@ttsc/win32-arm64 0.33.1 → 0.34.0

package/bin/go/src/crypto/internal/fips140/aes/gcm/_asm/gcm/gcm_amd64_asm.go

@@ -42,7 +42,7 @@ var (
 )
 
 func main() {
-	Package("crypto/aes")
+	Package("crypto/internal/fips140/aes/gcm")
 	ConstraintExpr("!purego")
 
 	gcmAesFinish()
@@ -1031,17 +1031,29 @@ func encLast4(ptx, ptxLen, aluCTR, aluTMP GPPhysical) {
 	PXOR(B0, B0)
 }
 
+// loadLoop loads count bytes from src into the low bytes of dst, one byte at a
+// time, to avoid reading past the end of a partial block. dst must be zeroed
+// and src must point at the last byte to load. Bytes are read in increasing
+// memory order into increasing byte positions, like a MOVOU of a full block,
+// leaving the upper 16-count bytes of dst zero. It clobbers src and count.
+func loadLoop(label string, dst VecPhysical, src, count Register) {
+	Label(label)
+	PSLLDQ(Imm(1), dst)
+	PINSRB(Imm(0), Mem{Base: src}, dst)
+	LEAQ(Mem{Base: src}.Offset(-1), src)
+	DECQ(count)
+	JNE(LabelRef(label))
+}
+
 func ptxLoadLoop(pTbl, ctx, ptx, ptxLen GPPhysical) {
-	Label("ptxLoadLoop")
-	PSLLDQ(Imm(1), B0)
-	PINSRB(Imm(0), Mem{Base: ptx}, B0)
-	LEAQ(Mem{Base: ptx}.Offset(-1), ptx)
-	DECQ(ptxLen)
-	JNE(LabelRef("ptxLoadLoop"))
+	tailLen := GP64()
+	MOVQ(ptxLen, tailLen)
+	loadLoop("ptxLoadLoop", B0, ptx, ptxLen)
 
 	PXOR(T0, B0)
 	PAND(T1, B0)
-	MOVOU(B0, Mem{Base: ctx})
+	MOVOU(B0, T1)
+	storeLoop("ctxStoreLoop", T1, ctx, tailLen)
 
 	PSHUFB(BSWAP, B0)
 	PXOR(ACC0, B0)
@@ -1151,7 +1163,7 @@ func gcmAesDec() {
 	decLast2(ctx, ptx)
 	gcmAesDecTail(pTbl, ctx, ks, ptxLen, aluCTR, aluTMP, aluK, NR)
 	decLast3()
-	ptxStoreLoop(ptx, ptxLen)
+	storeLoop("ptxStoreLoop", B0, ptx, ptxLen)
 	gcmAesDecDone(tPtr)
 }
 
@@ -1399,21 +1411,11 @@ func gcmAesDecTail(pTbl, ctx, ks, ptxLen, aluCTR, aluTMP, aluK, NR GPPhysical) {
 	TESTQ(ptxLen, ptxLen)
 	JE(LabelRef("gcmAesDecDone"))
 
-	// Hack to get Avo to emit:
-	// 	MOVQ ptxLen, aluTMP
-	Instruction(&ir.Instruction{Opcode: "MOVQ", Operands: []Op{ptxLen, aluTMP}})
-	// Hack to get Avo to emit:
-	// 	SHLQ $4, aluTMP
-	Instruction(&ir.Instruction{Opcode: "SHLQ", Operands: []Op{Imm(4), aluTMP}})
-
-	andMask := andMask_DATA()
-	// Hack to get Avo to emit:
-	// 	LEAQ andMask<>(SB), aluCTR
-	Instruction(&ir.Instruction{Opcode: "LEAQ", Operands: []Op{andMask, aluCTR}})
-	MOVOU(Mem{Base: aluCTR, Index: aluTMP, Scale: 1}.Offset(-16), T1)
-
-	MOVOU(Mem{Base: ctx}, B0)
-	PAND(T1, B0)
+	tailLen := GP64()
+	MOVQ(ptxLen, tailLen)
+	LEAQ(Mem{Base: ctx, Index: ptxLen, Scale: 1}.Offset(-1), ctx)
+	PXOR(B0, B0)
+	loadLoop("ctxLoadLoop", B0, ctx, tailLen)
 
 	MOVOU(B0, T1)
 	PSHUFB(BSWAP, B0)
@@ -1474,14 +1476,16 @@ func decLast3() {
 	PXOR(T1, B0)
 }
 
-func ptxStoreLoop(ptx, ptxLen GPPhysical) {
-	Label("ptxStoreLoop")
-	PEXTRB(Imm(0), B0, Mem{Base: ptx})
-	PSRLDQ(Imm(1), B0)
-	LEAQ(Mem{Base: ptx}.Offset(1), ptx)
-	DECQ(ptxLen)
-
-	JNE(LabelRef("ptxStoreLoop"))
+// storeLoop stores the low count bytes of src at dst, one byte at a time, to
+// avoid writing past the end of a partial block. It clobbers src, dst, and
+// count.
+func storeLoop(label string, src VecPhysical, dst, count Register) {
+	Label(label)
+	PEXTRB(Imm(0), src, Mem{Base: dst})
+	PSRLDQ(Imm(1), src)
+	LEAQ(Mem{Base: dst}.Offset(1), dst)
+	DECQ(count)
+	JNE(LabelRef(label))
 }
 
 func gcmAesDecDone(tPtr GPPhysical) {

package/bin/go/src/crypto/internal/fips140/aes/gcm/_asm/gcm/go.mod

@@ -1,11 +1,11 @@
-module crypto/aes/_asm/gcm
+module crypto/internal/fips140/aes/gcm/_asm/gcm
 
-go 1.24
+go 1.25
 
 require github.com/mmcloughlin/avo v0.6.0
 
 require (
-	golang.org/x/mod v0.20.0 // indirect
-	golang.org/x/sync v0.8.0 // indirect
-	golang.org/x/tools v0.24.0 // indirect
+	golang.org/x/mod v0.29.0 // indirect
+	golang.org/x/sync v0.17.0 // indirect
+	golang.org/x/tools v0.38.0 // indirect
 )

package/bin/go/src/crypto/internal/fips140/aes/gcm/_asm/gcm/go.sum

@@ -1,8 +1,10 @@
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/mmcloughlin/avo v0.6.0 h1:QH6FU8SKoTLaVs80GA8TJuLNkUYl4VokHKlPhVDg4YY=
 github.com/mmcloughlin/avo v0.6.0/go.mod h1:8CoAGaCSYXtCPR+8y18Y9aB/kxb8JSS6FRI7mSkvD+8=
-golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
-golang.org/x/mod v0.20.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/sync v0.8.0 h1:3NFvSEYkUoMifnESzZl15y791HH1qU2xm6eCJU5ZPXQ=
-golang.org/x/sync v0.8.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/tools v0.24.0 h1:J1shsA93PJUEVaUSaay7UXAyE8aimq3GW0pjlolpa24=
-golang.org/x/tools v0.24.0/go.mod h1:YhNqVBIfWHdzvTLs0d8LCuMhkKUgSUKldakyV7W/WDQ=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
+golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug=
+golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=

package/bin/go/src/crypto/internal/fips140/aes/gcm/gcm_amd64.s

@@ -1,4 +1,4 @@
-// Code generated by command: go run gcm_amd64_asm.go -out ../../gcm_amd64.s -pkg aes. DO NOT EDIT.
+// Code generated by command: go run gcm_amd64_asm.go -out ../../gcm_amd64.s. DO NOT EDIT.
 
 //go:build !purego
 
@@ -1239,16 +1239,24 @@ encLast4:
 	LEAQ       andMask<>+0(SB), R10
 	MOVOU      -16(R10)(R11*1), X12
 	PXOR       X0, X0
+	MOVQ       R9, AX
 
 ptxLoadLoop:
-	PSLLDQ    $0x01, X0
-	PINSRB    $0x00, (SI), X0
-	LEAQ      -1(SI), SI
-	DECQ      R9
-	JNE       ptxLoadLoop
-	PXOR      X11, X0
-	PAND      X12, X0
-	MOVOU     X0, (DX)
+	PSLLDQ $0x01, X0
+	PINSRB $0x00, (SI), X0
+	LEAQ   -1(SI), SI
+	DECQ   R9
+	JNE    ptxLoadLoop
+	PXOR   X11, X0
+	PAND   X12, X0
+	MOVOU  X0, X12
+
+ctxStoreLoop:
+	PEXTRB    $0x00, X12, (DX)
+	PSRLDQ    $0x01, X12
+	LEAQ      1(DX), DX
+	DECQ      AX
+	JNE       ctxStoreLoop
 	PSHUFB    X15, X0
 	PXOR      X8, X0
 	MOVOU     X13, X8
@@ -1801,14 +1809,18 @@ decLast2:
 	JMP        gcmAesDecSinglesLoop
 
 gcmAesDecTail:
-	TESTQ     R9, R9
-	JE        gcmAesDecDone
-	MOVQ      R9, R11
-	SHLQ      $0x04, R11
-	LEAQ      andMask<>+0(SB), R10
-	MOVOU     -16(R10)(R11*1), X12
-	MOVOU     (DX), X0
-	PAND      X12, X0
+	TESTQ R9, R9
+	JE    gcmAesDecDone
+	MOVQ  R9, CX
+	LEAQ  -1(DX)(R9*1), DX
+	PXOR  X0, X0
+
+ctxLoadLoop:
+	PSLLDQ    $0x01, X0
+	PINSRB    $0x00, (DX), X0
+	LEAQ      -1(DX), DX
+	DECQ      CX
+	JNE       ctxLoadLoop
 	MOVOU     X0, X12
 	PSHUFB    X15, X0
 	PXOR      X8, X0

package/bin/go/src/crypto/internal/fips140/aes/gcm/gcm_arm64.s

@@ -378,9 +378,6 @@ TEXT ·gcmAesEnc(SB),NOSPLIT,$0
 #define ks R4
 #define tPtr R5
 #define srcPtrLen R6
-#define aluCTR R7
-#define aluTMP R8
-#define aluK R9
 #define NR R10
 #define H0 R11
 #define H1 R12
@@ -415,6 +412,66 @@ TEXT ·gcmAesEnc(SB),NOSPLIT,$0
 	AESE	K.B16, B6.B16    \
 	AESE	K.B16, B7.B16
 
+// tailLoad reads the srcPtrLen bytes at srcPtr into the low bytes of
+// X, zero-padded, loading 8, 4, 2, and 1 bytes at a time to avoid
+// reading past the end of the source buffer. It also builds in T3 a
+// mask of the bytes within the source length. It clobbers H0 and H1.
+#define tailLoad(X) \
+	VEOR	X.B16, X.B16, X.B16           \
+	VEOR	T3.B16, T3.B16, T3.B16        \
+	MOVD	$-1, H1                       \
+	ADD	srcPtrLen, srcPtr             \
+	TBZ	$3, srcPtrLen, tailLoad4      \
+	MOVD.W	-8(srcPtr), H0                \
+	VMOV	H0, X.D[0]                    \
+	VMOV	H1, T3.D[0]                   \
+tailLoad4: \
+	TBZ	$2, srcPtrLen, tailLoad2      \
+	MOVW.W	-4(srcPtr), H0                \
+	VEXT	$12, X.B16, ZERO.B16, X.B16   \
+	VEXT	$12, T3.B16, ZERO.B16, T3.B16 \
+	VMOV	H0, X.S[0]                    \
+	VMOV	H1, T3.S[0]                   \
+tailLoad2: \
+	TBZ	$1, srcPtrLen, tailLoad1      \
+	MOVH.W	-2(srcPtr), H0                \
+	VEXT	$14, X.B16, ZERO.B16, X.B16   \
+	VEXT	$14, T3.B16, ZERO.B16, T3.B16 \
+	VMOV	H0, X.H[0]                    \
+	VMOV	H1, T3.H[0]                   \
+tailLoad1: \
+	TBZ	$0, srcPtrLen, tailLoad0      \
+	MOVB.W	-1(srcPtr), H0                \
+	VEXT	$15, X.B16, ZERO.B16, X.B16   \
+	VEXT	$15, T3.B16, ZERO.B16, T3.B16 \
+	VMOV	H0, X.B[0]                    \
+	VMOV	H1, T3.B[0]                   \
+tailLoad0:
+
+// tailStore writes the low srcPtrLen bytes of X to dstPtr, storing 8,
+// 4, 2, and 1 bytes at a time to avoid writing past the end of the
+// destination buffer. It clobbers X and H0.
+#define tailStore(X) \
+	TBZ	$3, srcPtrLen, tailStore4  \
+	VMOV	X.D[0], H0                 \
+	MOVD.P	H0, 8(dstPtr)              \
+	VEXT	$8, ZERO.B16, X.B16, X.B16 \
+tailStore4: \
+	TBZ	$2, srcPtrLen, tailStore2  \
+	VMOV	X.S[0], H0                 \
+	MOVW.P	H0, 4(dstPtr)              \
+	VEXT	$4, ZERO.B16, X.B16, X.B16 \
+tailStore2: \
+	TBZ	$1, srcPtrLen, tailStore1  \
+	VMOV	X.H[0], H0                 \
+	MOVH.P	H0, 2(dstPtr)              \
+	VEXT	$2, ZERO.B16, X.B16, X.B16 \
+tailStore1: \
+	TBZ	$0, srcPtrLen, tailStore0  \
+	VMOV	X.B[0], H0                 \
+	MOVB.P	H0, 1(dstPtr)              \
+tailStore0:
+
 	MOVD	productTable+0(FP), pTbl
 	MOVD	dst+8(FP), dstPtr
 	MOVD	src_base+32(FP), srcPtr
@@ -618,9 +675,9 @@ singlesLoop:
 		AESE	B3.B16, B0.B16
 singlesLast:
 		VEOR	T0.B16, B0.B16, B0.B16
-encReduce:
-		VST1.P	[B0.B16], 16(dstPtr)
 
+		VST1.P	[B0.B16], 16(dstPtr)
+encReduce:
 		VREV64	B0.B16, B0.B16
 		VEOR	ACC0.B16, B0.B16, B0.B16
 
@@ -636,40 +693,8 @@ encReduce:
 tail:
 	CBZ	srcPtrLen, done
 
-	VEOR	T0.B16, T0.B16, T0.B16
-	VEOR	T3.B16, T3.B16, T3.B16
-	MOVD	$0, H1
-	SUB	$1, H1
-	ADD	srcPtrLen, srcPtr
-
-	TBZ	$3, srcPtrLen, ld4
-	MOVD.W	-8(srcPtr), H0
-	VMOV	H0, T0.D[0]
-	VMOV	H1, T3.D[0]
-ld4:
-	TBZ	$2, srcPtrLen, ld2
-	MOVW.W	-4(srcPtr), H0
-	VEXT	$12, T0.B16, ZERO.B16, T0.B16
-	VEXT	$12, T3.B16, ZERO.B16, T3.B16
-	VMOV	H0, T0.S[0]
-	VMOV	H1, T3.S[0]
-ld2:
-	TBZ	$1, srcPtrLen, ld1
-	MOVH.W	-2(srcPtr), H0
-	VEXT	$14, T0.B16, ZERO.B16, T0.B16
-	VEXT	$14, T3.B16, ZERO.B16, T3.B16
-	VMOV	H0, T0.H[0]
-	VMOV	H1, T3.H[0]
-ld1:
-	TBZ	$0, srcPtrLen, ld0
-	MOVB.W	-1(srcPtr), H0
-	VEXT	$15, T0.B16, ZERO.B16, T0.B16
-	VEXT	$15, T3.B16, ZERO.B16, T3.B16
-	VMOV	H0, T0.B[0]
-	VMOV	H1, T3.B[0]
-ld0:
+	tailLoad(T0)
 
-	MOVD	ZR, srcPtrLen
 	VEOR	KLAST.B16, T0.B16, T0.B16
 	VREV32	CTR.B16, B0.B16
 
@@ -706,6 +731,13 @@ ld0:
 tailLast:
 	VEOR	T0.B16, B0.B16, B0.B16
 	VAND	T3.B16, B0.B16, B0.B16
+
+	// Store from a copy, since tailStore clobbers its argument and
+	// B0 is the GHASH input of encReduce.
+	VMOV	B0.B16, T0.B16
+	tailStore(T0)
+	MOVD	ZR, srcPtrLen
+
 	B	encReduce
 
 done:
@@ -971,43 +1003,12 @@ tail:
 tailLast:
 	VEOR	KLAST.B16, B0.B16, B0.B16
 
-	// Assuming it is safe to load past dstPtr due to the presence of the tag
-	VLD1	(srcPtr), [B5.B16]
+	tailLoad(B5)
 
 	VEOR	B5.B16, B0.B16, B0.B16
 
-	VEOR	T3.B16, T3.B16, T3.B16
-	MOVD	$0, H1
-	SUB	$1, H1
-
-	TBZ	$3, srcPtrLen, ld4
-	VMOV	B0.D[0], H0
-	MOVD.P	H0, 8(dstPtr)
-	VMOV	H1, T3.D[0]
-	VEXT	$8, ZERO.B16, B0.B16, B0.B16
-ld4:
-	TBZ	$2, srcPtrLen, ld2
-	VMOV	B0.S[0], H0
-	MOVW.P	H0, 4(dstPtr)
-	VEXT	$12, T3.B16, ZERO.B16, T3.B16
-	VMOV	H1, T3.S[0]
-	VEXT	$4, ZERO.B16, B0.B16, B0.B16
-ld2:
-	TBZ	$1, srcPtrLen, ld1
-	VMOV	B0.H[0], H0
-	MOVH.P	H0, 2(dstPtr)
-	VEXT	$14, T3.B16, ZERO.B16, T3.B16
-	VMOV	H1, T3.H[0]
-	VEXT	$2, ZERO.B16, B0.B16, B0.B16
-ld1:
-	TBZ	$0, srcPtrLen, ld0
-	VMOV	B0.B[0], H0
-	MOVB.P	H0, 1(dstPtr)
-	VEXT	$15, T3.B16, ZERO.B16, T3.B16
-	VMOV	H1, T3.B[0]
-ld0:
-
-	VAND	T3.B16, B5.B16, B5.B16
+	tailStore(B0)
+
 	VREV64	B5.B16, B5.B16
 
 	VEOR	ACC0.B16, B5.B16, B5.B16