diff options
author | Jack Lloyd <[email protected]> | 2019-09-01 07:09:25 -0400 |
---|---|---|
committer | Jack Lloyd <[email protected]> | 2019-09-01 07:09:25 -0400 |
commit | 0f949677debd43f7b748de49ac4fccd76c59a6a3 (patch) | |
tree | 63c66ec35e31718d9cb8ab9d44adfd193c717ae4 /src/lib | |
parent | a5e2231b247612831ffd66dea9dda32f5ffc3082 (diff) | |
parent | f2fc019a6e976bd05339a9280cdd9ae50376fe72 (diff) |
Merge GH #2093 Abstract the SSSE3 code for vector permute AES
Diffstat (limited to 'src/lib')
-rw-r--r-- | src/lib/block/aes/aes_ssse3/aes_ssse3.cpp | 778 | ||||
-rw-r--r-- | src/lib/block/aes/aes_ssse3/info.txt | 7 | ||||
-rw-r--r-- | src/lib/utils/simd/simd_32.h | 341 |
3 files changed, 512 insertions, 614 deletions
diff --git a/src/lib/block/aes/aes_ssse3/aes_ssse3.cpp b/src/lib/block/aes/aes_ssse3/aes_ssse3.cpp index 47d70d0b8..fa8bf4faa 100644 --- a/src/lib/block/aes/aes_ssse3/aes_ssse3.cpp +++ b/src/lib/block/aes/aes_ssse3/aes_ssse3.cpp @@ -1,6 +1,6 @@ /* * AES using SSSE3 -* (C) 2010,2016 Jack Lloyd +* (C) 2010,2016,2019 Jack Lloyd * * This is more or less a direct translation of public domain x86-64 * assembly written by Mike Hamburg, described in "Accelerating AES @@ -12,626 +12,506 @@ #include <botan/aes.h> #include <botan/internal/ct_utils.h> -#include <tmmintrin.h> +#include <botan/internal/simd_32.h> + +#if defined(BOTAN_SIMD_USE_SSE2) + #include <tmmintrin.h> +#elif defined(BOTAN_SIMD_USE_NEON) + #include <arm_neon.h> +#endif namespace Botan { namespace { -const __m128i low_nibs = _mm_set1_epi8(0x0F); - -const __m128i k_ipt1 = _mm_set_epi32( - 0xCABAE090, 0x52227808, 0xC2B2E898, 0x5A2A7000); -const __m128i k_ipt2 = _mm_set_epi32( - 0xCD80B1FC, 0xB0FDCC81, 0x4C01307D, 0x317C4D00); +inline SIMD_4x32 shuffle(SIMD_4x32 a, SIMD_4x32 b) + { +#if defined(BOTAN_SIMD_USE_SSE2) + return SIMD_4x32(_mm_shuffle_epi8(a.raw(), b.raw())); +#elif defined(BOTAN_SIMD_USE_NEON) && defined(BOTAN_TARGET_ARCH_IS_ARM64) -const __m128i k_inv1 = _mm_set_epi32( - 0x04070309, 0x0A0B0C02, 0x0E05060F, 0x0D080180); -const __m128i k_inv2 = _mm_set_epi32( - 0x030D0E0C, 0x02050809, 0x01040A06, 0x0F0B0780); + const int8x16_t tbl = vreinterpretq_s8_m128i(a.raw()); + const uint8x16_t idx = vreinterpretq_u8_m128i(b.raw()); -const __m128i sb1u = _mm_set_epi32( - 0xA5DF7A6E, 0x142AF544, 0xB19BE18F, 0xCB503E00); -const __m128i sb1t = _mm_set_epi32( - 0x3BF7CCC1, 0x0D2ED9EF, 0x3618D415, 0xFAE22300); + // fixme use vdupq_n_s8 + const uint8_t alignas(16) mask[16] = { + 0x8F, 0x8F, 0x8F, 0x8F, 0x8F, 0x8F, 0x8F, 0x8F, + 0x8F, 0x8F, 0x8F, 0x8F, 0x8F, 0x8F, 0x8F, 0x8F + }; -const __m128i mc_forward[4] = { - _mm_set_epi32(0x0C0F0E0D, 0x080B0A09, 0x04070605, 0x00030201), - _mm_set_epi32(0x00030201, 0x0C0F0E0D, 0x080B0A09, 0x04070605), - _mm_set_epi32(0x04070605, 0x00030201, 0x0C0F0E0D, 0x080B0A09), - _mm_set_epi32(0x080B0A09, 0x04070605, 0x00030201, 0x0C0F0E0D) -}; + const uint8x16_t idx_masked = + vandq_u8(idx, vld1q_u8(mask)); // avoid using meaningless bits -const __m128i sr[4] = { - _mm_set_epi32(0x0F0E0D0C, 0x0B0A0908, 0x07060504, 0x03020100), - _mm_set_epi32(0x0B06010C, 0x07020D08, 0x030E0904, 0x0F0A0500), - _mm_set_epi32(0x070E050C, 0x030A0108, 0x0F060D04, 0x0B020900), - _mm_set_epi32(0x0306090C, 0x0F020508, 0x0B0E0104, 0x070A0D00), -}; - -#define mm_xor3(x, y, z) _mm_xor_si128(x, _mm_xor_si128(y, z)) + return vreinterpretq_m128i_s8(vqtbl1q_s8(tbl, idx_masked)); +#else + #error "No shuffle implementation available" +#endif + } -BOTAN_FUNC_ISA("ssse3") -__m128i aes_schedule_transform(__m128i input, - __m128i table_1, - __m128i table_2) +template<size_t I1, size_t I2, size_t I3, size_t I4> +inline SIMD_4x32 shuffle32(SIMD_4x32 x) { - __m128i i_1 = _mm_and_si128(low_nibs, input); - __m128i i_2 = _mm_srli_epi32(_mm_andnot_si128(low_nibs, input), 4); - - return _mm_xor_si128( - _mm_shuffle_epi8(table_1, i_1), - _mm_shuffle_epi8(table_2, i_2)); + return SIMD_4x32(_mm_shuffle_epi32(x.raw(), _MM_SHUFFLE(I1, I2, I3, I4))); } -BOTAN_FUNC_ISA("ssse3") -__m128i aes_schedule_mangle(__m128i k, uint8_t round_no) +template<size_t I> +inline SIMD_4x32 slli(SIMD_4x32 x) { - __m128i t = _mm_shuffle_epi8(_mm_xor_si128(k, _mm_set1_epi8(0x5B)), - mc_forward[0]); - - __m128i t2 = t; - - t = _mm_shuffle_epi8(t, mc_forward[0]); - - t2 = mm_xor3(t2, t, _mm_shuffle_epi8(t, mc_forward[0])); - - return _mm_shuffle_epi8(t2, sr[round_no % 4]); +#if defined(BOTAN_SIMD_USE_SSE2) + return SIMD_4x32(_mm_slli_si128(x.raw(), 4*I)); +#else + #error "No ssli implementation available" +#endif } -BOTAN_FUNC_ISA("ssse3") -__m128i aes_schedule_192_smear(__m128i x, __m128i y) +inline SIMD_4x32 zero_top_half(SIMD_4x32 x) { - return mm_xor3(y, - _mm_shuffle_epi32(x, 0xFE), - _mm_shuffle_epi32(y, 0x80)); +#if defined(BOTAN_SIMD_USE_SSE2) + return SIMD_4x32(_mm_slli_si128(_mm_srli_si128(x.raw(), 8), 8)); +#else + #error "No zero_top_half implementation available" +#endif } -BOTAN_FUNC_ISA("ssse3") -__m128i aes_schedule_mangle_dec(__m128i k, uint8_t round_no) +template<int C> +inline SIMD_4x32 alignr(SIMD_4x32 a, SIMD_4x32 b) { - const __m128i dsk[8] = { - _mm_set_epi32(0x4AED9334, 0x82255BFC, 0xB6116FC8, 0x7ED9A700), - _mm_set_epi32(0x8BB89FAC, 0xE9DAFDCE, 0x45765162, 0x27143300), - _mm_set_epi32(0x4622EE8A, 0xADC90561, 0x27438FEB, 0xCCA86400), - _mm_set_epi32(0x73AEE13C, 0xBD602FF2, 0x815C13CE, 0x4F92DD00), - _mm_set_epi32(0xF83F3EF9, 0xFA3D3CFB, 0x03C4C502, 0x01C6C700), - _mm_set_epi32(0xA5526A9D, 0x7384BC4B, 0xEE1921D6, 0x38CFF700), - _mm_set_epi32(0xA080D3F3, 0x10306343, 0xE3C390B0, 0x53732000), - _mm_set_epi32(0x2F45AEC4, 0x8CE60D67, 0xA0CA214B, 0x036982E8) - }; +#if defined(BOTAN_SIMD_USE_SSE2) + return SIMD_4x32(_mm_alignr_epi8(a.raw(), b.raw(), C)); +#else + #error "No alignr implementation available" +#endif + } - __m128i t = aes_schedule_transform(k, dsk[0], dsk[1]); - __m128i output = _mm_shuffle_epi8(t, mc_forward[0]); +const SIMD_4x32 k_ipt1 = SIMD_4x32(0x5A2A7000, 0xC2B2E898, 0x52227808, 0xCABAE090); +const SIMD_4x32 k_ipt2 = SIMD_4x32(0x317C4D00, 0x4C01307D, 0xB0FDCC81, 0xCD80B1FC); - t = aes_schedule_transform(t, dsk[2], dsk[3]); - output = _mm_shuffle_epi8(_mm_xor_si128(t, output), mc_forward[0]); +const SIMD_4x32 k_inv1 = SIMD_4x32(0x0D080180, 0x0E05060F, 0x0A0B0C02, 0x04070309); +const SIMD_4x32 k_inv2 = SIMD_4x32(0x0F0B0780, 0x01040A06, 0x02050809, 0x030D0E0C); - t = aes_schedule_transform(t, dsk[4], dsk[5]); - output = _mm_shuffle_epi8(_mm_xor_si128(t, output), mc_forward[0]); +const SIMD_4x32 sb1u = SIMD_4x32(0xCB503E00, 0xB19BE18F, 0x142AF544, 0xA5DF7A6E); +const SIMD_4x32 sb1t = SIMD_4x32(0xFAE22300, 0x3618D415, 0x0D2ED9EF, 0x3BF7CCC1); - t = aes_schedule_transform(t, dsk[6], dsk[7]); - output = _mm_shuffle_epi8(_mm_xor_si128(t, output), mc_forward[0]); +const SIMD_4x32 mc_forward[4] = { + SIMD_4x32(0x00030201, 0x04070605, 0x080B0A09, 0x0C0F0E0D), + SIMD_4x32(0x04070605, 0x080B0A09, 0x0C0F0E0D, 0x00030201), + SIMD_4x32(0x080B0A09, 0x0C0F0E0D, 0x00030201, 0x04070605), + SIMD_4x32(0x0C0F0E0D, 0x00030201, 0x04070605, 0x080B0A09) +}; - return _mm_shuffle_epi8(output, sr[round_no % 4]); - } +const SIMD_4x32 sr[4] = { + SIMD_4x32(0x03020100, 0x07060504, 0x0B0A0908, 0x0F0E0D0C), + SIMD_4x32(0x0F0A0500, 0x030E0904, 0x07020D08, 0x0B06010C), + SIMD_4x32(0x0B020900, 0x0F060D04, 0x030A0108, 0x070E050C), + SIMD_4x32(0x070A0D00, 0x0B0E0104, 0x0F020508, 0x0306090C), +}; -BOTAN_FUNC_ISA("ssse3") -__m128i aes_schedule_mangle_last(__m128i k, uint8_t round_no) - { - const __m128i out_tr1 = _mm_set_epi32( - 0xF7974121, 0xDEBE6808, 0xFF9F4929, 0xD6B66000); - const __m128i out_tr2 = _mm_set_epi32( - 0xE10D5DB1, 0xB05C0CE0, 0x01EDBD51, 0x50BCEC00); +const SIMD_4x32 lo_nibs_mask = SIMD_4x32::splat_u8(0x0F); +const SIMD_4x32 hi_nibs_mask = SIMD_4x32::splat_u8(0xF0); - k = _mm_shuffle_epi8(k, sr[round_no % 4]); - k = _mm_xor_si128(k, _mm_set1_epi8(0x5B)); - return aes_schedule_transform(k, out_tr1, out_tr2); +inline SIMD_4x32 low_nibs(SIMD_4x32 x) + { + return lo_nibs_mask & x; } -BOTAN_FUNC_ISA("ssse3") -__m128i aes_schedule_mangle_last_dec(__m128i k) +inline SIMD_4x32 high_nibs(SIMD_4x32 x) { - const __m128i deskew1 = _mm_set_epi32( - 0x1DFEB95A, 0x5DBEF91A, 0x07E4A340, 0x47A4E300); - const __m128i deskew2 = _mm_set_epi32( - 0x2841C2AB, 0xF49D1E77, 0x5F36B5DC, 0x83EA6900); - - k = _mm_xor_si128(k, _mm_set1_epi8(0x5B)); - return aes_schedule_transform(k, deskew1, deskew2); + return (hi_nibs_mask & x).shr<4>(); } -BOTAN_FUNC_ISA("ssse3") -__m128i aes_schedule_round(__m128i* rcon, __m128i input1, __m128i input2) +SIMD_4x32 aes_vperm_encrypt(SIMD_4x32 B, const uint32_t* keys, size_t rounds) { - if(rcon) - { - input2 = _mm_xor_si128(_mm_alignr_epi8(_mm_setzero_si128(), *rcon, 15), - input2); - - *rcon = _mm_alignr_epi8(*rcon, *rcon, 15); // next rcon - - input1 = _mm_shuffle_epi32(input1, 0xFF); // rotate - input1 = _mm_alignr_epi8(input1, input1, 1); - } - - __m128i smeared = _mm_xor_si128(input2, _mm_slli_si128(input2, 4)); - smeared = mm_xor3(smeared, _mm_slli_si128(smeared, 8), _mm_set1_epi8(0x5B)); - - __m128i t = _mm_srli_epi32(_mm_andnot_si128(low_nibs, input1), 4); - - input1 = _mm_and_si128(low_nibs, input1); + const SIMD_4x32 sb2u = SIMD_4x32(0x0B712400, 0xE27A93C6, 0xBC982FCD, 0x5EB7E955); + const SIMD_4x32 sb2t = SIMD_4x32(0x0AE12900, 0x69EB8840, 0xAB82234A, 0xC2A163C8); - __m128i t2 = _mm_shuffle_epi8(k_inv2, input1); + const SIMD_4x32 sbou = SIMD_4x32(0x6FBDC700, 0xD0D26D17, 0xC502A878, 0x15AABF7A); + const SIMD_4x32 sbot = SIMD_4x32(0x5FBB6A00, 0xCFE474A5, 0x412B35FA, 0x8E1E90D1); - input1 = _mm_xor_si128(input1, t); - - __m128i t3 = _mm_xor_si128(t2, _mm_shuffle_epi8(k_inv1, t)); - __m128i t4 = _mm_xor_si128(t2, _mm_shuffle_epi8(k_inv1, input1)); - - __m128i t5 = _mm_xor_si128(input1, _mm_shuffle_epi8(k_inv1, t3)); - __m128i t6 = _mm_xor_si128(t, _mm_shuffle_epi8(k_inv1, t4)); - - return mm_xor3(_mm_shuffle_epi8(sb1u, t5), - _mm_shuffle_epi8(sb1t, t6), - smeared); - } - -BOTAN_FUNC_ISA("ssse3") -__m128i aes_ssse3_encrypt(__m128i B, const __m128i* keys, size_t rounds) - { - const __m128i sb2u = _mm_set_epi32( - 0x5EB7E955, 0xBC982FCD, 0xE27A93C6, 0x0B712400); - const __m128i sb2t = _mm_set_epi32( - 0xC2A163C8, 0xAB82234A, 0x69EB8840, 0x0AE12900); - - const __m128i sbou = _mm_set_epi32( - 0x15AABF7A, 0xC502A878, 0xD0D26D17, 0x6FBDC700); - const __m128i sbot = _mm_set_epi32( - 0x8E1E90D1, 0x412B35FA, 0xCFE474A5, 0x5FBB6A00); - - const __m128i mc_backward[4] = { - _mm_set_epi32(0x0E0D0C0F, 0x0A09080B, 0x06050407, 0x02010003), - _mm_set_epi32(0x0A09080B, 0x06050407, 0x02010003, 0x0E0D0C0F), - _mm_set_epi32(0x06050407, 0x02010003, 0x0E0D0C0F, 0x0A09080B), - _mm_set_epi32(0x02010003, 0x0E0D0C0F, 0x0A09080B, 0x06050407), + const SIMD_4x32 mc_backward[4] = { + SIMD_4x32(0x02010003, 0x06050407, 0x0A09080B, 0x0E0D0C0F), + SIMD_4x32(0x0E0D0C0F, 0x02010003, 0x06050407, 0x0A09080B), + SIMD_4x32(0x0A09080B, 0x0E0D0C0F, 0x02010003, 0x06050407), + SIMD_4x32(0x06050407, 0x0A09080B, 0x0E0D0C0F, 0x02010003), }; - B = mm_xor3(_mm_shuffle_epi8(k_ipt1, _mm_and_si128(low_nibs, B)), - _mm_shuffle_epi8(k_ipt2, - _mm_srli_epi32( - _mm_andnot_si128(low_nibs, B), - 4)), - _mm_loadu_si128(keys)); + B = shuffle(k_ipt1, low_nibs(B)) ^ shuffle(k_ipt2, high_nibs(B)) ^ SIMD_4x32(&keys[0]); for(size_t r = 1; ; ++r) { - const __m128i K = _mm_loadu_si128(keys + r); + const SIMD_4x32 K(&keys[4*r]); - __m128i t = _mm_srli_epi32(_mm_andnot_si128(low_nibs, B), 4); + SIMD_4x32 t = high_nibs(B); + B = low_nibs(B); - B = _mm_and_si128(low_nibs, B); + SIMD_4x32 t2 = shuffle(k_inv2, B); - __m128i t2 = _mm_shuffle_epi8(k_inv2, B); + B ^= t; - B = _mm_xor_si128(B, t); + SIMD_4x32 t3 = t2 ^ shuffle(k_inv1, t); + SIMD_4x32 t4 = t2 ^ shuffle(k_inv1, B); - __m128i t3 = _mm_xor_si128(t2, _mm_shuffle_epi8(k_inv1, t)); - __m128i t4 = _mm_xor_si128(t2, _mm_shuffle_epi8(k_inv1, B)); - - __m128i t5 = _mm_xor_si128(B, _mm_shuffle_epi8(k_inv1, t3)); - __m128i t6 = _mm_xor_si128(t, _mm_shuffle_epi8(k_inv1, t4)); + SIMD_4x32 t5 = B ^ shuffle(k_inv1, t3); + SIMD_4x32 t6 = t ^ shuffle(k_inv1, t4); if(r == rounds) { - B = _mm_shuffle_epi8( - mm_xor3(_mm_shuffle_epi8(sbou, t5), - _mm_shuffle_epi8(sbot, t6), - K), - sr[r % 4]); - - return B; + return shuffle(shuffle(sbou, t5) ^ shuffle(sbot, t6) ^ K, sr[r % 4]); } - __m128i t7 = mm_xor3(_mm_shuffle_epi8(sb1t, t6), - _mm_shuffle_epi8(sb1u, t5), - K); + SIMD_4x32 t7 = shuffle(sb1t, t6) ^ shuffle(sb1u, t5) ^ K; - __m128i t8 = mm_xor3(_mm_shuffle_epi8(sb2t, t6), - _mm_shuffle_epi8(sb2u, t5), - _mm_shuffle_epi8(t7, mc_forward[r % 4])); + SIMD_4x32 t8 = shuffle(sb2t, t6) ^ shuffle(sb2u, t5) ^ shuffle(t7, mc_forward[r % 4]); - B = mm_xor3(_mm_shuffle_epi8(t8, mc_forward[r % 4]), - _mm_shuffle_epi8(t7, mc_backward[r % 4]), - t8); + B = shuffle(t8, mc_forward[r % 4]) ^ shuffle(t7, mc_backward[r % 4]) ^ t8; } } -BOTAN_FUNC_ISA("ssse3") -__m128i aes_ssse3_decrypt(__m128i B, const __m128i* keys, size_t rounds) +SIMD_4x32 aes_vperm_decrypt(SIMD_4x32 B, const uint32_t keys[], size_t rounds) { - const __m128i k_dipt1 = _mm_set_epi32( - 0x154A411E, 0x114E451A, 0x0F505B04, 0x0B545F00); - const __m128i k_dipt2 = _mm_set_epi32( - 0x12771772, 0xF491F194, 0x86E383E6, 0x60056500); - - const __m128i sb9u = _mm_set_epi32( - 0xCAD51F50, 0x4F994CC9, 0x851C0353, 0x9A86D600); - const __m128i sb9t = _mm_set_epi32( - 0x725E2C9E, 0xB2FBA565, 0xC03B1789, 0xECD74900); - - const __m128i sbeu = _mm_set_epi32( - 0x22426004, 0x64B4F6B0, 0x46F29296, 0x26D4D000); - const __m128i sbet = _mm_set_epi32( - 0x9467F36B, 0x98593E32, 0x0C55A6CD, 0xFFAAC100); - - const __m128i sbdu = _mm_set_epi32( - 0xF56E9B13, 0x882A4439, 0x7D57CCDF, 0xE6B1A200); - const __m128i sbdt = _mm_set_epi32( - 0x2931180D, 0x15DEEFD3, 0x3CE2FAF7, 0x24C6CB00); - - const __m128i sbbu = _mm_set_epi32( - 0x602646F6, 0xB0F2D404, 0xD0226492, 0x96B44200); - const __m128i sbbt = _mm_set_epi32( - 0xF3FF0C3E, 0x3255AA6B, 0xC19498A6, 0xCD596700); - - __m128i mc = mc_forward[3]; - - __m128i t = - _mm_shuffle_epi8(k_dipt2, - _mm_srli_epi32( - _mm_andnot_si128(low_nibs, B), - 4)); - - B = mm_xor3(t, _mm_loadu_si128(keys), - _mm_shuffle_epi8(k_dipt1, _mm_and_si128(B, low_nibs))); + const SIMD_4x32 k_dipt1 = SIMD_4x32(0x0B545F00, 0x0F505B04, 0x114E451A, 0x154A411E); + const SIMD_4x32 k_dipt2 = SIMD_4x32(0x60056500, 0x86E383E6, 0xF491F194, 0x12771772); + + const SIMD_4x32 sb9u = SIMD_4x32(0x9A86D600, 0x851C0353, 0x4F994CC9, 0xCAD51F50); + const SIMD_4x32 sb9t = SIMD_4x32(0xECD74900, 0xC03B1789, 0xB2FBA565, 0x725E2C9E); + + const SIMD_4x32 sbeu = SIMD_4x32(0x26D4D000, 0x46F29296, 0x64B4F6B0, 0x22426004); + const SIMD_4x32 sbet = SIMD_4x32(0xFFAAC100, 0x0C55A6CD, 0x98593E32, 0x9467F36B); + + const SIMD_4x32 sbdu = SIMD_4x32(0xE6B1A200, 0x7D57CCDF, 0x882A4439, 0xF56E9B13); + const SIMD_4x32 sbdt = SIMD_4x32(0x24C6CB00, 0x3CE2FAF7, 0x15DEEFD3, 0x2931180D); + + const SIMD_4x32 sbbu = SIMD_4x32(0x96B44200, 0xD0226492, 0xB0F2D404, 0x602646F6); + const SIMD_4x32 sbbt = SIMD_4x32(0xCD596700, 0xC19498A6, 0x3255AA6B, 0xF3FF0C3E); + + const SIMD_4x32 sbou = SIMD_4x32(0x7EF94000, 0x1387EA53, 0xD4943E2D, 0xC7AA6DB9); + const SIMD_4x32 sbot = SIMD_4x32(0x93441D00, 0x12D7560F, 0xD8C58E9C, 0xCA4B8159); + + SIMD_4x32 mc(mc_forward[3]); + + B = shuffle(k_dipt1, low_nibs(B)) ^ shuffle(k_dipt2, high_nibs(B)) ^ SIMD_4x32(&keys[0]); for(size_t r = 1; ; ++r) { - const __m128i K = _mm_loadu_si128(keys + r); - - t = _mm_srli_epi32(_mm_andnot_si128(low_nibs, B), 4); + const SIMD_4x32 K(&keys[4*r]); - B = _mm_and_si128(low_nibs, B); + SIMD_4x32 t = high_nibs(B); + B = low_nibs(B); - __m128i t2 = _mm_shuffle_epi8(k_inv2, B); + SIMD_4x32 t2 = shuffle(k_inv2, B); - B = _mm_xor_si128(B, t); + B ^= t; - __m128i t3 = _mm_xor_si128(t2, _mm_shuffle_epi8(k_inv1, t)); - __m128i t4 = _mm_xor_si128(t2, _mm_shuffle_epi8(k_inv1, B)); - __m128i t5 = _mm_xor_si128(B, _mm_shuffle_epi8(k_inv1, t3)); - __m128i t6 = _mm_xor_si128(t, _mm_shuffle_epi8(k_inv1, t4)); + const SIMD_4x32 t3 = t2 ^ shuffle(k_inv1, t); + const SIMD_4x32 t4 = t2 ^ shuffle(k_inv1, B); + const SIMD_4x32 t5 = B ^ shuffle(k_inv1, t3); + const SIMD_4x32 t6 = t ^ shuffle(k_inv1, t4); if(r == rounds) { - const __m128i sbou = _mm_set_epi32( - 0xC7AA6DB9, 0xD4943E2D, 0x1387EA53, 0x7EF94000); - const __m128i sbot = _mm_set_epi32( - 0xCA4B8159, 0xD8C58E9C, 0x12D7560F, 0x93441D00); - - __m128i x = _mm_shuffle_epi8(sbou, t5); - __m128i y = _mm_shuffle_epi8(sbot, t6); - x = _mm_xor_si128(x, K); - x = _mm_xor_si128(x, y); - + const SIMD_4x32 x = shuffle(sbou, t5) ^ shuffle(sbot, t6) ^ K; const uint32_t which_sr = ((((rounds - 1) << 4) ^ 48) & 48) / 16; - return _mm_shuffle_epi8(x, sr[which_sr]); + return shuffle(x, sr[which_sr]); } - __m128i t8 = _mm_xor_si128(_mm_shuffle_epi8(sb9t, t6), - _mm_xor_si128(_mm_shuffle_epi8(sb9u, t5), K)); - - __m128i t9 = mm_xor3(_mm_shuffle_epi8(t8, mc), - _mm_shuffle_epi8(sbdu, t5), - _mm_shuffle_epi8(sbdt, t6)); - - __m128i t12 = _mm_xor_si128( - _mm_xor_si128( - _mm_shuffle_epi8(t9, mc), - _mm_shuffle_epi8(sbbu, t5)), - _mm_shuffle_epi8(sbbt, t6)); + const SIMD_4x32 t8 = shuffle(sb9t, t6) ^ shuffle(sb9u, t5) ^ K; + const SIMD_4x32 t9 = shuffle(t8, mc) ^ shuffle(sbdu, t5) ^ shuffle(sbdt, t6); + const SIMD_4x32 t12 = shuffle(t9, mc) ^ shuffle(sbbu, t5) ^ shuffle(sbbt, t6); - B = _mm_xor_si128(_mm_xor_si128(_mm_shuffle_epi8(t12, mc), - _mm_shuffle_epi8(sbeu, t5)), - _mm_shuffle_epi8(sbet, t6)); + B = shuffle(t12, mc) ^ shuffle(sbeu, t5) ^ shuffle(sbet, t6); - mc = _mm_alignr_epi8(mc, mc, 12); + mc = alignr<12>(mc, mc); } } -} - -/* -* AES-128 Encryption -*/ -BOTAN_FUNC_ISA("ssse3") -void AES_128::ssse3_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const +void vperm_encrypt_blocks(const uint8_t in[], uint8_t out[], size_t blocks, + const uint32_t keys[], size_t rounds) { - const __m128i* in_mm = reinterpret_cast<const __m128i*>(in); - __m128i* out_mm = reinterpret_cast<__m128i*>(out); + CT::poison(in, blocks * 16); - const __m128i* keys = reinterpret_cast<const __m128i*>(m_EK.data()); + BOTAN_PARALLEL_FOR(size_t i = 0; i < blocks; ++i) + { + SIMD_4x32 B = SIMD_4x32::load_le(in + i*16); // ??? + B = aes_vperm_encrypt(B, keys, rounds); + B.store_le(out + i*16); + } - CT::poison(in, blocks * block_size()); + CT::unpoison(in, blocks * 16); + CT::unpoison(out, blocks * 16); + } + +void vperm_decrypt_blocks(const uint8_t in[], uint8_t out[], size_t blocks, + const uint32_t keys[], size_t rounds) + { + CT::poison(in, blocks * 16); BOTAN_PARALLEL_FOR(size_t i = 0; i < blocks; ++i) { - __m128i B = _mm_loadu_si128(in_mm + i); - _mm_storeu_si128(out_mm + i, aes_ssse3_encrypt(B, keys, 10)); + SIMD_4x32 B = SIMD_4x32::load_le(in + i*16); // ??? + B = aes_vperm_decrypt(B, keys, rounds); + B.store_le(out + i*16); } - CT::unpoison(in, blocks * block_size()); - CT::unpoison(out, blocks * block_size()); + CT::unpoison(in, blocks * 16); + CT::unpoison(out, blocks * 16); + } + +} + +void AES_128::ssse3_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const + { + vperm_encrypt_blocks(in, out, blocks, m_EK.data(), 10); } -/* -* AES-128 Decryption -*/ -BOTAN_FUNC_ISA("ssse3") void AES_128::ssse3_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const { - const __m128i* in_mm = reinterpret_cast<const __m128i*>(in); - __m128i* out_mm = reinterpret_cast<__m128i*>(out); + vperm_decrypt_blocks(in, out, blocks, m_DK.data(), 10); + } - const __m128i* keys = reinterpret_cast<const __m128i*>(m_DK.data()); +void AES_192::ssse3_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const + { + vperm_encrypt_blocks(in, out, blocks, m_EK.data(), 12); + } - CT::poison(in, blocks * block_size()); +void AES_192::ssse3_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const + { + vperm_decrypt_blocks(in, out, blocks, m_DK.data(), 12); + } - BOTAN_PARALLEL_FOR(size_t i = 0; i < blocks; ++i) - { - __m128i B = _mm_loadu_si128(in_mm + i); - _mm_storeu_si128(out_mm + i, aes_ssse3_decrypt(B, keys, 10)); - } +void AES_256::ssse3_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const + { + vperm_encrypt_blocks(in, out, blocks, m_EK.data(), 14); + } - CT::unpoison(in, blocks * block_size()); - CT::unpoison(out, blocks * block_size()); +void AES_256::ssse3_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const + { + vperm_decrypt_blocks(in, out, blocks, m_DK.data(), 14); } -/* -* AES-128 Key Schedule -*/ -BOTAN_FUNC_ISA("ssse3") -void AES_128::ssse3_key_schedule(const uint8_t keyb[], size_t) +namespace { + +SIMD_4x32 aes_schedule_transform(SIMD_4x32 input, + SIMD_4x32 table_1, + SIMD_4x32 table_2) { - __m128i rcon = _mm_set_epi32(0x702A9808, 0x4D7C7D81, - 0x1F8391B9, 0xAF9DEEB6); + return shuffle(table_1, low_nibs(input)) ^ shuffle(table_2, high_nibs(input)); + } - __m128i key = _mm_loadu_si128(reinterpret_cast<const __m128i*>(keyb)); +SIMD_4x32 aes_schedule_mangle(SIMD_4x32 k, uint8_t round_no) + { + const SIMD_4x32 mc_forward0(0x00030201, 0x04070605, 0x080B0A09, 0x0C0F0E0D); + const SIMD_4x32 srx(sr[round_no % 4]); + + SIMD_4x32 t = shuffle(k ^ SIMD_4x32::splat_u8(0x5B), mc_forward0); + SIMD_4x32 t2 = t; + t = shuffle(t, mc_forward0); + t2 = t ^ t2 ^ shuffle(t, mc_forward0); + return shuffle(t2, srx); + } - m_EK.resize(11*4); - m_DK.resize(11*4); +SIMD_4x32 aes_schedule_mangle_dec(SIMD_4x32 k, uint8_t round_no) + { + const SIMD_4x32 mc_forward0(0x00030201, 0x04070605, 0x080B0A09, 0x0C0F0E0D); + + const SIMD_4x32 dsk[8] = { + SIMD_4x32(0x7ED9A700, 0xB6116FC8, 0x82255BFC, 0x4AED9334), + SIMD_4x32(0x27143300, 0x45765162, 0xE9DAFDCE, 0x8BB89FAC), + SIMD_4x32(0xCCA86400, 0x27438FEB, 0xADC90561, 0x4622EE8A), + SIMD_4x32(0x4F92DD00, 0x815C13CE, 0xBD602FF2, 0x73AEE13C), + SIMD_4x32(0x01C6C700, 0x03C4C502, 0xFA3D3CFB, 0xF83F3EF9), + SIMD_4x32(0x38CFF700, 0xEE1921D6, 0x7384BC4B, 0xA5526A9D), + SIMD_4x32(0x53732000, 0xE3C390B0, 0x10306343, 0xA080D3F3), + SIMD_4x32(0x036982E8, 0xA0CA214B, 0x8CE60D67, 0x2F45AEC4), + }; - __m128i* EK_mm = reinterpret_cast<__m128i*>(m_EK.data()); - __m128i* DK_mm = reinterpret_cast<__m128i*>(m_DK.data()); + SIMD_4x32 t = aes_schedule_transform(k, dsk[0], dsk[1]); + SIMD_4x32 output = shuffle(t, mc_forward0); - _mm_storeu_si128(DK_mm + 10, _mm_shuffle_epi8(key, sr[2])); + t = aes_schedule_transform(t, dsk[2], dsk[3]); + output = shuffle(t ^ output, mc_forward0); - key = aes_schedule_transform(key, k_ipt1, k_ipt2); + t = aes_schedule_transform(t, dsk[4], dsk[5]); + output = shuffle(t ^ output, mc_forward0); - _mm_storeu_si128(EK_mm, key); + t = aes_schedule_transform(t, dsk[6], dsk[7]); + output = shuffle(t ^ output, mc_forward0); - for(size_t i = 1; i != 10; ++i) - { - key = aes_schedule_round(&rcon, key, key); + return shuffle(output, SIMD_4x32(sr[round_no % 4])); + } - _mm_storeu_si128(EK_mm + i, - aes_schedule_mangle(key, (12-i) % 4)); +SIMD_4x32 aes_schedule_mangle_last(SIMD_4x32 k, uint8_t round_no) + { + const SIMD_4x32 out_tr1(0xD6B66000, 0xFF9F4929, 0xDEBE6808, 0xF7974121); + const SIMD_4x32 out_tr2(0x50BCEC00, 0x01EDBD51, 0xB05C0CE0, 0xE10D5DB1); - _mm_storeu_si128(DK_mm + (10-i), - aes_schedule_mangle_dec(key, (10-i) % 4)); - } + k = shuffle(k, SIMD_4x32(sr[round_no % 4])); + k ^= SIMD_4x32::splat_u8(0x5B); + return aes_schedule_transform(k, out_tr1, out_tr2); + } + +SIMD_4x32 aes_schedule_mangle_last_dec(SIMD_4x32 k) + { + const SIMD_4x32 deskew1(0x47A4E300, 0x07E4A340, 0x5DBEF91A, 0x1DFEB95A); + const SIMD_4x32 deskew2(0x83EA6900, 0x5F36B5DC, 0xF49D1E77, 0x2841C2AB); - key = aes_schedule_round(&rcon, key, key); - _mm_storeu_si128(EK_mm + 10, aes_schedule_mangle_last(key, 2)); - _mm_storeu_si128(DK_mm, aes_schedule_mangle_last_dec(key)); + k ^= SIMD_4x32::splat_u8(0x5B); + return aes_schedule_transform(k, deskew1, deskew2); } -/* -* AES-192 Encryption -*/ -BOTAN_FUNC_ISA("ssse3") -void AES_192::ssse3_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const +SIMD_4x32 aes_schedule_round(SIMD_4x32 input1, SIMD_4x32 input2) { - const __m128i* in_mm = reinterpret_cast<const __m128i*>(in); - __m128i* out_mm = reinterpret_cast<__m128i*>(out); + SIMD_4x32 smeared = input2 ^ slli<1>(input2); + smeared ^= slli<2>(smeared); + smeared ^= SIMD_4x32::splat_u8(0x5B); - const __m128i* keys = reinterpret_cast<const __m128i*>(m_EK.data()); + SIMD_4x32 t = high_nibs(input1); + input1 = low_nibs(input1); - CT::poison(in, blocks * block_size()); + SIMD_4x32 t2 = shuffle(k_inv2, input1); - for(size_t i = 0; i != blocks; ++i) - { - __m128i B = _mm_loadu_si128(in_mm + i); - _mm_storeu_si128(out_mm + i, aes_ssse3_encrypt(B, keys, 12)); - } + input1 ^= t; + + SIMD_4x32 t3 = t2 ^ shuffle(k_inv1, t); + SIMD_4x32 t4 = t2 ^ shuffle(k_inv1, input1); + + SIMD_4x32 t5 = input1 ^ shuffle(k_inv1, t3); + SIMD_4x32 t6 = t ^ shuffle(k_inv1, t4); - CT::unpoison(in, blocks * block_size()); - CT::unpoison(out, blocks * block_size()); + return smeared ^ shuffle(sb1u, t5) ^ shuffle(sb1t, t6); } -/* -* AES-192 Decryption -*/ -BOTAN_FUNC_ISA("ssse3") -void AES_192::ssse3_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const +SIMD_4x32 aes_schedule_round(SIMD_4x32& rcon, SIMD_4x32 input1, SIMD_4x32 input2) + { + input2 ^= alignr<15>(SIMD_4x32(), rcon); + rcon = alignr<15>(rcon, rcon); + input1 = shuffle32<3,3,3,3>(input1); + input1 = alignr<1>(input1, input1); + + return aes_schedule_round(input1, input2); + } + +SIMD_4x32 aes_schedule_192_smear(SIMD_4x32 x, SIMD_4x32 y) + { + return y ^ shuffle32<3,3,3,2>(x) ^ shuffle32<2,0,0,0>(y); + } + +} + +void AES_128::ssse3_key_schedule(const uint8_t keyb[], size_t) { - const __m128i* in_mm = reinterpret_cast<const __m128i*>(in); - __m128i* out_mm = reinterpret_cast<__m128i*>(out); + m_EK.resize(11*4); + m_DK.resize(11*4); + + SIMD_4x32 rcon(0xAF9DEEB6, 0x1F8391B9, 0x4D7C7D81, 0x702A9808); - const __m128i* keys = reinterpret_cast<const __m128i*>(m_DK.data()); + SIMD_4x32 key = SIMD_4x32::load_le(keyb); - CT::poison(in, blocks * block_size()); + shuffle(key, sr[2]).store_le(&m_DK[4*10]); - for(size_t i = 0; i != blocks; ++i) + key = aes_schedule_transform(key, k_ipt1, k_ipt2); + key.store_le(&m_EK[0]); + + for(size_t i = 1; i != 10; ++i) { - __m128i B = _mm_loadu_si128(in_mm + i); - _mm_storeu_si128(out_mm + i, aes_ssse3_decrypt(B, keys, 12)); + key = aes_schedule_round(rcon, key, key); + + aes_schedule_mangle(key, (12-i) % 4).store_le(&m_EK[4*i]); + + aes_schedule_mangle_dec(key, (10-i)%4).store_le(&m_DK[4*(10-i)]); } - CT::unpoison(in, blocks * block_size()); - CT::unpoison(out, blocks * block_size()); + key = aes_schedule_round(rcon, key, key); + aes_schedule_mangle_last(key, 2).store_le(&m_EK[4*10]); + aes_schedule_mangle_last_dec(key).store_le(&m_DK[0]); } -/* -* AES-192 Key Schedule -*/ -BOTAN_FUNC_ISA("ssse3") void AES_192::ssse3_key_schedule(const uint8_t keyb[], size_t) { - __m128i rcon = _mm_set_epi32(0x702A9808, 0x4D7C7D81, - 0x1F8391B9, 0xAF9DEEB6); - m_EK.resize(13*4); m_DK.resize(13*4); - __m128i* EK_mm = reinterpret_cast<__m128i*>(m_EK.data()); - __m128i* DK_mm = reinterpret_cast<__m128i*>(m_DK.data()); + SIMD_4x32 rcon(0xAF9DEEB6, 0x1F8391B9, 0x4D7C7D81, 0x702A9808); - __m128i key1 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(keyb)); - __m128i key2 = _mm_loadu_si128(reinterpret_cast<const __m128i*>((keyb + 8))); + SIMD_4x32 key1 = SIMD_4x32::load_le(keyb); + SIMD_4x32 key2 = SIMD_4x32::load_le(keyb + 8); - _mm_storeu_si128(DK_mm + 12, _mm_shuffle_epi8(key1, sr[0])); + shuffle(key1, sr[0]).store_le(&m_DK[12*4]); key1 = aes_schedule_transform(key1, k_ipt1, k_ipt2); key2 = aes_schedule_transform(key2, k_ipt1, k_ipt2); - _mm_storeu_si128(EK_mm + 0, key1); - - // key2 with 8 high bytes masked off - __m128i t = _mm_slli_si128(_mm_srli_si128(key2, 8), 8); + key1.store_le(&m_EK[0]); for(size_t i = 0; i != 4; ++i) { - key2 = aes_schedule_round(&rcon, key2, key1); + // key2 with 8 high bytes masked off + SIMD_4x32 t = zero_top_half(key2); + key2 = aes_schedule_round(rcon, key2, key1); - _mm_storeu_si128(EK_mm + 3*i+1, - aes_schedule_mangle(_mm_alignr_epi8(key2, t, 8), (i+3)%4)); - _mm_storeu_si128(DK_mm + 11-3*i, - aes_schedule_mangle_dec(_mm_alignr_epi8(key2, t, 8), (i+3)%4)); + // fixme cse + aes_schedule_mangle(alignr<8>(key2, t), (i+3)%4).store_le(&m_EK[4*(3*i+1)]); + aes_schedule_mangle_dec(alignr<8>(key2, t), (i+3)%4).store_le(&m_DK[4*(11-3*i)]); t = aes_schedule_192_smear(key2, t); - _mm_storeu_si128(EK_mm + 3*i+2, - aes_schedule_mangle(t, (i+2)%4)); - _mm_storeu_si128(DK_mm + 10-3*i, - aes_schedule_mangle_dec(t, (i+2)%4)); + aes_schedule_mangle(t, (i+2)%4).store_le(&m_EK[4*(3*i+2)]); + aes_schedule_mangle_dec(t, (i+2)%4).store_le(&m_DK[4*(10-3*i)]); - key2 = aes_schedule_round(&rcon, t, key2); + key2 = aes_schedule_round(rcon, t, key2); if(i == 3) { - _mm_storeu_si128(EK_mm + 3*i+3, - aes_schedule_mangle_last(key2, (i+1)%4)); - _mm_storeu_si128(DK_mm + 9-3*i, - aes_schedule_mangle_last_dec(key2)); + aes_schedule_mangle_last(key2, (i+1)%4).store_le(&m_EK[4*(3*i+3)]); + aes_schedule_mangle_last_dec(key2).store_le(&m_DK[4*(9-3*i)]); } else { - _mm_storeu_si128(EK_mm + 3*i+3, - aes_schedule_mangle(key2, (i+1)%4)); - _mm_storeu_si128(DK_mm + 9-3*i, - aes_schedule_mangle_dec(key2, (i+1)%4)); + aes_schedule_mangle(key2, (i+1)%4).store_le(&m_EK[4*(3*i+3)]); + aes_schedule_mangle_dec(key2, (i+1)%4).store_le(&m_DK[4*(9-3*i)]); } key1 = key2; - key2 = aes_schedule_192_smear(key2, - _mm_slli_si128(_mm_srli_si128(t, 8), 8)); - t = _mm_slli_si128(_mm_srli_si128(key2, 8), 8); + key2 = aes_schedule_192_smear(key2, zero_top_half(t)); } } -/* -* AES-256 Encryption -*/ -BOTAN_FUNC_ISA("ssse3") -void AES_256::ssse3_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const - { - const __m128i* in_mm = reinterpret_cast<const __m128i*>(in); - __m128i* out_mm = reinterpret_cast<__m128i*>(out); - - const __m128i* keys = reinterpret_cast<const __m128i*>(m_EK.data()); - - CT::poison(in, blocks * block_size()); - - for(size_t i = 0; i != blocks; ++i) - { - __m128i B = _mm_loadu_si128(in_mm + i); - _mm_storeu_si128(out_mm + i, aes_ssse3_encrypt(B, keys, 14)); - } - - CT::unpoison(in, blocks * block_size()); - CT::unpoison(out, blocks * block_size()); - } - -/* -* AES-256 Decryption -*/ -BOTAN_FUNC_ISA("ssse3") -void AES_256::ssse3_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const - { - const __m128i* in_mm = reinterpret_cast<const __m128i*>(in); - __m128i* out_mm = reinterpret_cast<__m128i*>(out); - - const __m128i* keys = reinterpret_cast<const __m128i*>(m_DK.data()); - - CT::poison(in, blocks * block_size()); - - for(size_t i = 0; i != blocks; ++i) - { - __m128i B = _mm_loadu_si128(in_mm + i); - _mm_storeu_si128(out_mm + i, aes_ssse3_decrypt(B, keys, 14)); - } - - CT::unpoison(in, blocks * block_size()); - CT::unpoison(out, blocks * block_size()); - } - -/* -* AES-256 Key Schedule -*/ -BOTAN_FUNC_ISA("ssse3") void AES_256::ssse3_key_schedule(const uint8_t keyb[], size_t) { - __m128i rcon = _mm_set_epi32(0x702A9808, 0x4D7C7D81, - 0x1F8391B9, 0xAF9DEEB6); - m_EK.resize(15*4); m_DK.resize(15*4); - __m128i* EK_mm = reinterpret_cast<__m128i*>(m_EK.data()); - __m128i* DK_mm = reinterpret_cast<__m128i*>(m_DK.data()); + SIMD_4x32 rcon(0xAF9DEEB6, 0x1F8391B9, 0x4D7C7D81, 0x702A9808); - __m128i key1 = _mm_loadu_si128(reinterpret_cast<const __m128i*>(keyb)); - __m128i key2 = _mm_loadu_si128(reinterpret_cast<const __m128i*>((keyb + 16))); + SIMD_4x32 key1 = SIMD_4x32::load_le(keyb); + SIMD_4x32 key2 = SIMD_4x32::load_le(keyb + 16); - _mm_storeu_si128(DK_mm + 14, _mm_shuffle_epi8(key1, sr[2])); + shuffle(key1, sr[2]).store_le(&m_DK[4*14]); key1 = aes_schedule_transform(key1, k_ipt1, k_ipt2); key2 = aes_schedule_transform(key2, k_ipt1, k_ipt2); - _mm_storeu_si128(EK_mm + 0, key1); - _mm_storeu_si128(EK_mm + 1, aes_schedule_mangle(key2, 3)); + key1.store_le(&m_EK[0]); + aes_schedule_mangle(key2, 3).store_le(&m_EK[4]); - _mm_storeu_si128(DK_mm + 13, aes_schedule_mangle_dec(key2, 1)); + aes_schedule_mangle_dec(key2, 1).store_le(&m_DK[4*13]); for(size_t i = 2; i != 14; i += 2) { - __m128i k_t = key2; - key1 = key2 = aes_schedule_round(&rcon, key2, key1); + const SIMD_4x32 k_t = key2; + key1 = key2 = aes_schedule_round(rcon, key2, key1); + + aes_schedule_mangle(key2, i % 4).store_le(&m_EK[4*i]); + aes_schedule_mangle_dec(key2, (i+2)%4).store_le(&m_DK[4*(14-i)]); - _mm_storeu_si128(EK_mm + i, aes_schedule_mangle(key2, i % 4)); - _mm_storeu_si128(DK_mm + (14-i), aes_schedule_mangle_dec(key2, (i+2) % 4)); + key2 = aes_schedule_round(shuffle32<3,3,3,3>(key2), k_t); - key2 = aes_schedule_round(nullptr, _mm_shuffle_epi32(key2, 0xFF), k_t); - _mm_storeu_si128(EK_mm + i + 1, aes_schedule_mangle(key2, (i - 1) % 4)); - _mm_storeu_si128(DK_mm + (13-i), aes_schedule_mangle_dec(key2, (i+1) % 4)); + aes_schedule_mangle(key2, (i-1)%4).store_le(&m_EK[4*(i+1)]); + aes_schedule_mangle_dec(key2, (i+1)%4).store_le(&m_DK[4*(13-i)]); } - key2 = aes_schedule_round(&rcon, key2, key1); + key2 = aes_schedule_round(rcon, key2, key1); - _mm_storeu_si128(EK_mm + 14, aes_schedule_mangle_last(key2, 2)); - _mm_storeu_si128(DK_mm + 0, aes_schedule_mangle_last_dec(key2)); + aes_schedule_mangle_last(key2, 2).store_le(&m_EK[4*14]); + aes_schedule_mangle_last_dec(key2).store_le(&m_DK[0]); } } diff --git a/src/lib/block/aes/aes_ssse3/info.txt b/src/lib/block/aes/aes_ssse3/info.txt index 7a7f0354e..49d9a9214 100644 --- a/src/lib/block/aes/aes_ssse3/info.txt +++ b/src/lib/block/aes/aes_ssse3/info.txt @@ -6,10 +6,13 @@ AES_SSSE3 -> 20131128 ssse3 </isa> -# Intel C++ can't deal with syntax for defining constants :( +<requires> +simd +</requires> + <cc> gcc clang -msvc +msvc:19.10 # VC 2017 sunstudio </cc> diff --git a/src/lib/utils/simd/simd_32.h b/src/lib/utils/simd/simd_32.h index 304770587..7b6929c6d 100644 --- a/src/lib/utils/simd/simd_32.h +++ b/src/lib/utils/simd/simd_32.h @@ -33,6 +33,16 @@ namespace Botan { +#if defined(BOTAN_SIMD_USE_SSE2) + typedef __m128i native_simd_type; +#elif defined(BOTAN_SIMD_USE_ALTIVEC) + typedef __vector unsigned int native_simd_type; +#elif defined(BOTAN_SIMD_USE_NEON) + typedef uint32x4_t native_simd_type; +#else + typedef struct { uint32_t val[4]; } native_simd_type; +#endif + /** * 4x32 bit SIMD register * @@ -59,16 +69,16 @@ class SIMD_4x32 final SIMD_4x32() // zero initialized { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_setzero_si128(); + m_simd = _mm_setzero_si128(); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = vec_splat_u32(0); + m_simd = vec_splat_u32(0); #elif defined(BOTAN_SIMD_USE_NEON) - m_neon = vdupq_n_u32(0); + m_simd = vdupq_n_u32(0); #else - m_scalar[0] = 0; - m_scalar[1] = 0; - m_scalar[2] = 0; - m_scalar[3] = 0; + m_simd.val[0] = 0; + m_simd.val[1] = 0; + m_simd.val[2] = 0; + m_simd.val[3] = 0; #endif } @@ -78,16 +88,16 @@ class SIMD_4x32 final explicit SIMD_4x32(const uint32_t B[4]) { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_loadu_si128(reinterpret_cast<const __m128i*>(B)); + m_simd = _mm_loadu_si128(reinterpret_cast<const __m128i*>(B)); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = (__vector unsigned int){B[0], B[1], B[2], B[3]}; + m_simd = (__vector unsigned int){B[0], B[1], B[2], B[3]}; #elif defined(BOTAN_SIMD_USE_NEON) - m_neon = vld1q_u32(B); + m_simd = vld1q_u32(B); #else - m_scalar[0] = B[0]; - m_scalar[1] = B[1]; - m_scalar[2] = B[2]; - m_scalar[3] = B[3]; + m_simd.val[0] = B[0]; + m_simd.val[1] = B[1]; + m_simd.val[2] = B[2]; + m_simd.val[3] = B[3]; #endif } @@ -97,18 +107,18 @@ class SIMD_4x32 final SIMD_4x32(uint32_t B0, uint32_t B1, uint32_t B2, uint32_t B3) { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_set_epi32(B3, B2, B1, B0); + m_simd = _mm_set_epi32(B3, B2, B1, B0); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = (__vector unsigned int){B0, B1, B2, B3}; + m_simd = (__vector unsigned int){B0, B1, B2, B3}; #elif defined(BOTAN_SIMD_USE_NEON) // Better way to do this? const uint32_t B[4] = { B0, B1, B2, B3 }; - m_neon = vld1q_u32(B); + m_simd = vld1q_u32(B); #else - m_scalar[0] = B0; - m_scalar[1] = B1; - m_scalar[2] = B2; - m_scalar[3] = B3; + m_simd.val[0] = B0; + m_simd.val[1] = B1; + m_simd.val[2] = B2; + m_simd.val[3] = B3; #endif } @@ -127,6 +137,21 @@ class SIMD_4x32 final } /** + * Load SIMD register with one 8-bit element repeated + */ + static SIMD_4x32 splat_u8(uint8_t B) + { +#if defined(BOTAN_SIMD_USE_SSE2) + return SIMD_4x32(_mm_set1_epi8(B)); +#elif defined(BOTAN_SIMD_USE_ARM) + return SIMD_4x32(vdupq_n_u8(B)); +#else + const uint32_t B4 = make_uint32(B, B, B, B); + return SIMD_4x32(B4, B4, B4, B4); +#endif + } + + /** * Load a SIMD register with little-endian convention */ static SIMD_4x32 load_le(const void* in) @@ -145,7 +170,7 @@ class SIMD_4x32 final return CPUID::is_big_endian() ? l.bswap() : l; #else SIMD_4x32 out; - Botan::load_le(out.m_scalar, static_cast<const uint8_t*>(in), 4); + Botan::load_le(out.m_simd.val, static_cast<const uint8_t*>(in), 4); return out; #endif } @@ -172,11 +197,16 @@ class SIMD_4x32 final #else SIMD_4x32 out; - Botan::load_be(out.m_scalar, static_cast<const uint8_t*>(in), 4); + Botan::load_be(out.m_simd.val, static_cast<const uint8_t*>(in), 4); return out; #endif } + void store_le(uint32_t out[]) const + { + this->store_le(reinterpret_cast<uint8_t*>(out)); + } + /** * Load a SIMD register with little-endian convention */ @@ -184,7 +214,7 @@ class SIMD_4x32 final { #if defined(BOTAN_SIMD_USE_SSE2) - _mm_storeu_si128(reinterpret_cast<__m128i*>(out), m_sse); + _mm_storeu_si128(reinterpret_cast<__m128i*>(out), m_simd); #elif defined(BOTAN_SIMD_USE_ALTIVEC) @@ -192,7 +222,7 @@ class SIMD_4x32 final __vector unsigned int V; uint32_t R[4]; } vec; - vec.V = m_vmx; + vec.V = m_simd; Botan::store_le(out, vec.R[0], vec.R[1], vec.R[2], vec.R[3]); #elif defined(BOTAN_SIMD_USE_NEON) @@ -203,10 +233,10 @@ class SIMD_4x32 final } else { - vst1q_u8(out, vreinterpretq_u8_u32(m_neon)); + vst1q_u8(out, vreinterpretq_u8_u32(m_simd)); } #else - Botan::store_le(out, m_scalar[0], m_scalar[1], m_scalar[2], m_scalar[3]); + Botan::store_le(out, m_simd.val[0], m_simd.val[1], m_simd.val[2], m_simd.val[3]); #endif } @@ -225,7 +255,7 @@ class SIMD_4x32 final __vector unsigned int V; uint32_t R[4]; } vec; - vec.V = m_vmx; + vec.V = m_simd; Botan::store_be(out, vec.R[0], vec.R[1], vec.R[2], vec.R[3]); #elif defined(BOTAN_SIMD_USE_NEON) @@ -236,15 +266,14 @@ class SIMD_4x32 final } else { - vst1q_u8(out, vreinterpretq_u8_u32(m_neon)); + vst1q_u8(out, vreinterpretq_u8_u32(m_simd)); } #else - Botan::store_be(out, m_scalar[0], m_scalar[1], m_scalar[2], m_scalar[3]); + Botan::store_be(out, m_simd.val[0], m_simd.val[1], m_simd.val[2], m_simd.val[3]); #endif } - /* * This is used for SHA-2/SHACAL2 * Return rotr(ROT1) ^ rotr(ROT2) ^ rotr(ROT3) @@ -268,20 +297,20 @@ class SIMD_4x32 final #if defined(BOTAN_SIMD_USE_SSE2) - return SIMD_4x32(_mm_or_si128(_mm_slli_epi32(m_sse, static_cast<int>(ROT)), - _mm_srli_epi32(m_sse, static_cast<int>(32-ROT)))); + return SIMD_4x32(_mm_or_si128(_mm_slli_epi32(m_simd, static_cast<int>(ROT)), + _mm_srli_epi32(m_simd, static_cast<int>(32-ROT)))); #elif defined(BOTAN_SIMD_USE_ALTIVEC) const unsigned int r = static_cast<unsigned int>(ROT); - return SIMD_4x32(vec_rl(m_vmx, (__vector unsigned int){r, r, r, r})); + return SIMD_4x32(vec_rl(m_simd, (__vector unsigned int){r, r, r, r})); #elif defined(BOTAN_SIMD_USE_NEON) #if defined(BOTAN_TARGET_ARCH_IS_ARM32) - return SIMD_4x32(vorrq_u32(vshlq_n_u32(m_neon, static_cast<int>(ROT)), - vshrq_n_u32(m_neon, static_cast<int>(32-ROT)))); + return SIMD_4x32(vorrq_u32(vshlq_n_u32(m_simd, static_cast<int>(ROT)), + vshrq_n_u32(m_simd, static_cast<int>(32-ROT)))); #else @@ -289,25 +318,25 @@ class SIMD_4x32 final { const uint8_t maskb[16] = { 3,0,1,2, 7,4,5,6, 11,8,9,10, 15,12,13,14 }; const uint8x16_t mask = vld1q_u8(maskb); - return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_neon), mask))); + return SIMD_4x32(vreinterpretq_u32_u8(vqtbl1q_u8(vreinterpretq_u8_u32(m_simd), mask))); } else BOTAN_IF_CONSTEXPR(ROT == 16) { - return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_neon)))); + return SIMD_4x32(vreinterpretq_u32_u16(vrev32q_u16(vreinterpretq_u16_u32(m_simd)))); } else { - return SIMD_4x32(vorrq_u32(vshlq_n_u32(m_neon, static_cast<int>(ROT)), - vshrq_n_u32(m_neon, static_cast<int>(32-ROT)))); + return SIMD_4x32(vorrq_u32(vshlq_n_u32(m_simd, static_cast<int>(ROT)), + vshrq_n_u32(m_simd, static_cast<int>(32-ROT)))); } #endif #else - return SIMD_4x32(Botan::rotl<ROT>(m_scalar[0]), - Botan::rotl<ROT>(m_scalar[1]), - Botan::rotl<ROT>(m_scalar[2]), - Botan::rotl<ROT>(m_scalar[3])); + return SIMD_4x32(Botan::rotl<ROT>(m_simd.val[0]), + Botan::rotl<ROT>(m_simd.val[1]), + Botan::rotl<ROT>(m_simd.val[2]), + Botan::rotl<ROT>(m_simd.val[3])); #endif } @@ -373,81 +402,81 @@ class SIMD_4x32 final void operator+=(const SIMD_4x32& other) { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_add_epi32(m_sse, other.m_sse); + m_simd = _mm_add_epi32(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = vec_add(m_vmx, other.m_vmx); + m_simd = vec_add(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_NEON) - m_neon = vaddq_u32(m_neon, other.m_neon); + m_simd = vaddq_u32(m_simd, other.m_simd); #else - m_scalar[0] += other.m_scalar[0]; - m_scalar[1] += other.m_scalar[1]; - m_scalar[2] += other.m_scalar[2]; - m_scalar[3] += other.m_scalar[3]; + m_simd.val[0] += other.m_simd.val[0]; + m_simd.val[1] += other.m_simd.val[1]; + m_simd.val[2] += other.m_simd.val[2]; + m_simd.val[3] += other.m_simd.val[3]; #endif } void operator-=(const SIMD_4x32& other) { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_sub_epi32(m_sse, other.m_sse); + m_simd = _mm_sub_epi32(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = vec_sub(m_vmx, other.m_vmx); + m_simd = vec_sub(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_NEON) - m_neon = vsubq_u32(m_neon, other.m_neon); + m_simd = vsubq_u32(m_simd, other.m_simd); #else - m_scalar[0] -= other.m_scalar[0]; - m_scalar[1] -= other.m_scalar[1]; - m_scalar[2] -= other.m_scalar[2]; - m_scalar[3] -= other.m_scalar[3]; + m_simd.val[0] -= other.m_simd.val[0]; + m_simd.val[1] -= other.m_simd.val[1]; + m_simd.val[2] -= other.m_simd.val[2]; + m_simd.val[3] -= other.m_simd.val[3]; #endif } void operator^=(const SIMD_4x32& other) { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_xor_si128(m_sse, other.m_sse); + m_simd = _mm_xor_si128(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = vec_xor(m_vmx, other.m_vmx); + m_simd = vec_xor(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_NEON) - m_neon = veorq_u32(m_neon, other.m_neon); + m_simd = veorq_u32(m_simd, other.m_simd); #else - m_scalar[0] ^= other.m_scalar[0]; - m_scalar[1] ^= other.m_scalar[1]; - m_scalar[2] ^= other.m_scalar[2]; - m_scalar[3] ^= other.m_scalar[3]; + m_simd.val[0] ^= other.m_simd.val[0]; + m_simd.val[1] ^= other.m_simd.val[1]; + m_simd.val[2] ^= other.m_simd.val[2]; + m_simd.val[3] ^= other.m_simd.val[3]; #endif } void operator|=(const SIMD_4x32& other) { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_or_si128(m_sse, other.m_sse); + m_simd = _mm_or_si128(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = vec_or(m_vmx, other.m_vmx); + m_simd = vec_or(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_NEON) - m_neon = vorrq_u32(m_neon, other.m_neon); + m_simd = vorrq_u32(m_simd, other.m_simd); #else - m_scalar[0] |= other.m_scalar[0]; - m_scalar[1] |= other.m_scalar[1]; - m_scalar[2] |= other.m_scalar[2]; - m_scalar[3] |= other.m_scalar[3]; + m_simd.val[0] |= other.m_simd.val[0]; + m_simd.val[1] |= other.m_simd.val[1]; + m_simd.val[2] |= other.m_simd.val[2]; + m_simd.val[3] |= other.m_simd.val[3]; #endif } void operator&=(const SIMD_4x32& other) { #if defined(BOTAN_SIMD_USE_SSE2) - m_sse = _mm_and_si128(m_sse, other.m_sse); + m_simd = _mm_and_si128(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - m_vmx = vec_and(m_vmx, other.m_vmx); + m_simd = vec_and(m_simd, other.m_simd); #elif defined(BOTAN_SIMD_USE_NEON) - m_neon = vandq_u32(m_neon, other.m_neon); + m_simd = vandq_u32(m_simd, other.m_simd); #else - m_scalar[0] &= other.m_scalar[0]; - m_scalar[1] &= other.m_scalar[1]; - m_scalar[2] &= other.m_scalar[2]; - m_scalar[3] &= other.m_scalar[3]; + m_simd.val[0] &= other.m_simd.val[0]; + m_simd.val[1] &= other.m_simd.val[1]; + m_simd.val[2] &= other.m_simd.val[2]; + m_simd.val[3] &= other.m_simd.val[3]; #endif } @@ -455,34 +484,34 @@ class SIMD_4x32 final template<int SHIFT> SIMD_4x32 shl() const { #if defined(BOTAN_SIMD_USE_SSE2) - return SIMD_4x32(_mm_slli_epi32(m_sse, SHIFT)); + return SIMD_4x32(_mm_slli_epi32(m_simd, SHIFT)); #elif defined(BOTAN_SIMD_USE_ALTIVEC) const unsigned int s = static_cast<unsigned int>(SHIFT); - return SIMD_4x32(vec_sl(m_vmx, (__vector unsigned int){s, s, s, s})); + return SIMD_4x32(vec_sl(m_simd, (__vector unsigned int){s, s, s, s})); #elif defined(BOTAN_SIMD_USE_NEON) - return SIMD_4x32(vshlq_n_u32(m_neon, SHIFT)); + return SIMD_4x32(vshlq_n_u32(m_simd, SHIFT)); #else - return SIMD_4x32(m_scalar[0] << SHIFT, - m_scalar[1] << SHIFT, - m_scalar[2] << SHIFT, - m_scalar[3] << SHIFT); + return SIMD_4x32(m_simd.val[0] << SHIFT, + m_simd.val[1] << SHIFT, + m_simd.val[2] << SHIFT, + m_simd.val[3] << SHIFT); #endif } template<int SHIFT> SIMD_4x32 shr() const { #if defined(BOTAN_SIMD_USE_SSE2) - return SIMD_4x32(_mm_srli_epi32(m_sse, SHIFT)); + return SIMD_4x32(_mm_srli_epi32(m_simd, SHIFT)); #elif defined(BOTAN_SIMD_USE_ALTIVEC) const unsigned int s = static_cast<unsigned int>(SHIFT); - return SIMD_4x32(vec_sr(m_vmx, (__vector unsigned int){s, s, s, s})); + return SIMD_4x32(vec_sr(m_simd, (__vector unsigned int){s, s, s, s})); #elif defined(BOTAN_SIMD_USE_NEON) - return SIMD_4x32(vshrq_n_u32(m_neon, SHIFT)); + return SIMD_4x32(vshrq_n_u32(m_simd, SHIFT)); #else - return SIMD_4x32(m_scalar[0] >> SHIFT, m_scalar[1] >> SHIFT, - m_scalar[2] >> SHIFT, m_scalar[3] >> SHIFT); + return SIMD_4x32(m_simd.val[0] >> SHIFT, m_simd.val[1] >> SHIFT, + m_simd.val[2] >> SHIFT, m_simd.val[3] >> SHIFT); #endif } @@ -490,13 +519,13 @@ class SIMD_4x32 final SIMD_4x32 operator~() const { #if defined(BOTAN_SIMD_USE_SSE2) - return SIMD_4x32(_mm_xor_si128(m_sse, _mm_set1_epi32(0xFFFFFFFF))); + return SIMD_4x32(_mm_xor_si128(m_simd, _mm_set1_epi32(0xFFFFFFFF))); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - return SIMD_4x32(vec_nor(m_vmx, m_vmx)); + return SIMD_4x32(vec_nor(m_simd, m_simd)); #elif defined(BOTAN_SIMD_USE_NEON) - return SIMD_4x32(vmvnq_u32(m_neon)); + return SIMD_4x32(vmvnq_u32(m_simd)); #else - return SIMD_4x32(~m_scalar[0], ~m_scalar[1], ~m_scalar[2], ~m_scalar[3]); + return SIMD_4x32(~m_simd.val[0], ~m_simd.val[1], ~m_simd.val[2], ~m_simd.val[3]); #endif } @@ -504,21 +533,21 @@ class SIMD_4x32 final SIMD_4x32 andc(const SIMD_4x32& other) const { #if defined(BOTAN_SIMD_USE_SSE2) - return SIMD_4x32(_mm_andnot_si128(m_sse, other.m_sse)); + return SIMD_4x32(_mm_andnot_si128(m_simd, other.m_simd)); #elif defined(BOTAN_SIMD_USE_ALTIVEC) /* AltiVec does arg1 & ~arg2 rather than SSE's ~arg1 & arg2 so swap the arguments */ - return SIMD_4x32(vec_andc(other.m_vmx, m_vmx)); + return SIMD_4x32(vec_andc(other.m_simd, m_simd)); #elif defined(BOTAN_SIMD_USE_NEON) // NEON is also a & ~b - return SIMD_4x32(vbicq_u32(other.m_neon, m_neon)); + return SIMD_4x32(vbicq_u32(other.m_simd, m_simd)); #else - return SIMD_4x32((~m_scalar[0]) & other.m_scalar[0], - (~m_scalar[1]) & other.m_scalar[1], - (~m_scalar[2]) & other.m_scalar[2], - (~m_scalar[3]) & other.m_scalar[3]); + return SIMD_4x32((~m_simd.val[0]) & other.m_simd.val[0], + (~m_simd.val[1]) & other.m_simd.val[1], + (~m_simd.val[2]) & other.m_simd.val[2], + (~m_simd.val[3]) & other.m_simd.val[3]); #endif } @@ -529,7 +558,7 @@ class SIMD_4x32 final { #if defined(BOTAN_SIMD_USE_SSE2) - __m128i T = m_sse; + __m128i T = m_simd; T = _mm_shufflehi_epi16(T, _MM_SHUFFLE(2, 3, 0, 1)); T = _mm_shufflelo_epi16(T, _MM_SHUFFLE(2, 3, 0, 1)); return SIMD_4x32(_mm_or_si128(_mm_srli_epi16(T, 8), _mm_slli_epi16(T, 8))); @@ -541,20 +570,20 @@ class SIMD_4x32 final uint32_t R[4]; } vec; - vec.V = m_vmx; + vec.V = m_simd; bswap_4(vec.R); return SIMD_4x32(vec.R[0], vec.R[1], vec.R[2], vec.R[3]); #elif defined(BOTAN_SIMD_USE_NEON) - return SIMD_4x32(vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(m_neon)))); + return SIMD_4x32(vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(m_simd)))); #else // scalar - return SIMD_4x32(reverse_bytes(m_scalar[0]), - reverse_bytes(m_scalar[1]), - reverse_bytes(m_scalar[2]), - reverse_bytes(m_scalar[3])); + return SIMD_4x32(reverse_bytes(m_simd.val[0]), + reverse_bytes(m_simd.val[1]), + reverse_bytes(m_simd.val[2]), + reverse_bytes(m_simd.val[3])); #endif } @@ -565,59 +594,59 @@ class SIMD_4x32 final SIMD_4x32& B2, SIMD_4x32& B3) { #if defined(BOTAN_SIMD_USE_SSE2) - const __m128i T0 = _mm_unpacklo_epi32(B0.m_sse, B1.m_sse); - const __m128i T1 = _mm_unpacklo_epi32(B2.m_sse, B3.m_sse); - const __m128i T2 = _mm_unpackhi_epi32(B0.m_sse, B1.m_sse); - const __m128i T3 = _mm_unpackhi_epi32(B2.m_sse, B3.m_sse); - - B0.m_sse = _mm_unpacklo_epi64(T0, T1); - B1.m_sse = _mm_unpackhi_epi64(T0, T1); - B2.m_sse = _mm_unpacklo_epi64(T2, T3); - B3.m_sse = _mm_unpackhi_epi64(T2, T3); + const __m128i T0 = _mm_unpacklo_epi32(B0.m_simd, B1.m_simd); + const __m128i T1 = _mm_unpacklo_epi32(B2.m_simd, B3.m_simd); + const __m128i T2 = _mm_unpackhi_epi32(B0.m_simd, B1.m_simd); + const __m128i T3 = _mm_unpackhi_epi32(B2.m_simd, B3.m_simd); + + B0.m_simd = _mm_unpacklo_epi64(T0, T1); + B1.m_simd = _mm_unpackhi_epi64(T0, T1); + B2.m_simd = _mm_unpacklo_epi64(T2, T3); + B3.m_simd = _mm_unpackhi_epi64(T2, T3); #elif defined(BOTAN_SIMD_USE_ALTIVEC) - const __vector unsigned int T0 = vec_mergeh(B0.m_vmx, B2.m_vmx); - const __vector unsigned int T1 = vec_mergeh(B1.m_vmx, B3.m_vmx); - const __vector unsigned int T2 = vec_mergel(B0.m_vmx, B2.m_vmx); - const __vector unsigned int T3 = vec_mergel(B1.m_vmx, B3.m_vmx); - - B0.m_vmx = vec_mergeh(T0, T1); - B1.m_vmx = vec_mergel(T0, T1); - B2.m_vmx = vec_mergeh(T2, T3); - B3.m_vmx = vec_mergel(T2, T3); + const __vector unsigned int T0 = vec_mergeh(B0.m_simd, B2.m_simd); + const __vector unsigned int T1 = vec_mergeh(B1.m_simd, B3.m_simd); + const __vector unsigned int T2 = vec_mergel(B0.m_simd, B2.m_simd); + const __vector unsigned int T3 = vec_mergel(B1.m_simd, B3.m_simd); + + B0.m_simd = vec_mergeh(T0, T1); + B1.m_simd = vec_mergel(T0, T1); + B2.m_simd = vec_mergeh(T2, T3); + B3.m_simd = vec_mergel(T2, T3); #elif defined(BOTAN_SIMD_USE_NEON) #if defined(BOTAN_TARGET_ARCH_IS_ARM32) - const uint32x4x2_t T0 = vzipq_u32(B0.m_neon, B2.m_neon); - const uint32x4x2_t T1 = vzipq_u32(B1.m_neon, B3.m_neon); + const uint32x4x2_t T0 = vzipq_u32(B0.m_simd, B2.m_simd); + const uint32x4x2_t T1 = vzipq_u32(B1.m_simd, B3.m_simd); const uint32x4x2_t O0 = vzipq_u32(T0.val[0], T1.val[0]); const uint32x4x2_t O1 = vzipq_u32(T0.val[1], T1.val[1]); - B0.m_neon = O0.val[0]; - B1.m_neon = O0.val[1]; - B2.m_neon = O1.val[0]; - B3.m_neon = O1.val[1]; + B0.m_simd = O0.val[0]; + B1.m_simd = O0.val[1]; + B2.m_simd = O1.val[0]; + B3.m_simd = O1.val[1]; #elif defined(BOTAN_TARGET_ARCH_IS_ARM64) - const uint32x4_t T0 = vzip1q_u32(B0.m_neon, B2.m_neon); - const uint32x4_t T2 = vzip2q_u32(B0.m_neon, B2.m_neon); + const uint32x4_t T0 = vzip1q_u32(B0.m_simd, B2.m_simd); + const uint32x4_t T2 = vzip2q_u32(B0.m_simd, B2.m_simd); - const uint32x4_t T1 = vzip1q_u32(B1.m_neon, B3.m_neon); - const uint32x4_t T3 = vzip2q_u32(B1.m_neon, B3.m_neon); + const uint32x4_t T1 = vzip1q_u32(B1.m_simd, B3.m_simd); + const uint32x4_t T3 = vzip2q_u32(B1.m_simd, B3.m_simd); - B0.m_neon = vzip1q_u32(T0, T1); - B1.m_neon = vzip2q_u32(T0, T1); + B0.m_simd = vzip1q_u32(T0, T1); + B1.m_simd = vzip2q_u32(T0, T1); - B2.m_neon = vzip1q_u32(T2, T3); - B3.m_neon = vzip2q_u32(T2, T3); + B2.m_simd = vzip1q_u32(T2, T3); + B3.m_simd = vzip2q_u32(T2, T3); #endif #else // scalar - SIMD_4x32 T0(B0.m_scalar[0], B1.m_scalar[0], B2.m_scalar[0], B3.m_scalar[0]); - SIMD_4x32 T1(B0.m_scalar[1], B1.m_scalar[1], B2.m_scalar[1], B3.m_scalar[1]); - SIMD_4x32 T2(B0.m_scalar[2], B1.m_scalar[2], B2.m_scalar[2], B3.m_scalar[2]); - SIMD_4x32 T3(B0.m_scalar[3], B1.m_scalar[3], B2.m_scalar[3], B3.m_scalar[3]); + SIMD_4x32 T0(B0.m_simd.val[0], B1.m_simd.val[0], B2.m_simd.val[0], B3.m_simd.val[0]); + SIMD_4x32 T1(B0.m_simd.val[1], B1.m_simd.val[1], B2.m_simd.val[1], B3.m_simd.val[1]); + SIMD_4x32 T2(B0.m_simd.val[2], B1.m_simd.val[2], B2.m_simd.val[2], B3.m_simd.val[2]); + SIMD_4x32 T3(B0.m_simd.val[3], B1.m_simd.val[3], B2.m_simd.val[3], B3.m_simd.val[3]); B0 = T0; B1 = T1; @@ -626,25 +655,11 @@ class SIMD_4x32 final #endif } - private: + native_simd_type raw() const { return m_simd; } -#if defined(BOTAN_SIMD_USE_SSE2) - explicit SIMD_4x32(__m128i in) : m_sse(in) {} -#elif defined(BOTAN_SIMD_USE_ALTIVEC) - explicit SIMD_4x32(__vector unsigned int in) : m_vmx(in) {} -#elif defined(BOTAN_SIMD_USE_NEON) - explicit SIMD_4x32(uint32x4_t in) : m_neon(in) {} -#endif - -#if defined(BOTAN_SIMD_USE_SSE2) - __m128i m_sse; -#elif defined(BOTAN_SIMD_USE_ALTIVEC) - __vector unsigned int m_vmx; -#elif defined(BOTAN_SIMD_USE_NEON) - uint32x4_t m_neon; -#else - uint32_t m_scalar[4]; -#endif + explicit SIMD_4x32(native_simd_type x) : m_simd(x) {} + private: + native_simd_type m_simd; }; } |