Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 1 | #! /usr/bin/env perl |
| 2 | # Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved. |
| 3 | # |
| 4 | # Licensed under the OpenSSL license (the "License"). You may not use |
| 5 | # this file except in compliance with the License. You can obtain a copy |
| 6 | # in the file LICENSE in the source distribution or at |
| 7 | # https://www.openssl.org/source/license.html |
| 8 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 9 | |
| 10 | # ==================================================================== |
| 11 | # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL |
| 12 | # project. The module is, however, dual licensed under OpenSSL and |
| 13 | # CRYPTOGAMS licenses depending on where you obtain it. For further |
| 14 | # details see http://www.openssl.org/~appro/cryptogams/. |
| 15 | # ==================================================================== |
| 16 | |
| 17 | # sha1_block procedure for ARMv4. |
| 18 | # |
| 19 | # January 2007. |
| 20 | |
| 21 | # Size/performance trade-off |
| 22 | # ==================================================================== |
| 23 | # impl size in bytes comp cycles[*] measured performance |
| 24 | # ==================================================================== |
| 25 | # thumb 304 3212 4420 |
| 26 | # armv4-small 392/+29% 1958/+64% 2250/+96% |
| 27 | # armv4-compact 740/+89% 1552/+26% 1840/+22% |
| 28 | # armv4-large 1420/+92% 1307/+19% 1370/+34%[***] |
| 29 | # full unroll ~5100/+260% ~1260/+4% ~1300/+5% |
| 30 | # ==================================================================== |
| 31 | # thumb = same as 'small' but in Thumb instructions[**] and |
| 32 | # with recurring code in two private functions; |
| 33 | # small = detached Xload/update, loops are folded; |
| 34 | # compact = detached Xload/update, 5x unroll; |
| 35 | # large = interleaved Xload/update, 5x unroll; |
| 36 | # full unroll = interleaved Xload/update, full unroll, estimated[!]; |
| 37 | # |
| 38 | # [*] Manually counted instructions in "grand" loop body. Measured |
| 39 | # performance is affected by prologue and epilogue overhead, |
| 40 | # i-cache availability, branch penalties, etc. |
| 41 | # [**] While each Thumb instruction is twice smaller, they are not as |
| 42 | # diverse as ARM ones: e.g., there are only two arithmetic |
| 43 | # instructions with 3 arguments, no [fixed] rotate, addressing |
| 44 | # modes are limited. As result it takes more instructions to do |
| 45 | # the same job in Thumb, therefore the code is never twice as |
| 46 | # small and always slower. |
| 47 | # [***] which is also ~35% better than compiler generated code. Dual- |
| 48 | # issue Cortex A8 core was measured to process input block in |
| 49 | # ~990 cycles. |
| 50 | |
| 51 | # August 2010. |
| 52 | # |
| 53 | # Rescheduling for dual-issue pipeline resulted in 13% improvement on |
| 54 | # Cortex A8 core and in absolute terms ~870 cycles per input block |
| 55 | # [or 13.6 cycles per byte]. |
| 56 | |
| 57 | # February 2011. |
| 58 | # |
| 59 | # Profiler-assisted and platform-specific optimization resulted in 10% |
| 60 | # improvement on Cortex A8 core and 12.2 cycles per byte. |
| 61 | |
| 62 | # September 2013. |
| 63 | # |
| 64 | # Add NEON implementation (see sha1-586.pl for background info). On |
| 65 | # Cortex A8 it was measured to process one byte in 6.7 cycles or >80% |
| 66 | # faster than integer-only code. Because [fully unrolled] NEON code |
| 67 | # is ~2.5x larger and there are some redundant instructions executed |
| 68 | # when processing last block, improvement is not as big for smallest |
| 69 | # blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 70 | # byte, which is also >80% faster than integer-only code. Cortex-A15 |
| 71 | # is even faster spending 5.6 cycles per byte outperforming integer- |
| 72 | # only code by factor of 2. |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 73 | |
| 74 | # May 2014. |
| 75 | # |
| 76 | # Add ARMv8 code path performing at 2.35 cpb on Apple A7. |
| 77 | |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 78 | $flavour = shift; |
David Benjamin | c895d6b | 2016-08-11 13:26:41 -0400 | [diff] [blame] | 79 | if ($flavour=~/\w[\w\-]*\.\w+$/) { $output=$flavour; undef $flavour; } |
| 80 | else { while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} } |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 81 | |
| 82 | if ($flavour && $flavour ne "void") { |
| 83 | $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1; |
| 84 | ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or |
Robert Sloan | 572a4e2 | 2017-04-17 10:52:19 -0700 | [diff] [blame] | 85 | ( $xlate="${dir}../../../perlasm/arm-xlate.pl" and -f $xlate) or |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 86 | die "can't locate arm-xlate.pl"; |
| 87 | |
| 88 | open STDOUT,"| \"$^X\" $xlate $flavour $output"; |
| 89 | } else { |
| 90 | open STDOUT,">$output"; |
| 91 | } |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 92 | |
| 93 | $ctx="r0"; |
| 94 | $inp="r1"; |
| 95 | $len="r2"; |
| 96 | $a="r3"; |
| 97 | $b="r4"; |
| 98 | $c="r5"; |
| 99 | $d="r6"; |
| 100 | $e="r7"; |
| 101 | $K="r8"; |
| 102 | $t0="r9"; |
| 103 | $t1="r10"; |
| 104 | $t2="r11"; |
| 105 | $t3="r12"; |
| 106 | $Xi="r14"; |
| 107 | @V=($a,$b,$c,$d,$e); |
| 108 | |
| 109 | sub Xupdate { |
| 110 | my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_; |
| 111 | $code.=<<___; |
| 112 | ldr $t0,[$Xi,#15*4] |
| 113 | ldr $t1,[$Xi,#13*4] |
| 114 | ldr $t2,[$Xi,#7*4] |
| 115 | add $e,$K,$e,ror#2 @ E+=K_xx_xx |
| 116 | ldr $t3,[$Xi,#2*4] |
| 117 | eor $t0,$t0,$t1 |
| 118 | eor $t2,$t2,$t3 @ 1 cycle stall |
| 119 | eor $t1,$c,$d @ F_xx_xx |
| 120 | mov $t0,$t0,ror#31 |
| 121 | add $e,$e,$a,ror#27 @ E+=ROR(A,27) |
| 122 | eor $t0,$t0,$t2,ror#31 |
| 123 | str $t0,[$Xi,#-4]! |
| 124 | $opt1 @ F_xx_xx |
| 125 | $opt2 @ F_xx_xx |
| 126 | add $e,$e,$t0 @ E+=X[i] |
| 127 | ___ |
| 128 | } |
| 129 | |
| 130 | sub BODY_00_15 { |
| 131 | my ($a,$b,$c,$d,$e)=@_; |
| 132 | $code.=<<___; |
| 133 | #if __ARM_ARCH__<7 |
| 134 | ldrb $t1,[$inp,#2] |
| 135 | ldrb $t0,[$inp,#3] |
| 136 | ldrb $t2,[$inp,#1] |
| 137 | add $e,$K,$e,ror#2 @ E+=K_00_19 |
| 138 | ldrb $t3,[$inp],#4 |
| 139 | orr $t0,$t0,$t1,lsl#8 |
| 140 | eor $t1,$c,$d @ F_xx_xx |
| 141 | orr $t0,$t0,$t2,lsl#16 |
| 142 | add $e,$e,$a,ror#27 @ E+=ROR(A,27) |
| 143 | orr $t0,$t0,$t3,lsl#24 |
| 144 | #else |
| 145 | ldr $t0,[$inp],#4 @ handles unaligned |
| 146 | add $e,$K,$e,ror#2 @ E+=K_00_19 |
| 147 | eor $t1,$c,$d @ F_xx_xx |
| 148 | add $e,$e,$a,ror#27 @ E+=ROR(A,27) |
| 149 | #ifdef __ARMEL__ |
| 150 | rev $t0,$t0 @ byte swap |
| 151 | #endif |
| 152 | #endif |
| 153 | and $t1,$b,$t1,ror#2 |
| 154 | add $e,$e,$t0 @ E+=X[i] |
| 155 | eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D) |
| 156 | str $t0,[$Xi,#-4]! |
| 157 | add $e,$e,$t1 @ E+=F_00_19(B,C,D) |
| 158 | ___ |
| 159 | } |
| 160 | |
| 161 | sub BODY_16_19 { |
| 162 | my ($a,$b,$c,$d,$e)=@_; |
| 163 | &Xupdate(@_,"and $t1,$b,$t1,ror#2"); |
| 164 | $code.=<<___; |
| 165 | eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D) |
| 166 | add $e,$e,$t1 @ E+=F_00_19(B,C,D) |
| 167 | ___ |
| 168 | } |
| 169 | |
| 170 | sub BODY_20_39 { |
| 171 | my ($a,$b,$c,$d,$e)=@_; |
| 172 | &Xupdate(@_,"eor $t1,$b,$t1,ror#2"); |
| 173 | $code.=<<___; |
| 174 | add $e,$e,$t1 @ E+=F_20_39(B,C,D) |
| 175 | ___ |
| 176 | } |
| 177 | |
| 178 | sub BODY_40_59 { |
| 179 | my ($a,$b,$c,$d,$e)=@_; |
| 180 | &Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d"); |
| 181 | $code.=<<___; |
| 182 | add $e,$e,$t1 @ E+=F_40_59(B,C,D) |
| 183 | add $e,$e,$t2,ror#2 |
| 184 | ___ |
| 185 | } |
| 186 | |
| 187 | $code=<<___; |
Kenny Root | b849459 | 2015-09-25 02:29:14 +0000 | [diff] [blame] | 188 | #include <openssl/arm_arch.h> |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 189 | |
| 190 | .text |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 191 | #if defined(__thumb2__) |
| 192 | .syntax unified |
| 193 | .thumb |
| 194 | #else |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 195 | .code 32 |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 196 | #endif |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 197 | |
| 198 | .global sha1_block_data_order |
| 199 | .type sha1_block_data_order,%function |
| 200 | |
| 201 | .align 5 |
| 202 | sha1_block_data_order: |
| 203 | #if __ARM_MAX_ARCH__>=7 |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 204 | .Lsha1_block: |
| 205 | adr r3,.Lsha1_block |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 206 | ldr r12,.LOPENSSL_armcap |
| 207 | ldr r12,[r3,r12] @ OPENSSL_armcap_P |
Adam Langley | e9ada86 | 2015-05-11 17:20:37 -0700 | [diff] [blame] | 208 | #ifdef __APPLE__ |
| 209 | ldr r12,[r12] |
| 210 | #endif |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 211 | tst r12,#ARMV8_SHA1 |
| 212 | bne .LARMv8 |
| 213 | tst r12,#ARMV7_NEON |
| 214 | bne .LNEON |
| 215 | #endif |
| 216 | stmdb sp!,{r4-r12,lr} |
| 217 | add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp |
| 218 | ldmia $ctx,{$a,$b,$c,$d,$e} |
| 219 | .Lloop: |
| 220 | ldr $K,.LK_00_19 |
| 221 | mov $Xi,sp |
| 222 | sub sp,sp,#15*4 |
| 223 | mov $c,$c,ror#30 |
| 224 | mov $d,$d,ror#30 |
| 225 | mov $e,$e,ror#30 @ [6] |
| 226 | .L_00_15: |
| 227 | ___ |
| 228 | for($i=0;$i<5;$i++) { |
| 229 | &BODY_00_15(@V); unshift(@V,pop(@V)); |
| 230 | } |
| 231 | $code.=<<___; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 232 | #if defined(__thumb2__) |
| 233 | mov $t3,sp |
| 234 | teq $Xi,$t3 |
| 235 | #else |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 236 | teq $Xi,sp |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 237 | #endif |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 238 | bne .L_00_15 @ [((11+4)*5+2)*3] |
| 239 | sub sp,sp,#25*4 |
| 240 | ___ |
| 241 | &BODY_00_15(@V); unshift(@V,pop(@V)); |
| 242 | &BODY_16_19(@V); unshift(@V,pop(@V)); |
| 243 | &BODY_16_19(@V); unshift(@V,pop(@V)); |
| 244 | &BODY_16_19(@V); unshift(@V,pop(@V)); |
| 245 | &BODY_16_19(@V); unshift(@V,pop(@V)); |
| 246 | $code.=<<___; |
| 247 | |
| 248 | ldr $K,.LK_20_39 @ [+15+16*4] |
| 249 | cmn sp,#0 @ [+3], clear carry to denote 20_39 |
| 250 | .L_20_39_or_60_79: |
| 251 | ___ |
| 252 | for($i=0;$i<5;$i++) { |
| 253 | &BODY_20_39(@V); unshift(@V,pop(@V)); |
| 254 | } |
| 255 | $code.=<<___; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 256 | #if defined(__thumb2__) |
| 257 | mov $t3,sp |
| 258 | teq $Xi,$t3 |
| 259 | #else |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 260 | teq $Xi,sp @ preserve carry |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 261 | #endif |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 262 | bne .L_20_39_or_60_79 @ [+((12+3)*5+2)*4] |
| 263 | bcs .L_done @ [+((12+3)*5+2)*4], spare 300 bytes |
| 264 | |
| 265 | ldr $K,.LK_40_59 |
| 266 | sub sp,sp,#20*4 @ [+2] |
| 267 | .L_40_59: |
| 268 | ___ |
| 269 | for($i=0;$i<5;$i++) { |
| 270 | &BODY_40_59(@V); unshift(@V,pop(@V)); |
| 271 | } |
| 272 | $code.=<<___; |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 273 | #if defined(__thumb2__) |
| 274 | mov $t3,sp |
| 275 | teq $Xi,$t3 |
| 276 | #else |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 277 | teq $Xi,sp |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 278 | #endif |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 279 | bne .L_40_59 @ [+((12+5)*5+2)*4] |
| 280 | |
| 281 | ldr $K,.LK_60_79 |
| 282 | sub sp,sp,#20*4 |
| 283 | cmp sp,#0 @ set carry to denote 60_79 |
| 284 | b .L_20_39_or_60_79 @ [+4], spare 300 bytes |
| 285 | .L_done: |
| 286 | add sp,sp,#80*4 @ "deallocate" stack frame |
| 287 | ldmia $ctx,{$K,$t0,$t1,$t2,$t3} |
| 288 | add $a,$K,$a |
| 289 | add $b,$t0,$b |
| 290 | add $c,$t1,$c,ror#2 |
| 291 | add $d,$t2,$d,ror#2 |
| 292 | add $e,$t3,$e,ror#2 |
| 293 | stmia $ctx,{$a,$b,$c,$d,$e} |
| 294 | teq $inp,$len |
| 295 | bne .Lloop @ [+18], total 1307 |
| 296 | |
| 297 | #if __ARM_ARCH__>=5 |
| 298 | ldmia sp!,{r4-r12,pc} |
| 299 | #else |
| 300 | ldmia sp!,{r4-r12,lr} |
| 301 | tst lr,#1 |
| 302 | moveq pc,lr @ be binary compatible with V4, yet |
| 303 | bx lr @ interoperable with Thumb ISA:-) |
| 304 | #endif |
| 305 | .size sha1_block_data_order,.-sha1_block_data_order |
| 306 | |
| 307 | .align 5 |
| 308 | .LK_00_19: .word 0x5a827999 |
| 309 | .LK_20_39: .word 0x6ed9eba1 |
| 310 | .LK_40_59: .word 0x8f1bbcdc |
| 311 | .LK_60_79: .word 0xca62c1d6 |
| 312 | #if __ARM_MAX_ARCH__>=7 |
| 313 | .LOPENSSL_armcap: |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 314 | .word OPENSSL_armcap_P-.Lsha1_block |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 315 | #endif |
| 316 | .asciz "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>" |
| 317 | .align 5 |
| 318 | ___ |
| 319 | ##################################################################### |
| 320 | # NEON stuff |
| 321 | # |
| 322 | {{{ |
| 323 | my @V=($a,$b,$c,$d,$e); |
| 324 | my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14)); |
| 325 | my $Xi=4; |
| 326 | my @X=map("q$_",(8..11,0..3)); |
| 327 | my @Tx=("q12","q13"); |
| 328 | my ($K,$zero)=("q14","q15"); |
| 329 | my $j=0; |
| 330 | |
| 331 | sub AUTOLOAD() # thunk [simplified] x86-style perlasm |
| 332 | { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./; |
| 333 | my $arg = pop; |
| 334 | $arg = "#$arg" if ($arg*1 eq $arg); |
| 335 | $code .= "\t$opcode\t".join(',',@_,$arg)."\n"; |
| 336 | } |
| 337 | |
| 338 | sub body_00_19 () { |
| 339 | ( |
| 340 | '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. |
| 341 | '&bic ($t0,$d,$b)', |
| 342 | '&add ($e,$e,$Ki)', # e+=X[i]+K |
| 343 | '&and ($t1,$c,$b)', |
| 344 | '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))', |
| 345 | '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) |
| 346 | '&eor ($t1,$t1,$t0)', # F_00_19 |
| 347 | '&mov ($b,$b,"ror#2")', # b=ROR(b,2) |
| 348 | '&add ($e,$e,$t1);'. # e+=F_00_19 |
| 349 | '$j++; unshift(@V,pop(@V));' |
| 350 | ) |
| 351 | } |
| 352 | sub body_20_39 () { |
| 353 | ( |
| 354 | '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. |
| 355 | '&eor ($t0,$b,$d)', |
| 356 | '&add ($e,$e,$Ki)', # e+=X[i]+K |
| 357 | '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)', |
| 358 | '&eor ($t1,$t0,$c)', # F_20_39 |
| 359 | '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) |
| 360 | '&mov ($b,$b,"ror#2")', # b=ROR(b,2) |
| 361 | '&add ($e,$e,$t1);'. # e+=F_20_39 |
| 362 | '$j++; unshift(@V,pop(@V));' |
| 363 | ) |
| 364 | } |
| 365 | sub body_40_59 () { |
| 366 | ( |
| 367 | '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. |
| 368 | '&add ($e,$e,$Ki)', # e+=X[i]+K |
| 369 | '&and ($t0,$c,$d)', |
| 370 | '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))', |
| 371 | '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) |
| 372 | '&eor ($t1,$c,$d)', |
| 373 | '&add ($e,$e,$t0)', |
| 374 | '&and ($t1,$t1,$b)', |
| 375 | '&mov ($b,$b,"ror#2")', # b=ROR(b,2) |
| 376 | '&add ($e,$e,$t1);'. # e+=F_40_59 |
| 377 | '$j++; unshift(@V,pop(@V));' |
| 378 | ) |
| 379 | } |
| 380 | |
| 381 | sub Xupdate_16_31 () |
| 382 | { use integer; |
| 383 | my $body = shift; |
| 384 | my @insns = (&$body,&$body,&$body,&$body); |
| 385 | my ($a,$b,$c,$d,$e); |
| 386 | |
| 387 | &vext_8 (@X[0],@X[-4&7],@X[-3&7],8); # compose "X[-14]" in "X[0]" |
| 388 | eval(shift(@insns)); |
| 389 | eval(shift(@insns)); |
| 390 | eval(shift(@insns)); |
| 391 | &vadd_i32 (@Tx[1],@X[-1&7],$K); |
| 392 | eval(shift(@insns)); |
| 393 | &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0); |
| 394 | eval(shift(@insns)); |
| 395 | &vext_8 (@Tx[0],@X[-1&7],$zero,4); # "X[-3]", 3 words |
| 396 | eval(shift(@insns)); |
| 397 | eval(shift(@insns)); |
| 398 | eval(shift(@insns)); |
| 399 | &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"^="X[-16]" |
| 400 | eval(shift(@insns)); |
| 401 | eval(shift(@insns)); |
| 402 | &veor (@Tx[0],@Tx[0],@X[-2&7]); # "X[-3]"^"X[-8]" |
| 403 | eval(shift(@insns)); |
| 404 | eval(shift(@insns)); |
| 405 | &veor (@Tx[0],@Tx[0],@X[0]); # "X[0]"^="X[-3]"^"X[-8] |
| 406 | eval(shift(@insns)); |
| 407 | eval(shift(@insns)); |
| 408 | &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer |
| 409 | &sub ($Xfer,$Xfer,64) if ($Xi%4==0); |
| 410 | eval(shift(@insns)); |
| 411 | eval(shift(@insns)); |
| 412 | &vext_8 (@Tx[1],$zero,@Tx[0],4); # "X[0]"<<96, extract one dword |
| 413 | eval(shift(@insns)); |
| 414 | eval(shift(@insns)); |
| 415 | &vadd_i32 (@X[0],@Tx[0],@Tx[0]); |
| 416 | eval(shift(@insns)); |
| 417 | eval(shift(@insns)); |
| 418 | &vsri_32 (@X[0],@Tx[0],31); # "X[0]"<<<=1 |
| 419 | eval(shift(@insns)); |
| 420 | eval(shift(@insns)); |
| 421 | eval(shift(@insns)); |
| 422 | &vshr_u32 (@Tx[0],@Tx[1],30); |
| 423 | eval(shift(@insns)); |
| 424 | eval(shift(@insns)); |
| 425 | &vshl_u32 (@Tx[1],@Tx[1],2); |
| 426 | eval(shift(@insns)); |
| 427 | eval(shift(@insns)); |
| 428 | &veor (@X[0],@X[0],@Tx[0]); |
| 429 | eval(shift(@insns)); |
| 430 | eval(shift(@insns)); |
| 431 | &veor (@X[0],@X[0],@Tx[1]); # "X[0]"^=("X[0]">>96)<<<2 |
| 432 | |
| 433 | foreach (@insns) { eval; } # remaining instructions [if any] |
| 434 | |
| 435 | $Xi++; push(@X,shift(@X)); # "rotate" X[] |
| 436 | } |
| 437 | |
| 438 | sub Xupdate_32_79 () |
| 439 | { use integer; |
| 440 | my $body = shift; |
| 441 | my @insns = (&$body,&$body,&$body,&$body); |
| 442 | my ($a,$b,$c,$d,$e); |
| 443 | |
| 444 | &vext_8 (@Tx[0],@X[-2&7],@X[-1&7],8); # compose "X[-6]" |
| 445 | eval(shift(@insns)); |
| 446 | eval(shift(@insns)); |
| 447 | eval(shift(@insns)); |
| 448 | &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"="X[-32]"^"X[-16]" |
| 449 | eval(shift(@insns)); |
| 450 | eval(shift(@insns)); |
| 451 | &veor (@X[0],@X[0],@X[-7&7]); # "X[0]"^="X[-28]" |
| 452 | eval(shift(@insns)); |
| 453 | eval(shift(@insns)); |
| 454 | &vadd_i32 (@Tx[1],@X[-1&7],$K); |
| 455 | eval(shift(@insns)); |
| 456 | &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0); |
| 457 | eval(shift(@insns)); |
| 458 | &veor (@Tx[0],@Tx[0],@X[0]); # "X[-6]"^="X[0]" |
| 459 | eval(shift(@insns)); |
| 460 | eval(shift(@insns)); |
| 461 | &vshr_u32 (@X[0],@Tx[0],30); |
| 462 | eval(shift(@insns)); |
| 463 | eval(shift(@insns)); |
| 464 | &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer |
| 465 | &sub ($Xfer,$Xfer,64) if ($Xi%4==0); |
| 466 | eval(shift(@insns)); |
| 467 | eval(shift(@insns)); |
| 468 | &vsli_32 (@X[0],@Tx[0],2); # "X[0]"="X[-6]"<<<2 |
| 469 | |
| 470 | foreach (@insns) { eval; } # remaining instructions [if any] |
| 471 | |
| 472 | $Xi++; push(@X,shift(@X)); # "rotate" X[] |
| 473 | } |
| 474 | |
| 475 | sub Xuplast_80 () |
| 476 | { use integer; |
| 477 | my $body = shift; |
| 478 | my @insns = (&$body,&$body,&$body,&$body); |
| 479 | my ($a,$b,$c,$d,$e); |
| 480 | |
| 481 | &vadd_i32 (@Tx[1],@X[-1&7],$K); |
| 482 | eval(shift(@insns)); |
| 483 | eval(shift(@insns)); |
| 484 | &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); |
| 485 | &sub ($Xfer,$Xfer,64); |
| 486 | |
| 487 | &teq ($inp,$len); |
| 488 | &sub ($K_XX_XX,$K_XX_XX,16); # rewind $K_XX_XX |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 489 | &it ("eq"); |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 490 | &subeq ($inp,$inp,64); # reload last block to avoid SEGV |
| 491 | &vld1_8 ("{@X[-4&7]-@X[-3&7]}","[$inp]!"); |
| 492 | eval(shift(@insns)); |
| 493 | eval(shift(@insns)); |
| 494 | &vld1_8 ("{@X[-2&7]-@X[-1&7]}","[$inp]!"); |
| 495 | eval(shift(@insns)); |
| 496 | eval(shift(@insns)); |
| 497 | &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!"); # load K_00_19 |
| 498 | eval(shift(@insns)); |
| 499 | eval(shift(@insns)); |
| 500 | &vrev32_8 (@X[-4&7],@X[-4&7]); |
| 501 | |
| 502 | foreach (@insns) { eval; } # remaining instructions |
| 503 | |
| 504 | $Xi=0; |
| 505 | } |
| 506 | |
| 507 | sub Xloop() |
| 508 | { use integer; |
| 509 | my $body = shift; |
| 510 | my @insns = (&$body,&$body,&$body,&$body); |
| 511 | my ($a,$b,$c,$d,$e); |
| 512 | |
| 513 | &vrev32_8 (@X[($Xi-3)&7],@X[($Xi-3)&7]); |
| 514 | eval(shift(@insns)); |
| 515 | eval(shift(@insns)); |
| 516 | &vadd_i32 (@X[$Xi&7],@X[($Xi-4)&7],$K); |
| 517 | eval(shift(@insns)); |
| 518 | eval(shift(@insns)); |
| 519 | &vst1_32 ("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU |
| 520 | |
| 521 | foreach (@insns) { eval; } |
| 522 | |
| 523 | $Xi++; |
| 524 | } |
| 525 | |
| 526 | $code.=<<___; |
| 527 | #if __ARM_MAX_ARCH__>=7 |
| 528 | .arch armv7-a |
| 529 | .fpu neon |
| 530 | |
| 531 | .type sha1_block_data_order_neon,%function |
| 532 | .align 4 |
| 533 | sha1_block_data_order_neon: |
| 534 | .LNEON: |
| 535 | stmdb sp!,{r4-r12,lr} |
| 536 | add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp |
| 537 | @ dmb @ errata #451034 on early Cortex A8 |
| 538 | @ vstmdb sp!,{d8-d15} @ ABI specification says so |
| 539 | mov $saved_sp,sp |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 540 | sub $Xfer,sp,#64 |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 541 | adr $K_XX_XX,.LK_00_19 |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 542 | bic $Xfer,$Xfer,#15 @ align for 128-bit stores |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 543 | |
| 544 | ldmia $ctx,{$a,$b,$c,$d,$e} @ load context |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 545 | mov sp,$Xfer @ alloca |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 546 | |
| 547 | vld1.8 {@X[-4&7]-@X[-3&7]},[$inp]! @ handles unaligned |
| 548 | veor $zero,$zero,$zero |
| 549 | vld1.8 {@X[-2&7]-@X[-1&7]},[$inp]! |
| 550 | vld1.32 {${K}\[]},[$K_XX_XX,:32]! @ load K_00_19 |
| 551 | vrev32.8 @X[-4&7],@X[-4&7] @ yes, even on |
| 552 | vrev32.8 @X[-3&7],@X[-3&7] @ big-endian... |
| 553 | vrev32.8 @X[-2&7],@X[-2&7] |
| 554 | vadd.i32 @X[0],@X[-4&7],$K |
| 555 | vrev32.8 @X[-1&7],@X[-1&7] |
| 556 | vadd.i32 @X[1],@X[-3&7],$K |
| 557 | vst1.32 {@X[0]},[$Xfer,:128]! |
| 558 | vadd.i32 @X[2],@X[-2&7],$K |
| 559 | vst1.32 {@X[1]},[$Xfer,:128]! |
| 560 | vst1.32 {@X[2]},[$Xfer,:128]! |
| 561 | ldr $Ki,[sp] @ big RAW stall |
| 562 | |
| 563 | .Loop_neon: |
| 564 | ___ |
| 565 | &Xupdate_16_31(\&body_00_19); |
| 566 | &Xupdate_16_31(\&body_00_19); |
| 567 | &Xupdate_16_31(\&body_00_19); |
| 568 | &Xupdate_16_31(\&body_00_19); |
| 569 | &Xupdate_32_79(\&body_00_19); |
| 570 | &Xupdate_32_79(\&body_20_39); |
| 571 | &Xupdate_32_79(\&body_20_39); |
| 572 | &Xupdate_32_79(\&body_20_39); |
| 573 | &Xupdate_32_79(\&body_20_39); |
| 574 | &Xupdate_32_79(\&body_20_39); |
| 575 | &Xupdate_32_79(\&body_40_59); |
| 576 | &Xupdate_32_79(\&body_40_59); |
| 577 | &Xupdate_32_79(\&body_40_59); |
| 578 | &Xupdate_32_79(\&body_40_59); |
| 579 | &Xupdate_32_79(\&body_40_59); |
| 580 | &Xupdate_32_79(\&body_20_39); |
| 581 | &Xuplast_80(\&body_20_39); |
| 582 | &Xloop(\&body_20_39); |
| 583 | &Xloop(\&body_20_39); |
| 584 | &Xloop(\&body_20_39); |
| 585 | $code.=<<___; |
| 586 | ldmia $ctx,{$Ki,$t0,$t1,$Xfer} @ accumulate context |
| 587 | add $a,$a,$Ki |
| 588 | ldr $Ki,[$ctx,#16] |
| 589 | add $b,$b,$t0 |
| 590 | add $c,$c,$t1 |
| 591 | add $d,$d,$Xfer |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 592 | it eq |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 593 | moveq sp,$saved_sp |
| 594 | add $e,$e,$Ki |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 595 | it ne |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 596 | ldrne $Ki,[sp] |
| 597 | stmia $ctx,{$a,$b,$c,$d,$e} |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 598 | itt ne |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 599 | addne $Xfer,sp,#3*16 |
| 600 | bne .Loop_neon |
| 601 | |
| 602 | @ vldmia sp!,{d8-d15} |
| 603 | ldmia sp!,{r4-r12,pc} |
| 604 | .size sha1_block_data_order_neon,.-sha1_block_data_order_neon |
| 605 | #endif |
| 606 | ___ |
| 607 | }}} |
| 608 | ##################################################################### |
| 609 | # ARMv8 stuff |
| 610 | # |
| 611 | {{{ |
| 612 | my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3)); |
| 613 | my @MSG=map("q$_",(4..7)); |
| 614 | my @Kxx=map("q$_",(8..11)); |
| 615 | my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14)); |
| 616 | |
| 617 | $code.=<<___; |
| 618 | #if __ARM_MAX_ARCH__>=7 |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 619 | |
| 620 | # if defined(__thumb2__) |
| 621 | # define INST(a,b,c,d) .byte c,d|0xf,a,b |
| 622 | # else |
| 623 | # define INST(a,b,c,d) .byte a,b,c,d|0x10 |
| 624 | # endif |
| 625 | |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 626 | .type sha1_block_data_order_armv8,%function |
| 627 | .align 5 |
| 628 | sha1_block_data_order_armv8: |
| 629 | .LARMv8: |
| 630 | vstmdb sp!,{d8-d15} @ ABI specification says so |
| 631 | |
| 632 | veor $E,$E,$E |
| 633 | adr r3,.LK_00_19 |
| 634 | vld1.32 {$ABCD},[$ctx]! |
| 635 | vld1.32 {$E\[0]},[$ctx] |
| 636 | sub $ctx,$ctx,#16 |
| 637 | vld1.32 {@Kxx[0]\[]},[r3,:32]! |
| 638 | vld1.32 {@Kxx[1]\[]},[r3,:32]! |
| 639 | vld1.32 {@Kxx[2]\[]},[r3,:32]! |
| 640 | vld1.32 {@Kxx[3]\[]},[r3,:32] |
| 641 | |
| 642 | .Loop_v8: |
| 643 | vld1.8 {@MSG[0]-@MSG[1]},[$inp]! |
| 644 | vld1.8 {@MSG[2]-@MSG[3]},[$inp]! |
| 645 | vrev32.8 @MSG[0],@MSG[0] |
| 646 | vrev32.8 @MSG[1],@MSG[1] |
| 647 | |
| 648 | vadd.i32 $W0,@Kxx[0],@MSG[0] |
| 649 | vrev32.8 @MSG[2],@MSG[2] |
| 650 | vmov $ABCD_SAVE,$ABCD @ offload |
| 651 | subs $len,$len,#1 |
| 652 | |
| 653 | vadd.i32 $W1,@Kxx[0],@MSG[1] |
| 654 | vrev32.8 @MSG[3],@MSG[3] |
| 655 | sha1h $E1,$ABCD @ 0 |
| 656 | sha1c $ABCD,$E,$W0 |
| 657 | vadd.i32 $W0,@Kxx[$j],@MSG[2] |
| 658 | sha1su0 @MSG[0],@MSG[1],@MSG[2] |
| 659 | ___ |
| 660 | for ($j=0,$i=1;$i<20-3;$i++) { |
| 661 | my $f=("c","p","m","p")[$i/5]; |
| 662 | $code.=<<___; |
| 663 | sha1h $E0,$ABCD @ $i |
| 664 | sha1$f $ABCD,$E1,$W1 |
| 665 | vadd.i32 $W1,@Kxx[$j],@MSG[3] |
| 666 | sha1su1 @MSG[0],@MSG[3] |
| 667 | ___ |
| 668 | $code.=<<___ if ($i<20-4); |
| 669 | sha1su0 @MSG[1],@MSG[2],@MSG[3] |
| 670 | ___ |
| 671 | ($E0,$E1)=($E1,$E0); ($W0,$W1)=($W1,$W0); |
| 672 | push(@MSG,shift(@MSG)); $j++ if ((($i+3)%5)==0); |
| 673 | } |
| 674 | $code.=<<___; |
| 675 | sha1h $E0,$ABCD @ $i |
| 676 | sha1p $ABCD,$E1,$W1 |
| 677 | vadd.i32 $W1,@Kxx[$j],@MSG[3] |
| 678 | |
| 679 | sha1h $E1,$ABCD @ 18 |
| 680 | sha1p $ABCD,$E0,$W0 |
| 681 | |
| 682 | sha1h $E0,$ABCD @ 19 |
| 683 | sha1p $ABCD,$E1,$W1 |
| 684 | |
| 685 | vadd.i32 $E,$E,$E0 |
| 686 | vadd.i32 $ABCD,$ABCD,$ABCD_SAVE |
| 687 | bne .Loop_v8 |
| 688 | |
| 689 | vst1.32 {$ABCD},[$ctx]! |
| 690 | vst1.32 {$E\[0]},[$ctx] |
| 691 | |
| 692 | vldmia sp!,{d8-d15} |
| 693 | ret @ bx lr |
| 694 | .size sha1_block_data_order_armv8,.-sha1_block_data_order_armv8 |
| 695 | #endif |
| 696 | ___ |
| 697 | }}} |
| 698 | $code.=<<___; |
| 699 | #if __ARM_MAX_ARCH__>=7 |
| 700 | .comm OPENSSL_armcap_P,4,4 |
Adam Langley | 13066f1 | 2015-02-13 14:47:35 -0800 | [diff] [blame] | 701 | .hidden OPENSSL_armcap_P |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 702 | #endif |
| 703 | ___ |
| 704 | |
| 705 | { my %opcode = ( |
| 706 | "sha1c" => 0xf2000c40, "sha1p" => 0xf2100c40, |
| 707 | "sha1m" => 0xf2200c40, "sha1su0" => 0xf2300c40, |
| 708 | "sha1h" => 0xf3b902c0, "sha1su1" => 0xf3ba0380 ); |
| 709 | |
| 710 | sub unsha1 { |
| 711 | my ($mnemonic,$arg)=@_; |
| 712 | |
| 713 | if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) { |
| 714 | my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19) |
| 715 | |(($2&7)<<17)|(($2&8)<<4) |
| 716 | |(($3&7)<<1) |(($3&8)<<2); |
| 717 | # since ARMv7 instructions are always encoded little-endian. |
| 718 | # correct solution is to use .inst directive, but older |
| 719 | # assemblers don't implement it:-( |
Robert Sloan | 8ff0355 | 2017-06-14 12:40:58 -0700 | [diff] [blame] | 720 | |
| 721 | # this fix-up provides Thumb encoding in conjunction with INST |
| 722 | $word &= ~0x10000000 if (($word & 0x0f000000) == 0x02000000); |
| 723 | sprintf "INST(0x%02x,0x%02x,0x%02x,0x%02x)\t@ %s %s", |
Adam Langley | d9e397b | 2015-01-22 14:27:53 -0800 | [diff] [blame] | 724 | $word&0xff,($word>>8)&0xff, |
| 725 | ($word>>16)&0xff,($word>>24)&0xff, |
| 726 | $mnemonic,$arg; |
| 727 | } |
| 728 | } |
| 729 | } |
| 730 | |
| 731 | foreach (split($/,$code)) { |
| 732 | s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo or |
| 733 | s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo; |
| 734 | |
| 735 | s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo; |
| 736 | |
| 737 | s/\bret\b/bx lr/o or |
| 738 | s/\bbx\s+lr\b/.word\t0xe12fff1e/o; # make it possible to compile with -march=armv4 |
| 739 | |
| 740 | print $_,$/; |
| 741 | } |
| 742 | |
Pete Bentley | 0c61efe | 2019-08-13 09:32:23 +0100 | [diff] [blame^] | 743 | close STDOUT or die "error closing STDOUT"; # enforce flush |