1 /// -*- mode: asm; asm-comment-char: ?/ -*-
3 /// Fancy SIMD implementation of Salsa20
5 /// (c) 2015 Straylight/Edgeware
8 ///----- Licensing notice ---------------------------------------------------
10 /// This file is part of Catacomb.
12 /// Catacomb is free software; you can redistribute it and/or modify
13 /// it under the terms of the GNU Library General Public License as
14 /// published by the Free Software Foundation; either version 2 of the
15 /// License, or (at your option) any later version.
17 /// Catacomb is distributed in the hope that it will be useful,
18 /// but WITHOUT ANY WARRANTY; without even the implied warranty of
19 /// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 /// GNU Library General Public License for more details.
22 /// You should have received a copy of the GNU Library General Public
23 /// License along with Catacomb; if not, write to the Free
24 /// Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
25 /// MA 02111-1307, USA.
27 ///--------------------------------------------------------------------------
28 /// External definitions.
31 #include "asm-common.h"
33 ///--------------------------------------------------------------------------
36 // Magic constants for shuffling.
41 ///--------------------------------------------------------------------------
47 FUNC(salsa20_core_x86ish_sse2)
52 // Arguments come in on the stack, and will need to be collected. We
53 // we can get away with just the scratch registers for integer work,
54 // but we'll run out of XMM registers and will need some properly
55 // aligned space which we'll steal from the stack. I don't trust the
56 // stack pointer's alignment, so I'll have to mask the stack pointer,
57 // which in turn means I'll need to keep track of the old value.
58 // Hence I'm making a full i386-style stack frame here.
60 // The Windows and SysV ABIs are sufficiently similar that we don't
61 // need to worry about the differences here.
68 # define SAVE2 [esp + 0]
69 # define SAVE3 [esp + 16]
80 #if CPUFAM_AMD64 && ABI_SYSV
81 // This is nice. We have plenty of XMM registers, and the arguments
82 // are in useful places. There's no need to spill anything and we
83 // can just get on with the code.
94 # if CPUFAM_AMD64 && ABI_WIN
95 // Arguments come in registers, but they're different between Windows
96 // and everyone else (and everyone else is saner).
98 // The Windows ABI insists that we preserve some of the XMM
99 // registers, but we want more than we can use as scratch space. Two
100 // places we only need to save a copy of the input for the
101 // feedforward at the end; but the other two we want for the final
102 // permutation, so save the old values on the stack (We need an extra
103 // 8 bytes to align the stack.)
110 # define SAVE2 [rsp + 32]
111 # define SAVE3 [rsp + 48]
114 .seh_stackalloc 64 + 8
115 movdqa [rsp + 0], xmm6
117 movdqa [rsp + 16], xmm7
118 .seh_savexmm xmm7, 16
122 // First job is to slurp the matrix into XMM registers. The words
123 // have already been permuted conveniently to make them line up
124 // better for SIMD processing.
126 // The textbook arrangement of the matrix is this.
133 // But we've rotated the columns up so that the main diagonal with
134 // the constants on it end up in the first row, giving something more
142 // so the transformation looks like this:
144 // [ 0 1 2 3] [ 0 5 10 15] (a, xmm0)
145 // [ 4 5 6 7] --> [ 4 9 14 3] (b, xmm1)
146 // [ 8 9 10 11] [ 8 13 2 7] (c, xmm2)
147 // [12 13 14 15] [12 1 6 11] (d, xmm3)
148 movdqu xmm0, [IN + 0]
149 movdqu xmm1, [IN + 16]
150 movdqu xmm2, [IN + 32]
151 movdqu xmm3, [IN + 48]
153 // Take a copy for later.
160 // Apply a column quarterround to each of the columns simultaneously.
161 // Alas, there doesn't seem to be a packed doubleword rotate, so we
162 // have to synthesize it.
164 // b ^= (a + d) <<< 7
173 // c ^= (b + a) <<< 9
182 // d ^= (c + b) <<< 13
185 pshufd xmm1, xmm1, ROTL
192 // a ^= (d + c) <<< 18
194 pshufd xmm3, xmm3, ROTR
196 pshufd xmm2, xmm2, ROT2
203 // The transpose conveniently only involves reordering elements of
204 // individual rows, which can be done quite easily, and reordering
205 // the rows themselves, which is a trivial renaming. It doesn't
206 // involve any movement of elements between rows.
208 // [ 0 5 10 15] [ 0 5 10 15] (a, xmm0)
209 // [ 4 9 14 3] --> [ 1 6 11 12] (b, xmm3)
210 // [ 8 13 2 7] [ 2 7 8 13] (c, xmm2)
211 // [12 1 6 11] [ 3 4 9 14] (d, xmm1)
213 // The shuffles have quite high latency, so they've been pushed
214 // backwards into the main instruction list.
216 // Apply the row quarterround to each of the columns (yes!)
219 // b ^= (a + d) <<< 7
228 // c ^= (b + a) <<< 9
237 // d ^= (c + b) <<< 13
240 pshufd xmm3, xmm3, ROTL
247 // a ^= (d + c) <<< 18
249 pshufd xmm1, xmm1, ROTR
251 pshufd xmm2, xmm2, ROT2
258 // We had to undo the transpose ready for the next loop. Again, push
259 // back the shuffles because they take a long time coming through.
260 // Decrement the loop counter and see if we should go round again.
261 // Later processors fuse this pair into a single uop.
265 // Almost there. Firstly, the feedforward addition, and then we have
266 // to write out the result. Here we have to undo the permutation
267 // which was already applied to the input. Shuffling has quite high
268 // latency, so arrange to start a new shuffle into a temporary as
269 // soon as we've written out the old value.
271 pshufd xmm4, xmm0, 0x39
275 pshufd xmm5, xmm1, ROTL
276 movd [OUT + 16], xmm1
279 pshufd xmm6, xmm2, ROT2
280 movd [OUT + 32], xmm2
283 pshufd xmm7, xmm3, ROTR
284 movd [OUT + 48], xmm3
287 pshufd xmm7, xmm3, ROT2
288 movd [OUT + 24], xmm7
289 pshufd xmm3, xmm3, ROTL
290 movd [OUT + 44], xmm3
293 pshufd xmm6, xmm2, ROTL
294 movd [OUT + 28], xmm6
295 pshufd xmm2, xmm2, ROTR
296 movd [OUT + 52], xmm2
298 movd [OUT + 12], xmm5
299 pshufd xmm5, xmm1, ROTR
300 movd [OUT + 36], xmm5
301 pshufd xmm1, xmm1, ROT2
302 movd [OUT + 56], xmm1
304 movd [OUT + 20], xmm4
305 pshufd xmm4, xmm0, ROT2
306 movd [OUT + 40], xmm4
307 pshufd xmm0, xmm0, ROTL
308 movd [OUT + 60], xmm0
316 #if CPUFAM_AMD64 && ABI_WIN
317 movdqa xmm6, [rsp + 0]
318 movdqa xmm7, [rsp + 16]
322 // And with that, we're done.
335 ///----- That's all, folks --------------------------------------------------