3 # ====================================================================
4 # [Re]written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
5 # project. Rights for redistribution and usage in source and binary
6 # forms are granted according to the OpenSSL license.
7 # ====================================================================
9 # "[Re]written" was achieved in two major overhauls. In 2004 BODY_*
10 # functions were re-implemented to address P4 performance issue [see
11 # commentary below], and in 2006 the rest was rewritten in order to
12 # gain freedom to liberate licensing terms.
14 # It was noted that Intel IA-32 C compiler generates code which
15 # performs ~30% *faster* on P4 CPU than original *hand-coded*
16 # SHA1 assembler implementation. To address this problem (and
17 # prove that humans are still better than machines:-), the
18 # original code was overhauled, which resulted in following
19 # performance changes:
21 # compared with original compared with Intel cc
22 # assembler impl. generated code
27 # As you can see Pentium came out as looser:-( Yet I reckoned that
28 # improvement on P4 outweights the loss and incorporate this
29 # re-tuned code to 0.9.7 and later.
30 # ----------------------------------------------------------------
31 # Those who for any particular reason absolutely must score on
32 # Pentium can replace this module with one from 0.9.6 distribution.
33 # This "offer" shall be revoked the moment programming interface to
34 # this module is changed, in which case this paragraph should be
36 # ----------------------------------------------------------------
37 # <appro@fy.chalmers.se>
39 push(@INC,"perlasm","../../perlasm");
42 &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386");
52 @V=($A,$B,$C,$D,$E,$T);
56 local($n,$a,$b,$c,$d,$e,$f)=@_;
60 &mov($f,$c); # f to hold F_00_19(b,c,d)
61 if ($n==0) { &mov($tmp1,$a); }
62 else { &mov($a,$tmp1); }
63 &rotl($tmp1,5); # tmp1=ROTATE(a,5)
65 &add($tmp1,$e); # tmp1+=e;
67 &mov($e,&swtmp($n%16)); # e becomes volatile and is loaded
68 # with xi, also note that e becomes
70 &xor($f,$d); # f holds F_00_19(b,c,d)
71 &rotr($b,2); # b=ROTATE(b,30)
72 &lea($tmp1,&DWP(0x5a827999,$tmp1,$e)); # tmp1+=K_00_19+xi
74 if ($n==15) { &add($f,$tmp1); } # f+=tmp1
75 else { &add($tmp1,$f); } # f becomes a in next round
80 local($n,$a,$b,$c,$d,$e,$f)=@_;
84 &mov($f,&swtmp($n%16)); # f to hold Xupdate(xi,xa,xb,xc,xd)
85 &mov($tmp1,$c); # tmp1 to hold F_00_19(b,c,d)
86 &xor($f,&swtmp(($n+2)%16));
88 &xor($f,&swtmp(($n+8)%16));
89 &and($tmp1,$b); # tmp1 holds F_00_19(b,c,d)
90 &rotr($b,2); # b=ROTATE(b,30)
91 &xor($f,&swtmp(($n+13)%16)); # f holds xa^xb^xc^xd
92 &rotl($f,1); # f=ROTATE(f,1)
93 &xor($tmp1,$d); # tmp1=F_00_19(b,c,d)
94 &mov(&swtmp($n%16),$f); # xi=f
95 &lea($f,&DWP(0x5a827999,$f,$e));# f+=K_00_19+e
96 &mov($e,$a); # e becomes volatile
97 &rotl($e,5); # e=ROTATE(a,5)
98 &add($f,$tmp1); # f+=F_00_19(b,c,d)
99 &add($f,$e); # f+=ROTATE(a,5)
104 local($n,$a,$b,$c,$d,$e,$f)=@_;
105 local $K=($n<40)?0x6ed9eba1:0xca62c1d6;
107 &comment("20_39 $n");
109 &mov($tmp1,$b); # tmp1 to hold F_20_39(b,c,d)
110 &mov($f,&swtmp($n%16)); # f to hold Xupdate(xi,xa,xb,xc,xd)
111 &rotr($b,2); # b=ROTATE(b,30)
112 &xor($f,&swtmp(($n+2)%16));
114 &xor($f,&swtmp(($n+8)%16));
115 &xor($tmp1,$d); # tmp1 holds F_20_39(b,c,d)
116 &xor($f,&swtmp(($n+13)%16)); # f holds xa^xb^xc^xd
117 &rotl($f,1); # f=ROTATE(f,1)
119 &mov(&swtmp($n%16),$f); # xi=f
120 &mov($e,$a); # e becomes volatile
121 &rotl($e,5); # e=ROTATE(a,5)
122 &lea($f,&DWP($K,$f,$tmp1)); # f+=K_20_39+e
123 &add($f,$e); # f+=ROTATE(a,5)
128 local($n,$a,$b,$c,$d,$e,$f)=@_;
130 &comment("40_59 $n");
132 &mov($f,&swtmp($n%16)); # f to hold Xupdate(xi,xa,xb,xc,xd)
133 &mov($tmp1,&swtmp(($n+2)%16));
135 &mov($tmp1,&swtmp(($n+8)%16));
137 &mov($tmp1,&swtmp(($n+13)%16));
138 &xor($f,$tmp1); # f holds xa^xb^xc^xd
139 &mov($tmp1,$b); # tmp1 to hold F_40_59(b,c,d)
140 &rotl($f,1); # f=ROTATE(f,1)
142 &mov(&swtmp($n%16),$f); # xi=f
144 &lea($f,&DWP(0x8f1bbcdc,$f,$e));# f+=K_40_59+e
145 &mov($e,$b); # e becomes volatile and is used
146 # to calculate F_40_59(b,c,d)
147 &rotr($b,2); # b=ROTATE(b,30)
149 &or($tmp1,$e); # tmp1 holds F_40_59(b,c,d)
151 &rotl($e,5); # e=ROTATE(a,5)
152 &add($f,$tmp1); # f+=tmp1;
153 &add($f,$e); # f+=ROTATE(a,5)
156 &function_begin("sha1_block_asm_data_order",16);
157 &mov($tmp1,&wparam(0)); # SHA_CTX *c
158 &mov($T,&wparam(1)); # const void *input
159 &mov($A,&wparam(2)); # size_t num
160 &stack_push(16); # allocate X[16]
163 &mov(&wparam(2),$A); # pointer beyond the end of input
164 &mov($E,&DWP(16,$tmp1));# pre-load E
166 &set_label("loop",16);
168 # copy input chunk to X, but reversing byte order!
169 for ($i=0; $i<16; $i+=4)
171 &mov($A,&DWP(4*($i+0),$T));
172 &mov($B,&DWP(4*($i+1),$T));
173 &mov($C,&DWP(4*($i+2),$T));
174 &mov($D,&DWP(4*($i+3),$T));
179 &mov(&swtmp($i+0),$A);
180 &mov(&swtmp($i+1),$B);
181 &mov(&swtmp($i+2),$C);
182 &mov(&swtmp($i+3),$D);
184 &mov(&wparam(1),$T); # redundant in 1st spin
186 &mov($A,&DWP(0,$tmp1)); # load SHA_CTX
187 &mov($B,&DWP(4,$tmp1));
188 &mov($C,&DWP(8,$tmp1));
189 &mov($D,&DWP(12,$tmp1));
192 &set_label("shortcut");
193 # keep a note of shortcut label so it can be used outside the block.
194 $shortcut = &label("shortcut");
196 for($i=0;$i<16;$i++) { &BODY_00_15($i,@V); unshift(@V,pop(@V)); }
197 for(;$i<20;$i++) { &BODY_16_19($i,@V); unshift(@V,pop(@V)); }
198 for(;$i<40;$i++) { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
199 for(;$i<60;$i++) { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
200 for(;$i<80;$i++) { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
202 (($V[5] eq $D) and ($V[0] eq $E)) or die; # double-check
204 &mov($tmp1,&wparam(0)); # re-load SHA_CTX*
205 &mov($D,&wparam(1)); # D is last "T" and is discarded
207 &add($E,&DWP(0,$tmp1)); # E is last "A"...
208 &add($T,&DWP(4,$tmp1));
209 &add($A,&DWP(8,$tmp1));
210 &add($B,&DWP(12,$tmp1));
211 &add($C,&DWP(16,$tmp1));
213 &mov(&DWP(0,$tmp1),$E); # update SHA_CTX
214 &add($D,64); # advance input pointer
215 &mov(&DWP(4,$tmp1),$T);
216 &cmp($D,&wparam(2)); # have we reached the end yet?
217 &mov(&DWP(8,$tmp1),$A);
218 &mov($E,$C); # C is last "E" which needs to be "pre-loaded"
219 &mov(&DWP(12,$tmp1),$B);
220 &mov($T,$D); # input pointer
221 &mov(&DWP(16,$tmp1),$C);
225 &function_end("sha1_block_asm_data_order");
227 &function_begin("sha1_block_asm_host_order",16);
228 &mov($tmp1,&wparam(0)); # SHA_CTX *c
229 &mov($T,&wparam(1)); # const void *input
230 #&mov($A,&wparam(2)); # size_t num, always 1
231 &stack_push(16); # allocate X[16]
232 &lea($A,&DWP(64,$T)); # this works, because num is always 1 here
233 &mov(&wparam(2),$A); # pointer beyond the end of input
235 # just copy input to X
236 for ($i=0; $i<16; $i+=4)
238 &mov($A,&DWP(4*($i+0),$T));
239 &mov($B,&DWP(4*($i+1),$T));
240 &mov($C,&DWP(4*($i+2),$T));
241 &mov($D,&DWP(4*($i+3),$T));
242 &mov(&swtmp($i+0),$A);
243 &mov(&swtmp($i+1),$B);
244 &mov(&swtmp($i+2),$C);
245 &mov(&swtmp($i+3),$D);
248 &mov($A,&DWP(0,$tmp1)); # load SHA_CTX
249 &mov($B,&DWP(4,$tmp1));
250 &mov($C,&DWP(8,$tmp1));
251 &mov($D,&DWP(12,$tmp1));
252 &mov($E,&DWP(16,$tmp1));
254 &jmp($shortcut); # this works, because num is always 1
255 &function_end_B("sha1_block_asm_host_order");