Skip to content

Commit b1ccc8f

Browse files
martinwilliherbertx
martinwilli
authored and
herbertx
committed
crypto: poly1305 - Add a four block AVX2 variant for x86_64
Extends the x86_64 Poly1305 authenticator by a function processing four consecutive Poly1305 blocks in parallel using AVX2 instructions. For large messages, throughput increases by ~15-45% compared to two block SSE2: testing speed of poly1305 (poly1305-simd) test 0 ( 96 byte blocks, 16 bytes per update, 6 updates): 3809514 opers/sec, 365713411 bytes/sec test 1 ( 96 byte blocks, 32 bytes per update, 3 updates): 5973423 opers/sec, 573448627 bytes/sec test 2 ( 96 byte blocks, 96 bytes per update, 1 updates): 9446779 opers/sec, 906890803 bytes/sec test 3 ( 288 byte blocks, 16 bytes per update, 18 updates): 1364814 opers/sec, 393066691 bytes/sec test 4 ( 288 byte blocks, 32 bytes per update, 9 updates): 2045780 opers/sec, 589184697 bytes/sec test 5 ( 288 byte blocks, 288 bytes per update, 1 updates): 3711946 opers/sec, 1069040592 bytes/sec test 6 ( 1056 byte blocks, 32 bytes per update, 33 updates): 573686 opers/sec, 605812732 bytes/sec test 7 ( 1056 byte blocks, 1056 bytes per update, 1 updates): 1647802 opers/sec, 1740079440 bytes/sec test 8 ( 2080 byte blocks, 32 bytes per update, 65 updates): 292970 opers/sec, 609378224 bytes/sec test 9 ( 2080 byte blocks, 2080 bytes per update, 1 updates): 943229 opers/sec, 1961916528 bytes/sec test 10 ( 4128 byte blocks, 4128 bytes per update, 1 updates): 494623 opers/sec, 2041804569 bytes/sec test 11 ( 8224 byte blocks, 8224 bytes per update, 1 updates): 254045 opers/sec, 2089271014 bytes/sec testing speed of poly1305 (poly1305-simd) test 0 ( 96 byte blocks, 16 bytes per update, 6 updates): 3826224 opers/sec, 367317552 bytes/sec test 1 ( 96 byte blocks, 32 bytes per update, 3 updates): 5948638 opers/sec, 571069267 bytes/sec test 2 ( 96 byte blocks, 96 bytes per update, 1 updates): 9439110 opers/sec, 906154627 bytes/sec test 3 ( 288 byte blocks, 16 bytes per update, 18 updates): 1367756 opers/sec, 393913872 bytes/sec test 4 ( 288 byte blocks, 32 bytes per update, 9 updates): 2056881 opers/sec, 592381958 bytes/sec test 5 ( 288 byte blocks, 288 bytes per update, 1 updates): 3711153 opers/sec, 1068812179 bytes/sec test 6 ( 1056 byte blocks, 32 bytes per update, 33 updates): 574940 opers/sec, 607136745 bytes/sec test 7 ( 1056 byte blocks, 1056 bytes per update, 1 updates): 1948830 opers/sec, 2057964585 bytes/sec test 8 ( 2080 byte blocks, 32 bytes per update, 65 updates): 293308 opers/sec, 610082096 bytes/sec test 9 ( 2080 byte blocks, 2080 bytes per update, 1 updates): 1235224 opers/sec, 2569267792 bytes/sec test 10 ( 4128 byte blocks, 4128 bytes per update, 1 updates): 684405 opers/sec, 2825226316 bytes/sec test 11 ( 8224 byte blocks, 8224 bytes per update, 1 updates): 367101 opers/sec, 3019039446 bytes/sec Benchmark results from a Core i5-4670T. Signed-off-by: Martin Willi <[email protected]> Signed-off-by: Herbert Xu <[email protected]>
1 parent da35b22 commit b1ccc8f

File tree

4 files changed

+428
-1
lines changed

4 files changed

+428
-1
lines changed

‎arch/x86/crypto/Makefile

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,7 @@ sha1-ssse3-y := sha1_ssse3_asm.o sha1_ssse3_glue.o
8989
poly1305-x86_64-y := poly1305-sse2-x86_64.o poly1305_glue.o
9090
ifeq ($(avx2_supported),yes)
9191
sha1-ssse3-y += sha1_avx2_x86_64_asm.o
92+
poly1305-x86_64-y += poly1305-avx2-x86_64.o
9293
endif
9394
crc32c-intel-y := crc32c-intel_glue.o
9495
crc32c-intel-$(CONFIG_64BIT) += crc32c-pcl-intel-asm_64.o

‎arch/x86/crypto/poly1305-avx2-x86_64.S

Lines changed: 386 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,386 @@
1+
/*
2+
* Poly1305 authenticator algorithm, RFC7539, x64 AVX2 functions
3+
*
4+
* Copyright (C) 2015 Martin Willi
5+
*
6+
* This program is free software; you can redistribute it and/or modify
7+
* it under the terms of the GNU General Public License as published by
8+
* the Free Software Foundation; either version 2 of the License, or
9+
* (at your option) any later version.
10+
*/
11+
12+
#include <linux/linkage.h>
13+
14+
.data
15+
.align 32
16+
17+
ANMASK: .octa 0x0000000003ffffff0000000003ffffff
18+
.octa 0x0000000003ffffff0000000003ffffff
19+
ORMASK: .octa 0x00000000010000000000000001000000
20+
.octa 0x00000000010000000000000001000000
21+
22+
.text
23+
24+
#define h0 0x00(%rdi)
25+
#define h1 0x04(%rdi)
26+
#define h2 0x08(%rdi)
27+
#define h3 0x0c(%rdi)
28+
#define h4 0x10(%rdi)
29+
#define r0 0x00(%rdx)
30+
#define r1 0x04(%rdx)
31+
#define r2 0x08(%rdx)
32+
#define r3 0x0c(%rdx)
33+
#define r4 0x10(%rdx)
34+
#define u0 0x00(%r8)
35+
#define u1 0x04(%r8)
36+
#define u2 0x08(%r8)
37+
#define u3 0x0c(%r8)
38+
#define u4 0x10(%r8)
39+
#define w0 0x14(%r8)
40+
#define w1 0x18(%r8)
41+
#define w2 0x1c(%r8)
42+
#define w3 0x20(%r8)
43+
#define w4 0x24(%r8)
44+
#define y0 0x28(%r8)
45+
#define y1 0x2c(%r8)
46+
#define y2 0x30(%r8)
47+
#define y3 0x34(%r8)
48+
#define y4 0x38(%r8)
49+
#define m %rsi
50+
#define hc0 %ymm0
51+
#define hc1 %ymm1
52+
#define hc2 %ymm2
53+
#define hc3 %ymm3
54+
#define hc4 %ymm4
55+
#define hc0x %xmm0
56+
#define hc1x %xmm1
57+
#define hc2x %xmm2
58+
#define hc3x %xmm3
59+
#define hc4x %xmm4
60+
#define t1 %ymm5
61+
#define t2 %ymm6
62+
#define t1x %xmm5
63+
#define t2x %xmm6
64+
#define ruwy0 %ymm7
65+
#define ruwy1 %ymm8
66+
#define ruwy2 %ymm9
67+
#define ruwy3 %ymm10
68+
#define ruwy4 %ymm11
69+
#define ruwy0x %xmm7
70+
#define ruwy1x %xmm8
71+
#define ruwy2x %xmm9
72+
#define ruwy3x %xmm10
73+
#define ruwy4x %xmm11
74+
#define svxz1 %ymm12
75+
#define svxz2 %ymm13
76+
#define svxz3 %ymm14
77+
#define svxz4 %ymm15
78+
#define d0 %r9
79+
#define d1 %r10
80+
#define d2 %r11
81+
#define d3 %r12
82+
#define d4 %r13
83+
84+
ENTRY(poly1305_4block_avx2)
85+
# %rdi: Accumulator h[5]
86+
# %rsi: 64 byte input block m
87+
# %rdx: Poly1305 key r[5]
88+
# %rcx: Quadblock count
89+
# %r8: Poly1305 derived key r^2 u[5], r^3 w[5], r^4 y[5],
90+
91+
# This four-block variant uses loop unrolled block processing. It
92+
# requires 4 Poly1305 keys: r, r^2, r^3 and r^4:
93+
# h = (h + m) * r => h = (h + m1) * r^4 + m2 * r^3 + m3 * r^2 + m4 * r
94+
95+
vzeroupper
96+
push %rbx
97+
push %r12
98+
push %r13
99+
100+
# combine r0,u0,w0,y0
101+
vmovd y0,ruwy0x
102+
vmovd w0,t1x
103+
vpunpcklqdq t1,ruwy0,ruwy0
104+
vmovd u0,t1x
105+
vmovd r0,t2x
106+
vpunpcklqdq t2,t1,t1
107+
vperm2i128 $0x20,t1,ruwy0,ruwy0
108+
109+
# combine r1,u1,w1,y1 and s1=r1*5,v1=u1*5,x1=w1*5,z1=y1*5
110+
vmovd y1,ruwy1x
111+
vmovd w1,t1x
112+
vpunpcklqdq t1,ruwy1,ruwy1
113+
vmovd u1,t1x
114+
vmovd r1,t2x
115+
vpunpcklqdq t2,t1,t1
116+
vperm2i128 $0x20,t1,ruwy1,ruwy1
117+
vpslld $2,ruwy1,svxz1
118+
vpaddd ruwy1,svxz1,svxz1
119+
120+
# combine r2,u2,w2,y2 and s2=r2*5,v2=u2*5,x2=w2*5,z2=y2*5
121+
vmovd y2,ruwy2x
122+
vmovd w2,t1x
123+
vpunpcklqdq t1,ruwy2,ruwy2
124+
vmovd u2,t1x
125+
vmovd r2,t2x
126+
vpunpcklqdq t2,t1,t1
127+
vperm2i128 $0x20,t1,ruwy2,ruwy2
128+
vpslld $2,ruwy2,svxz2
129+
vpaddd ruwy2,svxz2,svxz2
130+
131+
# combine r3,u3,w3,y3 and s3=r3*5,v3=u3*5,x3=w3*5,z3=y3*5
132+
vmovd y3,ruwy3x
133+
vmovd w3,t1x
134+
vpunpcklqdq t1,ruwy3,ruwy3
135+
vmovd u3,t1x
136+
vmovd r3,t2x
137+
vpunpcklqdq t2,t1,t1
138+
vperm2i128 $0x20,t1,ruwy3,ruwy3
139+
vpslld $2,ruwy3,svxz3
140+
vpaddd ruwy3,svxz3,svxz3
141+
142+
# combine r4,u4,w4,y4 and s4=r4*5,v4=u4*5,x4=w4*5,z4=y4*5
143+
vmovd y4,ruwy4x
144+
vmovd w4,t1x
145+
vpunpcklqdq t1,ruwy4,ruwy4
146+
vmovd u4,t1x
147+
vmovd r4,t2x
148+
vpunpcklqdq t2,t1,t1
149+
vperm2i128 $0x20,t1,ruwy4,ruwy4
150+
vpslld $2,ruwy4,svxz4
151+
vpaddd ruwy4,svxz4,svxz4
152+
153+
.Ldoblock4:
154+
# hc0 = [m[48-51] & 0x3ffffff, m[32-35] & 0x3ffffff,
155+
# m[16-19] & 0x3ffffff, m[ 0- 3] & 0x3ffffff + h0]
156+
vmovd 0x00(m),hc0x
157+
vmovd 0x10(m),t1x
158+
vpunpcklqdq t1,hc0,hc0
159+
vmovd 0x20(m),t1x
160+
vmovd 0x30(m),t2x
161+
vpunpcklqdq t2,t1,t1
162+
vperm2i128 $0x20,t1,hc0,hc0
163+
vpand ANMASK(%rip),hc0,hc0
164+
vmovd h0,t1x
165+
vpaddd t1,hc0,hc0
166+
# hc1 = [(m[51-54] >> 2) & 0x3ffffff, (m[35-38] >> 2) & 0x3ffffff,
167+
# (m[19-22] >> 2) & 0x3ffffff, (m[ 3- 6] >> 2) & 0x3ffffff + h1]
168+
vmovd 0x03(m),hc1x
169+
vmovd 0x13(m),t1x
170+
vpunpcklqdq t1,hc1,hc1
171+
vmovd 0x23(m),t1x
172+
vmovd 0x33(m),t2x
173+
vpunpcklqdq t2,t1,t1
174+
vperm2i128 $0x20,t1,hc1,hc1
175+
vpsrld $2,hc1,hc1
176+
vpand ANMASK(%rip),hc1,hc1
177+
vmovd h1,t1x
178+
vpaddd t1,hc1,hc1
179+
# hc2 = [(m[54-57] >> 4) & 0x3ffffff, (m[38-41] >> 4) & 0x3ffffff,
180+
# (m[22-25] >> 4) & 0x3ffffff, (m[ 6- 9] >> 4) & 0x3ffffff + h2]
181+
vmovd 0x06(m),hc2x
182+
vmovd 0x16(m),t1x
183+
vpunpcklqdq t1,hc2,hc2
184+
vmovd 0x26(m),t1x
185+
vmovd 0x36(m),t2x
186+
vpunpcklqdq t2,t1,t1
187+
vperm2i128 $0x20,t1,hc2,hc2
188+
vpsrld $4,hc2,hc2
189+
vpand ANMASK(%rip),hc2,hc2
190+
vmovd h2,t1x
191+
vpaddd t1,hc2,hc2
192+
# hc3 = [(m[57-60] >> 6) & 0x3ffffff, (m[41-44] >> 6) & 0x3ffffff,
193+
# (m[25-28] >> 6) & 0x3ffffff, (m[ 9-12] >> 6) & 0x3ffffff + h3]
194+
vmovd 0x09(m),hc3x
195+
vmovd 0x19(m),t1x
196+
vpunpcklqdq t1,hc3,hc3
197+
vmovd 0x29(m),t1x
198+
vmovd 0x39(m),t2x
199+
vpunpcklqdq t2,t1,t1
200+
vperm2i128 $0x20,t1,hc3,hc3
201+
vpsrld $6,hc3,hc3
202+
vpand ANMASK(%rip),hc3,hc3
203+
vmovd h3,t1x
204+
vpaddd t1,hc3,hc3
205+
# hc4 = [(m[60-63] >> 8) | (1<<24), (m[44-47] >> 8) | (1<<24),
206+
# (m[28-31] >> 8) | (1<<24), (m[12-15] >> 8) | (1<<24) + h4]
207+
vmovd 0x0c(m),hc4x
208+
vmovd 0x1c(m),t1x
209+
vpunpcklqdq t1,hc4,hc4
210+
vmovd 0x2c(m),t1x
211+
vmovd 0x3c(m),t2x
212+
vpunpcklqdq t2,t1,t1
213+
vperm2i128 $0x20,t1,hc4,hc4
214+
vpsrld $8,hc4,hc4
215+
vpor ORMASK(%rip),hc4,hc4
216+
vmovd h4,t1x
217+
vpaddd t1,hc4,hc4
218+
219+
# t1 = [ hc0[3] * r0, hc0[2] * u0, hc0[1] * w0, hc0[0] * y0 ]
220+
vpmuludq hc0,ruwy0,t1
221+
# t1 += [ hc1[3] * s4, hc1[2] * v4, hc1[1] * x4, hc1[0] * z4 ]
222+
vpmuludq hc1,svxz4,t2
223+
vpaddq t2,t1,t1
224+
# t1 += [ hc2[3] * s3, hc2[2] * v3, hc2[1] * x3, hc2[0] * z3 ]
225+
vpmuludq hc2,svxz3,t2
226+
vpaddq t2,t1,t1
227+
# t1 += [ hc3[3] * s2, hc3[2] * v2, hc3[1] * x2, hc3[0] * z2 ]
228+
vpmuludq hc3,svxz2,t2
229+
vpaddq t2,t1,t1
230+
# t1 += [ hc4[3] * s1, hc4[2] * v1, hc4[1] * x1, hc4[0] * z1 ]
231+
vpmuludq hc4,svxz1,t2
232+
vpaddq t2,t1,t1
233+
# d0 = t1[0] + t1[1] + t[2] + t[3]
234+
vpermq $0xee,t1,t2
235+
vpaddq t2,t1,t1
236+
vpsrldq $8,t1,t2
237+
vpaddq t2,t1,t1
238+
vmovq t1x,d0
239+
240+
# t1 = [ hc0[3] * r1, hc0[2] * u1,hc0[1] * w1, hc0[0] * y1 ]
241+
vpmuludq hc0,ruwy1,t1
242+
# t1 += [ hc1[3] * r0, hc1[2] * u0, hc1[1] * w0, hc1[0] * y0 ]
243+
vpmuludq hc1,ruwy0,t2
244+
vpaddq t2,t1,t1
245+
# t1 += [ hc2[3] * s4, hc2[2] * v4, hc2[1] * x4, hc2[0] * z4 ]
246+
vpmuludq hc2,svxz4,t2
247+
vpaddq t2,t1,t1
248+
# t1 += [ hc3[3] * s3, hc3[2] * v3, hc3[1] * x3, hc3[0] * z3 ]
249+
vpmuludq hc3,svxz3,t2
250+
vpaddq t2,t1,t1
251+
# t1 += [ hc4[3] * s2, hc4[2] * v2, hc4[1] * x2, hc4[0] * z2 ]
252+
vpmuludq hc4,svxz2,t2
253+
vpaddq t2,t1,t1
254+
# d1 = t1[0] + t1[1] + t1[3] + t1[4]
255+
vpermq $0xee,t1,t2
256+
vpaddq t2,t1,t1
257+
vpsrldq $8,t1,t2
258+
vpaddq t2,t1,t1
259+
vmovq t1x,d1
260+
261+
# t1 = [ hc0[3] * r2, hc0[2] * u2, hc0[1] * w2, hc0[0] * y2 ]
262+
vpmuludq hc0,ruwy2,t1
263+
# t1 += [ hc1[3] * r1, hc1[2] * u1, hc1[1] * w1, hc1[0] * y1 ]
264+
vpmuludq hc1,ruwy1,t2
265+
vpaddq t2,t1,t1
266+
# t1 += [ hc2[3] * r0, hc2[2] * u0, hc2[1] * w0, hc2[0] * y0 ]
267+
vpmuludq hc2,ruwy0,t2
268+
vpaddq t2,t1,t1
269+
# t1 += [ hc3[3] * s4, hc3[2] * v4, hc3[1] * x4, hc3[0] * z4 ]
270+
vpmuludq hc3,svxz4,t2
271+
vpaddq t2,t1,t1
272+
# t1 += [ hc4[3] * s3, hc4[2] * v3, hc4[1] * x3, hc4[0] * z3 ]
273+
vpmuludq hc4,svxz3,t2
274+
vpaddq t2,t1,t1
275+
# d2 = t1[0] + t1[1] + t1[2] + t1[3]
276+
vpermq $0xee,t1,t2
277+
vpaddq t2,t1,t1
278+
vpsrldq $8,t1,t2
279+
vpaddq t2,t1,t1
280+
vmovq t1x,d2
281+
282+
# t1 = [ hc0[3] * r3, hc0[2] * u3, hc0[1] * w3, hc0[0] * y3 ]
283+
vpmuludq hc0,ruwy3,t1
284+
# t1 += [ hc1[3] * r2, hc1[2] * u2, hc1[1] * w2, hc1[0] * y2 ]
285+
vpmuludq hc1,ruwy2,t2
286+
vpaddq t2,t1,t1
287+
# t1 += [ hc2[3] * r1, hc2[2] * u1, hc2[1] * w1, hc2[0] * y1 ]
288+
vpmuludq hc2,ruwy1,t2
289+
vpaddq t2,t1,t1
290+
# t1 += [ hc3[3] * r0, hc3[2] * u0, hc3[1] * w0, hc3[0] * y0 ]
291+
vpmuludq hc3,ruwy0,t2
292+
vpaddq t2,t1,t1
293+
# t1 += [ hc4[3] * s4, hc4[2] * v4, hc4[1] * x4, hc4[0] * z4 ]
294+
vpmuludq hc4,svxz4,t2
295+
vpaddq t2,t1,t1
296+
# d3 = t1[0] + t1[1] + t1[2] + t1[3]
297+
vpermq $0xee,t1,t2
298+
vpaddq t2,t1,t1
299+
vpsrldq $8,t1,t2
300+
vpaddq t2,t1,t1
301+
vmovq t1x,d3
302+
303+
# t1 = [ hc0[3] * r4, hc0[2] * u4, hc0[1] * w4, hc0[0] * y4 ]
304+
vpmuludq hc0,ruwy4,t1
305+
# t1 += [ hc1[3] * r3, hc1[2] * u3, hc1[1] * w3, hc1[0] * y3 ]
306+
vpmuludq hc1,ruwy3,t2
307+
vpaddq t2,t1,t1
308+
# t1 += [ hc2[3] * r2, hc2[2] * u2, hc2[1] * w2, hc2[0] * y2 ]
309+
vpmuludq hc2,ruwy2,t2
310+
vpaddq t2,t1,t1
311+
# t1 += [ hc3[3] * r1, hc3[2] * u1, hc3[1] * w1, hc3[0] * y1 ]
312+
vpmuludq hc3,ruwy1,t2
313+
vpaddq t2,t1,t1
314+
# t1 += [ hc4[3] * r0, hc4[2] * u0, hc4[1] * w0, hc4[0] * y0 ]
315+
vpmuludq hc4,ruwy0,t2
316+
vpaddq t2,t1,t1
317+
# d4 = t1[0] + t1[1] + t1[2] + t1[3]
318+
vpermq $0xee,t1,t2
319+
vpaddq t2,t1,t1
320+
vpsrldq $8,t1,t2
321+
vpaddq t2,t1,t1
322+
vmovq t1x,d4
323+
324+
# d1 += d0 >> 26
325+
mov d0,%rax
326+
shr $26,%rax
327+
add %rax,d1
328+
# h0 = d0 & 0x3ffffff
329+
mov d0,%rbx
330+
and $0x3ffffff,%ebx
331+
332+
# d2 += d1 >> 26
333+
mov d1,%rax
334+
shr $26,%rax
335+
add %rax,d2
336+
# h1 = d1 & 0x3ffffff
337+
mov d1,%rax
338+
and $0x3ffffff,%eax
339+
mov %eax,h1
340+
341+
# d3 += d2 >> 26
342+
mov d2,%rax
343+
shr $26,%rax
344+
add %rax,d3
345+
# h2 = d2 & 0x3ffffff
346+
mov d2,%rax
347+
and $0x3ffffff,%eax
348+
mov %eax,h2
349+
350+
# d4 += d3 >> 26
351+
mov d3,%rax
352+
shr $26,%rax
353+
add %rax,d4
354+
# h3 = d3 & 0x3ffffff
355+
mov d3,%rax
356+
and $0x3ffffff,%eax
357+
mov %eax,h3
358+
359+
# h0 += (d4 >> 26) * 5
360+
mov d4,%rax
361+
shr $26,%rax
362+
lea (%eax,%eax,4),%eax
363+
add %eax,%ebx
364+
# h4 = d4 & 0x3ffffff
365+
mov d4,%rax
366+
and $0x3ffffff,%eax
367+
mov %eax,h4
368+
369+
# h1 += h0 >> 26
370+
mov %ebx,%eax
371+
shr $26,%eax
372+
add %eax,h1
373+
# h0 = h0 & 0x3ffffff
374+
andl $0x3ffffff,%ebx
375+
mov %ebx,h0
376+
377+
add $0x40,m
378+
dec %rcx
379+
jnz .Ldoblock4
380+
381+
vzeroupper
382+
pop %r13
383+
pop %r12
384+
pop %rbx
385+
ret
386+
ENDPROC(poly1305_4block_avx2)

0 commit comments

Comments
 (0)