1 /* SPDX-License-Identifier: Apache-2.0 OR BSD-
2 //
3 // This file is dual-licensed, meaning that yo
4 // choice of either of the following two licen
5 //
6 // Copyright 2023 The OpenSSL Project Authors.
7 //
8 // Licensed under the Apache License 2.0 (the
9 // a copy in the file LICENSE in the source di
10 // https://www.openssl.org/source/license.html
11 //
12 // or
13 //
14 // Copyright (c) 2023, Christoph Müllner <chri
15 // Copyright (c) 2023, Phoebe Chen <phoebe.chen
16 // Copyright 2024 Google LLC
17 // All rights reserved.
18 //
19 // Redistribution and use in source and binary
20 // modification, are permitted provided that t
21 // are met:
22 // 1. Redistributions of source code must reta
23 // notice, this list of conditions and the
24 // 2. Redistributions in binary form must repr
25 // notice, this list of conditions and the
26 // documentation and/or other materials pro
27 //
28 // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT
29 // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTI
30 // LIMITED TO, THE IMPLIED WARRANTIES OF MERCH
31 // A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
32 // OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIR
33 // SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGE
34 // LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
35 // DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
36 // THEORY OF LIABILITY, WHETHER IN CONTRACT, S
37 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
38 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE PO
39
40 // The generated code of this file depends on
41 // - RV64I
42 // - RISC-V Vector ('V') with VLEN >= 128
43 // - RISC-V Vector SHA-2 Secure Hash extension
44 // - RISC-V Vector Cryptography Bit-manipulati
45
46 #include <linux/cfi_types.h>
47
48 .text
49 .option arch, +zvknha, +zvkb
50
51 #define STATEP a0
52 #define DATA a1
53 #define NUM_BLOCKS a2
54
55 #define STATEP_C a3
56
57 #define MASK v0
58 #define INDICES v1
59 #define W0 v2
60 #define W1 v3
61 #define W2 v4
62 #define W3 v5
63 #define VTMP v6
64 #define FEBA v7
65 #define HGDC v8
66 #define K0 v10
67 #define K1 v11
68 #define K2 v12
69 #define K3 v13
70 #define K4 v14
71 #define K5 v15
72 #define K6 v16
73 #define K7 v17
74 #define K8 v18
75 #define K9 v19
76 #define K10 v20
77 #define K11 v21
78 #define K12 v22
79 #define K13 v23
80 #define K14 v24
81 #define K15 v25
82 #define PREV_FEBA v26
83 #define PREV_HGDC v27
84
85 // Do 4 rounds of SHA-256. w0 contains the cu
86 //
87 // If not all the message schedule words have
88 // computes 4 more message schedule words. w1
89 // message schedule words; this macro computes
90 // to w0. This means that the next (w0, w1, w
91 // w0), so the caller must cycle through the r
92 .macro sha256_4rounds last, k, w0, w1, w2, w
93 vadd.vv VTMP, \k, \w0
94 vsha2cl.vv HGDC, FEBA, VTMP
95 vsha2ch.vv FEBA, HGDC, VTMP
96 .if !\last
97 vmerge.vvm VTMP, \w2, \w1, MASK
98 vsha2ms.vv \w0, VTMP, \w3
99 .endif
100 .endm
101
102 .macro sha256_16rounds last, k0, k1, k2, k3
103 sha256_4rounds \last, \k0, W0, W1, W2
104 sha256_4rounds \last, \k1, W1, W2, W3
105 sha256_4rounds \last, \k2, W2, W3, W0
106 sha256_4rounds \last, \k3, W3, W0, W1
107 .endm
108
109 // void sha256_transform_zvknha_or_zvknhb_zvkb
110 //
111 SYM_TYPED_FUNC_START(sha256_transform_zvknha_o
112
113 // Load the round constants into K0-K1
114 vsetivli zero, 4, e32, m1, ta,
115 la t0, K256
116 vle32.v K0, (t0)
117 addi t0, t0, 16
118 vle32.v K1, (t0)
119 addi t0, t0, 16
120 vle32.v K2, (t0)
121 addi t0, t0, 16
122 vle32.v K3, (t0)
123 addi t0, t0, 16
124 vle32.v K4, (t0)
125 addi t0, t0, 16
126 vle32.v K5, (t0)
127 addi t0, t0, 16
128 vle32.v K6, (t0)
129 addi t0, t0, 16
130 vle32.v K7, (t0)
131 addi t0, t0, 16
132 vle32.v K8, (t0)
133 addi t0, t0, 16
134 vle32.v K9, (t0)
135 addi t0, t0, 16
136 vle32.v K10, (t0)
137 addi t0, t0, 16
138 vle32.v K11, (t0)
139 addi t0, t0, 16
140 vle32.v K12, (t0)
141 addi t0, t0, 16
142 vle32.v K13, (t0)
143 addi t0, t0, 16
144 vle32.v K14, (t0)
145 addi t0, t0, 16
146 vle32.v K15, (t0)
147
148 // Setup mask for the vmerge to replac
149 // message scheduling. There are 4 wo
150 vsetivli zero, 1, e8, m1, ta, m
151 vmv.v.i MASK, 0x01
152
153 // Load the state. The state is store
154 // need {f,e,b,a},{h,g,d,c}. The dst
155 // is e8mf4. We use index-load with t
156 // loaded using the 32-bit little endi
157 li t0, 0x00041014
158 vsetivli zero, 1, e32, m1, ta,
159 vmv.v.x INDICES, t0
160 addi STATEP_C, STATEP, 8
161 vsetivli zero, 4, e32, m1, ta,
162 vluxei8.v FEBA, (STATEP), INDICE
163 vluxei8.v HGDC, (STATEP_C), INDI
164
165 .Lnext_block:
166 addi NUM_BLOCKS, NUM_BLOCKS
167
168 // Save the previous state, as it's ne
169 vmv.v.v PREV_FEBA, FEBA
170 vmv.v.v PREV_HGDC, HGDC
171
172 // Load the next 512-bit message block
173 vle32.v W0, (DATA)
174 vrev8.v W0, W0
175 addi DATA, DATA, 16
176 vle32.v W1, (DATA)
177 vrev8.v W1, W1
178 addi DATA, DATA, 16
179 vle32.v W2, (DATA)
180 vrev8.v W2, W2
181 addi DATA, DATA, 16
182 vle32.v W3, (DATA)
183 vrev8.v W3, W3
184 addi DATA, DATA, 16
185
186 // Do the 64 rounds of SHA-256.
187 sha256_16rounds 0, K0, K1, K2, K3
188 sha256_16rounds 0, K4, K5, K6, K7
189 sha256_16rounds 0, K8, K9, K10, K11
190 sha256_16rounds 1, K12, K13, K14, K15
191
192 // Add the previous state.
193 vadd.vv FEBA, FEBA, PREV_FEBA
194 vadd.vv HGDC, HGDC, PREV_HGDC
195
196 // Repeat if more blocks remain.
197 bnez NUM_BLOCKS, .Lnext_blo
198
199 // Store the new state and return.
200 vsuxei8.v FEBA, (STATEP), INDICE
201 vsuxei8.v HGDC, (STATEP_C), INDI
202 ret
203 SYM_FUNC_END(sha256_transform_zvknha_or_zvknhb
204
205 .section ".rodata"
206 .p2align 2
207 .type K256, @object
208 K256:
209 .word 0x428a2f98, 0x71374491
210 .word 0x3956c25b, 0x59f111f1
211 .word 0xd807aa98, 0x12835b01
212 .word 0x72be5d74, 0x80deb1fe
213 .word 0xe49b69c1, 0xefbe4786
214 .word 0x2de92c6f, 0x4a7484aa
215 .word 0x983e5152, 0xa831c66d
216 .word 0xc6e00bf3, 0xd5a79147
217 .word 0x27b70a85, 0x2e1b2138
218 .word 0x650a7354, 0x766a0abb
219 .word 0xa2bfe8a1, 0xa81a664b
220 .word 0xd192e819, 0xd6990624
221 .word 0x19a4c116, 0x1e376c08
222 .word 0x391c0cb3, 0x4ed8aa4a
223 .word 0x748f82ee, 0x78a5636f
224 .word 0x90befffa, 0xa4506ceb
225 .size K256, . - K256
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.