crypto/sha/asm/sha1-armv4-large.pl

   1 #!/usr/bin/env perl
   2
   3 # ====================================================================
   4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
   5 # project. The module is, however, dual licensed under OpenSSL and
   6 # CRYPTOGAMS licenses depending on where you obtain it. For further
   7 # details see http://www.openssl.org/~appro/cryptogams/.
   8 # ====================================================================
   9
  10 # sha1_block procedure for ARMv4.
  11 #
  12 # January 2007.
  13
  14 # Size/performance trade-off
  15 # ====================================================================
  16 # impl          size in bytes   comp cycles[*]  measured performance
  17 # ====================================================================
  18 # thumb         304             3212            4420
  19 # armv4-small   392/+29%        1958/+64%       2250/+96%
  20 # armv4-compact 740/+89%        1552/+26%       1840/+22%
  21 # armv4-large   1420/+92%       1307/+19%       1370/+34%[***]
  22 # full unroll   ~5100/+260%     ~1260/+4%       ~1300/+5%
  23 # ====================================================================
  24 # thumb         = same as 'small' but in Thumb instructions[**] and
  25 #                 with recurring code in two private functions;
  26 # small         = detached Xload/update, loops are folded;
  27 # compact       = detached Xload/update, 5x unroll;
  28 # large         = interleaved Xload/update, 5x unroll;
  29 # full unroll   = interleaved Xload/update, full unroll, estimated[!];
  30 #
  31 # [*]   Manually counted instructions in "grand" loop body. Measured
  32 #       performance is affected by prologue and epilogue overhead,
  33 #       i-cache availability, branch penalties, etc.
  34 # [**]  While each Thumb instruction is twice smaller, they are not as
  35 #       diverse as ARM ones: e.g., there are only two arithmetic
  36 #       instructions with 3 arguments, no [fixed] rotate, addressing
  37 #       modes are limited. As result it takes more instructions to do
  38 #       the same job in Thumb, therefore the code is never twice as
  39 #       small and always slower.
  40 # [***] which is also ~35% better than compiler generated code. Dual-
  41 #       issue Cortex A8 core was measured to process input block in
  42 #       ~990 cycles.
  43
  44 # August 2010.
  45 #
  46 # Rescheduling for dual-issue pipeline resulted in 13% improvement on
  47 # Cortex A8 core and in absolute terms ~870 cycles per input block
  48 # [or 13.6 cycles per byte].
  49
  50 # February 2011.
  51 #
  52 # Profiler-assisted and platform-specific optimization resulted in 10%
  53 # improvement on Cortex A8 core and 12.2 cycles per byte.
  54
  55 # September 2013.
  56 #
  57 # Add NEON implementation (see sha1-586.pl for background info). On
  58 # Cortex A8 it was measured to process one byte in 6.7 cycles or >80%
  59 # faster than integer-only code. Because [fully unrolled] NEON code
  60 # is ~2.5x larger and there are some redundant instructions executed
  61 # when processing last block, improvement is not as big for smallest
  62 # blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per
  63 # byte, which is also >80% faster than integer-only code.
  64
  65 # May 2014.
  66 #
  67 # Add ARMv8 code path performing at 2.35 cpb on Apple A7.
  68
  69 while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {}
  70 open STDOUT,">$output";
  71
  72 $ctx="r0";
  73 $inp="r1";
  74 $len="r2";
  75 $a="r3";
  76 $b="r4";
  77 $c="r5";
  78 $d="r6";
  79 $e="r7";
  80 $K="r8";
  81 $t0="r9";
  82 $t1="r10";
  83 $t2="r11";
  84 $t3="r12";
  85 $Xi="r14";
  86 @V=($a,$b,$c,$d,$e);
  87
  88 sub Xupdate {
  89 my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_;
  90 $code.=<<___;
  91         ldr     $t0,[$Xi,#15*4]
  92         ldr     $t1,[$Xi,#13*4]
  93         ldr     $t2,[$Xi,#7*4]
  94         add     $e,$K,$e,ror#2                  @ E+=K_xx_xx
  95         ldr     $t3,[$Xi,#2*4]
  96         eor     $t0,$t0,$t1
  97         eor     $t2,$t2,$t3                     @ 1 cycle stall
  98         eor     $t1,$c,$d                       @ F_xx_xx
  99         mov     $t0,$t0,ror#31
 100         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 101         eor     $t0,$t0,$t2,ror#31
 102         str     $t0,[$Xi,#-4]!
 103         $opt1                                   @ F_xx_xx
 104         $opt2                                   @ F_xx_xx
 105         add     $e,$e,$t0                       @ E+=X[i]
 106 ___
 107 }
 108
 109 sub BODY_00_15 {
 110 my ($a,$b,$c,$d,$e)=@_;
 111 $code.=<<___;
 112 #if __ARM_ARCH__<7
 113         ldrb    $t1,[$inp,#2]
 114         ldrb    $t0,[$inp,#3]
 115         ldrb    $t2,[$inp,#1]
 116         add     $e,$K,$e,ror#2                  @ E+=K_00_19
 117         ldrb    $t3,[$inp],#4
 118         orr     $t0,$t0,$t1,lsl#8
 119         eor     $t1,$c,$d                       @ F_xx_xx
 120         orr     $t0,$t0,$t2,lsl#16
 121         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 122         orr     $t0,$t0,$t3,lsl#24
 123 #else
 124         ldr     $t0,[$inp],#4                   @ handles unaligned
 125         add     $e,$K,$e,ror#2                  @ E+=K_00_19
 126         eor     $t1,$c,$d                       @ F_xx_xx
 127         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 128 #ifdef __ARMEL__
 129         rev     $t0,$t0                         @ byte swap
 130 #endif
 131 #endif
 132         and     $t1,$b,$t1,ror#2
 133         add     $e,$e,$t0                       @ E+=X[i]
 134         eor     $t1,$t1,$d,ror#2                @ F_00_19(B,C,D)
 135         str     $t0,[$Xi,#-4]!
 136         add     $e,$e,$t1                       @ E+=F_00_19(B,C,D)
 137 ___
 138 }
 139
 140 sub BODY_16_19 {
 141 my ($a,$b,$c,$d,$e)=@_;
 142         &Xupdate(@_,"and $t1,$b,$t1,ror#2");
 143 $code.=<<___;
 144         eor     $t1,$t1,$d,ror#2                @ F_00_19(B,C,D)
 145         add     $e,$e,$t1                       @ E+=F_00_19(B,C,D)
 146 ___
 147 }
 148
 149 sub BODY_20_39 {
 150 my ($a,$b,$c,$d,$e)=@_;
 151         &Xupdate(@_,"eor $t1,$b,$t1,ror#2");
 152 $code.=<<___;
 153         add     $e,$e,$t1                       @ E+=F_20_39(B,C,D)
 154 ___
 155 }
 156
 157 sub BODY_40_59 {
 158 my ($a,$b,$c,$d,$e)=@_;
 159         &Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d");
 160 $code.=<<___;
 161         add     $e,$e,$t1                       @ E+=F_40_59(B,C,D)
 162         add     $e,$e,$t2,ror#2
 163 ___
 164 }
 165
 166 $code=<<___;
 167 #include "arm_arch.h"
 168
 169 .text
 170 .code   32
 171
 172 .global sha1_block_data_order
 173 .type   sha1_block_data_order,%function
 174
 175 .align  5
 176 sha1_block_data_order:
 177 #if __ARM_MAX_ARCH__>=7
 178         sub     r3,pc,#8                @ sha1_block_data_order
 179         ldr     r12,.LOPENSSL_armcap
 180         ldr     r12,[r3,r12]            @ OPENSSL_armcap_P
 181         tst     r12,#ARMV8_SHA1
 182         bne     .LARMv8
 183         tst     r12,#ARMV7_NEON
 184         bne     .LNEON
 185 #endif
 186         stmdb   sp!,{r4-r12,lr}
 187         add     $len,$inp,$len,lsl#6    @ $len to point at the end of $inp
 188         ldmia   $ctx,{$a,$b,$c,$d,$e}
 189 .Lloop:
 190         ldr     $K,.LK_00_19
 191         mov     $Xi,sp
 192         sub     sp,sp,#15*4
 193         mov     $c,$c,ror#30
 194         mov     $d,$d,ror#30
 195         mov     $e,$e,ror#30            @ [6]
 196 .L_00_15:
 197 ___
 198 for($i=0;$i<5;$i++) {
 199         &BODY_00_15(@V);        unshift(@V,pop(@V));
 200 }
 201 $code.=<<___;
 202         teq     $Xi,sp
 203         bne     .L_00_15                @ [((11+4)*5+2)*3]
 204         sub     sp,sp,#25*4
 205 ___
 206         &BODY_00_15(@V);        unshift(@V,pop(@V));
 207         &BODY_16_19(@V);        unshift(@V,pop(@V));
 208         &BODY_16_19(@V);        unshift(@V,pop(@V));
 209         &BODY_16_19(@V);        unshift(@V,pop(@V));
 210         &BODY_16_19(@V);        unshift(@V,pop(@V));
 211 $code.=<<___;
 212
 213         ldr     $K,.LK_20_39            @ [+15+16*4]
 214         cmn     sp,#0                   @ [+3], clear carry to denote 20_39
 215 .L_20_39_or_60_79:
 216 ___
 217 for($i=0;$i<5;$i++) {
 218         &BODY_20_39(@V);        unshift(@V,pop(@V));
 219 }
 220 $code.=<<___;
 221         teq     $Xi,sp                  @ preserve carry
 222         bne     .L_20_39_or_60_79       @ [+((12+3)*5+2)*4]
 223         bcs     .L_done                 @ [+((12+3)*5+2)*4], spare 300 bytes
 224
 225         ldr     $K,.LK_40_59
 226         sub     sp,sp,#20*4             @ [+2]
 227 .L_40_59:
 228 ___
 229 for($i=0;$i<5;$i++) {
 230         &BODY_40_59(@V);        unshift(@V,pop(@V));
 231 }
 232 $code.=<<___;
 233         teq     $Xi,sp
 234         bne     .L_40_59                @ [+((12+5)*5+2)*4]
 235
 236         ldr     $K,.LK_60_79
 237         sub     sp,sp,#20*4
 238         cmp     sp,#0                   @ set carry to denote 60_79
 239         b       .L_20_39_or_60_79       @ [+4], spare 300 bytes
 240 .L_done:
 241         add     sp,sp,#80*4             @ "deallocate" stack frame
 242         ldmia   $ctx,{$K,$t0,$t1,$t2,$t3}
 243         add     $a,$K,$a
 244         add     $b,$t0,$b
 245         add     $c,$t1,$c,ror#2
 246         add     $d,$t2,$d,ror#2
 247         add     $e,$t3,$e,ror#2
 248         stmia   $ctx,{$a,$b,$c,$d,$e}
 249         teq     $inp,$len
 250         bne     .Lloop                  @ [+18], total 1307
 251
 252 #if __ARM_ARCH__>=5
 253         ldmia   sp!,{r4-r12,pc}
 254 #else
 255         ldmia   sp!,{r4-r12,lr}
 256         tst     lr,#1
 257         moveq   pc,lr                   @ be binary compatible with V4, yet
 258         bx      lr                      @ interoperable with Thumb ISA:-)
 259 #endif
 260 .size   sha1_block_data_order,.-sha1_block_data_order
 261
 262 .align  5
 263 .LK_00_19:      .word   0x5a827999
 264 .LK_20_39:      .word   0x6ed9eba1
 265 .LK_40_59:      .word   0x8f1bbcdc
 266 .LK_60_79:      .word   0xca62c1d6
 267 #if __ARM_MAX_ARCH__>=7
 268 .LOPENSSL_armcap:
 269 .word   OPENSSL_armcap_P-sha1_block_data_order
 270 #endif
 271 .asciz  "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>"
 272 .align  5
 273 ___
 274 #####################################################################
 275 # NEON stuff
 276 #
 277 {{{
 278 my @V=($a,$b,$c,$d,$e);
 279 my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14));
 280 my $Xi=4;
 281 my @X=map("q$_",(8..11,0..3));
 282 my @Tx=("q12","q13");
 283 my ($K,$zero)=("q14","q15");
 284 my $j=0;
 285
 286 sub AUTOLOAD()          # thunk [simplified] x86-style perlasm
 287 { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./;
 288   my $arg = pop;
 289     $arg = "#$arg" if ($arg*1 eq $arg);
 290     $code .= "\t$opcode\t".join(',',@_,$arg)."\n";
 291 }
 292
 293 sub body_00_19 () {
 294         (
 295         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 296         '&bic   ($t0,$d,$b)',
 297         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 298         '&and   ($t1,$c,$b)',
 299         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
 300         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 301         '&eor   ($t1,$t1,$t0)',         # F_00_19
 302         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 303         '&add   ($e,$e,$t1);'.          # e+=F_00_19
 304         '$j++;  unshift(@V,pop(@V));'
 305         )
 306 }
 307 sub body_20_39 () {
 308         (
 309         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 310         '&eor   ($t0,$b,$d)',
 311         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 312         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)',
 313         '&eor   ($t1,$t0,$c)',          # F_20_39
 314         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 315         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 316         '&add   ($e,$e,$t1);'.          # e+=F_20_39
 317         '$j++;  unshift(@V,pop(@V));'
 318         )
 319 }
 320 sub body_40_59 () {
 321         (
 322         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 323         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 324         '&and   ($t0,$c,$d)',
 325         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
 326         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 327         '&eor   ($t1,$c,$d)',
 328         '&add   ($e,$e,$t0)',
 329         '&and   ($t1,$t1,$b)',
 330         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 331         '&add   ($e,$e,$t1);'.          # e+=F_40_59
 332         '$j++;  unshift(@V,pop(@V));'
 333         )
 334 }
 335
 336 sub Xupdate_16_31 ()
 337 { use integer;
 338   my $body = shift;
 339   my @insns = (&$body,&$body,&$body,&$body);
 340   my ($a,$b,$c,$d,$e);
 341
 342         &vext_8         (@X[0],@X[-4&7],@X[-3&7],8);    # compose "X[-14]" in "X[0]"
 343          eval(shift(@insns));
 344          eval(shift(@insns));
 345          eval(shift(@insns));
 346           &vadd_i32     (@Tx[1],@X[-1&7],$K);
 347          eval(shift(@insns));
 348           &vld1_32      ("{$K\[]}","[$K_XX_XX,:32]!")   if ($Xi%5==0);
 349          eval(shift(@insns));
 350         &vext_8         (@Tx[0],@X[-1&7],$zero,4);      # "X[-3]", 3 words
 351          eval(shift(@insns));
 352          eval(shift(@insns));
 353          eval(shift(@insns));
 354         &veor           (@X[0],@X[0],@X[-4&7]);         # "X[0]"^="X[-16]"
 355          eval(shift(@insns));
 356          eval(shift(@insns));
 357         &veor           (@Tx[0],@Tx[0],@X[-2&7]);       # "X[-3]"^"X[-8]"
 358          eval(shift(@insns));
 359          eval(shift(@insns));
 360         &veor           (@Tx[0],@Tx[0],@X[0]);          # "X[0]"^="X[-3]"^"X[-8]
 361          eval(shift(@insns));
 362          eval(shift(@insns));
 363           &vst1_32      ("{@Tx[1]}","[$Xfer,:128]!");   # X[]+K xfer
 364           &sub          ($Xfer,$Xfer,64)                if ($Xi%4==0);
 365          eval(shift(@insns));
 366          eval(shift(@insns));
 367         &vext_8         (@Tx[1],$zero,@Tx[0],4);        # "X[0]"<<96, extract one dword
 368          eval(shift(@insns));
 369          eval(shift(@insns));
 370         &vadd_i32       (@X[0],@Tx[0],@Tx[0]);
 371          eval(shift(@insns));
 372          eval(shift(@insns));
 373         &vsri_32        (@X[0],@Tx[0],31);              # "X[0]"<<<=1
 374          eval(shift(@insns));
 375          eval(shift(@insns));
 376          eval(shift(@insns));
 377         &vshr_u32       (@Tx[0],@Tx[1],30);
 378          eval(shift(@insns));
 379          eval(shift(@insns));
 380         &vshl_u32       (@Tx[1],@Tx[1],2);
 381          eval(shift(@insns));
 382          eval(shift(@insns));
 383         &veor           (@X[0],@X[0],@Tx[0]);
 384          eval(shift(@insns));
 385          eval(shift(@insns));
 386         &veor           (@X[0],@X[0],@Tx[1]);           # "X[0]"^=("X[0]">>96)<<<2
 387
 388         foreach (@insns) { eval; }      # remaining instructions [if any]
 389
 390   $Xi++;        push(@X,shift(@X));     # "rotate" X[]
 391 }
 392
 393 sub Xupdate_32_79 ()
 394 { use integer;
 395   my $body = shift;
 396   my @insns = (&$body,&$body,&$body,&$body);
 397   my ($a,$b,$c,$d,$e);
 398
 399         &vext_8         (@Tx[0],@X[-2&7],@X[-1&7],8);   # compose "X[-6]"
 400          eval(shift(@insns));
 401          eval(shift(@insns));
 402          eval(shift(@insns));
 403         &veor           (@X[0],@X[0],@X[-4&7]);         # "X[0]"="X[-32]"^"X[-16]"
 404          eval(shift(@insns));
 405          eval(shift(@insns));
 406         &veor           (@X[0],@X[0],@X[-7&7]);         # "X[0]"^="X[-28]"
 407          eval(shift(@insns));
 408          eval(shift(@insns));
 409           &vadd_i32     (@Tx[1],@X[-1&7],$K);
 410          eval(shift(@insns));
 411           &vld1_32      ("{$K\[]}","[$K_XX_XX,:32]!")   if ($Xi%5==0);
 412          eval(shift(@insns));
 413         &veor           (@Tx[0],@Tx[0],@X[0]);          # "X[-6]"^="X[0]"
 414          eval(shift(@insns));
 415          eval(shift(@insns));
 416         &vshr_u32       (@X[0],@Tx[0],30);
 417          eval(shift(@insns));
 418          eval(shift(@insns));
 419           &vst1_32      ("{@Tx[1]}","[$Xfer,:128]!");   # X[]+K xfer
 420           &sub          ($Xfer,$Xfer,64)                if ($Xi%4==0);
 421          eval(shift(@insns));
 422          eval(shift(@insns));
 423         &vsli_32        (@X[0],@Tx[0],2);               # "X[0]"="X[-6]"<<<2
 424
 425         foreach (@insns) { eval; }      # remaining instructions [if any]
 426
 427   $Xi++;        push(@X,shift(@X));     # "rotate" X[]
 428 }
 429
 430 sub Xuplast_80 ()
 431 { use integer;
 432   my $body = shift;
 433   my @insns = (&$body,&$body,&$body,&$body);
 434   my ($a,$b,$c,$d,$e);
 435
 436         &vadd_i32       (@Tx[1],@X[-1&7],$K);
 437          eval(shift(@insns));
 438          eval(shift(@insns));
 439         &vst1_32        ("{@Tx[1]}","[$Xfer,:128]!");
 440         &sub            ($Xfer,$Xfer,64);
 441
 442         &teq            ($inp,$len);
 443         &sub            ($K_XX_XX,$K_XX_XX,16); # rewind $K_XX_XX
 444         &subeq          ($inp,$inp,64);         # reload last block to avoid SEGV
 445         &vld1_8         ("{@X[-4&7]-@X[-3&7]}","[$inp]!");
 446          eval(shift(@insns));
 447          eval(shift(@insns));
 448         &vld1_8         ("{@X[-2&7]-@X[-1&7]}","[$inp]!");
 449          eval(shift(@insns));
 450          eval(shift(@insns));
 451         &vld1_32        ("{$K\[]}","[$K_XX_XX,:32]!");  # load K_00_19
 452          eval(shift(@insns));
 453          eval(shift(@insns));
 454         &vrev32_8       (@X[-4&7],@X[-4&7]);
 455
 456         foreach (@insns) { eval; }              # remaining instructions
 457
 458    $Xi=0;
 459 }
 460
 461 sub Xloop()
 462 { use integer;
 463   my $body = shift;
 464   my @insns = (&$body,&$body,&$body,&$body);
 465   my ($a,$b,$c,$d,$e);
 466
 467         &vrev32_8       (@X[($Xi-3)&7],@X[($Xi-3)&7]);
 468          eval(shift(@insns));
 469          eval(shift(@insns));
 470         &vadd_i32       (@X[$Xi&7],@X[($Xi-4)&7],$K);
 471          eval(shift(@insns));
 472          eval(shift(@insns));
 473         &vst1_32        ("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU
 474
 475         foreach (@insns) { eval; }
 476
 477   $Xi++;
 478 }
 479
 480 $code.=<<___;
 481 #if __ARM_MAX_ARCH__>=7
 482 .arch   armv7-a
 483 .fpu    neon
 484
 485 .type   sha1_block_data_order_neon,%function
 486 .align  4
 487 sha1_block_data_order_neon:
 488 .LNEON:
 489         stmdb   sp!,{r4-r12,lr}
 490         add     $len,$inp,$len,lsl#6    @ $len to point at the end of $inp
 491         @ dmb                           @ errata #451034 on early Cortex A8
 492         @ vstmdb        sp!,{d8-d15}    @ ABI specification says so
 493         mov     $saved_sp,sp
 494         sub     sp,sp,#64               @ alloca
 495         adr     $K_XX_XX,.LK_00_19
 496         bic     sp,sp,#15               @ align for 128-bit stores
 497
 498         ldmia   $ctx,{$a,$b,$c,$d,$e}   @ load context
 499         mov     $Xfer,sp
 500
 501         vld1.8          {@X[-4&7]-@X[-3&7]},[$inp]!     @ handles unaligned
 502         veor            $zero,$zero,$zero
 503         vld1.8          {@X[-2&7]-@X[-1&7]},[$inp]!
 504         vld1.32         {${K}\[]},[$K_XX_XX,:32]!       @ load K_00_19
 505         vrev32.8        @X[-4&7],@X[-4&7]               @ yes, even on
 506         vrev32.8        @X[-3&7],@X[-3&7]               @ big-endian...
 507         vrev32.8        @X[-2&7],@X[-2&7]
 508         vadd.i32        @X[0],@X[-4&7],$K
 509         vrev32.8        @X[-1&7],@X[-1&7]
 510         vadd.i32        @X[1],@X[-3&7],$K
 511         vst1.32         {@X[0]},[$Xfer,:128]!
 512         vadd.i32        @X[2],@X[-2&7],$K
 513         vst1.32         {@X[1]},[$Xfer,:128]!
 514         vst1.32         {@X[2]},[$Xfer,:128]!
 515         ldr             $Ki,[sp]                        @ big RAW stall
 516
 517 .Loop_neon:
 518 ___
 519         &Xupdate_16_31(\&body_00_19);
 520         &Xupdate_16_31(\&body_00_19);
 521         &Xupdate_16_31(\&body_00_19);
 522         &Xupdate_16_31(\&body_00_19);
 523         &Xupdate_32_79(\&body_00_19);
 524         &Xupdate_32_79(\&body_20_39);
 525         &Xupdate_32_79(\&body_20_39);
 526         &Xupdate_32_79(\&body_20_39);
 527         &Xupdate_32_79(\&body_20_39);
 528         &Xupdate_32_79(\&body_20_39);
 529         &Xupdate_32_79(\&body_40_59);
 530         &Xupdate_32_79(\&body_40_59);
 531         &Xupdate_32_79(\&body_40_59);
 532         &Xupdate_32_79(\&body_40_59);
 533         &Xupdate_32_79(\&body_40_59);
 534         &Xupdate_32_79(\&body_20_39);
 535         &Xuplast_80(\&body_20_39);
 536         &Xloop(\&body_20_39);
 537         &Xloop(\&body_20_39);
 538         &Xloop(\&body_20_39);
 539 $code.=<<___;
 540         ldmia   $ctx,{$Ki,$t0,$t1,$Xfer}        @ accumulate context
 541         add     $a,$a,$Ki
 542         ldr     $Ki,[$ctx,#16]
 543         add     $b,$b,$t0
 544         add     $c,$c,$t1
 545         add     $d,$d,$Xfer
 546         moveq   sp,$saved_sp
 547         add     $e,$e,$Ki
 548         ldrne   $Ki,[sp]
 549         stmia   $ctx,{$a,$b,$c,$d,$e}
 550         addne   $Xfer,sp,#3*16
 551         bne     .Loop_neon
 552
 553         @ vldmia        sp!,{d8-d15}
 554         ldmia   sp!,{r4-r12,pc}
 555 .size   sha1_block_data_order_neon,.-sha1_block_data_order_neon
 556 #endif
 557 ___
 558 }}}
 559 #####################################################################
 560 # ARMv8 stuff
 561 #
 562 {{{
 563 my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3));
 564 my @MSG=map("q$_",(4..7));
 565 my @Kxx=map("q$_",(8..11));
 566 my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14));
 567
 568 $code.=<<___;
 569 #if __ARM_MAX_ARCH__>=7
 570 .type   sha1_block_data_order_armv8,%function
 571 .align  5
 572 sha1_block_data_order_armv8:
 573 .LARMv8:
 574         vstmdb  sp!,{d8-d15}            @ ABI specification says so
 575
 576         veor    $E,$E,$E
 577         adr     r3,.LK_00_19
 578         vld1.32 {$ABCD},[$ctx]!
 579         vld1.32 {$E\[0]},[$ctx]
 580         sub     $ctx,$ctx,#16
 581         vld1.32 {@Kxx[0]\[]},[r3,:32]!
 582         vld1.32 {@Kxx[1]\[]},[r3,:32]!
 583         vld1.32 {@Kxx[2]\[]},[r3,:32]!
 584         vld1.32 {@Kxx[3]\[]},[r3,:32]
 585
 586 .Loop_v8:
 587         vld1.8          {@MSG[0]-@MSG[1]},[$inp]!
 588         vld1.8          {@MSG[2]-@MSG[3]},[$inp]!
 589         vrev32.8        @MSG[0],@MSG[0]
 590         vrev32.8        @MSG[1],@MSG[1]
 591
 592         vadd.i32        $W0,@Kxx[0],@MSG[0]
 593         vrev32.8        @MSG[2],@MSG[2]
 594         vmov            $ABCD_SAVE,$ABCD        @ offload
 595         subs            $len,$len,#1
 596
 597         vadd.i32        $W1,@Kxx[0],@MSG[1]
 598         vrev32.8        @MSG[3],@MSG[3]
 599         sha1h           $E1,$ABCD               @ 0
 600         sha1c           $ABCD,$E,$W0
 601         vadd.i32        $W0,@Kxx[$j],@MSG[2]
 602         sha1su0         @MSG[0],@MSG[1],@MSG[2]
 603 ___
 604 for ($j=0,$i=1;$i<20-3;$i++) {
 605 my $f=("c","p","m","p")[$i/5];
 606 $code.=<<___;
 607         sha1h           $E0,$ABCD               @ $i
 608         sha1$f          $ABCD,$E1,$W1
 609         vadd.i32        $W1,@Kxx[$j],@MSG[3]
 610         sha1su1         @MSG[0],@MSG[3]
 611 ___
 612 $code.=<<___ if ($i<20-4);
 613         sha1su0         @MSG[1],@MSG[2],@MSG[3]
 614 ___
 615         ($E0,$E1)=($E1,$E0);    ($W0,$W1)=($W1,$W0);
 616         push(@MSG,shift(@MSG)); $j++ if ((($i+3)%5)==0);
 617 }
 618 $code.=<<___;
 619         sha1h           $E0,$ABCD               @ $i
 620         sha1p           $ABCD,$E1,$W1
 621         vadd.i32        $W1,@Kxx[$j],@MSG[3]
 622
 623         sha1h           $E1,$ABCD               @ 18
 624         sha1p           $ABCD,$E0,$W0
 625
 626         sha1h           $E0,$ABCD               @ 19
 627         sha1p           $ABCD,$E1,$W1
 628
 629         vadd.i32        $E,$E,$E0
 630         vadd.i32        $ABCD,$ABCD,$ABCD_SAVE
 631         bne             .Loop_v8
 632
 633         vst1.32         {$ABCD},[$ctx]!
 634         vst1.32         {$E\[0]},[$ctx]
 635
 636         vldmia  sp!,{d8-d15}
 637         ret                                     @ bx lr
 638 .size   sha1_block_data_order_armv8,.-sha1_block_data_order_armv8
 639 #endif
 640 ___
 641 }}}
 642 $code.=<<___;
 643 #if __ARM_MAX_ARCH__>=7
 644 .comm   OPENSSL_armcap_P,4,4
 645 #endif
 646 ___
 647
 648 {   my  %opcode = (
 649         "sha1c"         => 0xf2000c40,  "sha1p"         => 0xf2100c40,
 650         "sha1m"         => 0xf2200c40,  "sha1su0"       => 0xf2300c40,
 651         "sha1h"         => 0xf3b902c0,  "sha1su1"       => 0xf3ba0380   );
 652
 653     sub unsha1 {
 654         my ($mnemonic,$arg)=@_;
 655
 656         if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) {
 657             my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19)
 658                                          |(($2&7)<<17)|(($2&8)<<4)
 659                                          |(($3&7)<<1) |(($3&8)<<2);
 660             # since ARMv7 instructions are always encoded little-endian.
 661             # correct solution is to use .inst directive, but older
 662             # assemblers don't implement it:-(
 663             sprintf ".byte\t0x%02x,0x%02x,0x%02x,0x%02x\t@ %s %s",
 664                         $word&0xff,($word>>8)&0xff,
 665                         ($word>>16)&0xff,($word>>24)&0xff,
 666                         $mnemonic,$arg;
 667         }
 668     }
 669 }
 670
 671 foreach (split($/,$code)) {
 672         s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo        or
 673         s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo;
 674
 675         s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo;
 676
 677         s/\bret\b/bx    lr/o            or
 678         s/\bbx\s+lr\b/.word\t0xe12fff1e/o;      # make it possible to compile with -march=armv4
 679
 680         print $_,$/;
 681 }
 682
 683 close STDOUT; # enforce flush