mirror of
https://github.com/emmansun/gmsm.git
synced 2025-05-11 03:26:17 +08:00
Updated SM3性能优化 (markdown)
Sun Yimin
parent
80dd222342
commit
22d8920487
88
SM3性能优化.md
88
SM3性能优化.md
@ -1,20 +1,23 @@
|
||||
最近对SM3的性能进行了优化，主要包括：
|
||||
|
||||
* 纯golang版本，减少W，W'预计算；避免使用条件判断。
|
||||
* 三月初实现了针对AMD64架构的ASM版本。
|
||||
|
||||
下一步，看看能否实现使用AVX2指令集进行优化。
|
||||
|
||||
# SHA256 SIMD Execution
|
||||
|
||||
下面是SHA256 message scheduler SIMD实现，四轮算出下一个4个DWORDs.
|
||||
|
||||
// Wt = SIGMA1(Wt-2) + Wt-7 + SIGMA0(Wt-15) + Wt-16; for 16 <= t <= 63
|
||||
// SIGMA0(x) = ROTR(7,x) XOR ROTR(18,x) XOR SHR(3,x)
|
||||
// SIGMA1(x) = ROTR(17,x) XOR ROTR(19,x) XOR SHR(10,x)
|
||||
|
||||
// Transpose data into high/low parts
|
||||
VPERM2I128 $0x20, XTMP2, XTMP0, XDWORD0 // w3, w2, w1, w0
|
||||
VPERM2I128 $0x31, XTMP2, XTMP0, XDWORD1 // w7, w6, w5, w4
|
||||
VPERM2I128 $0x20, XTMP3, XTMP1, XDWORD2 // w11, w10, w9, w8
|
||||
VPERM2I128 $0x31, XTMP3, XTMP1, XDWORD3 // w15, w14, w13, w12
|
||||
|
||||
// Transpose data into high/low parts
|
||||
VPERM2I128 $0x20, XTMP2, XTMP0, XDWORD0 // w3, w2, w1, w0
|
||||
VPERM2I128 $0x31, XTMP2, XTMP0, XDWORD1 // w7, w6, w5, w4
|
||||
VPERM2I128 $0x20, XTMP3, XTMP1, XDWORD2 // w11, w10, w9, w8
|
||||
VPERM2I128 $0x31, XTMP3, XTMP1, XDWORD3 // w15, w14, w13, w12
|
||||
|
||||
|
||||
VPALIGNR $4, XDWORD2, XDWORD3, XTMP0; \ // XTMP0 = W[-7] = {w12,w11,w10,w9}
|
||||
@ -24,7 +27,7 @@
|
||||
VPSLLD $(32-7), XTMP1, XTMP3; \ // XTMP3 = W[-15] << 25 = {w4<<25,w3<<25,w2<<25,w1<<25}
|
||||
VPOR XTMP2, XTMP3, XTMP3; \ // XTMP3 = W[-15] ror 7 = {ROTR(7,w4),ROTR(7,w3),ROTR(7,w2),ROTR(7,w1)}
|
||||
VPSRLD $18, XTMP1, XTMP2;
|
||||
|
||||
|
||||
VPSRLD $3, XTMP1, XTMP4; \ // XTMP4 = W[-15] >> 3
|
||||
VPSLLD $(32-18), XTMP1, XTMP1; \ // why no VPOR?
|
||||
VPXOR XTMP1, XTMP3, XTMP3; \
|
||||
@ -33,7 +36,7 @@
|
||||
VPSHUFD $0xFA, XDWORD3, XTMP2; \ // XTMP2 = W[-2] {BBAA} {w15,w15,w14,w14}
|
||||
VPADDD XTMP1, XTMP0, XTMP0; \ // XTMP0 = W[-16] + W[-7] + s0
|
||||
VPSRLD $10, XTMP2, XTMP4 // XTMP4 = W[-2] >> 10 {BBAA}
|
||||
|
||||
|
||||
VPSRLQ $19, XTMP2, XTMP3; \ // XTMP3 = W[-2] ror 19 {xBxA}
|
||||
VPSRLQ $17, XTMP2, XTMP2; \ // XTMP2 = W[-2] ror 17 {xBxA}
|
||||
VPXOR XTMP3, XTMP2, XTMP2; \
|
||||
@ -41,7 +44,7 @@
|
||||
VPSHUFB shuff_00BA<>(SB), XTMP4, XTMP4;\ // XTMP4 = s1 {00BA}
|
||||
VPADDD XTMP4, XTMP0, XTMP0; \ // XTMP0 = {..., ..., W[1], W[0]}
|
||||
VPSHUFD $0x50, XTMP0, XTMP2; \ // XTMP2 = W[-2] {DDCC}
|
||||
|
||||
|
||||
VPSRLD $10, XTMP2, XTMP5; \ // XTMP5 = W[-2] >> 10 {DDCC}
|
||||
VPSRLQ $19, XTMP2, XTMP3; \ // XTMP3 = W[-2] ror 19 {xDxC}
|
||||
VPSRLQ $17, XTMP2, XTMP2; \ // XTMP2 = W[-2] ror 17 {xDxC}
|
||||
@ -51,21 +54,24 @@
|
||||
VPADDD XTMP0, XTMP5, XDWORD0; \ // XDWORD0 = {W[3], W[2], W[1], W[0]}
|
||||
|
||||
SM3的message scheduler有两个显著差别：
|
||||
|
||||
1. Wi+3依赖Wi，所以也和SHA256类似，不能一次生成四个DWORDs，但和SHA256不完全一样。
|
||||
1. 比SHA256需要多算4个DWORDs。
|
||||
|
||||
Intel 指令参考：
|
||||
https://software.intel.com/sites/landingpage/IntrinsicsGuide/
|
||||
|
||||
SM3的第一版，比SHA256复杂：
|
||||
# SM3 SIMD Execution
|
||||
|
||||
SM3的第一版，比SHA256复杂，不知道有没有继续优化的空间。
|
||||
|
||||
// Wj ← P1(Wj−16 ⊕ Wj−9 ⊕ (Wj−3 ≪ 15)) ⊕ (Wj−13 ≪ 7) ⊕ Wj−6
|
||||
// Transpose data into high/low parts
|
||||
VPERM2I128 $0x20, XTMP2, XTMP0, XDWORD0 // w3, w2, w1, w0
|
||||
VPERM2I128 $0x31, XTMP2, XTMP0, XDWORD1 // w7, w6, w5, w4
|
||||
VPERM2I128 $0x20, XTMP3, XTMP1, XDWORD2 // w11, w10, w9, w8
|
||||
VPERM2I128 $0x31, XTMP3, XTMP1, XDWORD3 // w15, w14, w13, w12
|
||||
|
||||
// Transpose data into high/low parts
|
||||
VPERM2I128 $0x20, XTMP2, XTMP0, XDWORD0 // w3, w2, w1, w0
|
||||
VPERM2I128 $0x31, XTMP2, XTMP0, XDWORD1 // w7, w6, w5, w4
|
||||
VPERM2I128 $0x20, XTMP3, XTMP1, XDWORD2 // w11, w10, w9, w8
|
||||
VPERM2I128 $0x31, XTMP3, XTMP1, XDWORD3 // w15, w14, w13, w12
|
||||
|
||||
VPALIGNR $12, XDWORD0, XDWORD1, XTMP0; \ // XTMP0 = W[-13] = {w6,w5,w4,w3}
|
||||
VPSLLD $7, XTMP0, XTMP1; \
|
||||
VPSRLD $(32-7), XTMP0, XTMP0; \
|
||||
@ -75,7 +81,7 @@ SM3的第一版，比SHA256复杂：
|
||||
VPALIGNR $12, XDWORD1, XDWORD2, XTMP1; \ // XTMP1 = W[-9] = {w10,w9,w8,w7}
|
||||
VPXOR XDWORD0, XTMP1, XTMP1; \ // XTMP1 = W[-9] XOR W[-16]
|
||||
VPSHUFD $0xA5, XDWORD3, XTMP2; \ // XTMP2 = W[-3] {BBAA} {w14,w14,w13,w13}
|
||||
|
||||
|
||||
VPSLLQ $15, XTMP2, XTMP2; \ // XTMP2 = W[-3] rol 15 {xBxA}
|
||||
VPSHUFB shuff_00BA<>(SB), XTMP2, XTMP2;\ // XTMP2 = W[-3] rol 15 {00BA}
|
||||
VPXOR XTMP1, XTMP2, XTMP2; \ // XTMP2 = W[-9] XOR W[-16] XOR (W[-3] rol 15) {xxBA}
|
||||
@ -85,7 +91,7 @@ SM3的第一版，比SHA256复杂：
|
||||
VPXOR XTMP2, XTMP4, XTMP4; \ // XTMP4 = XTMP2 XOR (XTMP2 rol 15 {xxBA})
|
||||
VPSLLD $23, XTMP2, XTMP3; \
|
||||
VPSRLD $(32-23), XTMP2, XTMP5; \
|
||||
|
||||
|
||||
VPOR XTMP3, XTMP5, XTMP5; \ //XTMP5 = XTMP2 rol 23 {xxBA}
|
||||
VPXOR XTMP4, XTMP5, XTMP4; \ // XTMP4 = XTMP2 XOR (XTMP2 rol 15 {xxBA}) XOR (XTMP2 rol 23 {xxBA})
|
||||
VPXOR XTMP4, XTMP0, XTMP2; \ // XTMP2 = {..., ..., W[1], W[0]}
|
||||
@ -95,7 +101,7 @@ SM3的第一版，比SHA256复杂：
|
||||
VPSHUFB shuff_DC00<>(SB), XTMP4, XTMP4;\ // XTMP4 = W[-3] rol 15 {DC00}
|
||||
VPXOR XTMP1, XTMP4, XTMP4; \ // XTMP4 = W[-9] XOR W[-16] XOR (W[-3] rol 15) {DCxx}
|
||||
VPSLLD $15, XTMP4, XTMP5; \
|
||||
|
||||
|
||||
VPSRLD $(32-15), XTMP4, XTMP3; \
|
||||
VPOR XTMP3, XTMP5, XTMP3; \ // XTMP3 = XTMP4 rol 15 {DCxx}
|
||||
VPXOR XTMP3, XTMP4, XTMP3; \ // XTMP3 = XTMP4 XOR (XTMP4 rol 15 {DCxx})
|
||||
@ -107,3 +113,47 @@ SM3的第一版，比SHA256复杂：
|
||||
VPALIGNR $8, XTMP1, XTMP2, XTMP3; \ // XTMP3 = {W[1], W[0], W[3], W[2]}
|
||||
VPSHUFD $0x4E, XTMP3, XDWORD0; \ // XDWORD0 = {W[3], W[2], W[1], W[0]}
|
||||
|
||||
由于要算**52**个DWORDs，所以
|
||||
|
||||
| Ingteger Execution | SIMD Execution |
|
||||
| ---------------------- | ---------------------------- |
|
||||
| Execute Rounds 0...15 | Compute Message DWORDs 16…31 |
|
||||
| Execute Rounds 16...31 | Compute Message DWORDs 32…47 |
|
||||
| Execute Rounds 32...47 | Compute Message DWORDs 48…63 |
|
||||
| Execute Rounds 48...63 | Compute Message DWORDs 64…67 |
|
||||
|
||||
# 其它SIMD Execution
|
||||
|
||||
SHA 256的64轮压缩计算中，对Kt + Wt 进行了并行计算
|
||||
|
||||
VPADDD 0*32(TBL)(SRND*1), XDWORD0, XFER
|
||||
VMOVDQU XFER, (_XFER + 0*32)(SP)(SRND*1)
|
||||
|
||||
SM3可以对Wt XOR Wt+4进行并行计算，
|
||||
|
||||
VPXOR XDWORD0, XDWORD1, XFER
|
||||
VMOVDQU XFER, (_XFER + 0*32)(SP)(SRND*1)
|
||||
|
||||
但其依然需要Wt, 如何传入和使用Wt呢？难道把Wt和Wt'一起放到栈，譬如W0,W1,W2,W3,W0',W1',W2',W3'，
|
||||
|
||||
VMOVDQU XDWORD0, (_XFER + 0*32)(SP)(SRND*1)
|
||||
VPXOR XDWORD0, XDWORD1, XFER
|
||||
VMOVDQU XFER, (_XFER + 1*32)(SP)(SRND*1)
|
||||
|
||||
没有大改变SHA 256 AVX2的主流程，但是栈的处理需要改变。
|
||||
|
||||
# T常量处理
|
||||
|
||||
这个比较麻烦，要是作为参数传入，那就没法和SHA 256一样循环处理，必须把所有压缩轮都列出来。
|
||||
|
||||
# RORXL
|
||||
|
||||
这是循环右移，SM3使用循环左移，没看到有ROLXL这样的指令，应该能传入负数来实现，
|
||||
|
||||
|
||||
|
||||
实在不行只能用MOVL + ROLL来处理，但性能就没啥提高了。
|
||||
|
||||
# 主流程
|
||||
|
||||
如果只有(只剩)一个block (64字节)，则只处理这个block，否则2个block(128字节)处理，两个block并行处理message scheduler。
|
||||
Loading…
x
Reference in New Issue
Block a user