|
| 1 | +/* Copyright lowRISC contributors (OpenTitan project). */ |
| 2 | +/* Licensed under the Apache License, Version 2.0, see LICENSE for details. */ |
| 3 | +/* SPDX-License-Identifier: Apache-2.0 */ |
| 4 | + |
| 5 | +/* Polynomial arithmetic over Z_q[X] / (X^256 + 1). */ |
| 6 | + |
| 7 | +.globl poly_mul |
| 8 | +.globl poly_add |
| 9 | +.globl poly_sub |
| 10 | + |
| 11 | +.text |
| 12 | + |
| 13 | +/** |
| 14 | + * Pointwise Montgomery multiplication of two polynomials a(X) and b(X) over |
| 15 | + * Z_q[X] / (X^256 + 1). |
| 16 | + * |
| 17 | + * Both a and b are assumed to be stored in 1024-byte (256 32-bit coefficient |
| 18 | + * slots) regions in DMEM. Depending on whether {x2, x3} == x4, this routine is |
| 19 | + * either in-place or not. |
| 20 | + * |
| 21 | + * The caller must ensure that the modulus q and the corresponding Montgomery |
| 22 | + * multiplication constant have been correctly prepared (see the `MOD` register |
| 23 | + * and usage of the `bn.{add,sub,mul}vm` instructions) prior to invoking this |
| 24 | + * routine. |
| 25 | + * |
| 26 | + * CAUTION: The coefficients of a(X) and b(X) are not mapped into the |
| 27 | + * Montgomery space nor are the output coefficients converted back. It is the |
| 28 | + * responsibility of the caller to appropriately adjust the input/output |
| 29 | + * polynomials. For example, if two coefficients x and y are given as is, then |
| 30 | + * the resulting Montgomery mulplication will result in x * y * R^-1 mod q, |
| 31 | + * where R = 2^32. |
| 32 | + * |
| 33 | + * @param[in] x2: DMEM address of the polynomial a(X). |
| 34 | + * @param[in] x3: DMEM address of the polynomial b(X). |
| 35 | + * @param[in] x4: DMEM address of the result a(X) * b(X) * R^-1 mod q. |
| 36 | + */ |
| 37 | +poly_mul: |
| 38 | + /* Push clobbered general-purpose registers onto the stack. */ |
| 39 | + .irp reg, x2, x3, x4, x5 |
| 40 | + sw \reg, 0(x31) |
| 41 | + addi x31, x31, 4 |
| 42 | + .endr |
| 43 | + |
| 44 | + /* WDR pointer for the coefficients of b(X). */ |
| 45 | + addi x5, x0, 1 |
| 46 | + |
| 47 | + /* Each iteration calculates the modular addition of 8 coefficients. */ |
| 48 | + loopi 32, 5 |
| 49 | + /* Load 8 coefficients of a(X) and b(X) into w0 and w1. */ |
| 50 | + bn.lid x0, 0(x2++) |
| 51 | + bn.lid x5, 0(x3++) |
| 52 | + |
| 53 | + /* Execute the vectorized Montgomery multiplication. */ |
| 54 | + bn.mulvm.8S w0, w0, w1 |
| 55 | + bn.addvm.8S w0, w0, w31 /* cond sub */ |
| 56 | + |
| 57 | + /* Store the result back to DMEM. */ |
| 58 | + bn.sid x0, 0(x4++) |
| 59 | + /* End of loop */ |
| 60 | + |
| 61 | + /* Restore clobbered general-purpose registers. */ |
| 62 | + .irp reg, x5, x4, x3, x2 |
| 63 | + addi x31, x31, -4 |
| 64 | + lw \reg, 0(x31) |
| 65 | + .endr |
| 66 | + |
| 67 | + ret |
| 68 | + |
| 69 | +/** |
| 70 | + * Modular addition of two polynomials a(X) and b(X) over Z_q[X] / (X^256 + 1). |
| 71 | + * |
| 72 | + * Both a and b are assumed to be stored in 1024-byte (256 32-bit coefficient |
| 73 | + * slots) regions in DMEM. Depending on whether {x2, x3} == x4, this routine is |
| 74 | + * either in-place or not. |
| 75 | + * |
| 76 | + * The caller must ensure that the modulus q has been correctly prepared (see |
| 77 | + * the `MOD` register and usage of the `bn.{add,sub,mul}vm` instructions) prior |
| 78 | + * to invoking this routine. |
| 79 | + * |
| 80 | + * @param[in] x2: DMEM address of the polynomial a(X). |
| 81 | + * @param[in] x3: DMEM address of the polynomial b(X). |
| 82 | + * @param[in] x4: DMEM address of the result a(X) + b(X) mod q. |
| 83 | + */ |
| 84 | +poly_add: |
| 85 | + /* Push clobbered general-purpose registers onto the stack. */ |
| 86 | + .irp reg, x2, x3, x4, x5 |
| 87 | + sw \reg, 0(x31) |
| 88 | + addi x31, x31, 4 |
| 89 | + .endr |
| 90 | + |
| 91 | + /* WDR pointer for the coefficients of b(X). */ |
| 92 | + addi x5, x0, 1 |
| 93 | + |
| 94 | + /* Each iteration calculates the modular addition of 8 coefficients. */ |
| 95 | + loopi 32, 4 |
| 96 | + /* Load 8 coefficients of a(X) and b(X) into w0 and w1. */ |
| 97 | + bn.lid x0, 0(x2++) |
| 98 | + bn.lid x5, 0(x3++) |
| 99 | + |
| 100 | + /* Execute the vectorized modular addition. */ |
| 101 | + bn.addvm.8S w0, w0, w1 |
| 102 | + |
| 103 | + /* Store the result back to DMEM. */ |
| 104 | + bn.sid x0, 0(x4++) |
| 105 | + /* End of loop */ |
| 106 | + |
| 107 | + /* Restore clobbered general-purpose registers. */ |
| 108 | + .irp reg, x5, x4, x3, x2 |
| 109 | + addi x31, x31, -4 |
| 110 | + lw \reg, 0(x31) |
| 111 | + .endr |
| 112 | + |
| 113 | + ret |
| 114 | + |
| 115 | +/** |
| 116 | + * Modular subtraction of two polynomials a(X) and b(X) over |
| 117 | + * Z_q[X] / (X^256 + 1). |
| 118 | + * |
| 119 | + * Both a and b are assumed to be stored in 1024-byte (256 32-bit coefficient |
| 120 | + * slots) regions in DMEM. Depending on whether {x2, x3} == x4, this routine is |
| 121 | + * either in-place or not. |
| 122 | + * |
| 123 | + * The caller must ensure that the modulus q has been correctly prepared (see |
| 124 | + * the `MOD` register and usage of the `bn.{add,sub,mul}vm` instructions) prior |
| 125 | + * to invoking this routine. |
| 126 | + * |
| 127 | + * @param[in] x2: DMEM address of the polynomial a(X). |
| 128 | + * @param[in] x3: DMEM address of the polynomial b(X). |
| 129 | + * @param[in] x4: DMEM address of the result a(X) - b(X) mod q. |
| 130 | + */ |
| 131 | +poly_sub: |
| 132 | + /* Push clobbered general-purpose registers onto the stack. */ |
| 133 | + .irp reg, x2, x3, x4, x5 |
| 134 | + sw \reg, 0(x31) |
| 135 | + addi x31, x31, 4 |
| 136 | + .endr |
| 137 | + |
| 138 | + /* WDR pointer for the coefficients of b(X). */ |
| 139 | + addi x5, x0, 1 |
| 140 | + |
| 141 | + /* Each iteration calculates the modular addition of 8 coefficients. */ |
| 142 | + loopi 32, 4 |
| 143 | + /* Load 8 coefficients of a(X) and b(X) into w0 and w1. */ |
| 144 | + bn.lid x0, 0(x2++) |
| 145 | + bn.lid x5, 0(x3++) |
| 146 | + |
| 147 | + /* Execute the vectorized modular subtraction. */ |
| 148 | + bn.subvm.8S w0, w0, w1 |
| 149 | + |
| 150 | + /* Store the result back to DMEM. */ |
| 151 | + bn.sid x0, 0(x4++) |
| 152 | + /* End of loop */ |
| 153 | + |
| 154 | + /* Restore clobbered general-purpose registers. */ |
| 155 | + .irp reg, x5, x4, x3, x2 |
| 156 | + addi x31, x31, -4 |
| 157 | + lw \reg, 0(x31) |
| 158 | + .endr |
| 159 | + |
| 160 | + ret |
0 commit comments