1#! /usr/bin/env perl
2# This file is dual-licensed, meaning that you can use it under your
3# choice of either of the following two licenses:
4#
5# Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
6#
7# Licensed under the Apache License 2.0 (the "License"). You can obtain
8# a copy in the file LICENSE in the source distribution or at
9# https://www.openssl.org/source/license.html
10#
11# or
12#
13# Copyright (c) 2023, Christoph Müllner <christoph.muellner@vrull.eu>
14# All rights reserved.
15#
16# Redistribution and use in source and binary forms, with or without
17# modification, are permitted provided that the following conditions
18# are met:
19# 1. Redistributions of source code must retain the above copyright
20#    notice, this list of conditions and the following disclaimer.
21# 2. Redistributions in binary form must reproduce the above copyright
22#    notice, this list of conditions and the following disclaimer in the
23#    documentation and/or other materials provided with the distribution.
24#
25# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
26# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
27# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
28# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
29# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
30# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
31# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
35# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36
37# - RV64I
38# - RISC-V Vector ('V') with VLEN >= 128
39# - RISC-V Vector GCM/GMAC extension ('Zvkg')
40#
41# Optional:
42# - RISC-V Vector Cryptography Bit-manipulation extension ('Zvkb')
43
44use strict;
45use warnings;
46
47use FindBin qw($Bin);
48use lib "$Bin";
49use lib "$Bin/../../perlasm";
50use riscv;
51
52# $output is the last argument if it looks like a file (it has an extension)
53# $flavour is the first argument if it doesn't look like a file
54my $output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef;
55my $flavour = $#ARGV >= 0 && $ARGV[0] !~ m|\.| ? shift : undef;
56
57$output and open STDOUT,">$output";
58
59my $code=<<___;
60.text
61___
62
63################################################################################
64# void gcm_init_rv64i_zvkg(u128 Htable[16], const u64 H[2]);
65# void gcm_init_rv64i_zvkg_zvkb(u128 Htable[16], const u64 H[2]);
66#
67# input: H: 128-bit H - secret parameter E(K, 0^128)
68# output: Htable: Copy of secret parameter (in normalized byte order)
69#
70# All callers of this function revert the byte-order unconditionally
71# on little-endian machines. So we need to revert the byte-order back.
72{
73my ($Htable,$H,$VAL0,$VAL1,$TMP0) = ("a0","a1","a2","a3","t0");
74
75$code .= <<___;
76.p2align 3
77.globl gcm_init_rv64i_zvkg
78.type gcm_init_rv64i_zvkg,\@function
79gcm_init_rv64i_zvkg:
80    ld      $VAL0, 0($H)
81    ld      $VAL1, 8($H)
82    @{[sd_rev8_rv64i $VAL0, $Htable, 0, $TMP0]}
83    @{[sd_rev8_rv64i $VAL1, $Htable, 8, $TMP0]}
84    ret
85.size gcm_init_rv64i_zvkg,.-gcm_init_rv64i_zvkg
86___
87}
88
89{
90my ($Htable,$H,$V0) = ("a0","a1","v0");
91
92$code .= <<___;
93.p2align 3
94.globl gcm_init_rv64i_zvkg_zvkb
95.type gcm_init_rv64i_zvkg_zvkb,\@function
96gcm_init_rv64i_zvkg_zvkb:
97    @{[vsetivli__x0_2_e64_m1_tu_mu]} # vsetivli x0, 2, e64, m1, ta, ma
98    @{[vle64_v $V0, $H]}             # vle64.v v0, (a1)
99    @{[vrev8_v $V0, $V0]}            # vrev8.v v0, v0
100    @{[vse64_v $V0, $Htable]}        # vse64.v v0, (a0)
101    ret
102.size gcm_init_rv64i_zvkg_zvkb,.-gcm_init_rv64i_zvkg_zvkb
103___
104}
105
106################################################################################
107# void gcm_gmult_rv64i_zvkg(u64 Xi[2], const u128 Htable[16]);
108#
109# input: Xi: current hash value
110#        Htable: copy of H
111# output: Xi: next hash value Xi
112{
113my ($Xi,$Htable) = ("a0","a1");
114my ($VD,$VS2) = ("v1","v2");
115
116$code .= <<___;
117.p2align 3
118.globl gcm_gmult_rv64i_zvkg
119.type gcm_gmult_rv64i_zvkg,\@function
120gcm_gmult_rv64i_zvkg:
121    @{[vsetivli__x0_4_e32_m1_tu_mu]}
122    @{[vle32_v $VS2, $Htable]}
123    @{[vle32_v $VD, $Xi]}
124    @{[vgmul_vv $VD, $VS2]}
125    @{[vse32_v $VD, $Xi]}
126    ret
127.size gcm_gmult_rv64i_zvkg,.-gcm_gmult_rv64i_zvkg
128___
129}
130
131################################################################################
132# void gcm_ghash_rv64i_zvkg(u64 Xi[2], const u128 Htable[16],
133#                           const u8 *inp, size_t len);
134#
135# input: Xi: current hash value
136#        Htable: copy of H
137#        inp: pointer to input data
138#        len: length of input data in bytes (multiple of block size)
139# output: Xi: Xi+1 (next hash value Xi)
140{
141my ($Xi,$Htable,$inp,$len) = ("a0","a1","a2","a3");
142my ($vXi,$vH,$vinp,$Vzero) = ("v1","v2","v3","v4");
143
144$code .= <<___;
145.p2align 3
146.globl gcm_ghash_rv64i_zvkg
147.type gcm_ghash_rv64i_zvkg,\@function
148gcm_ghash_rv64i_zvkg:
149    @{[vsetivli__x0_4_e32_m1_tu_mu]}
150    @{[vle32_v $vH, $Htable]}
151    @{[vle32_v $vXi, $Xi]}
152
153Lstep:
154    @{[vle32_v $vinp, $inp]}
155    add $inp, $inp, 16
156    add $len, $len, -16
157    @{[vghsh_vv $vXi, $vH, $vinp]}
158    bnez $len, Lstep
159
160    @{[vse32_v $vXi, $Xi]}
161    ret
162
163.size gcm_ghash_rv64i_zvkg,.-gcm_ghash_rv64i_zvkg
164___
165}
166
167print $code;
168
169close STDOUT or die "error closing STDOUT: $!";
170