/// -*- mode: asm; asm-comment-char: ?/ -*- /// /// Fancy SIMD implementation of Salsa20 /// /// (c) 2015 Straylight/Edgeware /// ///----- Licensing notice --------------------------------------------------- /// /// This file is part of Catacomb. /// /// Catacomb is free software; you can redistribute it and/or modify /// it under the terms of the GNU Library General Public License as /// published by the Free Software Foundation; either version 2 of the /// License, or (at your option) any later version. /// /// Catacomb is distributed in the hope that it will be useful, /// but WITHOUT ANY WARRANTY; without even the implied warranty of /// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the /// GNU Library General Public License for more details. /// /// You should have received a copy of the GNU Library General Public /// License along with Catacomb; if not, write to the Free /// Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, /// MA 02111-1307, USA. ///-------------------------------------------------------------------------- /// External definitions. #include "config.h" #include "asm-common.h" ///-------------------------------------------------------------------------- /// Local utilities. // Magic constants for shuffling. #define ROTL 0x93 #define ROT2 0x4e #define ROTR 0x39 ///-------------------------------------------------------------------------- /// Main code. .arch pentium4 .section .text FUNC(salsa20_core_x86_sse2) // Initial state. We have three arguments: // [ebp + 8] is the number of rounds to do // [ebp + 12] points to the input matrix // [ebp + 16] points to the output matrix push ebp mov ebp, esp sub esp, 32 mov edx, [ebp + 12] and esp, ~15 // Prepare for the main loop. mov ecx, [ebp + 8] // First job is to slurp the matrix into XMM registers. The words // have already been permuted conveniently to make them line up // better for SIMD processing. // // The textbook arrangement of the matrix is this. // // [C K K K] // [K C N N] // [T T C K] // [K K K C] // // But we've rotated the columns up so that the main diagonal with // the constants on it end up in the first row, giving something more // like // // [C C C C] // [K T K K] // [T K K N] // [K K N K] // // so the transformation looks like this: // // [ 0 1 2 3] [ 0 5 10 15] (a, xmm0) // [ 4 5 6 7] --> [ 4 9 14 3] (b, xmm1) // [ 8 9 10 11] [ 8 13 2 7] (c, xmm2) // [12 13 14 15] [12 1 6 11] (d, xmm3) movdqu xmm0, [edx + 0] movdqu xmm1, [edx + 16] movdqu xmm2, [edx + 32] movdqu xmm3, [edx + 48] // Take a copy for later. movdqa [esp + 0], xmm0 movdqa [esp + 16], xmm1 movdqa xmm6, xmm2 movdqa xmm7, xmm3 loop: // Apply a column quarterround to each of the columns simultaneously. // Alas, there doesn't seem to be a packed doubleword rotate, so we // have to synthesize it. // b ^= (a + d) <<< 7 movdqa xmm4, xmm0 paddd xmm4, xmm3 movdqa xmm5, xmm4 pslld xmm4, 7 psrld xmm5, 25 por xmm4, xmm5 pxor xmm1, xmm4 // c ^= (b + a) <<< 9 movdqa xmm4, xmm1 paddd xmm4, xmm0 movdqa xmm5, xmm4 pslld xmm4, 9 psrld xmm5, 23 por xmm4, xmm5 pxor xmm2, xmm4 // d ^= (c + b) <<< 13 movdqa xmm4, xmm2 paddd xmm4, xmm1 pshufd xmm1, xmm1, ROTL movdqa xmm5, xmm4 pslld xmm4, 13 psrld xmm5, 19 por xmm4, xmm5 pxor xmm3, xmm4 // a ^= (d + c) <<< 18 movdqa xmm4, xmm3 pshufd xmm3, xmm3, ROTR paddd xmm4, xmm2 pshufd xmm2, xmm2, ROT2 movdqa xmm5, xmm4 pslld xmm4, 18 psrld xmm5, 14 por xmm4, xmm5 pxor xmm0, xmm4 // The transpose conveniently only involves reordering elements of // individual rows, which can be done quite easily, and reordering // the rows themselves, which is a trivial renaming. It doesn't // involve any movement of elements between rows. // // [ 0 5 10 15] [ 0 5 10 15] (a, xmm0) // [ 4 9 14 3] --> [ 1 6 11 12] (b, xmm3) // [ 8 13 2 7] [ 2 7 8 13] (c, xmm2) // [12 1 6 11] [ 3 4 9 14] (d, xmm1) // // The shuffles have quite high latency, so they've been pushed // backwards into the main instruction list. // Apply the row quarterround to each of the columns (yes!) // simultaneously. // b ^= (a + d) <<< 7 movdqa xmm4, xmm0 paddd xmm4, xmm1 movdqa xmm5, xmm4 pslld xmm4, 7 psrld xmm5, 25 por xmm4, xmm5 pxor xmm3, xmm4 // c ^= (b + a) <<< 9 movdqa xmm4, xmm3 paddd xmm4, xmm0 movdqa xmm5, xmm4 pslld xmm4, 9 psrld xmm5, 23 por xmm4, xmm5 pxor xmm2, xmm4 // d ^= (c + b) <<< 13 movdqa xmm4, xmm2 paddd xmm4, xmm3 pshufd xmm3, xmm3, ROTL movdqa xmm5, xmm4 pslld xmm4, 13 psrld xmm5, 19 por xmm4, xmm5 pxor xmm1, xmm4 // a ^= (d + c) <<< 18 movdqa xmm4, xmm1 pshufd xmm1, xmm1, ROTR paddd xmm4, xmm2 pshufd xmm2, xmm2, ROT2 movdqa xmm5, xmm4 pslld xmm4, 18 psrld xmm5, 14 por xmm4, xmm5 pxor xmm0, xmm4 // We had to undo the transpose ready for the next loop. Again, push // back the shuffles because they take a long time coming through. // Decrement the loop counter and see if we should go round again. // Later processors fuse this pair into a single uop. sub ecx, 2 ja loop // Almost there. Firstly, the feedforward addition, and then we have // to write out the result. Here we have to undo the permutation // which was already applied to the input. Shuffling has quite high // latency, so arrange to start a new shuffle into a temporary as // soon as we've written out the old value. mov edx, [ebp + 16] paddd xmm0, [esp + 0] pshufd xmm4, xmm0, ROTR movd [edx + 0], xmm0 paddd xmm1, [esp + 16] pshufd xmm5, xmm1, ROTL movd [edx + 16], xmm1 paddd xmm2, xmm6 pshufd xmm6, xmm2, ROT2 movd [edx + 32], xmm2 paddd xmm3, xmm7 pshufd xmm7, xmm3, ROTR movd [edx + 48], xmm3 movd [edx + 4], xmm7 pshufd xmm7, xmm3, ROT2 movd [edx + 24], xmm7 pshufd xmm3, xmm3, ROTL movd [edx + 44], xmm3 movd [edx + 8], xmm6 pshufd xmm6, xmm2, ROTL movd [edx + 28], xmm6 pshufd xmm2, xmm2, ROTR movd [edx + 52], xmm2 movd [edx + 12], xmm5 pshufd xmm5, xmm1, ROTR movd [edx + 36], xmm5 pshufd xmm1, xmm1, ROT2 movd [edx + 56], xmm1 movd [edx + 20], xmm4 pshufd xmm4, xmm0, ROT2 movd [edx + 40], xmm4 pshufd xmm0, xmm0, ROTL movd [edx + 60], xmm0 // Tidy things up. mov esp, ebp pop ebp // And with that, we're done. ret ENDFUNC ///----- That's all, folks --------------------------------------------------