| // SPDX-License-Identifier: GPL-2.0 |
| /* |
| * Copyright (C) 2024 Xi Ruoyao <xry111@xry111.site>. All Rights Reserved. |
| */ |
| |
| #include <asm/asm.h> |
| #include <asm/regdef.h> |
| #include <linux/linkage.h> |
| |
| .text |
| |
| .macro OP_4REG op d0 d1 d2 d3 s0 s1 s2 s3 |
| \op \d0, \d0, \s0 |
| \op \d1, \d1, \s1 |
| \op \d2, \d2, \s2 |
| \op \d3, \d3, \s3 |
| .endm |
| |
| /* |
| * Very basic LoongArch implementation of ChaCha20. Produces a given positive |
| * number of blocks of output with a nonce of 0, taking an input key and |
| * 8-byte counter. Importantly does not spill to the stack. Its arguments |
| * are: |
| * |
| * a0: output bytes |
| * a1: 32-byte key input |
| * a2: 8-byte counter input/output |
| * a3: number of 64-byte blocks to write to output |
| */ |
| SYM_FUNC_START(__arch_chacha20_blocks_nostack) |
| |
| /* We don't need a frame pointer */ |
| #define s9 fp |
| |
| #define output a0 |
| #define key a1 |
| #define counter a2 |
| #define nblocks a3 |
| #define i a4 |
| #define state0 s0 |
| #define state1 s1 |
| #define state2 s2 |
| #define state3 s3 |
| #define state4 s4 |
| #define state5 s5 |
| #define state6 s6 |
| #define state7 s7 |
| #define state8 s8 |
| #define state9 s9 |
| #define state10 a5 |
| #define state11 a6 |
| #define state12 a7 |
| #define state13 t0 |
| #define state14 t1 |
| #define state15 t2 |
| #define cnt_lo t3 |
| #define cnt_hi t4 |
| #define copy0 t5 |
| #define copy1 t6 |
| #define copy2 t7 |
| |
| /* Reuse i as copy3 */ |
| #define copy3 i |
| |
| /* Packs to be used with OP_4REG */ |
| #define line0 state0, state1, state2, state3 |
| #define line1 state4, state5, state6, state7 |
| #define line2 state8, state9, state10, state11 |
| #define line3 state12, state13, state14, state15 |
| |
| #define line1_perm state5, state6, state7, state4 |
| #define line2_perm state10, state11, state8, state9 |
| #define line3_perm state15, state12, state13, state14 |
| |
| #define copy copy0, copy1, copy2, copy3 |
| |
| #define _16 16, 16, 16, 16 |
| #define _20 20, 20, 20, 20 |
| #define _24 24, 24, 24, 24 |
| #define _25 25, 25, 25, 25 |
| |
| /* |
| * The ABI requires s0-s9 saved, and sp aligned to 16-byte. |
| * This does not violate the stack-less requirement: no sensitive data |
| * is spilled onto the stack. |
| */ |
| PTR_ADDI sp, sp, (-SZREG * 10) & STACK_ALIGN |
| REG_S s0, sp, 0 |
| REG_S s1, sp, SZREG |
| REG_S s2, sp, SZREG * 2 |
| REG_S s3, sp, SZREG * 3 |
| REG_S s4, sp, SZREG * 4 |
| REG_S s5, sp, SZREG * 5 |
| REG_S s6, sp, SZREG * 6 |
| REG_S s7, sp, SZREG * 7 |
| REG_S s8, sp, SZREG * 8 |
| REG_S s9, sp, SZREG * 9 |
| |
| li.w copy0, 0x61707865 |
| li.w copy1, 0x3320646e |
| li.w copy2, 0x79622d32 |
| |
| ld.w cnt_lo, counter, 0 |
| ld.w cnt_hi, counter, 4 |
| |
| .Lblock: |
| /* state[0,1,2,3] = "expand 32-byte k" */ |
| move state0, copy0 |
| move state1, copy1 |
| move state2, copy2 |
| li.w state3, 0x6b206574 |
| |
| /* state[4,5,..,11] = key */ |
| ld.w state4, key, 0 |
| ld.w state5, key, 4 |
| ld.w state6, key, 8 |
| ld.w state7, key, 12 |
| ld.w state8, key, 16 |
| ld.w state9, key, 20 |
| ld.w state10, key, 24 |
| ld.w state11, key, 28 |
| |
| /* state[12,13] = counter */ |
| move state12, cnt_lo |
| move state13, cnt_hi |
| |
| /* state[14,15] = 0 */ |
| move state14, zero |
| move state15, zero |
| |
| li.w i, 10 |
| .Lpermute: |
| /* odd round */ |
| OP_4REG add.w line0, line1 |
| OP_4REG xor line3, line0 |
| OP_4REG rotri.w line3, _16 |
| |
| OP_4REG add.w line2, line3 |
| OP_4REG xor line1, line2 |
| OP_4REG rotri.w line1, _20 |
| |
| OP_4REG add.w line0, line1 |
| OP_4REG xor line3, line0 |
| OP_4REG rotri.w line3, _24 |
| |
| OP_4REG add.w line2, line3 |
| OP_4REG xor line1, line2 |
| OP_4REG rotri.w line1, _25 |
| |
| /* even round */ |
| OP_4REG add.w line0, line1_perm |
| OP_4REG xor line3_perm, line0 |
| OP_4REG rotri.w line3_perm, _16 |
| |
| OP_4REG add.w line2_perm, line3_perm |
| OP_4REG xor line1_perm, line2_perm |
| OP_4REG rotri.w line1_perm, _20 |
| |
| OP_4REG add.w line0, line1_perm |
| OP_4REG xor line3_perm, line0 |
| OP_4REG rotri.w line3_perm, _24 |
| |
| OP_4REG add.w line2_perm, line3_perm |
| OP_4REG xor line1_perm, line2_perm |
| OP_4REG rotri.w line1_perm, _25 |
| |
| addi.w i, i, -1 |
| bnez i, .Lpermute |
| |
| /* |
| * copy[3] = "expa", materialize it here because copy[3] shares the |
| * same register with i which just became dead. |
| */ |
| li.w copy3, 0x6b206574 |
| |
| /* output[0,1,2,3] = copy[0,1,2,3] + state[0,1,2,3] */ |
| OP_4REG add.w line0, copy |
| st.w state0, output, 0 |
| st.w state1, output, 4 |
| st.w state2, output, 8 |
| st.w state3, output, 12 |
| |
| /* from now on state[0,1,2,3] are scratch registers */ |
| |
| /* state[0,1,2,3] = lo32(key) */ |
| ld.w state0, key, 0 |
| ld.w state1, key, 4 |
| ld.w state2, key, 8 |
| ld.w state3, key, 12 |
| |
| /* output[4,5,6,7] = state[0,1,2,3] + state[4,5,6,7] */ |
| OP_4REG add.w line1, line0 |
| st.w state4, output, 16 |
| st.w state5, output, 20 |
| st.w state6, output, 24 |
| st.w state7, output, 28 |
| |
| /* state[0,1,2,3] = hi32(key) */ |
| ld.w state0, key, 16 |
| ld.w state1, key, 20 |
| ld.w state2, key, 24 |
| ld.w state3, key, 28 |
| |
| /* output[8,9,10,11] = state[0,1,2,3] + state[8,9,10,11] */ |
| OP_4REG add.w line2, line0 |
| st.w state8, output, 32 |
| st.w state9, output, 36 |
| st.w state10, output, 40 |
| st.w state11, output, 44 |
| |
| /* output[12,13,14,15] = state[12,13,14,15] + [cnt_lo, cnt_hi, 0, 0] */ |
| add.w state12, state12, cnt_lo |
| add.w state13, state13, cnt_hi |
| st.w state12, output, 48 |
| st.w state13, output, 52 |
| st.w state14, output, 56 |
| st.w state15, output, 60 |
| |
| /* ++counter */ |
| addi.w cnt_lo, cnt_lo, 1 |
| sltui state0, cnt_lo, 1 |
| add.w cnt_hi, cnt_hi, state0 |
| |
| /* output += 64 */ |
| PTR_ADDI output, output, 64 |
| /* --nblocks */ |
| PTR_ADDI nblocks, nblocks, -1 |
| bnez nblocks, .Lblock |
| |
| /* counter = [cnt_lo, cnt_hi] */ |
| st.w cnt_lo, counter, 0 |
| st.w cnt_hi, counter, 4 |
| |
| /* |
| * Zero out the potentially sensitive regs, in case nothing uses these |
| * again. As at now copy[0,1,2,3] just contains "expand 32-byte k" and |
| * state[0,...,9] are s0-s9 those we'll restore in the epilogue, so we |
| * only need to zero state[11,...,15]. |
| */ |
| move state10, zero |
| move state11, zero |
| move state12, zero |
| move state13, zero |
| move state14, zero |
| move state15, zero |
| |
| REG_L s0, sp, 0 |
| REG_L s1, sp, SZREG |
| REG_L s2, sp, SZREG * 2 |
| REG_L s3, sp, SZREG * 3 |
| REG_L s4, sp, SZREG * 4 |
| REG_L s5, sp, SZREG * 5 |
| REG_L s6, sp, SZREG * 6 |
| REG_L s7, sp, SZREG * 7 |
| REG_L s8, sp, SZREG * 8 |
| REG_L s9, sp, SZREG * 9 |
| PTR_ADDI sp, sp, -((-SZREG * 10) & STACK_ALIGN) |
| |
| jr ra |
| SYM_FUNC_END(__arch_chacha20_blocks_nostack) |
