Skip to content

Commit 9c2d59f

Browse files
mkannwischermkannwischer
committed
SLOTHY: Superoptimize ntt.S for the Neoverse N1
This commit adds the optimized backend dev/aarch64_opt. For now this backend only differs from the clean backend in the NTT which is superoptimized using SLOTHY for the Neoverse N1. For all other files it's a simple copy of the clean backend. A Makefile is added that performs the optimization. CI is adjusted to test both the clean and the opt backend. The first loop of the NTT can be optimized, in one go. The second loop is too large (>350 instructions) and we, hence, use the split heuristic. The autogen script is extended to allow running the optimization through the --slothy flag. Signed-off-by: Matthias J. Kannwischer <[email protected]>
1 parent dcc95d6 commit 9c2d59f

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

48 files changed

+6452
-274
lines changed

‎.github/workflows/base.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -221,9 +221,8 @@ jobs:
221221
backend:
222222
- arg: '--aarch64-clean'
223223
name: Clean
224-
# TODO: add backend option after we have optimized/clean seperation
225-
# - arg: ''
226-
# name: Optimized
224+
- arg: ''
225+
name: Optimized
227226
simplify:
228227
- arg: ''
229228
name: Simplified

‎BIBLIOGRAPHY.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,9 @@ source code and documentation.
158158
* Referenced from:
159159
- [dev/aarch64_clean/src/intt.S](dev/aarch64_clean/src/intt.S)
160160
- [dev/aarch64_clean/src/ntt.S](dev/aarch64_clean/src/ntt.S)
161+
- [dev/aarch64_opt/README.md](dev/aarch64_opt/README.md)
162+
- [dev/aarch64_opt/src/intt.S](dev/aarch64_opt/src/intt.S)
163+
- [dev/aarch64_opt/src/ntt.S](dev/aarch64_opt/src/ntt.S)
161164
- [mldsa/src/native/aarch64/src/intt.S](mldsa/src/native/aarch64/src/intt.S)
162165
- [mldsa/src/native/aarch64/src/ntt.S](mldsa/src/native/aarch64/src/ntt.S)
163166

@@ -266,6 +269,9 @@ source code and documentation.
266269
* Referenced from:
267270
- [dev/aarch64_clean/src/intt.S](dev/aarch64_clean/src/intt.S)
268271
- [dev/aarch64_clean/src/ntt.S](dev/aarch64_clean/src/ntt.S)
272+
- [dev/aarch64_opt/README.md](dev/aarch64_opt/README.md)
273+
- [dev/aarch64_opt/src/intt.S](dev/aarch64_opt/src/intt.S)
274+
- [dev/aarch64_opt/src/ntt.S](dev/aarch64_opt/src/ntt.S)
269275
- [mldsa/src/native/aarch64/src/intt.S](mldsa/src/native/aarch64/src/intt.S)
270276
- [mldsa/src/native/aarch64/src/ntt.S](mldsa/src/native/aarch64/src/ntt.S)
271277

‎dev/aarch64_opt/README.md‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[//]: # (SPDX-License-Identifier: CC-BY-4.0)
2+
3+
# AArch64 backend (little endian)
4+
5+
This directory contains a native backend for little endian AArch64 systems. It is derived from [^NeonNTT] [^SLOTHY_Paper].
6+
7+
## Variants
8+
9+
This backend comes in two versions: "clean" and optimized. The "clean" backend is handwritten and meant to be easy to read and modify; for example, it heavily leverages register aliases and assembly macros. This directory contains the optimized version, which is automatically generated from the clean one via [SLOTHY](https://github.com/slothy-optimizer/slothy). Currently, the target architecture is Neoverse N1, but you can easily re-optimize the code for a different microarchitecture supported by SLOTHY, by adjusting the parameters in the [Makefile](src/Makefile).
10+
11+
<!--- bibliography --->
12+
[^NeonNTT]: Becker, Hwang, Kannwischer, Yang, Yang: Neon NTT: Faster Dilithium, Kyber, and Saber on Cortex-A72 and Apple M1, [https://eprint.iacr.org/2021/986](https://eprint.iacr.org/2021/986)
13+
[^SLOTHY_Paper]: Abdulrahman, Becker, Kannwischer, Klein: Fast and Clean: Auditable high-performance assembly via constraint solving, [https://eprint.iacr.org/2022/1303](https://eprint.iacr.org/2022/1303)

‎dev/aarch64_opt/meta.h‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
/*
2+
* Copyright (c) The mlkem-native project authors
3+
* Copyright (c) The mldsa-native project authors
4+
* SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
5+
*/
6+
7+
#ifndef MLD_NATIVE_AARCH64_META_H
8+
#define MLD_NATIVE_AARCH64_META_H
9+
10+
/* Set of primitives that this backend replaces */
11+
#define MLD_USE_NATIVE_NTT
12+
#define MLD_USE_NATIVE_INTT
13+
#define MLD_USE_NATIVE_REJ_UNIFORM
14+
#define MLD_USE_NATIVE_REJ_UNIFORM_ETA2
15+
#define MLD_USE_NATIVE_REJ_UNIFORM_ETA4
16+
#define MLD_USE_NATIVE_POLY_DECOMPOSE_32
17+
#define MLD_USE_NATIVE_POLY_DECOMPOSE_88
18+
#define MLD_USE_NATIVE_POLY_CADDQ
19+
#define MLD_USE_NATIVE_POLY_USE_HINT_32
20+
#define MLD_USE_NATIVE_POLY_USE_HINT_88
21+
#define MLD_USE_NATIVE_POLY_CHKNORM
22+
#define MLD_USE_NATIVE_POLYZ_UNPACK_17
23+
#define MLD_USE_NATIVE_POLYZ_UNPACK_19
24+
#define MLD_USE_NATIVE_POINTWISE_MONTGOMERY
25+
#define MLD_USE_NATIVE_POLYVECL_POINTWISE_ACC_MONTGOMERY_L4
26+
#define MLD_USE_NATIVE_POLYVECL_POINTWISE_ACC_MONTGOMERY_L5
27+
#define MLD_USE_NATIVE_POLYVECL_POINTWISE_ACC_MONTGOMERY_L7
28+
29+
/* Identifier for this backend so that source and assembly files
30+
* in the build can be appropriately guarded. */
31+
#define MLD_ARITH_BACKEND_AARCH64
32+
33+
34+
#if !defined(__ASSEMBLER__)
35+
#include "src/arith_native_aarch64.h"
36+
37+
static MLD_INLINE void mld_ntt_native(int32_t data[MLDSA_N])
38+
{
39+
mld_ntt_asm(data, mld_aarch64_ntt_zetas_layer123456,
40+
mld_aarch64_ntt_zetas_layer78);
41+
}
42+
43+
static MLD_INLINE void mld_intt_native(int32_t data[MLDSA_N])
44+
{
45+
mld_intt_asm(data, mld_aarch64_intt_zetas_layer78,
46+
mld_aarch64_intt_zetas_layer123456);
47+
}
48+
49+
static MLD_INLINE int mld_rej_uniform_native(int32_t *r, unsigned len,
50+
const uint8_t *buf,
51+
unsigned buflen)
52+
{
53+
if (len != MLDSA_N || buflen % 24 != 0)
54+
{
55+
return -1;
56+
}
57+
58+
/* Safety: outlen is at most MLDSA_N, hence, this cast is safe. */
59+
return (int)mld_rej_uniform_asm(r, buf, buflen, mld_rej_uniform_table);
60+
}
61+
62+
static MLD_INLINE int mld_rej_uniform_eta2_native(int32_t *r, unsigned len,
63+
const uint8_t *buf,
64+
unsigned buflen)
65+
{
66+
unsigned int outlen;
67+
/* AArch64 implementation assumes specific buffer lengths */
68+
if (len != MLDSA_N || buflen != MLD_AARCH64_REJ_UNIFORM_ETA2_BUFLEN)
69+
{
70+
return -1;
71+
}
72+
/* Constant time: Inputs and outputs to this function are secret.
73+
* It is safe to leak which coefficients are accepted/rejected.
74+
* The assembly implementation must not leak any other information about the
75+
* accepted coefficients. Constant-time testing cannot cover this, and we
76+
* hence have to manually verify the assembly.
77+
* We declassify prior the input data and mark the outputs as secret.
78+
*/
79+
MLD_CT_TESTING_DECLASSIFY(buf, buflen);
80+
outlen = mld_rej_uniform_eta2_asm(r, buf, buflen, mld_rej_uniform_eta_table);
81+
MLD_CT_TESTING_SECRET(r, sizeof(int32_t) * outlen);
82+
/* Safety: outlen is at most MLDSA_N and, hence, this cast is safe. */
83+
return (int)outlen;
84+
}
85+
86+
static MLD_INLINE int mld_rej_uniform_eta4_native(int32_t *r, unsigned len,
87+
const uint8_t *buf,
88+
unsigned buflen)
89+
{
90+
unsigned int outlen;
91+
/* AArch64 implementation assumes specific buffer lengths */
92+
if (len != MLDSA_N || buflen != MLD_AARCH64_REJ_UNIFORM_ETA4_BUFLEN)
93+
{
94+
return -1;
95+
}
96+
/* Constant time: Inputs and outputs to this function are secret.
97+
* It is safe to leak which coefficients are accepted/rejected.
98+
* The assembly implementation must not leak any other information about the
99+
* accepted coefficients. Constant-time testing cannot cover this, and we
100+
* hence have to manually verify the assembly.
101+
* We declassify prior the input data and mark the outputs as secret.
102+
*/
103+
MLD_CT_TESTING_DECLASSIFY(buf, buflen);
104+
outlen = mld_rej_uniform_eta4_asm(r, buf, buflen, mld_rej_uniform_eta_table);
105+
MLD_CT_TESTING_SECRET(r, sizeof(int32_t) * outlen);
106+
/* Safety: outlen is at most MLDSA_N and, hence, this cast is safe. */
107+
return (int)outlen;
108+
}
109+
110+
static MLD_INLINE void mld_poly_decompose_32_native(int32_t *a1, int32_t *a0,
111+
const int32_t *a)
112+
{
113+
mld_poly_decompose_32_asm(a1, a0, a);
114+
}
115+
116+
static MLD_INLINE void mld_poly_decompose_88_native(int32_t *a1, int32_t *a0,
117+
const int32_t *a)
118+
{
119+
mld_poly_decompose_88_asm(a1, a0, a);
120+
}
121+
122+
static MLD_INLINE void mld_poly_caddq_native(int32_t a[MLDSA_N])
123+
{
124+
mld_poly_caddq_asm(a);
125+
}
126+
127+
static MLD_INLINE void mld_poly_use_hint_32_native(int32_t *b, const int32_t *a,
128+
const int32_t *h)
129+
{
130+
mld_poly_use_hint_32_asm(b, a, h);
131+
}
132+
133+
static MLD_INLINE void mld_poly_use_hint_88_native(int32_t *b, const int32_t *a,
134+
const int32_t *h)
135+
{
136+
mld_poly_use_hint_88_asm(b, a, h);
137+
}
138+
139+
static MLD_INLINE int mld_poly_chknorm_native(const int32_t *a, int32_t B)
140+
{
141+
return mld_poly_chknorm_asm(a, B);
142+
}
143+
144+
static MLD_INLINE void mld_polyz_unpack_17_native(int32_t *r,
145+
const uint8_t *buf)
146+
{
147+
mld_polyz_unpack_17_asm(r, buf, mld_polyz_unpack_17_indices);
148+
}
149+
150+
static MLD_INLINE void mld_polyz_unpack_19_native(int32_t *r,
151+
const uint8_t *buf)
152+
{
153+
mld_polyz_unpack_19_asm(r, buf, mld_polyz_unpack_19_indices);
154+
}
155+
156+
static MLD_INLINE void mld_poly_pointwise_montgomery_native(
157+
int32_t out[MLDSA_N], const int32_t in0[MLDSA_N],
158+
const int32_t in1[MLDSA_N])
159+
{
160+
mld_poly_pointwise_montgomery_asm(out, in0, in1);
161+
}
162+
163+
static MLD_INLINE void mld_polyvecl_pointwise_acc_montgomery_l4_native(
164+
int32_t w[MLDSA_N], const int32_t u[4][MLDSA_N],
165+
const int32_t v[4][MLDSA_N])
166+
{
167+
mld_polyvecl_pointwise_acc_montgomery_l4_asm(w, (const int32_t *)u,
168+
(const int32_t *)v);
169+
}
170+
171+
static MLD_INLINE void mld_polyvecl_pointwise_acc_montgomery_l5_native(
172+
int32_t w[MLDSA_N], const int32_t u[5][MLDSA_N],
173+
const int32_t v[5][MLDSA_N])
174+
{
175+
mld_polyvecl_pointwise_acc_montgomery_l5_asm(w, (const int32_t *)u,
176+
(const int32_t *)v);
177+
}
178+
179+
static MLD_INLINE void mld_polyvecl_pointwise_acc_montgomery_l7_native(
180+
int32_t w[MLDSA_N], const int32_t u[7][MLDSA_N],
181+
const int32_t v[7][MLDSA_N])
182+
{
183+
mld_polyvecl_pointwise_acc_montgomery_l7_asm(w, (const int32_t *)u,
184+
(const int32_t *)v);
185+
}
186+
187+
#endif /* !__ASSEMBLER__ */
188+
#endif /* !MLD_NATIVE_AARCH64_META_H */

‎dev/aarch64_opt/src/Makefile‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
# Copyright (c) The mldsa-native project authors
2+
# SPDX-License-Identifier: Apache-2.0 OR ISC OR MIT
3+
4+
######
5+
# To run, see the README.md file
6+
######
7+
.PHONY: all clean
8+
9+
# ISA to optimize for
10+
TARGET_ISA=Arm_AArch64
11+
12+
# MicroArch target to optimize for
13+
TARGET_MICROARCH=Arm_Neoverse_N1_experimental
14+
15+
SLOTHY_EXTRA_FLAGS ?=
16+
17+
SLOTHY_FLAGS=-c sw_pipelining.enabled=true \
18+
-c inputs_are_outputs \
19+
-c sw_pipelining.minimize_overlapping=False \
20+
-c sw_pipelining.allow_post \
21+
-c variable_size \
22+
-c constraints.stalls_first_attempt=64 \
23+
$(SLOTHY_EXTRA_FLAGS)
24+
25+
SLOTHY_FLAGS_SPLIT= -c inputs_are_outputs \
26+
-c variable_size \
27+
-c constraints.stalls_first_attempt=64 \
28+
-c split_heuristic=true \
29+
-c split_heuristic_factor=1.5 \
30+
-c split_heuristic_repeat=2 \
31+
-c sw_pipelining.enabled=true \
32+
-c sw_pipelining.halving_heuristic=True \
33+
$(SLOTHY_EXTRA_FLAGS)
34+
35+
# For kernels which stash callee-saved v8-v15 but don't stash callee-saved GPRs x19-x30.
36+
# Allow SLOTHY to use all V-registers, but only caller-saved GPRs.
37+
RESERVE_X_ONLY_FLAG=-c reserved_regs="[x18--x30,sp]"
38+
39+
# Used for kernels which don't stash callee-saved registers.
40+
# Restrict SLOTHY to caller-saved registers.
41+
RESERVE_ALL_FLAG=-c reserved_regs="[x18--x30,sp,v8--v15]"
42+
43+
all: ntt.S \
44+
intt.S \
45+
mld_polyvecl_pointwise_acc_montgomery_l4.S \
46+
mld_polyvecl_pointwise_acc_montgomery_l5.S \
47+
mld_polyvecl_pointwise_acc_montgomery_l7.S \
48+
pointwise_montgomery.S \
49+
poly_caddq_asm.S \
50+
poly_chknorm_asm.S \
51+
poly_decompose_32_asm.S \
52+
poly_decompose_88_asm.S \
53+
poly_use_hint_32_asm.S \
54+
poly_use_hint_88_asm.S \
55+
polyz_unpack_17_asm.S \
56+
polyz_unpack_19_asm.S \
57+
rej_uniform_asm.S \
58+
rej_uniform_eta2_asm.S \
59+
rej_uniform_eta4_asm.S
60+
61+
# These units explicitly save and restore registers v8-v15, so SLOTHY can freely use
62+
# those registers.
63+
ntt.S: ../../aarch64_clean/src/ntt.S
64+
# optimize first loop in one go and write to temp file
65+
$(eval TMPFILE := $(shell mktemp))
66+
slothy-cli $(TARGET_ISA) $(TARGET_MICROARCH) $< -o $(TMPFILE) -l ntt_layer123_start $(SLOTHY_FLAGS) $(RESERVE_X_ONLY_FLAG)
67+
# optimize second loop using split heuristic
68+
slothy-cli $(TARGET_ISA) $(TARGET_MICROARCH) $(TMPFILE) -o $@ -l ntt_layer45678_start $(SLOTHY_FLAGS_SPLIT) $(RESERVE_X_ONLY_FLAG)
69+
70+
# Copy remaining files without optimization for now
71+
intt.S: ../../aarch64_clean/src/intt.S
72+
cp $< $@
73+
74+
mld_polyvecl_pointwise_acc_montgomery_l4.S: ../../aarch64_clean/src/mld_polyvecl_pointwise_acc_montgomery_l4.S
75+
cp $< $@
76+
77+
mld_polyvecl_pointwise_acc_montgomery_l5.S: ../../aarch64_clean/src/mld_polyvecl_pointwise_acc_montgomery_l5.S
78+
cp $< $@
79+
80+
mld_polyvecl_pointwise_acc_montgomery_l7.S: ../../aarch64_clean/src/mld_polyvecl_pointwise_acc_montgomery_l7.S
81+
cp $< $@
82+
83+
pointwise_montgomery.S: ../../aarch64_clean/src/pointwise_montgomery.S
84+
cp $< $@
85+
86+
poly_caddq_asm.S: ../../aarch64_clean/src/poly_caddq_asm.S
87+
cp $< $@
88+
89+
poly_chknorm_asm.S: ../../aarch64_clean/src/poly_chknorm_asm.S
90+
cp $< $@
91+
92+
poly_decompose_32_asm.S: ../../aarch64_clean/src/poly_decompose_32_asm.S
93+
cp $< $@
94+
95+
poly_decompose_88_asm.S: ../../aarch64_clean/src/poly_decompose_88_asm.S
96+
cp $< $@
97+
98+
poly_use_hint_32_asm.S: ../../aarch64_clean/src/poly_use_hint_32_asm.S
99+
cp $< $@
100+
101+
poly_use_hint_88_asm.S: ../../aarch64_clean/src/poly_use_hint_88_asm.S
102+
cp $< $@
103+
104+
polyz_unpack_17_asm.S: ../../aarch64_clean/src/polyz_unpack_17_asm.S
105+
cp $< $@
106+
107+
polyz_unpack_19_asm.S: ../../aarch64_clean/src/polyz_unpack_19_asm.S
108+
cp $< $@
109+
110+
rej_uniform_asm.S: ../../aarch64_clean/src/rej_uniform_asm.S
111+
cp $< $@
112+
113+
rej_uniform_eta2_asm.S: ../../aarch64_clean/src/rej_uniform_eta2_asm.S
114+
cp $< $@
115+
116+
rej_uniform_eta4_asm.S: ../../aarch64_clean/src/rej_uniform_eta4_asm.S
117+
cp $< $@
118+
119+
clean:
120+
-$(RM) -rf *.S

‎dev/aarch64_opt/src/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
[//]: # (SPDX-License-Identifier: CC-BY-4.0)
2+
3+
# mldsa-native AArch64 backend SLOTHY-optimized code
4+
5+
This directory contains the AArch64 backend after it has been optimized by [SLOTHY](https://github.com/slothy-optimizer/slothy/).
6+
7+
## Re-running SLOTHY
8+
9+
If the "clean" sources [`../../aarch64_clean/src/*.S`](../../aarch64_clean/src/) change, take the following steps to re-optimize and install them into the main source tree:
10+
11+
1. Run `make` to re-generate the optimized sources using SLOTHY. This assumes a working SLOTHY setup, as established e.g. by the default nix shell for mldsa-native. See also the [SLOTHY README](https://github.com/slothy-optimizer/slothy/).
12+
13+
2. Run `autogen` to transfer the newly optimized files into the main source tree [mldsa/src/native](../../../mldsa/src/native).
14+
15+
3. Run `./scripts/tests all --opt=OPT` to check that the new assembly is still functional.

0 commit comments

Comments
 (0)