1 /// -*- mode: asm; asm-comment-char: ?/ -*-
3 /// Fancy SIMD implementation of ChaCha
5 /// (c) 2015 Straylight/Edgeware
8 ///----- Licensing notice ---------------------------------------------------
10 /// This file is part of Catacomb.
12 /// Catacomb is free software; you can redistribute it and/or modify
13 /// it under the terms of the GNU Library General Public License as
14 /// published by the Free Software Foundation; either version 2 of the
15 /// License, or (at your option) any later version.
17 /// Catacomb is distributed in the hope that it will be useful,
18 /// but WITHOUT ANY WARRANTY; without even the implied warranty of
19 /// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 /// GNU Library General Public License for more details.
22 /// You should have received a copy of the GNU Library General Public
23 /// License along with Catacomb; if not, write to the Free
24 /// Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
25 /// MA 02111-1307, USA.
27 ///--------------------------------------------------------------------------
28 /// External definitions.
31 #include "asm-common.h"
33 ///--------------------------------------------------------------------------
39 FUNC(chacha_core_x86_sse2)
41 // Initial state. We have three arguments:
42 // [ebp + 8] is the number of rounds to do
43 // [ebp + 12] points to the input matrix
44 // [ebp + 16] points to the output matrix
51 // First job is to slurp the matrix into XMM registers. Be careful:
52 // the input matrix isn't likely to be properly aligned.
54 // [ 0 1 2 3] (a, xmm0)
55 // [ 4 5 6 7] (b, xmm0)
56 // [ 8 9 10 11] (c, xmm0)
57 // [12 13 14 15] (d, xmm0)
58 movdqu xmm0, [edx + 0]
59 movdqu xmm1, [edx + 16]
60 movdqu xmm2, [edx + 32]
61 movdqu xmm3, [edx + 48]
63 // Prepare for the main loop.
66 // Take a copy for later. This one is aligned properly, by
74 // Apply a column quarterround to each of the columns simultaneously.
75 // Alas, there doesn't seem to be a packed doubleword rotate, so we
76 // have to synthesize it.
78 // a += b; d ^= a; d <<<= 16
86 // c += d; b ^= c; b <<<= 12
94 // a += b; d ^= a; d <<<= 8
102 // c += d; b ^= c; b <<<= 7
104 pshufd xmm3, xmm3, 0x93
106 pshufd xmm2, xmm2, 0x4e
112 // The not-quite-transpose conveniently only involves reordering
113 // elements of individual rows, which can be done quite easily. It
114 // doesn't involve any movement of elements between rows, or even
115 // renaming of the rows.
117 // [ 0 1 2 3] [ 0 1 2 3] (a, xmm0)
118 // [ 4 5 6 7] --> [ 5 6 7 4] (b, xmm1)
119 // [ 8 9 10 11] [10 11 8 9] (c, xmm2)
120 // [12 13 14 15] [15 12 13 14] (d, xmm3)
122 // The shuffles have quite high latency, so they've mostly been
123 // pushed upwards. The remaining one can't be moved, though.
124 pshufd xmm1, xmm1, 0x39
126 // Apply the diagonal quarterround to each of the columns
129 // a += b; d ^= a; d <<<= 16
137 // c += d; b ^= c; b <<<= 12
145 // a += b; d ^= a; d <<<= 8
153 // c += d; b ^= c; b <<<= 7
155 pshufd xmm3, xmm3, 0x39
157 pshufd xmm2, xmm2, 0x4e
163 // Finally, finish off undoing the transpose, and we're done for this
164 // doubleround. Again, most of this was done above so we don't have
165 // to wait for the shuffles.
166 pshufd xmm1, xmm1, 0x93
168 // Decrement the loop counter and see if we should go round again.
172 // Almost there. Firstly, the feedforward addition.
179 // And now we write out the result. This one won't be aligned
181 movdqu [edx + 0], xmm0
182 movdqu [edx + 16], xmm1
183 movdqu [edx + 32], xmm2
184 movdqu [edx + 48], xmm3
190 // And with that, we're done.
195 ///----- That's all, folks --------------------------------------------------