $H4,$H4,$T0,0b00
|
||||
|
||||
be?lvx_u $_4,$x50,$const # byte swap mask
|
||||
lvx_u $T1,$x00,$inp # load first input block
|
||||
lvx_u $T2,$x10,$inp
|
||||
lvx_u $T3,$x20,$inp
|
||||
lvx_u $T4,$x30,$inp
|
||||
be?vperm $T1,$T1,$T1,$_4
|
||||
be?vperm $T2,$T2,$T2,$_4
|
||||
be?vperm $T3,$T3,$T3,$_4
|
||||
be?vperm $T4,$T4,$T4,$_4
|
||||
|
||||
vpermdi $I0,$T1,$T2,0b00 # smash input to base 2^26
|
||||
vspltisb $_4,4
|
||||
vperm $I2,$T1,$T2,$I2perm # 0x...0e0f0001...1e1f1011
|
||||
vspltisb $_14,14
|
||||
vpermdi $I3,$T1,$T2,0b11
|
||||
|
||||
vsrd $I1,$I0,$_26
|
||||
vsrd $I2,$I2,$_4
|
||||
vsrd $I4,$I3,$_40
|
||||
vsrd $I3,$I3,$_14
|
||||
vand $I0,$I0,$mask26
|
||||
vand $I1,$I1,$mask26
|
||||
vand $I2,$I2,$mask26
|
||||
vand $I3,$I3,$mask26
|
||||
|
||||
vpermdi $T1,$T3,$T4,0b00
|
||||
vperm $T2,$T3,$T4,$I2perm # 0x...0e0f0001...1e1f1011
|
||||
vpermdi $T3,$T3,$T4,0b11
|
||||
|
||||
vsrd $T0,$T1,$_26
|
||||
vsrd $T2,$T2,$_4
|
||||
vsrd $T4,$T3,$_40
|
||||
vsrd $T3,$T3,$_14
|
||||
vand $T1,$T1,$mask26
|
||||
vand $T0,$T0,$mask26
|
||||
vand $T2,$T2,$mask26
|
||||
vand $T3,$T3,$mask26
|
||||
|
||||
# inp[2]:inp[0]:inp[3]:inp[1]
|
||||
vmrgow $I4,$T4,$I4
|
||||
vmrgow $I0,$T1,$I0
|
||||
vmrgow $I1,$T0,$I1
|
||||
vmrgow $I2,$T2,$I2
|
||||
vmrgow $I3,$T3,$I3
|
||||
vor $I4,$I4,$padbits
|
||||
|
||||
lvx_splt $R0,$x30,$ctx # taking lvx_vsplt out of loop
|
||||
lvx_splt $R1,$x00,$ctx_ # gives ~8% improvement
|
||||
lvx_splt $S1,$x10,$ctx_
|
||||
lvx_splt $R2,$x20,$ctx_
|
||||
lvx_splt $S2,$x30,$ctx_
|
||||
lvx_splt $T1,$x40,$ctx_
|
||||
lvx_splt $T2,$x50,$ctx_
|
||||
lvx_splt $T3,$x60,$ctx_
|
||||
lvx_splt $T4,$x70,$ctx_
|
||||
stvx $R1,$x00,$_ctx
|
||||
stvx $S1,$x10,$_ctx
|
||||
stvx $R2,$x20,$_ctx
|
||||
stvx $S2,$x30,$_ctx
|
||||
stvx $T1,$x40,$_ctx
|
||||
stvx $T2,$x50,$_ctx
|
||||
stvx $T3,$x60,$_ctx
|
||||
stvx $T4,$x70,$_ctx
|
||||
|
||||
addi $inp,$inp,0x40
|
||||
addi $const,$const,0x50
|
||||
addi r0,$len,-64
|
||||
srdi r0,r0,6
|
||||
mtctr r0
|
||||
b Loop_vsx
|
||||
|
||||
.align 4
|
||||
Loop_vsx:
|
||||
################################################################
|
||||
## ((inp[0]*r^4+inp[2]*r^2+inp[4])*r^4+inp[6]*r^2
|
||||
## ((inp[1]*r^4+inp[3]*r^2+inp[5])*r^3+inp[7]*r
|
||||
## \___________________/
|
||||
##
|
||||
## Note that we start with inp[2:3]*r^2. This is because it
|
||||
## doesn't depend on reduction in previous iteration.
|
||||
################################################################
|
||||
## d4 = h4*r0 + h3*r1 + h2*r2 + h1*r3 + h0*r4
|
||||
## d3 = h3*r0 + h2*r1 + h1*r2 + h0*r3 + h4*5*r4
|
||||
## d2 = h2*r0 + h1*r1 + h0*r2 + h4*5*r3 + h3*5*r4
|
||||
## d1 = h1*r0 + h0*r1 + h4*5*r2 + h3*5*r3 + h2*5*r4
|
||||
## d0 = h0*r0 + h4*5*r1 + h3*5*r2 + h2*5*r3 + h1*5*r4
|
||||
|
||||
vmuleuw $ACC0,$I0,$R0
|
||||
vmuleuw $ACC1,$I0,$R1
|
||||
vmuleuw $ACC2,$I0,$R2
|
||||
vmuleuw $ACC3,$I1,$R2
|
||||
|
||||
vmuleuw $T0,$I1,$R0
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I1,$R1
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $ACC4,$I2,$R2
|
||||
vmuleuw $T0,$I4,$S1
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I2,$R1
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx $S3,$x50,$_ctx
|
||||
vmuleuw $T0,$I3,$R1
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx $R3,$x40,$_ctx
|
||||
|
||||
vaddudm $H2,$H2,$I2
|
||||
vaddudm $H0,$H0,$I0
|
||||
vaddudm $H3,$H3,$I3
|
||||
vaddudm $H1,$H1,$I1
|
||||
vaddudm $H4,$H4,$I4
|
||||
|
||||
vmuleuw $T0,$I3,$S2
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I4,$S2
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I2,$R0
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $T0,$I3,$R0
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx $S4,$x70,$_ctx
|
||||
vmuleuw $T0,$I4,$R0
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx $R4,$x60,$_ctx
|
||||
|
||||
vmuleuw $T0,$I2,$S3
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I3,$S3
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I4,$S3
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $T0,$I0,$R3
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmuleuw $T0,$I1,$R3
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
be?lvx_u $_4,$x00,$const # byte swap mask
|
||||
lvx_u $T1,$x00,$inp # load next input block
|
||||
lvx_u $T2,$x10,$inp
|
||||
lvx_u $T3,$x20,$inp
|
||||
lvx_u $T4,$x30,$inp
|
||||
be?vperm $T1,$T1,$T1,$_4
|
||||
be?vperm $T2,$T2,$T2,$_4
|
||||
be?vperm $T3,$T3,$T3,$_4
|
||||
be?vperm $T4,$T4,$T4,$_4
|
||||
|
||||
vmuleuw $T0,$I1,$S4
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I2,$S4
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I3,$S4
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $T0,$I4,$S4
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmuleuw $T0,$I0,$R4
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vpermdi $I0,$T1,$T2,0b00 # smash input to base 2^26
|
||||
vspltisb $_4,4
|
||||
vperm $I2,$T1,$T2,$I2perm # 0x...0e0f0001...1e1f1011
|
||||
vpermdi $I3,$T1,$T2,0b11
|
||||
|
||||
# (hash + inp[0:1]) * r^4
|
||||
vmulouw $T0,$H0,$R0
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H1,$R0
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H2,$R0
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H3,$R0
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H4,$R0
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vpermdi $T1,$T3,$T4,0b00
|
||||
vperm $T2,$T3,$T4,$I2perm # 0x...0e0f0001...1e1f1011
|
||||
vpermdi $T3,$T3,$T4,0b11
|
||||
|
||||
vmulouw $T0,$H2,$S3
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H3,$S3
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H4,$S3
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H0,$R3
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx $S1,$x10,$_ctx
|
||||
vmulouw $T0,$H1,$R3
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx $R1,$x00,$_ctx
|
||||
|
||||
vsrd $I1,$I0,$_26
|
||||
vsrd $I2,$I2,$_4
|
||||
vsrd $I4,$I3,$_40
|
||||
vsrd $I3,$I3,$_14
|
||||
|
||||
vmulouw $T0,$H1,$S4
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H2,$S4
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H3,$S4
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H4,$S4
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx $S2,$x30,$_ctx
|
||||
vmulouw $T0,$H0,$R4
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx $R2,$x20,$_ctx
|
||||
|
||||
vand $I0,$I0,$mask26
|
||||
vand $I1,$I1,$mask26
|
||||
vand $I2,$I2,$mask26
|
||||
vand $I3,$I3,$mask26
|
||||
|
||||
vmulouw $T0,$H4,$S1
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H0,$R1
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H1,$R1
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H2,$R1
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H3,$R1
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vsrd $T2,$T2,$_4
|
||||
vsrd $_4,$T1,$_26
|
||||
vsrd $T4,$T3,$_40
|
||||
vsrd $T3,$T3,$_14
|
||||
|
||||
vmulouw $T0,$H3,$S2
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H4,$S2
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H0,$R2
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H1,$R2
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H2,$R2
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vand $T1,$T1,$mask26
|
||||
vand $_4,$_4,$mask26
|
||||
vand $T2,$T2,$mask26
|
||||
vand $T3,$T3,$mask26
|
||||
|
||||
################################################################
|
||||
# lazy reduction as discussed in "NEON crypto" by D.J. Bernstein
|
||||
# and P. Schwabe
|
||||
|
||||
vspltisb $T0,2
|
||||
vsrd $H4,$ACC3,$_26
|
||||
vsrd $H1,$ACC0,$_26
|
||||
vand $H3,$ACC3,$mask26
|
||||
vand $H0,$ACC0,$mask26
|
||||
vaddudm $H4,$H4,$ACC4 # h3 -> h4
|
||||
vaddudm $H1,$H1,$ACC1 # h0 -> h1
|
||||
|
||||
vmrgow $I4,$T4,$I4
|
||||
vmrgow $I0,$T1,$I0
|
||||
vmrgow $I1,$_4,$I1
|
||||
vmrgow $I2,$T2,$I2
|
||||
vmrgow $I3,$T3,$I3
|
||||
vor $I4,$I4,$padbits
|
||||
|
||||
vsrd $ACC4,$H4,$_26
|
||||
vsrd $ACC1,$H1,$_26
|
||||
vand $H4,$H4,$mask26
|
||||
vand $H1,$H1,$mask26
|
||||
vaddudm $H0,$H0,$ACC4
|
||||
vaddudm $H2,$ACC2,$ACC1 # h1 -> h2
|
||||
|
||||
vsld $ACC4,$ACC4,$T0 # <<2
|
||||
vsrd $ACC2,$H2,$_26
|
||||
vand $H2,$H2,$mask26
|
||||
vaddudm $H0,$H0,$ACC4 # h4 -> h0
|
||||
vaddudm $H3,$H3,$ACC2 # h2 -> h3
|
||||
|
||||
vsrd $ACC0,$H0,$_26
|
||||
vsrd $ACC3,$H3,$_26
|
||||
vand $H0,$H0,$mask26
|
||||
vand $H3,$H3,$mask26
|
||||
vaddudm $H1,$H1,$ACC0 # h0 -> h1
|
||||
vaddudm $H4,$H4,$ACC3 # h3 -> h4
|
||||
|
||||
addi $inp,$inp,0x40
|
||||
bdnz Loop_vsx
|
||||
|
||||
neg $len,$len
|
||||
andi. $len,$len,0x30
|
||||
sub $inp,$inp,$len
|
||||
|
||||
lvx_u $R0,$x30,$ctx # load all powers
|
||||
lvx_u $R1,$x00,$ctx_
|
||||
lvx_u $S1,$x10,$ctx_
|
||||
lvx_u $R2,$x20,$ctx_
|
||||
lvx_u $S2,$x30,$ctx_
|
||||
|
||||
Last_vsx:
|
||||
vmuleuw $ACC0,$I0,$R0
|
||||
vmuleuw $ACC1,$I1,$R0
|
||||
vmuleuw $ACC2,$I2,$R0
|
||||
vmuleuw $ACC3,$I3,$R0
|
||||
vmuleuw $ACC4,$I4,$R0
|
||||
|
||||
vmuleuw $T0,$I4,$S1
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I0,$R1
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I1,$R1
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $T0,$I2,$R1
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx_u $S3,$x50,$ctx_
|
||||
vmuleuw $T0,$I3,$R1
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx_u $R3,$x40,$ctx_
|
||||
|
||||
vaddudm $H2,$H2,$I2
|
||||
vaddudm $H0,$H0,$I0
|
||||
vaddudm $H3,$H3,$I3
|
||||
vaddudm $H1,$H1,$I1
|
||||
vaddudm $H4,$H4,$I4
|
||||
|
||||
vmuleuw $T0,$I3,$S2
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I4,$S2
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I0,$R2
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $T0,$I1,$R2
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx_u $S4,$x70,$ctx_
|
||||
vmuleuw $T0,$I2,$R2
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx_u $R4,$x60,$ctx_
|
||||
|
||||
vmuleuw $T0,$I2,$S3
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I3,$S3
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I4,$S3
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $T0,$I0,$R3
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmuleuw $T0,$I1,$R3
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vmuleuw $T0,$I1,$S4
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmuleuw $T0,$I2,$S4
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmuleuw $T0,$I3,$S4
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmuleuw $T0,$I4,$S4
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmuleuw $T0,$I0,$R4
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
# (hash + inp[0:1]) * r^4
|
||||
vmulouw $T0,$H0,$R0
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H1,$R0
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H2,$R0
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H3,$R0
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H4,$R0
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vmulouw $T0,$H2,$S3
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H3,$S3
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H4,$S3
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H0,$R3
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx_u $S1,$x10,$ctx_
|
||||
vmulouw $T0,$H1,$R3
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx_u $R1,$x00,$ctx_
|
||||
|
||||
vmulouw $T0,$H1,$S4
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H2,$S4
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H3,$S4
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H4,$S4
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
lvx_u $S2,$x30,$ctx_
|
||||
vmulouw $T0,$H0,$R4
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
lvx_u $R2,$x20,$ctx_
|
||||
|
||||
vmulouw $T0,$H4,$S1
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H0,$R1
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H1,$R1
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H2,$R1
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H3,$R1
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
vmulouw $T0,$H3,$S2
|
||||
vaddudm $ACC0,$ACC0,$T0
|
||||
vmulouw $T0,$H4,$S2
|
||||
vaddudm $ACC1,$ACC1,$T0
|
||||
vmulouw $T0,$H0,$R2
|
||||
vaddudm $ACC2,$ACC2,$T0
|
||||
vmulouw $T0,$H1,$R2
|
||||
vaddudm $ACC3,$ACC3,$T0
|
||||
vmulouw $T0,$H2,$R2
|
||||
vaddudm $ACC4,$ACC4,$T0
|
||||
|
||||
################################################################
|
||||
# horizontal addition
|
||||
|
||||
vpermdi $H0,$ACC0,$ACC0,0b10
|
||||
vpermdi $H1,$ACC1,$ACC1,0b10
|
||||
vpermdi $H2,$ACC2,$ACC2,0b10
|
||||
vpermdi $H3,$ACC3,$ACC3,0b10
|
||||
vpermdi $H4,$ACC4,$ACC4,0b10
|
||||
vaddudm $ACC0,$ACC0,$H0
|
||||
vaddudm $ACC1,$ACC1,$H1
|
||||
vaddudm $ACC2,$ACC2,$H2
|
||||
vaddudm $ACC3,$ACC3,$H3
|
||||
vaddudm $ACC4,$ACC4,$H4
|
||||
|
||||
################################################################
|
||||
# lazy reduction
|
||||
|
||||
vspltisb $T0,2
|
||||
vsrd $H4,$ACC3,$_26
|
||||
vsrd $H1,$ACC0,$_26
|
||||
vand $H3,$ACC3,$mask26
|
||||
vand $H0,$ACC0,$mask26
|
||||
vaddudm $H4,$H4,$ACC4 # h3 -> h4
|
||||
vaddudm $H1,$H1,$ACC1 # h0 -> h1
|
||||
|
||||
vsrd $ACC4,$H4,$_26
|
||||
vsrd $ACC1,$H1,$_26
|
||||
vand $H4,$H4,$mask26
|
||||
vand $H1,$H1,$mask26
|
||||
vaddudm $H0,$H0,$ACC4
|
||||
vaddudm $H2,$ACC2,$ACC1 # h1 -> h2
|
||||
|
||||
vsld $ACC4,$ACC4,$T0 # <<2
|
||||
vsrd $ACC2,$H2,$_26
|
||||
vand $H2,$H2,$mask26
|
||||
vaddudm $H0,$H0,$ACC4 # h4 -> h0
|
||||
vaddudm $H3,$H3,$ACC2 # h2 -> h3
|
||||
|
||||
vsrd $ACC0,$H0,$_26
|
||||
vsrd $ACC3,$H3,$_26
|
||||
vand $H0,$H0,$mask26
|
||||
vand $H3,$H3,$mask26
|
||||
vaddudm $H1,$H1,$ACC0 # h0 -> h1
|
||||
vaddudm $H4,$H4,$ACC3 # h3 -> h4
|
||||
|
||||
beq Ldone_vsx
|
||||
|
||||
add r6,$const,$len
|
||||
|
||||
be?lvx_u $_4,$x00,$const # byte swap mask
|
||||
lvx_u $T1,$x00,$inp # load last partial input block
|
||||
lvx_u $T2,$x10,$inp
|
||||
lvx_u $T3,$x20,$inp
|
||||
lvx_u $T4,$x30,$inp
|
||||
be?vperm $T1,$T1,$T1,$_4
|
||||
be?vperm $T2,$T2,$T2,$_4
|
||||
be?vperm $T3,$T3,$T3,$_4
|
||||
be?vperm $T4,$T4,$T4,$_4
|
||||
|
||||
vpermdi $I0,$T1,$T2,0b00 # smash input to base 2^26
|
||||
vspltisb $_4,4
|
||||
vperm $I2,$T1,$T2,$I2perm # 0x...0e0f0001...1e1f1011
|
||||
vpermdi $I3,$T1,$T2,0b11
|
||||
|
||||
vsrd $I1,$I0,$_26
|
||||
vsrd $I2,$I2,$_4
|
||||
vsrd $I4,$I3,$_40
|
||||
vsrd $I3,$I3,$_14
|
||||
vand $I0,$I0,$mask26
|
||||
vand $I1,$I1,$mask26
|
||||
vand $I2,$I2,$mask26
|
||||
vand $I3,$I3,$mask26
|
||||
|
||||
vpermdi $T0,$T3,$T4,0b00
|
||||
vperm $T1,$T3,$T4,$I2perm # 0x...0e0f0001...1e1f1011
|
||||
vpermdi $T2,$T3,$T4,0b11
|
||||
|
||||
lvx_u $ACC0,$x00,r6
|
||||
lvx_u $ACC1,$x30,r6
|
||||
|
||||
vsrd $T3,$T0,$_26
|
||||
vsrd $T1,$T1,$_4
|
||||
vsrd $T4,$T2,$_40
|
||||
vsrd $T2,$T2,$_14
|
||||
vand $T0,$T0,$mask26
|
||||
vand $T3,$T3,$mask26
|
||||
vand $T1,$T1,$mask26
|
||||
vand $T2,$T2,$mask26
|
||||
|
||||
# inp[2]:inp[0]:inp[3]:inp[1]
|
||||
vmrgow $I4,$T4,$I4
|
||||
vmrgow $I0,$T0,$I0
|
||||
vmrgow $I1,$T3,$I1
|
||||
vmrgow $I2,$T1,$I2
|
||||
vmrgow $I3,$T2,$I3
|
||||
vor $I4,$I4,$padbits
|
||||
|
||||
vperm $H0,$H0,$H0,$ACC0 # move hash to right lane
|
||||
vand $I0,$I0, $ACC1 # mask redundant input lane[s]
|
||||
vperm $H1,$H1,$H1,$ACC0
|
||||
vand $I1,$I1, $ACC1
|
||||
vperm $H2,$H2,$H2,$ACC0
|
||||
vand $I2,$I2, $ACC1
|
||||
vperm $H3,$H3,$H3,$ACC0
|
||||
vand $I3,$I3, $ACC1
|
||||
vperm $H4,$H4,$H4,$ACC0
|
||||
vand $I4,$I4, $ACC1
|
||||
|
||||
vaddudm $I0,$I0,$H0 # accumulate hash
|
||||
vxor $H0,$H0,$H0 # wipe hash value
|
||||
vaddudm $I1,$I1,$H1
|
||||
vxor $H1,$H1,$H1
|
||||
vaddudm $I2,$I2,$H2
|
||||
vxor $H2,$H2,$H2
|
||||
vaddudm $I3,$I3,$H3
|
||||
vxor $H3,$H3,$H3
|
||||
vaddudm $I4,$I4,$H4
|
||||
vxor $H4,$H4,$H4
|
||||
|
||||
xor. $len,$len,$len
|
||||
b Last_vsx
|
||||
|
||||
.align 4
|
||||
Ldone_vsx:
|
||||
$POP r0,`$VSXFRAME+$LRSAVE`($sp)
|
||||
li $x10,4
|
||||
li $x20,8
|
||||
li $x30,12
|
||||
li $x40,16
|
||||
stvwx_u $H0,$x00,$ctx # store hash
|
||||
stvwx_u $H1,$x10,$ctx
|
||||
stvwx_u $H2,$x20,$ctx
|
||||
stvwx_u $H3,$x30,$ctx
|
||||
stvwx_u $H4,$x40,$ctx
|
||||
|
||||
lwz r12,`$VSXFRAME-$SIZE_T*5-4`($sp)# pull vrsave
|
||||
mtlr r0
|
||||
li r10,`15+$LOCALS+128`
|
||||
li r11,`31+$LOCALS+128`
|
||||
mtspr 256,r12 # restore vrsave
|
||||
lvx v20,r10,$sp
|
||||
addi r10,r10,32
|
||||
lvx v21,r10,$sp
|
||||
addi r10,r10,32
|
||||
lvx v22,r11,$sp
|
||||
addi r11,r11,32
|
||||
lvx v23,r10,$sp
|
||||
addi r10,r10,32
|
||||
lvx v24,r11,$sp
|
||||
addi r11,r11,32
|
||||
lvx v25,r10,$sp
|
||||
addi r10,r10,32
|
||||
lvx v26,r11,$sp
|
||||
addi r11,r11,32
|
||||
lvx v27,r10,$sp
|
||||
addi r10,r10,32
|
||||
lvx v28,r11,$sp
|
||||
addi r11,r11,32
|
||||
lvx v29,r10,$sp
|
||||
addi r10,r10,32
|
||||
lvx v30,r11,$sp
|
||||
lvx v31,r10,$sp
|
||||
$POP r27,`$VSXFRAME-$SIZE_T*5`($sp)
|
||||
$POP r28,`$VSXFRAME-$SIZE_T*4`($sp)
|
||||
$POP r29,`$VSXFRAME-$SIZE_T*3`($sp)
|
||||
$POP r30,`$VSXFRAME-$SIZE_T*2`($sp)
|
||||
$POP r31,`$VSXFRAME-$SIZE_T*1`($sp)
|
||||
addi $sp,$sp,$VSXFRAME
|
||||
blr
|
||||
.long 0
|
||||
.byte 0,12,0x04,1,0x80,5,4,0
|
||||
.long 0
|
||||
.size __poly1305_blocks_vsx,.-__poly1305_blocks_vsx
|
||||
|
||||
.align 6
|
||||
LPICmeup:
|
||||
mflr r0
|
||||
bcl 20,31,\$+4
|
||||
mflr $const # vvvvvv "distance" between . and 1st data entry
|
||||
addi $const,$const,`64-8`
|
||||
mtlr r0
|
||||
blr
|
||||
.long 0
|
||||
.byte 0,12,0x14,0,0,0,0,0
|
||||
.space `64-9*4`
|
||||
|
||||
.quad 0x0000000003ffffff,0x0000000003ffffff # mask26
|
||||
.quad 0x000000000000001a,0x000000000000001a # _26
|
||||
.quad 0x0000000000000028,0x0000000000000028 # _40
|
||||
.quad 0x000000000e0f0001,0x000000001e1f1011 # I2perm
|
||||
.quad 0x0100000001000000,0x0100000001000000 # padbits
|
||||
.quad 0x0706050403020100,0x0f0e0d0c0b0a0908 # byte swap for big-endian
|
||||
|
||||
.quad 0x0000000000000000,0x0000000004050607 # magic tail masks
|
||||
.quad 0x0405060700000000,0x0000000000000000
|
||||
.quad 0x0000000000000000,0x0405060700000000
|
||||
|
||||
.quad 0xffffffff00000000,0xffffffffffffffff
|
||||
.quad 0xffffffff00000000,0xffffffff00000000
|
||||
.quad 0x0000000000000000,0xffffffff00000000
|
||||
___
|
||||
}}}
|
||||
$code.=<<___;
|
||||
.asciz "Poly1305 for PPC, CRYPTOGAMS by \@dot-asm"
|
||||
___
|
||||
|
||||
$code =~ s/\`([^\`]*)\`/eval $1/gem;
|
||||
print $code;
|
||||
foreach (split("\n",$code)) {
|
||||
s/\`([^\`]*)\`/eval($1)/ge;
|
||||
|
||||
# instructions prefixed with '?' are endian-specific and need
|
||||
# to be adjusted accordingly...
|
||||
if ($flavour !~ /le$/) { # big-endian
|
||||
s/be\?// or
|
||||
s/le\?/#le#/
|
||||
} else { # little-endian
|
||||
s/le\?// or
|
||||
s/be\?/#be#/
|
||||
}
|
||||
|
||||
print $_,"\n";
|
||||
}
|
||||
close STDOUT;
|
||||
@@ -24,204 +24,820 @@
|
||||
#
|
||||
# On side note, z13 enables vector base 2^26 implementation...
|
||||
|
||||
$flavour = shift;
|
||||
#
|
||||
# January 2019
|
||||
#
|
||||
# Add vx code path (base 2^26).
|
||||
#
|
||||
# Copyright IBM Corp. 2019
|
||||
# Author: Patrick Steuer <patrick.steuer@de.ibm.com>
|
||||
|
||||
use strict;
|
||||
use FindBin qw($Bin);
|
||||
use lib "$Bin/../..";
|
||||
use perlasm::s390x qw(:DEFAULT :VX AUTOLOAD LABEL);
|
||||
|
||||
my $flavour = shift;
|
||||
|
||||
my ($z,$SIZE_T);
|
||||
if ($flavour =~ /3[12]/) {
|
||||
$z=0; # S/390 ABI
|
||||
$SIZE_T=4;
|
||||
$g="";
|
||||
} else {
|
||||
$z=1; # zSeries ABI
|
||||
$SIZE_T=8;
|
||||
$g="g";
|
||||
}
|
||||
|
||||
my $output;
|
||||
while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {}
|
||||
open STDOUT,">$output";
|
||||
|
||||
$sp="%r15";
|
||||
my $sp="%r15";
|
||||
|
||||
# novx code path ctx layout
|
||||
# ---------------------------------
|
||||
# var value base off
|
||||
# ---------------------------------
|
||||
# u64 h[3] hash 2^64 0
|
||||
# u32 pad[2]
|
||||
# u64 r[2] key 2^64 32
|
||||
|
||||
# vx code path ctx layout
|
||||
# ---------------------------------
|
||||
# var value base off
|
||||
# ---------------------------------
|
||||
# u32 acc1[5] r^2-acc 2^26 0
|
||||
# u32 pad
|
||||
# u32 acc2[5] r-acc 2^26 24
|
||||
# u32 pad
|
||||
# u32 r1[5] r 2^26 48
|
||||
# u32 r15[5] 5*r 2^26 68
|
||||
# u32 r2[5] r^2 2^26 88
|
||||
# u32 r25[5] 5*r^2 2^26 108
|
||||
# u32 r4[5] r^4 2^26 128
|
||||
# u32 r45[5] 5*r^4 2^26 148
|
||||
|
||||
PERLASM_BEGIN($output);
|
||||
|
||||
TEXT ();
|
||||
|
||||
################
|
||||
# static void poly1305_init(void *ctx, const unsigned char key[16])
|
||||
{
|
||||
my ($ctx,$key)=map("%r$_",(2..3));
|
||||
my ($r0,$r1,$r2)=map("%r$_",(9,11,13));
|
||||
|
||||
sub MUL_RKEY { # r*=key
|
||||
my ($d0hi,$d0lo,$d1hi,$d1lo)=map("%r$_",(4..7));
|
||||
my ($t0,$t1,$s1)=map("%r$_",(8,10,12));
|
||||
|
||||
lg ("%r0","32($ctx)");
|
||||
lg ("%r1","40($ctx)");
|
||||
|
||||
srlg ($s1,"%r1",2);
|
||||
algr ($s1,"%r1");
|
||||
|
||||
lgr ($d0lo,$r0);
|
||||
lgr ($d1lo,$r1);
|
||||
|
||||
mlgr ($d0hi,"%r0");
|
||||
lgr ($r1,$d1lo);
|
||||
mlgr ($d1hi,$s1);
|
||||
|
||||
mlgr ($t0,"%r1");
|
||||
mlgr ($t1,"%r0");
|
||||
|
||||
algr ($d0lo,$d1lo);
|
||||
lgr ($d1lo,$r2);
|
||||
alcgr ($d0hi,$d1hi);
|
||||
lghi ($d1hi,0);
|
||||
|
||||
algr ($r1,$r0);
|
||||
alcgr ($t1,$t0);
|
||||
|
||||
msgr ($d1lo,$s1);
|
||||
msgr ($r2,"%r0");
|
||||
|
||||
algr ($r1,$d1lo);
|
||||
alcgr ($t1,$d1hi);
|
||||
|
||||
algr ($r1,$d0hi);
|
||||
alcgr ($r2,$t1);
|
||||
|
||||
lghi ($r0,-4);
|
||||
ngr ($r0,$r2);
|
||||
srlg ($t0,$r2,2);
|
||||
algr ($r0,$t0);
|
||||
lghi ($t1,3);
|
||||
ngr ($r2,$t1);
|
||||
|
||||
algr ($r0,$d0lo);
|
||||
alcgr ($r1,$d1hi);
|
||||
alcgr ($r2,$d1hi);
|
||||
}
|
||||
|
||||
sub ST_R5R { # store r,5*r -> base 2^26
|
||||
my @d=map("%r$_",(4..8));
|
||||
my @off=@_;
|
||||
|
||||
lgr (@d[2],$r0);
|
||||
lr ("%r1",@d[2]);
|
||||
nilh ("%r1",1023);
|
||||
lgr (@d[3],$r1);
|
||||
lr (@d[0],"%r1");
|
||||
srlg ("%r1",@d[2],52);
|
||||
lgr (@d[4],$r2);
|
||||
srlg ("%r0",@d[2],26);
|
||||
sll (@d[4],24);
|
||||
lr (@d[2],@d[3]);
|
||||
nilh ("%r0",1023);
|
||||
sll (@d[2],12);
|
||||
lr (@d[1],"%r0");
|
||||
&or (@d[2],"%r1");
|
||||
srlg ("%r1",@d[3],40);
|
||||
nilh (@d[2],1023);
|
||||
&or (@d[4],"%r1");
|
||||
srlg (@d[3],@d[3],14);
|
||||
nilh (@d[4],1023);
|
||||
nilh (@d[3],1023);
|
||||
|
||||
stm (@d[0],@d[4],"@off[0]($ctx)");
|
||||
mhi (@d[$_],5) for (0..4);
|
||||
stm (@d[0],@d[4],"@off[1]($ctx)");
|
||||
}
|
||||
|
||||
GLOBL ("poly1305_init");
|
||||
TYPE ("poly1305_init","\@function");
|
||||
ALIGN (16);
|
||||
LABEL ("poly1305_init");
|
||||
lghi ("%r0",0);
|
||||
lghi ("%r1",-1);
|
||||
stg ("%r0","0($ctx)"); # zero hash value / acc1
|
||||
stg ("%r0","8($ctx)");
|
||||
stg ("%r0","16($ctx)");
|
||||
|
||||
&{$z? \&clgr:\&clr} ($key,"%r0");
|
||||
je (".Ldone");
|
||||
|
||||
lrvg ("%r4","0($key)"); # load little-endian key
|
||||
lrvg ("%r5","8($key)");
|
||||
|
||||
nihl ("%r1",0xffc0); # 0xffffffc0ffffffff
|
||||
srlg ("%r0","%r1",4); # 0x0ffffffc0fffffff
|
||||
srlg ("%r1","%r1",4);
|
||||
nill ("%r1",0xfffc); # 0x0ffffffc0ffffffc
|
||||
|
||||
ngr ("%r4","%r0");
|
||||
ngr ("%r5","%r1");
|
||||
|
||||
stg ("%r4","32($ctx)");
|
||||
stg ("%r5","40($ctx)");
|
||||
|
||||
larl ("%r1","OPENSSL_s390xcap_P");
|
||||
lg ("%r0","16(%r1)");
|
||||
tmhh ("%r0",0x4000); # check for vector facility
|
||||
jz (".Ldone");
|
||||
|
||||
larl ("%r4","poly1305_blocks_vx");
|
||||
larl ("%r5","poly1305_emit_vx");
|
||||
|
||||
&{$z? \&stmg:\&stm} ("%r6","%r13","6*$SIZE_T($sp)");
|
||||
&{$z? \&stmg:\&stm} ("%r4","%r5","4*$z+228($ctx)");
|
||||
|
||||
lg ($r0,"32($ctx)");
|
||||
lg ($r1,"40($ctx)");
|
||||
lghi ($r2,0);
|
||||
|
||||
ST_R5R (48,68); # store r,5*r
|
||||
|
||||
MUL_RKEY();
|
||||
ST_R5R (88,108); # store r^2,5*r^2
|
||||
|
||||
MUL_RKEY();
|
||||
MUL_RKEY();
|
||||
ST_R5R (128,148); # store r^4,5*r^4
|
||||
|
||||
lghi ("%r0",0);
|
||||
stg ("%r0","24($ctx)"); # zero acc2
|
||||
stg ("%r0","32($ctx)");
|
||||
stg ("%r0","40($ctx)");
|
||||
|
||||
&{$z? \&lmg:\&lm} ("%r6","%r13","6*$SIZE_T($sp)");
|
||||
lghi ("%r2",1);
|
||||
br ("%r14");
|
||||
|
||||
LABEL (".Ldone");
|
||||
lghi ("%r2",0);
|
||||
br ("%r14");
|
||||
SIZE ("poly1305_init",".-poly1305_init");
|
||||
}
|
||||
|
||||
# VX CODE PATH
|
||||
{
|
||||
my $frame=8*16;
|
||||
my @m01=map("%v$_",(0..4));
|
||||
my @m23=map("%v$_",(5..9));
|
||||
my @tmp=@m23;
|
||||
my @acc=map("%v$_",(10..14));
|
||||
my @r=map("%v$_",(15..19));
|
||||
my @r5=map("%v$_",(20..24));
|
||||
my $padvec="%v26";
|
||||
my $mask4="%v27";
|
||||
my @vperm=map("%v$_",(28..30));
|
||||
my $mask="%v31";
|
||||
|
||||
sub REDUCE {
|
||||
vesrlg (@tmp[0],@acc[0],26);
|
||||
vesrlg (@tmp[3],@acc[3],26);
|
||||
vn (@acc[0],@acc[0],$mask);
|
||||
vn (@acc[3],@acc[3],$mask);
|
||||
vag (@acc[1],@acc[1],@tmp[0]); # carry 0->1
|
||||
vag (@acc[4],@acc[4],@tmp[3]); # carry 3->4
|
||||
|
||||
vesrlg (@tmp[1],@acc[1],26);
|
||||
vesrlg (@tmp[4],@acc[4],26);
|
||||
vn (@acc[1],@acc[1],$mask);
|
||||
vn (@acc[4],@acc[4],$mask);
|
||||
veslg (@tmp[0],@tmp[4],2);
|
||||
vag (@tmp[4],@tmp[4],@tmp[0]); # h[4]*=5
|
||||
vag (@acc[2],@acc[2],@tmp[1]); # carry 1->2
|
||||
vag (@acc[0],@acc[0],@tmp[4]); # carry 4->0
|
||||
|
||||
vesrlg (@tmp[2],@acc[2],26);
|
||||
vesrlg (@tmp[0],@acc[0],26);
|
||||
vn (@acc[2],@acc[2],$mask);
|
||||
vn (@acc[0],@acc[0],$mask);
|
||||
vag (@acc[3],@acc[3],@tmp[2]); # carry 2->3
|
||||
vag (@acc[1],@acc[1],@tmp[0]); # carry 0->1
|
||||
|
||||
vesrlg (@tmp[3],@acc[3],26);
|
||||
vn (@acc[3],@acc[3],$mask);
|
||||
vag (@acc[4],@acc[4],@tmp[3]); # carry 3->4
|
||||
}
|
||||
|
||||
################
|
||||
# static void poly1305_blocks_vx(void *ctx, const unsigned char *inp,
|
||||
# size_t len, u32 padbit)
|
||||
{
|
||||
my ($ctx,$inp,$len) = map("%r$_",(2..4));
|
||||
my $padbit="%r0";
|
||||
|
||||
GLOBL ("poly1305_blocks_vx");
|
||||
TYPE ("poly1305_blocks_vx","\@function");
|
||||
ALIGN (16);
|
||||
LABEL ("poly1305_blocks_vx");
|
||||
if ($z) {
|
||||
aghi ($sp,-$frame);
|
||||
vstm ("%v8","%v15","0($sp)");
|
||||
} else {
|
||||
std ("%f4","16*$SIZE_T+2*8($sp)");
|
||||
std ("%f6","16*$SIZE_T+3*8($sp)");
|
||||
llgfr ($len,$len);
|
||||
}
|
||||
llgfr ($padbit,"%r5");
|
||||
vlef (@acc[$_],"4*$_($ctx)",1) for (0..4); # load acc1
|
||||
larl ("%r5",".Lconst");
|
||||
vlef (@acc[$_],"24+4*$_($ctx)",3) for (0..4); # load acc2
|
||||
sllg ($padbit,$padbit,24);
|
||||
vlm (@vperm[0],$mask,"0(%r5)"); # load vperm ops, mask
|
||||
vgbm ($mask4,0x0707);
|
||||
vlvgp ($padvec,$padbit,$padbit);
|
||||
|
||||
srlg ("%r1",$len,6);
|
||||
ltgr ("%r1","%r1");
|
||||
jz (".Lvx_4x_done");
|
||||
|
||||
ALIGN (16);
|
||||
LABEL (".Lvx_4x");
|
||||
vlm ("%v20","%v23","0($inp)"); # load m0,m1,m2,m3
|
||||
|
||||
# m01,m23 -> base 2^26
|
||||
|
||||
vperm (@m01[0],"%v20","%v21",@vperm[0]);
|
||||
vperm (@m23[0],"%v22","%v23",@vperm[0]);
|
||||
vperm (@m01[2],"%v20","%v21",@vperm[1]);
|
||||
vperm (@m23[2],"%v22","%v23",@vperm[1]);
|
||||
vperm (@m01[4],"%v20","%v21",@vperm[2]);
|
||||
vperm (@m23[4],"%v22","%v23",@vperm[2]);
|
||||
|
||||
vesrlg (@m01[1],@m01[0],26);
|
||||
vesrlg (@m23[1],@m23[0],26);
|
||||
vesrlg (@m01[3],@m01[2],30);
|
||||
vesrlg (@m23[3],@m23[2],30);
|
||||
vesrlg (@m01[2],@m01[2],4);
|
||||
vesrlg (@m23[2],@m23[2],4);
|
||||
|
||||
vn (@m01[4],@m01[4],$mask4);
|
||||
vn (@m23[4],@m23[4],$mask4);
|
||||
for (0..3) {
|
||||
vn (@m01[$_],@m01[$_],$mask);
|
||||
vn (@m23[$_],@m23[$_],$mask);
|
||||
}
|
||||
vaf (@m01[4],@m01[4],$padvec); # pad m01
|
||||
vaf (@m23[4],@m23[4],$padvec); # pad m23
|
||||
|
||||
# acc = acc * r^4 + m01 * r^2 + m23
|
||||
|
||||
vlrepf (@r5[$_],"4*$_+108($ctx)") for (0..4); # load 5*r^2
|
||||
vlrepf (@r[$_],"4*$_+88($ctx)") for (0..4); # load r^2
|
||||
|
||||
vmalof (@tmp[0],@m01[4],@r5[1],@m23[0]);
|
||||
vmalof (@tmp[1],@m01[4],@r5[2],@m23[1]);
|
||||
vmalof (@tmp[2],@m01[4],@r5[3],@m23[2]);
|
||||
vmalof (@tmp[3],@m01[4],@r5[4],@m23[3]);
|
||||
vmalof (@tmp[4],@m01[4],@r[0],@m23[4]);
|
||||
|
||||
vmalof (@tmp[0],@m01[3],@r5[2],@tmp[0]);
|
||||
vmalof (@tmp[1],@m01[3],@r5[3],@tmp[1]);
|
||||
vmalof (@tmp[2],@m01[3],@r5[4],@tmp[2]);
|
||||
vmalof (@tmp[3],@m01[3],@r[0],@tmp[3]);
|
||||
vmalof (@tmp[4],@m01[3],@r[1],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@m01[2],@r5[3],@tmp[0]);
|
||||
vmalof (@tmp[1],@m01[2],@r5[4],@tmp[1]);
|
||||
vmalof (@tmp[2],@m01[2],@r[0],@tmp[2]);
|
||||
vmalof (@tmp[3],@m01[2],@r[1],@tmp[3]);
|
||||
vmalof (@tmp[4],@m01[2],@r[2],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@m01[1],@r5[4],@tmp[0]);
|
||||
vmalof (@tmp[1],@m01[1],@r[0],@tmp[1]);
|
||||
vmalof (@tmp[2],@m01[1],@r[1],@tmp[2]);
|
||||
vmalof (@tmp[3],@m01[1],@r[2],@tmp[3]);
|
||||
vmalof (@tmp[4],@m01[1],@r[3],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@m01[0],@r[0],@tmp[0]);
|
||||
vmalof (@tmp[1],@m01[0],@r[1],@tmp[1]);
|
||||
vmalof (@tmp[2],@m01[0],@r[2],@tmp[2]);
|
||||
vmalof (@tmp[3],@m01[0],@r[3],@tmp[3]);
|
||||
vmalof (@tmp[4],@m01[0],@r[4],@tmp[4]);
|
||||
|
||||
vlrepf (@r5[$_],"4*$_+148($ctx)") for (0..4); # load 5*r^4
|
||||
vlrepf (@r[$_],"4*$_+128($ctx)") for (0..4); # load r^4
|
||||
|
||||
vmalof (@tmp[0],@acc[4],@r5[1],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[4],@r5[2],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[4],@r5[3],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[4],@r5[4],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[4],@r[0],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
|
||||
|
||||
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
|
||||
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
|
||||
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
|
||||
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
|
||||
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
|
||||
|
||||
REDUCE ();
|
||||
|
||||
la ($inp,"64($inp)");
|
||||
brctg ("%r1",".Lvx_4x");
|
||||
|
||||
ALIGN (16);
|
||||
LABEL (".Lvx_4x_done");
|
||||
tml ($len,32);
|
||||
jz (".Lvx_2x_done");
|
||||
|
||||
vlm ("%v20","%v21","0($inp)"); # load m0,m1
|
||||
|
||||
# m01 -> base 2^26
|
||||
|
||||
vperm (@m01[0],"%v20","%v21",@vperm[0]);
|
||||
vperm (@m01[2],"%v20","%v21",@vperm[1]);
|
||||
vperm (@m01[4],"%v20","%v21",@vperm[2]);
|
||||
|
||||
vesrlg (@m01[1],@m01[0],26);
|
||||
vesrlg (@m01[3],@m01[2],30);
|
||||
vesrlg (@m01[2],@m01[2],4);
|
||||
|
||||
vn (@m01[4],@m01[4],$mask4);
|
||||
vn (@m01[$_],@m01[$_],$mask) for (0..3);
|
||||
|
||||
vaf (@m01[4],@m01[4],$padvec); # pad m01
|
||||
|
||||
# acc = acc * r^2+ m01
|
||||
|
||||
vlrepf (@r5[$_],"4*$_+108($ctx)") for (0..4); # load 5*r^2
|
||||
vlrepf (@r[$_],"4*$_+88($ctx)") for (0..4); # load r^2
|
||||
|
||||
vmalof (@tmp[0],@acc[4],@r5[1],@m01[0]);
|
||||
vmalof (@tmp[1],@acc[4],@r5[2],@m01[1]);
|
||||
vmalof (@tmp[2],@acc[4],@r5[3],@m01[2]);
|
||||
vmalof (@tmp[3],@acc[4],@r5[4],@m01[3]);
|
||||
vmalof (@tmp[4],@acc[4],@r[0],@m01[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
|
||||
|
||||
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
|
||||
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
|
||||
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
|
||||
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
|
||||
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
|
||||
|
||||
REDUCE ();
|
||||
|
||||
la ($inp,"32($inp)");
|
||||
|
||||
ALIGN (16);
|
||||
LABEL (".Lvx_2x_done");
|
||||
tml ($len,16);
|
||||
jz (".Lvx_done");
|
||||
|
||||
vleig ($padvec,0,0);
|
||||
|
||||
vzero ("%v20");
|
||||
vl ("%v21","0($inp)"); # load m0
|
||||
|
||||
# m0 -> base 2^26
|
||||
|
||||
vperm (@m01[0],"%v20","%v21",@vperm[0]);
|
||||
vperm (@m01[2],"%v20","%v21",@vperm[1]);
|
||||
vperm (@m01[4],"%v20","%v21",@vperm[2]);
|
||||
|
||||
vesrlg (@m01[1],@m01[0],26);
|
||||
vesrlg (@m01[3],@m01[2],30);
|
||||
vesrlg (@m01[2],@m01[2],4);
|
||||
|
||||
vn (@m01[4],@m01[4],$mask4);
|
||||
vn (@m01[$_],@m01[$_],$mask) for (0..3);
|
||||
|
||||
vaf (@m01[4],@m01[4],$padvec); # pad m0
|
||||
|
||||
# acc = acc * r + m01
|
||||
|
||||
vlrepf (@r5[$_],"4*$_+68($ctx)") for (0..4); # load 5*r
|
||||
vlrepf (@r[$_],"4*$_+48($ctx)") for (0..4); # load r
|
||||
|
||||
vmalof (@tmp[0],@acc[4],@r5[1],@m01[0]);
|
||||
vmalof (@tmp[1],@acc[4],@r5[2],@m01[1]);
|
||||
vmalof (@tmp[2],@acc[4],@r5[3],@m01[2]);
|
||||
vmalof (@tmp[3],@acc[4],@r5[4],@m01[3]);
|
||||
vmalof (@tmp[4],@acc[4],@r[0],@m01[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
|
||||
|
||||
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
|
||||
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
|
||||
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
|
||||
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
|
||||
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
|
||||
|
||||
REDUCE ();
|
||||
|
||||
ALIGN (16);
|
||||
LABEL (".Lvx_done");
|
||||
vstef (@acc[$_],"4*$_($ctx)",1) for (0..4); # store acc
|
||||
vstef (@acc[$_],"24+4*$_($ctx)",3) for (0..4);
|
||||
|
||||
if ($z) {
|
||||
vlm ("%v8","%v15","0($sp)");
|
||||
la ($sp,"$frame($sp)");
|
||||
} else {
|
||||
ld ("%f4","16*$SIZE_T+2*8($sp)");
|
||||
ld ("%f6","16*$SIZE_T+3*8($sp)");
|
||||
}
|
||||
br ("%r14");
|
||||
SIZE ("poly1305_blocks_vx",".-poly1305_blocks_vx");
|
||||
}
|
||||
|
||||
################
|
||||
# static void poly1305_emit_vx(void *ctx, unsigned char mac[16],
|
||||
# const u32 nonce[4])
|
||||
{
|
||||
my ($ctx,$mac,$nonce) = map("%r$_",(2..4));
|
||||
|
||||
GLOBL ("poly1305_emit_vx");
|
||||
TYPE ("poly1305_emit_vx","\@function");
|
||||
ALIGN (16);
|
||||
LABEL ("poly1305_emit_vx");
|
||||
if ($z) {
|
||||
aghi ($sp,-$frame);
|
||||
vstm ("%v8","%v15","0($sp)");
|
||||
} else {
|
||||
std ("%f4","16*$SIZE_T+2*8($sp)");
|
||||
std ("%f6","16*$SIZE_T+3*8($sp)");
|
||||
}
|
||||
larl ("%r5",".Lconst");
|
||||
|
||||
vlef (@acc[$_],"4*$_($ctx)",1) for (0..4); # load acc1
|
||||
vlef (@acc[$_],"24+4*$_($ctx)",3) for (0..4); # load acc2
|
||||
vlef (@r5[$_],"108+4*$_($ctx)",1) for (0..4); # load 5*r^2
|
||||
vlef (@r[$_],"88+4*$_($ctx)",1) for (0..4); # load r^2
|
||||
vlef (@r5[$_],"68+4*$_($ctx)",3) for (0..4); # load 5*r
|
||||
vlef (@r[$_],"48+4*$_($ctx)",3) for (0..4); # load r
|
||||
vl ($mask,"48(%r5)"); # load mask
|
||||
|
||||
# acc = acc1 * r^2 + acc2 * r
|
||||
|
||||
vmlof (@tmp[0],@acc[4],@r5[1]);
|
||||
vmlof (@tmp[1],@acc[4],@r5[2]);
|
||||
vmlof (@tmp[2],@acc[4],@r5[3]);
|
||||
vmlof (@tmp[3],@acc[4],@r5[4]);
|
||||
vmlof (@tmp[4],@acc[4],@r[0]);
|
||||
|
||||
vmalof (@tmp[0],@acc[3],@r5[2],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[3],@r5[3],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[3],@r5[4],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[3],@r[0],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[3],@r[1],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[2],@r5[3],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[2],@r5[4],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[2],@r[0],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[2],@r[1],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[2],@r[2],@tmp[4]);
|
||||
|
||||
vmalof (@tmp[0],@acc[1],@r5[4],@tmp[0]);
|
||||
vmalof (@tmp[1],@acc[1],@r[0],@tmp[1]);
|
||||
vmalof (@tmp[2],@acc[1],@r[1],@tmp[2]);
|
||||
vmalof (@tmp[3],@acc[1],@r[2],@tmp[3]);
|
||||
vmalof (@tmp[4],@acc[1],@r[3],@tmp[4]);
|
||||
|
||||
vmalof (@acc[1],@acc[0],@r[1],@tmp[1]);
|
||||
vmalof (@acc[2],@acc[0],@r[2],@tmp[2]);
|
||||
vmalof (@acc[3],@acc[0],@r[3],@tmp[3]);
|
||||
vmalof (@acc[4],@acc[0],@r[4],@tmp[4]);
|
||||
vmalof (@acc[0],@acc[0],@r[0],@tmp[0]);
|
||||
|
||||
vzero ("%v27");
|
||||
vsumqg (@acc[$_],@acc[$_],"%v27") for (0..4);
|
||||
|
||||
REDUCE ();
|
||||
|
||||
vesrlg (@tmp[1],@acc[1],26);
|
||||
vn (@acc[1],@acc[1],$mask);
|
||||
vag (@acc[2],@acc[2],@tmp[1]); # carry 1->2
|
||||
|
||||
vesrlg (@tmp[2],@acc[2],26);
|
||||
vn (@acc[2],@acc[2],$mask);
|
||||
vag (@acc[3],@acc[3],@tmp[2]); # carry 2->3
|
||||
|
||||
vesrlg (@tmp[3],@acc[3],26);
|
||||
vn (@acc[3],@acc[3],$mask);
|
||||
vag (@acc[4],@acc[4],@tmp[3]); # carry 3->4
|
||||
|
||||
# acc -> base 2^64
|
||||
vleib ("%v30",6*8,7);
|
||||
vleib ("%v29",13*8,7);
|
||||
vleib ("%v28",3*8,7);
|
||||
|
||||
veslg (@acc[1],@acc[1],26);
|
||||
veslg (@acc[3],@acc[3],26);
|
||||
vo (@acc[0],@acc[0],@acc[1]);
|
||||
vo (@acc[2],@acc[2],@acc[3]);
|
||||
|
||||
veslg (@acc[2],@acc[2],4);
|
||||
vslb (@acc[2],@acc[2],"%v30"); # <<52
|
||||
vo (@acc[0],@acc[0],@acc[2]);
|
||||
|
||||
vslb (@tmp[4],@acc[4],"%v29"); # <<104
|
||||
vo (@acc[0],@acc[0],@tmp[4]);
|
||||
|
||||
vsrlb (@acc[1],@acc[4],"%v28"); # >>24
|
||||
|
||||
# acc %= 2^130-5
|
||||
vone ("%v26");
|
||||
vleig ("%v27",5,1);
|
||||
vone ("%v29");
|
||||
vleig ("%v26",-4,1);
|
||||
|
||||
vaq (@tmp[0],@acc[0],"%v27");
|
||||
vaccq (@tmp[1],@acc[0],"%v27");
|
||||
|
||||
vaq (@tmp[1],@tmp[1],"%v26");
|
||||
vaccq (@tmp[1],@tmp[1],@acc[1]);
|
||||
|
||||
vaq (@tmp[1],@tmp[1],"%v29");
|
||||
|
||||
vn (@tmp[2],@tmp[1],@acc[0]);
|
||||
vnc (@tmp[3],@tmp[0],@tmp[1]);
|
||||
vo (@acc[0],@tmp[2],@tmp[3]);
|
||||
|
||||
# acc += nonce
|
||||
vl (@vperm[0],"64(%r5)");
|
||||
vlef (@tmp[0],"4*$_($nonce)",3-$_) for (0..3);
|
||||
|
||||
vaq (@acc[0],@acc[0],@tmp[0]);
|
||||
|
||||
vperm (@acc[0],@acc[0],@acc[0],@vperm[0]);
|
||||
vst (@acc[0],"0($mac)"); # store mac
|
||||
|
||||
if ($z) {
|
||||
vlm ("%v8","%v15","0($sp)");
|
||||
la ($sp,"$frame($sp)");
|
||||
} else {
|
||||
ld ("%f4","16*$SIZE_T+2*8($sp)");
|
||||
ld ("%f6","16*$SIZE_T+3*8($sp)");
|
||||
}
|
||||
br ("%r14");
|
||||
SIZE ("poly1305_emit_vx",".-poly1305_emit_vx");
|
||||
}
|
||||
}
|
||||
|
||||
# NOVX CODE PATH
|
||||
{
|
||||
################
|
||||
# static void poly1305_blocks(void *ctx, const unsigned char *inp, size_t len,
|
||||
# u32 padbit)
|
||||
{
|
||||
my ($ctx,$inp,$len,$padbit) = map("%r$_",(2..5));
|
||||
|
||||
$code.=<<___;
|
||||
.text
|
||||
|
||||
.globl poly1305_init
|
||||
.type poly1305_init,\@function
|
||||
.align 16
|
||||
poly1305_init:
|
||||
lghi %r0,0
|
||||
lghi %r1,-1
|
||||
stg %r0,0($ctx) # zero hash value
|
||||
stg %r0,8($ctx)
|
||||
stg %r0,16($ctx)
|
||||
|
||||
cl${g}r $inp,%r0
|
||||
je .Lno_key
|
||||
|
||||
lrvg %r4,0($inp) # load little-endian key
|
||||
lrvg %r5,8($inp)
|
||||
|
||||
nihl %r1,0xffc0 # 0xffffffc0ffffffff
|
||||
srlg %r0,%r1,4 # 0x0ffffffc0fffffff
|
||||
srlg %r1,%r1,4
|
||||
nill %r1,0xfffc # 0x0ffffffc0ffffffc
|
||||
|
||||
ngr %r4,%r0
|
||||
ngr %r5,%r1
|
||||
|
||||
stg %r4,32($ctx)
|
||||
stg %r5,40($ctx)
|
||||
|
||||
.Lno_key:
|
||||
lghi %r2,0
|
||||
br %r14
|
||||
.size poly1305_init,.-poly1305_init
|
||||
___
|
||||
{
|
||||
my ($d0hi,$d0lo,$d1hi,$d1lo,$t0,$h0,$t1,$h1,$h2) = map("%r$_",(6..14));
|
||||
my ($r0,$r1,$s1) = map("%r$_",(0..2));
|
||||
GLOBL ("poly1305_blocks");
|
||||
TYPE ("poly1305_blocks","\@function");
|
||||
ALIGN (16);
|
||||
LABEL ("poly1305_blocks");
|
||||
$z? srlg ($len,$len,4) :srl ($len,4);
|
||||
lghi ("%r0",0);
|
||||
&{$z? \&clgr:\&clr} ($len,"%r0");
|
||||
je (".Lno_data");
|
||||
|
||||
$code.=<<___;
|
||||
.globl poly1305_blocks
|
||||
.type poly1305_blocks,\@function
|
||||
.align 16
|
||||
poly1305_blocks:
|
||||
srl${g} $len,4 # fixed-up in 64-bit build
|
||||
lghi %r0,0
|
||||
cl${g}r $len,%r0
|
||||
je .Lno_data
|
||||
&{$z? \&stmg:\&stm} ("%r6","%r14","6*$SIZE_T($sp)");
|
||||
|
||||
stm${g} %r6,%r14,`6*$SIZE_T`($sp)
|
||||
|
||||
llgfr $padbit,$padbit # clear upper half, much needed with
|
||||
llgfr ($padbit,$padbit); # clear upper half, much needed with
|
||||
# non-64-bit ABI
|
||||
lg $r0,32($ctx) # load key
|
||||
lg $r1,40($ctx)
|
||||
lg ($r0,"32($ctx)"); # load key
|
||||
lg ($r1,"40($ctx)");
|
||||
|
||||
lg $h0,0($ctx) # load hash value
|
||||
lg $h1,8($ctx)
|
||||
lg $h2,16($ctx)
|
||||
lg ($h0,"0($ctx)"); # load hash value
|
||||
lg ($h1,"8($ctx)");
|
||||
lg ($h2,"16($ctx)");
|
||||
|
||||
st$g $ctx,`2*$SIZE_T`($sp) # off-load $ctx
|
||||
srlg $s1,$r1,2
|
||||
algr $s1,$r1 # s1 = r1 + r1>>2
|
||||
j .Loop
|
||||
&{$z? \&stg:\&st} ($ctx,"2*$SIZE_T($sp)"); # off-load $ctx
|
||||
srlg ($s1,$r1,2);
|
||||
algr ($s1,$r1); # s1 = r1 + r1>>2
|
||||
j (".Loop");
|
||||
|
||||
.align 16
|
||||
.Loop:
|
||||
lrvg $d0lo,0($inp) # load little-endian input
|
||||
lrvg $d1lo,8($inp)
|
||||
la $inp,16($inp)
|
||||
ALIGN (16);
|
||||
LABEL (".Loop");
|
||||
lrvg ($d0lo,"0($inp)"); # load little-endian input
|
||||
lrvg ($d1lo,"8($inp)");
|
||||
la ($inp,"16($inp)");
|
||||
|
||||
algr $d0lo,$h0 # accumulate input
|
||||
alcgr $d1lo,$h1
|
||||
algr ($d0lo,$h0); # accumulate input
|
||||
alcgr ($d1lo,$h1);
|
||||
|
||||
lgr $h0,$d0lo
|
||||
mlgr $d0hi,$r0 # h0*r0 -> $d0hi:$d0lo
|
||||
lgr $h1,$d1lo
|
||||
mlgr $d1hi,$s1 # h1*5*r1 -> $d1hi:$d1lo
|
||||
lgr ($h0,$d0lo);
|
||||
mlgr ($d0hi,$r0); # h0*r0 -> $d0hi:$d0lo
|
||||
lgr ($h1,$d1lo);
|
||||
mlgr ($d1hi,$s1); # h1*5*r1 -> $d1hi:$d1lo
|
||||
|
||||
mlgr $t0,$r1 # h0*r1 -> $t0:$h0
|
||||
mlgr $t1,$r0 # h1*r0 -> $t1:$h1
|
||||
alcgr $h2,$padbit
|
||||
mlgr ($t0,$r1); # h0*r1 -> $t0:$h0
|
||||
mlgr ($t1,$r0); # h1*r0 -> $t1:$h1
|
||||
alcgr ($h2,$padbit);
|
||||
|
||||
algr $d0lo,$d1lo
|
||||
lgr $d1lo,$h2
|
||||
alcgr $d0hi,$d1hi
|
||||
lghi $d1hi,0
|
||||
algr ($d0lo,$d1lo);
|
||||
lgr ($d1lo,$h2);
|
||||
alcgr ($d0hi,$d1hi);
|
||||
lghi ($d1hi,0);
|
||||
|
||||
algr $h1,$h0
|
||||
alcgr $t1,$t0
|
||||
algr ($h1,$h0);
|
||||
alcgr ($t1,$t0);
|
||||
|
||||
msgr $d1lo,$s1 # h2*s1
|
||||
msgr $h2,$r0 # h2*r0
|
||||
msgr ($d1lo,$s1); # h2*s1
|
||||
msgr ($h2,$r0); # h2*r0
|
||||
|
||||
algr $h1,$d1lo
|
||||
alcgr $t1,$d1hi # $d1hi is zero
|
||||
algr ($h1,$d1lo);
|
||||
alcgr ($t1,$d1hi); # $d1hi is zero
|
||||
|
||||
algr $h1,$d0hi
|
||||
alcgr $h2,$t1
|
||||
algr ($h1,$d0hi);
|
||||
alcgr ($h2,$t1);
|
||||
|
||||
lghi $h0,-4 # final reduction step
|
||||
ngr $h0,$h2
|
||||
srlg $t0,$h2,2
|
||||
algr $h0,$t0
|
||||
lghi $t1,3
|
||||
ngr $h2,$t1
|
||||
lghi ($h0,-4); # final reduction step
|
||||
ngr ($h0,$h2);
|
||||
srlg ($t0,$h2,2);
|
||||
algr ($h0,$t0);
|
||||
lghi ($t1,3);
|
||||
ngr ($h2,$t1);
|
||||
|
||||
algr $h0,$d0lo
|
||||
alcgr $h1,$d1hi # $d1hi is still zero
|
||||
alcgr $h2,$d1hi # $d1hi is still zero
|
||||
algr ($h0,$d0lo);
|
||||
alcgr ($h1,$d1hi); # $d1hi is still zero
|
||||
alcgr ($h2,$d1hi); # $d1hi is still zero
|
||||
|
||||
brct$g $len,.Loop
|
||||
&{$z? \&brctg:\&brct} ($len,".Loop");
|
||||
|
||||
l$g $ctx,`2*$SIZE_T`($sp) # restore $ctx
|
||||
&{$z? \&lg:\&l} ($ctx,"2*$SIZE_T($sp)");# restore $ctx
|
||||
|
||||
stg $h0,0($ctx) # store hash value
|
||||
stg $h1,8($ctx)
|
||||
stg $h2,16($ctx)
|
||||
stg ($h0,"0($ctx)"); # store hash value
|
||||
stg ($h1,"8($ctx)");
|
||||
stg ($h2,"16($ctx)");
|
||||
|
||||
lm${g} %r6,%r14,`6*$SIZE_T`($sp)
|
||||
.Lno_data:
|
||||
br %r14
|
||||
.size poly1305_blocks,.-poly1305_blocks
|
||||
___
|
||||
&{$z? \&lmg:\&lm} ("%r6","%r14","6*$SIZE_T($sp)");
|
||||
LABEL (".Lno_data");
|
||||
br ("%r14");
|
||||
SIZE ("poly1305_blocks",".-poly1305_blocks");
|
||||
}
|
||||
|
||||
################
|
||||
# static void poly1305_emit(void *ctx, unsigned char mac[16],
|
||||
# const u32 nonce[4])
|
||||
{
|
||||
my ($mac,$nonce)=($inp,$len);
|
||||
my ($ctx,$mac,$nonce) = map("%r$_",(2..4));
|
||||
my ($h0,$h1,$h2,$d0,$d1)=map("%r$_",(5..9));
|
||||
|
||||
$code.=<<___;
|
||||
.globl poly1305_emit
|
||||
.type poly1305_emit,\@function
|
||||
.align 16
|
||||
poly1305_emit:
|
||||
stm${g} %r6,%r9,`6*$SIZE_T`($sp)
|
||||
GLOBL ("poly1305_emit");
|
||||
TYPE ("poly1305_emit","\@function");
|
||||
ALIGN (16);
|
||||
LABEL ("poly1305_emit");
|
||||
&{$z? \&stmg:\&stm} ("%r6","%r9","6*$SIZE_T($sp)");
|
||||
|
||||
lg $h0,0($ctx)
|
||||
lg $h1,8($ctx)
|
||||
lg $h2,16($ctx)
|
||||
lg ($h0,"0($ctx)");
|
||||
lg ($h1,"8($ctx)");
|
||||
lg ($h2,"16($ctx)");
|
||||
|
||||
lghi %r0,5
|
||||
lghi %r1,0
|
||||
lgr $d0,$h0
|
||||
lgr $d1,$h1
|
||||
lghi ("%r0",5);
|
||||
lghi ("%r1",0);
|
||||
lgr ($d0,$h0);
|
||||
lgr ($d1,$h1);
|
||||
|
||||
algr $h0,%r0 # compare to modulus
|
||||
alcgr $h1,%r1
|
||||
alcgr $h2,%r1
|
||||
algr ($h0,"%r0"); # compare to modulus
|
||||
alcgr ($h1,"%r1");
|
||||
alcgr ($h2,"%r1");
|
||||
|
||||
srlg $h2,$h2,2 # did it borrow/carry?
|
||||
slgr %r1,$h2 # 0-$h2>>2
|
||||
lg $h2,0($nonce) # load nonce
|
||||
lghi %r0,-1
|
||||
lg $ctx,8($nonce)
|
||||
xgr %r0,%r1 # ~%r1
|
||||
srlg ($h2,$h2,2); # did it borrow/carry?
|
||||
slgr ("%r1",$h2); # 0-$h2>>2
|
||||
lg ($h2,"0($nonce)"); # load nonce
|
||||
lghi ("%r0",-1);
|
||||
lg ($ctx,"8($nonce)");
|
||||
xgr ("%r0","%r1"); # ~%r1
|
||||
|
||||
ngr $h0,%r1
|
||||
ngr $d0,%r0
|
||||
ngr $h1,%r1
|
||||
ngr $d1,%r0
|
||||
ogr $h0,$d0
|
||||
rllg $d0,$h2,32 # flip nonce words
|
||||
ogr $h1,$d1
|
||||
rllg $d1,$ctx,32
|
||||
ngr ($h0,"%r1");
|
||||
ngr ($d0,"%r0");
|
||||
ngr ($h1,"%r1");
|
||||
ngr ($d1,"%r0");
|
||||
ogr ($h0,$d0);
|
||||
rllg ($d0,$h2,32); # flip nonce words
|
||||
ogr ($h1,$d1);
|
||||
rllg ($d1,$ctx,32);
|
||||
|
||||
algr $h0,$d0 # accumulate nonce
|
||||
alcgr $h1,$d1
|
||||
algr ($h0,$d0); # accumulate nonce
|
||||
alcgr ($h1,$d1);
|
||||
|
||||
strvg $h0,0($mac) # write little-endian result
|
||||
strvg $h1,8($mac)
|
||||
strvg ($h0,"0($mac)"); # write little-endian result
|
||||
strvg ($h1,"8($mac)");
|
||||
|
||||
lm${g} %r6,%r9,`6*$SIZE_T`($sp)
|
||||
br %r14
|
||||
.size poly1305_emit,.-poly1305_emit
|
||||
|
||||
.string "Poly1305 for s390x, CRYPTOGAMS by <appro\@openssl.org>"
|
||||
___
|
||||
&{$z? \&lmg:\&lm} ("%r6","%r9","6*$SIZE_T($sp)");
|
||||
br ("%r14");
|
||||
SIZE ("poly1305_emit",".-poly1305_emit");
|
||||
}
|
||||
}
|
||||
################
|
||||
|
||||
$code =~ s/\`([^\`]*)\`/eval $1/gem;
|
||||
$code =~ s/\b(srlg\s+)(%r[0-9]+\s*,)\s*([0-9]+)/$1$2$2$3/gm;
|
||||
ALIGN (128);
|
||||
LABEL (".Lconst");
|
||||
LONG (0x00060504,0x03020100,0x00161514,0x13121110); # vperm op[m[1],m[0]]
|
||||
LONG (0x000c0b0a,0x09080706,0x001c1b1a,0x19181716); # vperm op[m[3],m[2]]
|
||||
LONG (0x00000000,0x000f0e0d,0x00000000,0x001f1e1d); # vperm op[ - ,m[4]]
|
||||
LONG (0x00000000,0x03ffffff,0x00000000,0x03ffffff); # [0,2^26-1,0,2^26-1]
|
||||
LONG (0x0f0e0d0c,0x0b0a0908,0x07060504,0x03020100); # vperm op endian
|
||||
STRING ("\"Poly1305 for s390x, CRYPTOGAMS by <appro\@openssl.org>\"");
|
||||
|
||||
print $code;
|
||||
close STDOUT;
|
||||
PERLASM_END();
|
||||
@@ -17,8 +17,5 @@ GENERATE[poly1305-armv8.S]=asm/poly1305-armv8.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[poly1305-armv8.o]=..
|
||||
GENERATE[poly1305-mips.S]=asm/poly1305-mips.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[poly1305-mips.o]=..
|
||||
|
||||
BEGINRAW[Makefile(unix)]
|
||||
{- $builddir -}/poly1305-%.S: {- $sourcedir -}/asm/poly1305-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
ENDRAW[Makefile(unix)]
|
||||
GENERATE[poly1305-c64xplus.S]=asm/poly1305-c64xplus.pl $(PERLASM_SCHEME)
|
||||
GENERATE[poly1305-s390x.S]=asm/poly1305-s390x.pl $(PERLASM_SCHEME)
|
||||
+10
-1
@@ -116,10 +116,19 @@ void poly1305_blocks_fpu(void *ctx, const unsigned char *inp, size_t len,
|
||||
unsigned int padbit);
|
||||
void poly1305_emit_fpu(void *ctx, unsigned char mac[16],
|
||||
const unsigned int nonce[4]);
|
||||
void poly1305_init_vsx(void *ctx, const unsigned char key[16]);
|
||||
void poly1305_blocks_vsx(void *ctx, const unsigned char *inp, size_t len,
|
||||
unsigned int padbit);
|
||||
void poly1305_emit_vsx(void *ctx, unsigned char mac[16],
|
||||
const unsigned int nonce[4]);
|
||||
int poly1305_init(void *ctx, const unsigned char key[16], void *func[2]);
|
||||
int poly1305_init(void *ctx, const unsigned char key[16], void *func[2])
|
||||
{
|
||||
if (sizeof(size_t) == 4 && (OPENSSL_ppccap_P & PPC_FPU)) {
|
||||
if (OPENSSL_ppccap_P & PPC_CRYPTO207) {
|
||||
poly1305_init_int(ctx, key);
|
||||
func[0] = (void*)(uintptr_t)poly1305_blocks_vsx;
|
||||
func[1] = (void*)(uintptr_t)poly1305_emit;
|
||||
} else if (sizeof(size_t) == 4 && (OPENSSL_ppccap_P & PPC_FPU)) {
|
||||
poly1305_init_fpu(ctx, key);
|
||||
func[0] = (void*)(uintptr_t)poly1305_blocks_fpu;
|
||||
func[1] = (void*)(uintptr_t)poly1305_emit_fpu;
|
||||
|
||||
@@ -10,9 +10,5 @@ GENERATE[rc4-x86_64.s]=asm/rc4-x86_64.pl $(PERLASM_SCHEME)
|
||||
GENERATE[rc4-md5-x86_64.s]=asm/rc4-md5-x86_64.pl $(PERLASM_SCHEME)
|
||||
|
||||
GENERATE[rc4-parisc.s]=asm/rc4-parisc.pl $(PERLASM_SCHEME)
|
||||
|
||||
BEGINRAW[Makefile]
|
||||
# GNU make "catch all"
|
||||
{- $builddir -}/rc4-%.s: {- $sourcedir -}/asm/rc4-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
ENDRAW[Makefile]
|
||||
GENERATE[rc4-c64xplus.s]=asm/rc4-c64xplus.pl $(PERLASM_SCHEME)
|
||||
GENERATE[rc4-s390x.s]=asm/rc4-s390x.pl $(PERLASM_SCHEME)
|
||||
+12
-10
@@ -26,6 +26,7 @@ GENERATE[sha256-mb-x86_64.s]=asm/sha256-mb-x86_64.pl $(PERLASM_SCHEME)
|
||||
GENERATE[sha512-x86_64.s]=asm/sha512-x86_64.pl $(PERLASM_SCHEME)
|
||||
GENERATE[keccak1600-x86_64.s]=asm/keccak1600-x86_64.pl $(PERLASM_SCHEME)
|
||||
|
||||
GENERATE[sha1-sparcv9a.S]=asm/sha1-sparcv9a.pl $(PERLASM_SCHEME)
|
||||
GENERATE[sha1-sparcv9.S]=asm/sha1-sparcv9.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[sha1-sparcv9.o]=..
|
||||
GENERATE[sha256-sparcv9.S]=asm/sha512-sparcv9.pl $(PERLASM_SCHEME)
|
||||
@@ -76,14 +77,15 @@ GENERATE[sha512-s390x.S]=asm/sha512-s390x.pl $(PERLASM_SCHEME)
|
||||
INCLUDE[sha512-s390x.o]=..
|
||||
GENERATE[keccak1600-s390x.S]=asm/keccak1600-s390x.pl $(PERLASM_SCHEME)
|
||||
|
||||
BEGINRAW[Makefile(unix)]
|
||||
##### SHA assembler implementations
|
||||
GENERATE[sha1-c64xplus.S]=asm/sha1-c64xplus.pl $(PERLASM_SCHEME)
|
||||
GENERATE[sha256-c64xplus.S]=asm/sha256-c64xplus.pl $(PERLASM_SCHEME)
|
||||
GENERATE[sha512-c64xplus.S]=asm/sha512-c64xplus.pl $(PERLASM_SCHEME)
|
||||
GENERATE[keccak1600-c64x.S]=asm/keccak1600-c64x.pl $(PERLASM_SCHEME)
|
||||
|
||||
# GNU make "catch all"
|
||||
{- $builddir -}/sha1-%.S: {- $sourcedir -}/asm/sha1-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
{- $builddir -}/sha256-%.S: {- $sourcedir -}/asm/sha512-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
{- $builddir -}/sha512-%.S: {- $sourcedir -}/asm/sha512-%.pl
|
||||
CC="$(CC)" $(PERL) $< $(PERLASM_SCHEME) $@
|
||||
ENDRAW[Makefile(unix)]
|
||||
# These are not yet used
|
||||
GENERATE[keccak1600-avx2.S]=asm/keccak1600-avx2.pl $(PERLASM_SCHEME)
|
||||
GENERATE[keccak1600-avx512.S]=asm/keccak1600-avx512.pl $(PERLASM_SCHEME)
|
||||
GENERATE[keccak1600-avx512vl.S]=asm/keccak1600-avx512vl.pl $(PERLASM_SCHEME)
|
||||
GENERATE[keccak1600-mmx.S]=asm/keccak1600-mmx.pl $(PERLASM_SCHEME)
|
||||
GENERATE[keccak1600p8-ppc.S]=asm/keccak1600p8-ppc.pl $(PERLASM_SCHEME)
|
||||
GENERATE[sha1-thumb.S]=asm/sha1-thumb.pl $(PERLASM_SCHEME)
|
||||
@@ -187,7 +187,7 @@ void SRP_user_pwd_free(SRP_user_pwd *user_pwd)
|
||||
SRP_user_pwd *SRP_user_pwd_new(void)
|
||||
{
|
||||
SRP_user_pwd *ret;
|
||||
|
||||
|
||||
if ((ret = OPENSSL_malloc(sizeof(*ret))) == NULL) {
|
||||
/* SRPerr(SRP_F_SRP_USER_PWD_NEW, ERR_R_MALLOC_FAILURE); */ /*ckerr_ignore*/
|
||||
return NULL;
|
||||
|
||||
@@ -158,6 +158,18 @@ static int crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
|
||||
int idx;
|
||||
|
||||
switch (operation) {
|
||||
case ASN1_OP_D2I_PRE:
|
||||
if (crl->meth->crl_free) {
|
||||
if (!crl->meth->crl_free(crl))
|
||||
return 0;
|
||||
}
|
||||
AUTHORITY_KEYID_free(crl->akid);
|
||||
ISSUING_DIST_POINT_free(crl->idp);
|
||||
ASN1_INTEGER_free(crl->crl_number);
|
||||
ASN1_INTEGER_free(crl->base_crl_number);
|
||||
sk_GENERAL_NAMES_pop_free(crl->issuers, GENERAL_NAMES_free);
|
||||
/* fall thru */
|
||||
|
||||
case ASN1_OP_NEW_POST:
|
||||
crl->idp = NULL;
|
||||
crl->akid = NULL;
|
||||
|
||||
@@ -36,6 +36,7 @@ static int pubkey_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
|
||||
/* Attempt to decode public key and cache in pubkey structure. */
|
||||
X509_PUBKEY *pubkey = (X509_PUBKEY *)*pval;
|
||||
EVP_PKEY_free(pubkey->pkey);
|
||||
pubkey->pkey = NULL;
|
||||
/*
|
||||
* Opportunistically decode the key but remove any non fatal errors
|
||||
* from the queue. Subsequent explicit attempts to decode/use the key
|
||||
|
||||
@@ -40,12 +40,35 @@ static int x509_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
|
||||
|
||||
switch (operation) {
|
||||
|
||||
case ASN1_OP_D2I_PRE:
|
||||
CRYPTO_free_ex_data(CRYPTO_EX_INDEX_X509, ret, &ret->ex_data);
|
||||
X509_CERT_AUX_free(ret->aux);
|
||||
ASN1_OCTET_STRING_free(ret->skid);
|
||||
AUTHORITY_KEYID_free(ret->akid);
|
||||
CRL_DIST_POINTS_free(ret->crldp);
|
||||
policy_cache_free(ret->policy_cache);
|
||||
GENERAL_NAMES_free(ret->altname);
|
||||
NAME_CONSTRAINTS_free(ret->nc);
|
||||
#ifndef OPENSSL_NO_RFC3779
|
||||
sk_IPAddressFamily_pop_free(ret->rfc3779_addr, IPAddressFamily_free);
|
||||
ASIdentifiers_free(ret->rfc3779_asid);
|
||||
#endif
|
||||
|
||||
/* fall thru */
|
||||
|
||||
case ASN1_OP_NEW_POST:
|
||||
ret->ex_cached = 0;
|
||||
ret->ex_kusage = 0;
|
||||
ret->ex_xkusage = 0;
|
||||
ret->ex_nscert = 0;
|
||||
ret->ex_flags = 0;
|
||||
ret->ex_pathlen = -1;
|
||||
ret->ex_pcpathlen = -1;
|
||||
ret->skid = NULL;
|
||||
ret->akid = NULL;
|
||||
ret->policy_cache = NULL;
|
||||
ret->altname = NULL;
|
||||
ret->nc = NULL;
|
||||
#ifndef OPENSSL_NO_RFC3779
|
||||
ret->rfc3779_addr = NULL;
|
||||
ret->rfc3779_asid = NULL;
|
||||
|
||||
Reference in New Issue
Block a user