1 #!/usr/bin/env perl 2 3 # ==================================================================== 4 # Written by Andy Polyakov <appro (at] openssl.org> for the OpenSSL 5 # project. The module is, however, dual licensed under OpenSSL and 6 # CRYPTOGAMS licenses depending on where you obtain it. For further 7 # details see http://www.openssl.org/~appro/cryptogams/. 8 # ==================================================================== 9 10 # sha1_block procedure for ARMv4. 11 # 12 # January 2007. 13 14 # Size/performance trade-off 15 # ==================================================================== 16 # impl size in bytes comp cycles[*] measured performance 17 # ==================================================================== 18 # thumb 304 3212 4420 19 # armv4-small 392/+29% 1958/+64% 2250/+96% 20 # armv4-compact 740/+89% 1552/+26% 1840/+22% 21 # armv4-large 1420/+92% 1307/+19% 1370/+34%[***] 22 # full unroll ~5100/+260% ~1260/+4% ~1300/+5% 23 # ==================================================================== 24 # thumb = same as 'small' but in Thumb instructions[**] and 25 # with recurring code in two private functions; 26 # small = detached Xload/update, loops are folded; 27 # compact = detached Xload/update, 5x unroll; 28 # large = interleaved Xload/update, 5x unroll; 29 # full unroll = interleaved Xload/update, full unroll, estimated[!]; 30 # 31 # [*] Manually counted instructions in "grand" loop body. Measured 32 # performance is affected by prologue and epilogue overhead, 33 # i-cache availability, branch penalties, etc. 34 # [**] While each Thumb instruction is twice smaller, they are not as 35 # diverse as ARM ones: e.g., there are only two arithmetic 36 # instructions with 3 arguments, no [fixed] rotate, addressing 37 # modes are limited. As result it takes more instructions to do 38 # the same job in Thumb, therefore the code is never twice as 39 # small and always slower. 40 # [***] which is also ~35% better than compiler generated code. Dual- 41 # issue Cortex A8 core was measured to process input block in 42 # ~990 cycles. 43 44 # August 2010. 45 # 46 # Rescheduling for dual-issue pipeline resulted in 13% improvement on 47 # Cortex A8 core and in absolute terms ~870 cycles per input block 48 # [or 13.6 cycles per byte]. 49 50 # February 2011. 51 # 52 # Profiler-assisted and platform-specific optimization resulted in 10% 53 # improvement on Cortex A8 core and 12.2 cycles per byte. 54 55 # September 2013. 56 # 57 # Add NEON implementation (see sha1-586.pl for background info). On 58 # Cortex A8 it was measured to process one byte in 6.7 cycles or >80% 59 # faster than integer-only code. Because [fully unrolled] NEON code 60 # is ~2.5x larger and there are some redundant instructions executed 61 # when processing last block, improvement is not as big for smallest 62 # blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per 63 # byte, which is also >80% faster than integer-only code. 64 65 # May 2014. 66 # 67 # Add ARMv8 code path performing at 2.35 cpb on Apple A7. 68 69 while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {} 70 open STDOUT,">$output"; 71 72 $ctx="r0"; 73 $inp="r1"; 74 $len="r2"; 75 $a="r3"; 76 $b="r4"; 77 $c="r5"; 78 $d="r6"; 79 $e="r7"; 80 $K="r8"; 81 $t0="r9"; 82 $t1="r10"; 83 $t2="r11"; 84 $t3="r12"; 85 $Xi="r14"; 86 @V=($a,$b,$c,$d,$e); 87 88 sub Xupdate { 89 my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_; 90 $code.=<<___; 91 ldr $t0,[$Xi,#15*4] 92 ldr $t1,[$Xi,#13*4] 93 ldr $t2,[$Xi,#7*4] 94 add $e,$K,$e,ror#2 @ E+=K_xx_xx 95 ldr $t3,[$Xi,#2*4] 96 eor $t0,$t0,$t1 97 eor $t2,$t2,$t3 @ 1 cycle stall 98 eor $t1,$c,$d @ F_xx_xx 99 mov $t0,$t0,ror#31 100 add $e,$e,$a,ror#27 @ E+=ROR(A,27) 101 eor $t0,$t0,$t2,ror#31 102 str $t0,[$Xi,#-4]! 103 $opt1 @ F_xx_xx 104 $opt2 @ F_xx_xx 105 add $e,$e,$t0 @ E+=X[i] 106 ___ 107 } 108 109 sub BODY_00_15 { 110 my ($a,$b,$c,$d,$e)=@_; 111 $code.=<<___; 112 #if __ARM_ARCH__<7 113 ldrb $t1,[$inp,#2] 114 ldrb $t0,[$inp,#3] 115 ldrb $t2,[$inp,#1] 116 add $e,$K,$e,ror#2 @ E+=K_00_19 117 ldrb $t3,[$inp],#4 118 orr $t0,$t0,$t1,lsl#8 119 eor $t1,$c,$d @ F_xx_xx 120 orr $t0,$t0,$t2,lsl#16 121 add $e,$e,$a,ror#27 @ E+=ROR(A,27) 122 orr $t0,$t0,$t3,lsl#24 123 #else 124 ldr $t0,[$inp],#4 @ handles unaligned 125 add $e,$K,$e,ror#2 @ E+=K_00_19 126 eor $t1,$c,$d @ F_xx_xx 127 add $e,$e,$a,ror#27 @ E+=ROR(A,27) 128 #ifdef __ARMEL__ 129 rev $t0,$t0 @ byte swap 130 #endif 131 #endif 132 and $t1,$b,$t1,ror#2 133 add $e,$e,$t0 @ E+=X[i] 134 eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D) 135 str $t0,[$Xi,#-4]! 136 add $e,$e,$t1 @ E+=F_00_19(B,C,D) 137 ___ 138 } 139 140 sub BODY_16_19 { 141 my ($a,$b,$c,$d,$e)=@_; 142 &Xupdate(@_,"and $t1,$b,$t1,ror#2"); 143 $code.=<<___; 144 eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D) 145 add $e,$e,$t1 @ E+=F_00_19(B,C,D) 146 ___ 147 } 148 149 sub BODY_20_39 { 150 my ($a,$b,$c,$d,$e)=@_; 151 &Xupdate(@_,"eor $t1,$b,$t1,ror#2"); 152 $code.=<<___; 153 add $e,$e,$t1 @ E+=F_20_39(B,C,D) 154 ___ 155 } 156 157 sub BODY_40_59 { 158 my ($a,$b,$c,$d,$e)=@_; 159 &Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d"); 160 $code.=<<___; 161 add $e,$e,$t1 @ E+=F_40_59(B,C,D) 162 add $e,$e,$t2,ror#2 163 ___ 164 } 165 166 $code=<<___; 167 #include "arm_arch.h" 168 169 .text 170 .code 32 171 172 .global sha1_block_data_order 173 .type sha1_block_data_order,%function 174 175 .align 5 176 sha1_block_data_order: 177 #if __ARM_ARCH__>=7 178 sub r3,pc,#8 @ sha1_block_data_order 179 ldr r12,.LOPENSSL_armcap 180 ldr r12,[r3,r12] @ OPENSSL_armcap_P 181 tst r12,#ARMV8_SHA1 182 bne .LARMv8 183 tst r12,#ARMV7_NEON 184 bne .LNEON 185 #endif 186 stmdb sp!,{r4-r12,lr} 187 add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp 188 ldmia $ctx,{$a,$b,$c,$d,$e} 189 .Lloop: 190 ldr $K,.LK_00_19 191 mov $Xi,sp 192 sub sp,sp,#15*4 193 mov $c,$c,ror#30 194 mov $d,$d,ror#30 195 mov $e,$e,ror#30 @ [6] 196 .L_00_15: 197 ___ 198 for($i=0;$i<5;$i++) { 199 &BODY_00_15(@V); unshift(@V,pop(@V)); 200 } 201 $code.=<<___; 202 teq $Xi,sp 203 bne .L_00_15 @ [((11+4)*5+2)*3] 204 sub sp,sp,#25*4 205 ___ 206 &BODY_00_15(@V); unshift(@V,pop(@V)); 207 &BODY_16_19(@V); unshift(@V,pop(@V)); 208 &BODY_16_19(@V); unshift(@V,pop(@V)); 209 &BODY_16_19(@V); unshift(@V,pop(@V)); 210 &BODY_16_19(@V); unshift(@V,pop(@V)); 211 $code.=<<___; 212 213 ldr $K,.LK_20_39 @ [+15+16*4] 214 cmn sp,#0 @ [+3], clear carry to denote 20_39 215 .L_20_39_or_60_79: 216 ___ 217 for($i=0;$i<5;$i++) { 218 &BODY_20_39(@V); unshift(@V,pop(@V)); 219 } 220 $code.=<<___; 221 teq $Xi,sp @ preserve carry 222 bne .L_20_39_or_60_79 @ [+((12+3)*5+2)*4] 223 bcs .L_done @ [+((12+3)*5+2)*4], spare 300 bytes 224 225 ldr $K,.LK_40_59 226 sub sp,sp,#20*4 @ [+2] 227 .L_40_59: 228 ___ 229 for($i=0;$i<5;$i++) { 230 &BODY_40_59(@V); unshift(@V,pop(@V)); 231 } 232 $code.=<<___; 233 teq $Xi,sp 234 bne .L_40_59 @ [+((12+5)*5+2)*4] 235 236 ldr $K,.LK_60_79 237 sub sp,sp,#20*4 238 cmp sp,#0 @ set carry to denote 60_79 239 b .L_20_39_or_60_79 @ [+4], spare 300 bytes 240 .L_done: 241 add sp,sp,#80*4 @ "deallocate" stack frame 242 ldmia $ctx,{$K,$t0,$t1,$t2,$t3} 243 add $a,$K,$a 244 add $b,$t0,$b 245 add $c,$t1,$c,ror#2 246 add $d,$t2,$d,ror#2 247 add $e,$t3,$e,ror#2 248 stmia $ctx,{$a,$b,$c,$d,$e} 249 teq $inp,$len 250 bne .Lloop @ [+18], total 1307 251 252 #if __ARM_ARCH__>=5 253 ldmia sp!,{r4-r12,pc} 254 #else 255 ldmia sp!,{r4-r12,lr} 256 tst lr,#1 257 moveq pc,lr @ be binary compatible with V4, yet 258 bx lr @ interoperable with Thumb ISA:-) 259 #endif 260 .size sha1_block_data_order,.-sha1_block_data_order 261 262 .align 5 263 .LK_00_19: .word 0x5a827999 264 .LK_20_39: .word 0x6ed9eba1 265 .LK_40_59: .word 0x8f1bbcdc 266 .LK_60_79: .word 0xca62c1d6 267 .LOPENSSL_armcap: 268 .word OPENSSL_armcap_P-sha1_block_data_order 269 .asciz "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>" 270 .align 5 271 ___ 272 ##################################################################### 273 # NEON stuff 274 # 275 {{{ 276 my @V=($a,$b,$c,$d,$e); 277 my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14)); 278 my $Xi=4; 279 my @X=map("q$_",(8..11,0..3)); 280 my @Tx=("q12","q13"); 281 my ($K,$zero)=("q14","q15"); 282 my $j=0; 283 284 sub AUTOLOAD() # thunk [simplified] x86-style perlasm 285 { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./; 286 my $arg = pop; 287 $arg = "#$arg" if ($arg*1 eq $arg); 288 $code .= "\t$opcode\t".join(',',@_,$arg)."\n"; 289 } 290 291 sub body_00_19 () { 292 ( 293 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. 294 '&bic ($t0,$d,$b)', 295 '&add ($e,$e,$Ki)', # e+=X[i]+K 296 '&and ($t1,$c,$b)', 297 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))', 298 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) 299 '&eor ($t1,$t1,$t0)', # F_00_19 300 '&mov ($b,$b,"ror#2")', # b=ROR(b,2) 301 '&add ($e,$e,$t1);'. # e+=F_00_19 302 '$j++; unshift(@V,pop(@V));' 303 ) 304 } 305 sub body_20_39 () { 306 ( 307 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. 308 '&eor ($t0,$b,$d)', 309 '&add ($e,$e,$Ki)', # e+=X[i]+K 310 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)', 311 '&eor ($t1,$t0,$c)', # F_20_39 312 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) 313 '&mov ($b,$b,"ror#2")', # b=ROR(b,2) 314 '&add ($e,$e,$t1);'. # e+=F_20_39 315 '$j++; unshift(@V,pop(@V));' 316 ) 317 } 318 sub body_40_59 () { 319 ( 320 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. 321 '&add ($e,$e,$Ki)', # e+=X[i]+K 322 '&and ($t0,$c,$d)', 323 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))', 324 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) 325 '&eor ($t1,$c,$d)', 326 '&add ($e,$e,$t0)', 327 '&and ($t1,$t1,$b)', 328 '&mov ($b,$b,"ror#2")', # b=ROR(b,2) 329 '&add ($e,$e,$t1);'. # e+=F_40_59 330 '$j++; unshift(@V,pop(@V));' 331 ) 332 } 333 334 sub Xupdate_16_31 () 335 { use integer; 336 my $body = shift; 337 my @insns = (&$body,&$body,&$body,&$body); 338 my ($a,$b,$c,$d,$e); 339 340 &vext_8 (@X[0],@X[-4&7],@X[-3&7],8); # compose "X[-14]" in "X[0]" 341 eval(shift(@insns)); 342 eval(shift(@insns)); 343 eval(shift(@insns)); 344 &vadd_i32 (@Tx[1],@X[-1&7],$K); 345 eval(shift(@insns)); 346 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0); 347 eval(shift(@insns)); 348 &vext_8 (@Tx[0],@X[-1&7],$zero,4); # "X[-3]", 3 words 349 eval(shift(@insns)); 350 eval(shift(@insns)); 351 eval(shift(@insns)); 352 &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"^="X[-16]" 353 eval(shift(@insns)); 354 eval(shift(@insns)); 355 &veor (@Tx[0],@Tx[0],@X[-2&7]); # "X[-3]"^"X[-8]" 356 eval(shift(@insns)); 357 eval(shift(@insns)); 358 &veor (@Tx[0],@Tx[0],@X[0]); # "X[0]"^="X[-3]"^"X[-8] 359 eval(shift(@insns)); 360 eval(shift(@insns)); 361 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer 362 &sub ($Xfer,$Xfer,64) if ($Xi%4==0); 363 eval(shift(@insns)); 364 eval(shift(@insns)); 365 &vext_8 (@Tx[1],$zero,@Tx[0],4); # "X[0]"<<96, extract one dword 366 eval(shift(@insns)); 367 eval(shift(@insns)); 368 &vadd_i32 (@X[0],@Tx[0],@Tx[0]); 369 eval(shift(@insns)); 370 eval(shift(@insns)); 371 &vsri_32 (@X[0],@Tx[0],31); # "X[0]"<<<=1 372 eval(shift(@insns)); 373 eval(shift(@insns)); 374 eval(shift(@insns)); 375 &vshr_u32 (@Tx[0],@Tx[1],30); 376 eval(shift(@insns)); 377 eval(shift(@insns)); 378 &vshl_u32 (@Tx[1],@Tx[1],2); 379 eval(shift(@insns)); 380 eval(shift(@insns)); 381 &veor (@X[0],@X[0],@Tx[0]); 382 eval(shift(@insns)); 383 eval(shift(@insns)); 384 &veor (@X[0],@X[0],@Tx[1]); # "X[0]"^=("X[0]">>96)<<<2 385 386 foreach (@insns) { eval; } # remaining instructions [if any] 387 388 $Xi++; push(@X,shift(@X)); # "rotate" X[] 389 } 390 391 sub Xupdate_32_79 () 392 { use integer; 393 my $body = shift; 394 my @insns = (&$body,&$body,&$body,&$body); 395 my ($a,$b,$c,$d,$e); 396 397 &vext_8 (@Tx[0],@X[-2&7],@X[-1&7],8); # compose "X[-6]" 398 eval(shift(@insns)); 399 eval(shift(@insns)); 400 eval(shift(@insns)); 401 &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"="X[-32]"^"X[-16]" 402 eval(shift(@insns)); 403 eval(shift(@insns)); 404 &veor (@X[0],@X[0],@X[-7&7]); # "X[0]"^="X[-28]" 405 eval(shift(@insns)); 406 eval(shift(@insns)); 407 &vadd_i32 (@Tx[1],@X[-1&7],$K); 408 eval(shift(@insns)); 409 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0); 410 eval(shift(@insns)); 411 &veor (@Tx[0],@Tx[0],@X[0]); # "X[-6]"^="X[0]" 412 eval(shift(@insns)); 413 eval(shift(@insns)); 414 &vshr_u32 (@X[0],@Tx[0],30); 415 eval(shift(@insns)); 416 eval(shift(@insns)); 417 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer 418 &sub ($Xfer,$Xfer,64) if ($Xi%4==0); 419 eval(shift(@insns)); 420 eval(shift(@insns)); 421 &vsli_32 (@X[0],@Tx[0],2); # "X[0]"="X[-6]"<<<2 422 423 foreach (@insns) { eval; } # remaining instructions [if any] 424 425 $Xi++; push(@X,shift(@X)); # "rotate" X[] 426 } 427 428 sub Xuplast_80 () 429 { use integer; 430 my $body = shift; 431 my @insns = (&$body,&$body,&$body,&$body); 432 my ($a,$b,$c,$d,$e); 433 434 &vadd_i32 (@Tx[1],@X[-1&7],$K); 435 eval(shift(@insns)); 436 eval(shift(@insns)); 437 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); 438 &sub ($Xfer,$Xfer,64); 439 440 &teq ($inp,$len); 441 &sub ($K_XX_XX,$K_XX_XX,16); # rewind $K_XX_XX 442 &subeq ($inp,$inp,64); # reload last block to avoid SEGV 443 &vld1_8 ("{@X[-4&7]-@X[-3&7]}","[$inp]!"); 444 eval(shift(@insns)); 445 eval(shift(@insns)); 446 &vld1_8 ("{@X[-2&7]-@X[-1&7]}","[$inp]!"); 447 eval(shift(@insns)); 448 eval(shift(@insns)); 449 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!"); # load K_00_19 450 eval(shift(@insns)); 451 eval(shift(@insns)); 452 &vrev32_8 (@X[-4&7],@X[-4&7]); 453 454 foreach (@insns) { eval; } # remaining instructions 455 456 $Xi=0; 457 } 458 459 sub Xloop() 460 { use integer; 461 my $body = shift; 462 my @insns = (&$body,&$body,&$body,&$body); 463 my ($a,$b,$c,$d,$e); 464 465 &vrev32_8 (@X[($Xi-3)&7],@X[($Xi-3)&7]); 466 eval(shift(@insns)); 467 eval(shift(@insns)); 468 &vadd_i32 (@X[$Xi&7],@X[($Xi-4)&7],$K); 469 eval(shift(@insns)); 470 eval(shift(@insns)); 471 &vst1_32 ("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU 472 473 foreach (@insns) { eval; } 474 475 $Xi++; 476 } 477 478 $code.=<<___; 479 #if __ARM_ARCH__>=7 480 .fpu neon 481 482 .type sha1_block_data_order_neon,%function 483 .align 4 484 sha1_block_data_order_neon: 485 .LNEON: 486 stmdb sp!,{r4-r12,lr} 487 add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp 488 @ dmb @ errata #451034 on early Cortex A8 489 @ vstmdb sp!,{d8-d15} @ ABI specification says so 490 mov $saved_sp,sp 491 sub sp,sp,#64 @ alloca 492 adr $K_XX_XX,.LK_00_19 493 bic sp,sp,#15 @ align for 128-bit stores 494 495 ldmia $ctx,{$a,$b,$c,$d,$e} @ load context 496 mov $Xfer,sp 497 498 vld1.8 {@X[-4&7]-@X[-3&7]},[$inp]! @ handles unaligned 499 veor $zero,$zero,$zero 500 vld1.8 {@X[-2&7]-@X[-1&7]},[$inp]! 501 vld1.32 {${K}\[]},[$K_XX_XX,:32]! @ load K_00_19 502 vrev32.8 @X[-4&7],@X[-4&7] @ yes, even on 503 vrev32.8 @X[-3&7],@X[-3&7] @ big-endian... 504 vrev32.8 @X[-2&7],@X[-2&7] 505 vadd.i32 @X[0],@X[-4&7],$K 506 vrev32.8 @X[-1&7],@X[-1&7] 507 vadd.i32 @X[1],@X[-3&7],$K 508 vst1.32 {@X[0]},[$Xfer,:128]! 509 vadd.i32 @X[2],@X[-2&7],$K 510 vst1.32 {@X[1]},[$Xfer,:128]! 511 vst1.32 {@X[2]},[$Xfer,:128]! 512 ldr $Ki,[sp] @ big RAW stall 513 514 .Loop_neon: 515 ___ 516 &Xupdate_16_31(\&body_00_19); 517 &Xupdate_16_31(\&body_00_19); 518 &Xupdate_16_31(\&body_00_19); 519 &Xupdate_16_31(\&body_00_19); 520 &Xupdate_32_79(\&body_00_19); 521 &Xupdate_32_79(\&body_20_39); 522 &Xupdate_32_79(\&body_20_39); 523 &Xupdate_32_79(\&body_20_39); 524 &Xupdate_32_79(\&body_20_39); 525 &Xupdate_32_79(\&body_20_39); 526 &Xupdate_32_79(\&body_40_59); 527 &Xupdate_32_79(\&body_40_59); 528 &Xupdate_32_79(\&body_40_59); 529 &Xupdate_32_79(\&body_40_59); 530 &Xupdate_32_79(\&body_40_59); 531 &Xupdate_32_79(\&body_20_39); 532 &Xuplast_80(\&body_20_39); 533 &Xloop(\&body_20_39); 534 &Xloop(\&body_20_39); 535 &Xloop(\&body_20_39); 536 $code.=<<___; 537 ldmia $ctx,{$Ki,$t0,$t1,$Xfer} @ accumulate context 538 add $a,$a,$Ki 539 ldr $Ki,[$ctx,#16] 540 add $b,$b,$t0 541 add $c,$c,$t1 542 add $d,$d,$Xfer 543 moveq sp,$saved_sp 544 add $e,$e,$Ki 545 ldrne $Ki,[sp] 546 stmia $ctx,{$a,$b,$c,$d,$e} 547 addne $Xfer,sp,#3*16 548 bne .Loop_neon 549 550 @ vldmia sp!,{d8-d15} 551 ldmia sp!,{r4-r12,pc} 552 .size sha1_block_data_order_neon,.-sha1_block_data_order_neon 553 #endif 554 ___ 555 }}} 556 ##################################################################### 557 # ARMv8 stuff 558 # 559 {{{ 560 my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3)); 561 my @MSG=map("q$_",(4..7)); 562 my @Kxx=map("q$_",(8..11)); 563 my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14)); 564 565 $code.=<<___; 566 #if __ARM_ARCH__>=7 567 .type sha1_block_data_order_armv8,%function 568 .align 5 569 sha1_block_data_order_armv8: 570 .LARMv8: 571 vstmdb sp!,{d8-d15} @ ABI specification says so 572 573 veor $E,$E,$E 574 adr r3,.LK_00_19 575 vld1.32 {$ABCD},[$ctx]! 576 vld1.32 {$E\[0]},[$ctx] 577 sub $ctx,$ctx,#16 578 vld1.32 {@Kxx[0]\[]},[r3,:32]! 579 vld1.32 {@Kxx[1]\[]},[r3,:32]! 580 vld1.32 {@Kxx[2]\[]},[r3,:32]! 581 vld1.32 {@Kxx[3]\[]},[r3,:32] 582 583 .Loop_v8: 584 vld1.8 {@MSG[0]-@MSG[1]},[$inp]! 585 vld1.8 {@MSG[2]-@MSG[3]},[$inp]! 586 vrev32.8 @MSG[0],@MSG[0] 587 vrev32.8 @MSG[1],@MSG[1] 588 589 vadd.i32 $W0,@Kxx[0],@MSG[0] 590 vrev32.8 @MSG[2],@MSG[2] 591 vmov $ABCD_SAVE,$ABCD @ offload 592 subs $len,$len,#1 593 594 vadd.i32 $W1,@Kxx[0],@MSG[1] 595 vrev32.8 @MSG[3],@MSG[3] 596 sha1h $E1,$ABCD @ 0 597 sha1c $ABCD,$E,$W0 598 vadd.i32 $W0,@Kxx[$j],@MSG[2] 599 sha1su0 @MSG[0],@MSG[1],@MSG[2] 600 ___ 601 for ($j=0,$i=1;$i<20-3;$i++) { 602 my $f=("c","p","m","p")[$i/5]; 603 $code.=<<___; 604 sha1h $E0,$ABCD @ $i 605 sha1$f $ABCD,$E1,$W1 606 vadd.i32 $W1,@Kxx[$j],@MSG[3] 607 sha1su1 @MSG[0],@MSG[3] 608 ___ 609 $code.=<<___ if ($i<20-4); 610 sha1su0 @MSG[1],@MSG[2],@MSG[3] 611 ___ 612 ($E0,$E1)=($E1,$E0); ($W0,$W1)=($W1,$W0); 613 push(@MSG,shift(@MSG)); $j++ if ((($i+3)%5)==0); 614 } 615 $code.=<<___; 616 sha1h $E0,$ABCD @ $i 617 sha1p $ABCD,$E1,$W1 618 vadd.i32 $W1,@Kxx[$j],@MSG[3] 619 620 sha1h $E1,$ABCD @ 18 621 sha1p $ABCD,$E0,$W0 622 623 sha1h $E0,$ABCD @ 19 624 sha1p $ABCD,$E1,$W1 625 626 vadd.i32 $E,$E,$E0 627 vadd.i32 $ABCD,$ABCD,$ABCD_SAVE 628 bne .Loop_v8 629 630 vst1.32 {$ABCD},[$ctx]! 631 vst1.32 {$E\[0]},[$ctx] 632 633 vldmia sp!,{d8-d15} 634 ret @ bx lr 635 .size sha1_block_data_order_armv8,.-sha1_block_data_order_armv8 636 #endif 637 ___ 638 }}} 639 $code.=<<___; 640 .comm OPENSSL_armcap_P,4,4 641 ___ 642 643 { my %opcode = ( 644 "sha1c" => 0xf2000c40, "sha1p" => 0xf2100c40, 645 "sha1m" => 0xf2200c40, "sha1su0" => 0xf2300c40, 646 "sha1h" => 0xf3b902c0, "sha1su1" => 0xf3ba0380 ); 647 648 sub unsha1 { 649 my ($mnemonic,$arg)=@_; 650 651 if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) { 652 my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19) 653 |(($2&7)<<17)|(($2&8)<<4) 654 |(($3&7)<<1) |(($3&8)<<2); 655 # since ARMv7 instructions are always encoded little-endian. 656 # correct solution is to use .inst directive, but older 657 # assemblers don't implement it:-( 658 sprintf ".byte\t0x%02x,0x%02x,0x%02x,0x%02x\t@ %s %s", 659 $word&0xff,($word>>8)&0xff, 660 ($word>>16)&0xff,($word>>24)&0xff, 661 $mnemonic,$arg; 662 } 663 } 664 } 665 666 foreach (split($/,$code)) { 667 s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo or 668 s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo; 669 670 s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo; 671 672 s/\bret\b/bx lr/o or 673 s/\bbx\s+lr\b/.word\t0xe12fff1e/o; # make it possible to compile with -march=armv4 674 675 print $_,$/; 676 } 677 678 close STDOUT; # enforce flush 679
