Add ABI tests for x86_64-mont5.pl. Fix some missing CFI bits. Change-Id: I42114527f0ef8e03079d37a9f466d64a63a313f5 Reviewed-on: https://boringssl-review.googlesource.com/c/34864 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/fipsmodule/bn/asm/x86_64-mont5.pl b/crypto/fipsmodule/bn/asm/x86_64-mont5.pl index 442e696..abcfe6a 100755 --- a/crypto/fipsmodule/bn/asm/x86_64-mont5.pl +++ b/crypto/fipsmodule/bn/asm/x86_64-mont5.pl
@@ -566,6 +566,7 @@ .type mul4x_internal,\@abi-omnipotent .align 32 mul4x_internal: +.cfi_startproc shl \$5,$num # $num was in bytes movd `($win64?56:8)`(%rax),%xmm5 # load 7th argument, index lea .Linc(%rip),%rax @@ -1060,6 +1061,7 @@ ___ } $code.=<<___; +.cfi_endproc .size mul4x_internal,.-mul4x_internal ___ }}} @@ -1226,6 +1228,7 @@ .align 32 bn_sqr8x_internal: __bn_sqr8x_internal: +.cfi_startproc ############################################################## # Squaring part: # @@ -2017,6 +2020,7 @@ cmp %rdx,$tptr # end of t[]? jb .L8x_reduction_loop ret +.cfi_endproc .size bn_sqr8x_internal,.-bn_sqr8x_internal ___ } @@ -2029,6 +2033,7 @@ .type __bn_post4x_internal,\@abi-omnipotent .align 32 __bn_post4x_internal: +.cfi_startproc mov 8*0($nptr),%r12 lea (%rdi,$num),$tptr # %rdi was $tptr above mov $num,%rcx @@ -2079,6 +2084,7 @@ mov $num,%r10 # prepare for back-to-back call neg $num # restore $num ret +.cfi_endproc .size __bn_post4x_internal,.-__bn_post4x_internal ___ } @@ -2088,10 +2094,12 @@ .type bn_from_montgomery,\@abi-omnipotent .align 32 bn_from_montgomery: +.cfi_startproc testl \$7,`($win64?"48(%rsp)":"%r9d")` jz bn_from_mont8x xor %eax,%eax ret +.cfi_endproc .size bn_from_montgomery,.-bn_from_montgomery .type bn_from_mont8x,\@function,6 @@ -2388,6 +2396,7 @@ .type mulx4x_internal,\@abi-omnipotent .align 32 mulx4x_internal: +.cfi_startproc mov $num,8(%rsp) # save -$num (it was in bytes) mov $num,%r10 neg $num # restore $num @@ -2738,6 +2747,7 @@ mov 8*2(%rbp),%r14 mov 8*3(%rbp),%r15 jmp .Lsqrx4x_sub_entry # common post-condition +.cfi_endproc .size mulx4x_internal,.-mulx4x_internal ___ } { @@ -3542,7 +3552,9 @@ my ($rptr,$nptr)=("%rdx","%rbp"); $code.=<<___; .align 32 +.type __bn_postx4x_internal,\@abi-omnipotent __bn_postx4x_internal: +.cfi_startproc mov 8*0($nptr),%r12 mov %rcx,%r10 # -$num mov %rcx,%r9 # -$num @@ -3590,6 +3602,7 @@ neg %r9 # restore $num ret +.cfi_endproc .size __bn_postx4x_internal,.-__bn_postx4x_internal ___ } @@ -3606,6 +3619,7 @@ .type bn_scatter5,\@abi-omnipotent .align 16 bn_scatter5: +.cfi_startproc cmp \$0, $num jz .Lscatter_epilogue lea ($tbl,$idx,8),$tbl @@ -3618,15 +3632,18 @@ jnz .Lscatter .Lscatter_epilogue: ret +.cfi_endproc .size bn_scatter5,.-bn_scatter5 .globl bn_gather5 .type bn_gather5,\@abi-omnipotent .align 32 bn_gather5: +.cfi_startproc .LSEH_begin_bn_gather5: # Win64 thing, but harmless in other cases # I can't trust assembler to use specific encoding:-( .byte 0x4c,0x8d,0x14,0x24 #lea (%rsp),%r10 +.cfi_def_cfa_register %r10 .byte 0x48,0x81,0xec,0x08,0x01,0x00,0x00 #sub $0x108,%rsp lea .Linc(%rip),%rax and \$-16,%rsp # shouldn't be formally required @@ -3707,8 +3724,10 @@ jnz .Lgather lea (%r10),%rsp +.cfi_def_cfa_register %rsp ret .LSEH_end_bn_gather5: +.cfi_endproc .size bn_gather5,.-bn_gather5 ___ }
diff --git a/crypto/fipsmodule/bn/bn_test.cc b/crypto/fipsmodule/bn/bn_test.cc index b7d98da..a61d6e1 100644 --- a/crypto/fipsmodule/bn/bn_test.cc +++ b/crypto/fipsmodule/bn/bn_test.cc
@@ -2405,6 +2405,55 @@ } #endif // OPENSSL_BN_ASM_MONT && SUPPORTS_ABI_TEST +#if defined(OPENSSL_BN_ASM_MONT5) && defined(SUPPORTS_ABI_TEST) +TEST_F(BNTest, BNMulMont5ABI) { + for (size_t words : {4, 5, 6, 7, 8, 16, 32}) { + SCOPED_TRACE(words); + + bssl::UniquePtr<BIGNUM> m(BN_new()); + ASSERT_TRUE(m); + ASSERT_TRUE(BN_set_bit(m.get(), 0)); + ASSERT_TRUE(BN_set_bit(m.get(), words * BN_BITS2 - 1)); + bssl::UniquePtr<BN_MONT_CTX> mont( + BN_MONT_CTX_new_for_modulus(m.get(), ctx())); + ASSERT_TRUE(mont); + + std::vector<BN_ULONG> r(words), a(words), b(words), table(words * 32); + a[0] = 1; + b[0] = 42; + + bn_mul_mont(r.data(), a.data(), b.data(), mont->N.d, mont->n0, words); + CHECK_ABI(bn_scatter5, r.data(), words, table.data(), 13); + for (size_t i = 0; i < 32; i++) { + bn_mul_mont(r.data(), a.data(), b.data(), mont->N.d, mont->n0, words); + bn_scatter5(r.data(), words, table.data(), i); + } + CHECK_ABI(bn_gather5, r.data(), words, table.data(), 13); + + CHECK_ABI(bn_mul_mont_gather5, r.data(), r.data(), table.data(), m->d, + mont->n0, words, 13); + CHECK_ABI(bn_mul_mont_gather5, r.data(), a.data(), table.data(), m->d, + mont->n0, words, 13); + + if (words % 8 == 0) { + CHECK_ABI(bn_power5, r.data(), r.data(), table.data(), m->d, mont->n0, + words, 13); + CHECK_ABI(bn_power5, r.data(), a.data(), table.data(), m->d, mont->n0, + words, 13); + EXPECT_EQ(1, CHECK_ABI(bn_from_montgomery, r.data(), r.data(), nullptr, + m->d, mont->n0, words)); + EXPECT_EQ(1, CHECK_ABI(bn_from_montgomery, r.data(), a.data(), nullptr, + m->d, mont->n0, words)); + } else { + EXPECT_EQ(0, CHECK_ABI(bn_from_montgomery, r.data(), r.data(), nullptr, + m->d, mont->n0, words)); + EXPECT_EQ(0, CHECK_ABI(bn_from_montgomery, r.data(), a.data(), nullptr, + m->d, mont->n0, words)); + } + } +} +#endif // OPENSSL_BN_ASM_MONT5 && SUPPORTS_ABI_TEST + #if defined(RSAZ_ENABLED) && defined(SUPPORTS_ABI_TEST) TEST_F(BNTest, RSAZABI) { if (!rsaz_avx2_capable()) {
diff --git a/crypto/fipsmodule/bn/exponentiation.c b/crypto/fipsmodule/bn/exponentiation.c index 29e7877..9e40811 100644 --- a/crypto/fipsmodule/bn/exponentiation.c +++ b/crypto/fipsmodule/bn/exponentiation.c
@@ -120,22 +120,6 @@ #include "rsaz_exp.h" -#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) -#define OPENSSL_BN_ASM_MONT5 - -void bn_mul_mont_gather5(BN_ULONG *rp, const BN_ULONG *ap, - const BN_ULONG *table, const BN_ULONG *np, - const BN_ULONG *n0, int num, int power); -void bn_scatter5(const BN_ULONG *inp, size_t num, BN_ULONG *table, - size_t power); -void bn_gather5(BN_ULONG *out, size_t num, BN_ULONG *table, size_t power); -void bn_power5(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *table, - const BN_ULONG *np, const BN_ULONG *n0, int num, int power); -int bn_from_montgomery(BN_ULONG *rp, const BN_ULONG *ap, - const BN_ULONG *not_used, const BN_ULONG *np, - const BN_ULONG *n0, int num); -#endif - int BN_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p, BN_CTX *ctx) { int i, bits, ret = 0; BIGNUM *v, *rr;
diff --git a/crypto/fipsmodule/bn/internal.h b/crypto/fipsmodule/bn/internal.h index 752f0dc..c1e60fe 100644 --- a/crypto/fipsmodule/bn/internal.h +++ b/crypto/fipsmodule/bn/internal.h
@@ -357,6 +357,44 @@ const BN_ULONG *np, const BN_ULONG *n0, size_t num); #endif +#if !defined(OPENSSL_NO_ASM) && defined(OPENSSL_X86_64) +#define OPENSSL_BN_ASM_MONT5 + +// bn_mul_mont_gather5 multiples loads index |power| of |table|, multiplies it +// by |ap| modulo |np|, and stores the result in |rp|. The values are |num| +// words long and represented in Montgomery form. |n0| is a pointer to the +// corresponding field in |BN_MONT_CTX|. +void bn_mul_mont_gather5(BN_ULONG *rp, const BN_ULONG *ap, + const BN_ULONG *table, const BN_ULONG *np, + const BN_ULONG *n0, int num, int power); + +// bn_scatter5 stores |inp| to index |power| of |table|. |inp| and each entry of +// |table| are |num| words long. |power| must be less than 32. |table| must be +// 32*|num| words long. +void bn_scatter5(const BN_ULONG *inp, size_t num, BN_ULONG *table, + size_t power); + +// bn_gather5 loads index |power| of |table| and stores it in |out|. |out| and +// each entry of |table| are |num| words long. |power| must be less than 32. +void bn_gather5(BN_ULONG *out, size_t num, BN_ULONG *table, size_t power); + +// bn_power5 squares |ap| five times and multiplies it by the value stored at +// index |power| of |table|, modulo |np|. It stores the result in |rp|. The +// values are |num| words long and represented in Montgomery form. |n0| is a +// pointer to the corresponding field in |BN_MONT_CTX|. |num| must be divisible +// by 8. +void bn_power5(BN_ULONG *rp, const BN_ULONG *ap, const BN_ULONG *table, + const BN_ULONG *np, const BN_ULONG *n0, int num, int power); + +// bn_from_montgomery converts |ap| from Montgomery form modulo |np| and writes +// the result in |rp|, each of which is |num| words long. It returns one on +// success and zero if it cannot handle inputs of length |num|. |n0| is a +// pointer to the corresponding field in |BN_MONT_CTX|. +int bn_from_montgomery(BN_ULONG *rp, const BN_ULONG *ap, + const BN_ULONG *not_used, const BN_ULONG *np, + const BN_ULONG *n0, int num); +#endif // !OPENSSL_NO_ASM && OPENSSL_X86_64 + uint64_t bn_mont_n0(const BIGNUM *n); // bn_mod_exp_base_2_consttime calculates r = 2**p (mod n). |p| must be larger