8a8228f94f90172366412079c3fc5894880b1c12
[openssl.git] / crypto / sha / asm / sha1-586.pl
1 #!/usr/bin/env perl
2
3 # ====================================================================
4 # [Re]written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
5 # project. Rights for redistribution and usage in source and binary
6 # forms are granted according to the OpenSSL license.
7 # ====================================================================
8
9 # "[Re]written" was achieved in two major overhauls. In 2004 BODY_*
10 # functions were re-implemented to address P4 performance issue [see
11 # commentary below], and in 2006 the rest was rewritten in order to
12 # gain freedom to liberate licensing terms.
13
14 # It was noted that Intel IA-32 C compiler generates code which
15 # performs ~30% *faster* on P4 CPU than original *hand-coded*
16 # SHA1 assembler implementation. To address this problem (and
17 # prove that humans are still better than machines:-), the
18 # original code was overhauled, which resulted in following
19 # performance changes:
20 #
21 #               compared with original  compared with Intel cc
22 #               assembler impl.         generated code
23 # Pentium       -16%                    +48%
24 # PIII/AMD      +8%                     +16%
25 # P4            +85%(!)                 +45%
26 #
27 # As you can see Pentium came out as looser:-( Yet I reckoned that
28 # improvement on P4 outweights the loss and incorporate this
29 # re-tuned code to 0.9.7 and later.
30 # ----------------------------------------------------------------
31 # Those who for any particular reason absolutely must score on
32 # Pentium can replace this module with one from 0.9.6 distribution.
33 # This "offer" shall be revoked the moment programming interface to
34 # this module is changed, in which case this paragraph should be
35 # removed.
36 # ----------------------------------------------------------------
37 #                                       <appro@fy.chalmers.se>
38
39 push(@INC,"perlasm","../../perlasm");
40 require "x86asm.pl";
41
42 &asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386");
43
44 $A="eax";
45 $B="ebx";
46 $C="ecx";
47 $D="edx";
48 $E="edi";
49 $T="esi";
50 $tmp1="ebp";
51
52 @V=($A,$B,$C,$D,$E,$T);
53
54 sub BODY_00_15
55         {
56         local($n,$a,$b,$c,$d,$e,$f)=@_;
57
58         &comment("00_15 $n");
59
60         &mov($f,$c);                    # f to hold F_00_19(b,c,d)
61          if ($n==0)  { &mov($tmp1,$a); }
62          else        { &mov($a,$tmp1); }
63         &rotl($tmp1,5);                 # tmp1=ROTATE(a,5)
64          &xor($f,$d);
65         &add($tmp1,$e);                 # tmp1+=e;
66          &and($f,$b);
67         &mov($e,&swtmp($n%16));         # e becomes volatile and is loaded
68                                         # with xi, also note that e becomes
69                                         # f in next round...
70          &xor($f,$d);                   # f holds F_00_19(b,c,d)
71         &rotr($b,2);                    # b=ROTATE(b,30)
72          &lea($tmp1,&DWP(0x5a827999,$tmp1,$e)); # tmp1+=K_00_19+xi
73
74         if ($n==15) { &add($f,$tmp1); } # f+=tmp1
75         else        { &add($tmp1,$f); } # f becomes a in next round
76         }
77
78 sub BODY_16_19
79         {
80         local($n,$a,$b,$c,$d,$e,$f)=@_;
81
82         &comment("16_19 $n");
83
84         &mov($f,&swtmp($n%16));         # f to hold Xupdate(xi,xa,xb,xc,xd)
85          &mov($tmp1,$c);                # tmp1 to hold F_00_19(b,c,d)
86         &xor($f,&swtmp(($n+2)%16));
87          &xor($tmp1,$d);
88         &xor($f,&swtmp(($n+8)%16));
89          &and($tmp1,$b);                # tmp1 holds F_00_19(b,c,d)
90         &rotr($b,2);                    # b=ROTATE(b,30)
91          &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
92         &rotl($f,1);                    # f=ROTATE(f,1)
93          &xor($tmp1,$d);                # tmp1=F_00_19(b,c,d)
94         &mov(&swtmp($n%16),$f);         # xi=f
95         &lea($f,&DWP(0x5a827999,$f,$e));# f+=K_00_19+e
96          &mov($e,$a);                   # e becomes volatile
97         &rotl($e,5);                    # e=ROTATE(a,5)
98          &add($f,$tmp1);                # f+=F_00_19(b,c,d)
99         &add($f,$e);                    # f+=ROTATE(a,5)
100         }
101
102 sub BODY_20_39
103         {
104         local($n,$a,$b,$c,$d,$e,$f)=@_;
105         local $K=($n<40)?0x6ed9eba1:0xca62c1d6;
106
107         &comment("20_39 $n");
108
109         &mov($tmp1,$b);                 # tmp1 to hold F_20_39(b,c,d)
110          &mov($f,&swtmp($n%16));        # f to hold Xupdate(xi,xa,xb,xc,xd)
111         &rotr($b,2);                    # b=ROTATE(b,30)
112          &xor($f,&swtmp(($n+2)%16));
113         &xor($tmp1,$c);
114          &xor($f,&swtmp(($n+8)%16));
115         &xor($tmp1,$d);                 # tmp1 holds F_20_39(b,c,d)
116          &xor($f,&swtmp(($n+13)%16));   # f holds xa^xb^xc^xd
117         &rotl($f,1);                    # f=ROTATE(f,1)
118          &add($tmp1,$e);
119         &mov(&swtmp($n%16),$f);         # xi=f
120          &mov($e,$a);                   # e becomes volatile
121         &rotl($e,5);                    # e=ROTATE(a,5)
122          &lea($f,&DWP($K,$f,$tmp1));    # f+=K_20_39+e
123         &add($f,$e);                    # f+=ROTATE(a,5)
124         }
125
126 sub BODY_40_59
127         {
128         local($n,$a,$b,$c,$d,$e,$f)=@_;
129
130         &comment("40_59 $n");
131
132         &mov($f,&swtmp($n%16));         # f to hold Xupdate(xi,xa,xb,xc,xd)
133          &mov($tmp1,&swtmp(($n+2)%16));
134         &xor($f,$tmp1);
135          &mov($tmp1,&swtmp(($n+8)%16));
136         &xor($f,$tmp1);
137          &mov($tmp1,&swtmp(($n+13)%16));
138         &xor($f,$tmp1);                 # f holds xa^xb^xc^xd
139          &mov($tmp1,$b);                # tmp1 to hold F_40_59(b,c,d)
140         &rotl($f,1);                    # f=ROTATE(f,1)
141          &or($tmp1,$c);
142         &mov(&swtmp($n%16),$f);         # xi=f
143          &and($tmp1,$d);
144         &lea($f,&DWP(0x8f1bbcdc,$f,$e));# f+=K_40_59+e
145          &mov($e,$b);                   # e becomes volatile and is used
146                                         # to calculate F_40_59(b,c,d)
147         &rotr($b,2);                    # b=ROTATE(b,30)
148          &and($e,$c);
149         &or($tmp1,$e);                  # tmp1 holds F_40_59(b,c,d)             
150          &mov($e,$a);
151         &rotl($e,5);                    # e=ROTATE(a,5)
152          &add($f,$tmp1);                # f+=tmp1;
153         &add($f,$e);                    # f+=ROTATE(a,5)
154         }
155
156 &function_begin("sha1_block_asm_data_order",16);
157         &mov($tmp1,&wparam(0)); # SHA_CTX *c
158         &mov($T,&wparam(1));    # const void *input
159         &mov($A,&wparam(2));    # size_t num
160         &stack_push(16);        # allocate X[16]
161         &shl($A,6);
162         &add($A,$T);
163         &mov(&wparam(2),$A);    # pointer beyond the end of input
164         &mov($E,&DWP(16,$tmp1));# pre-load E
165
166         &set_label("loop",16);
167
168         # copy input chunk to X, but reversing byte order!
169         for ($i=0; $i<16; $i+=4)
170                 {
171                 &mov($A,&DWP(4*($i+0),$T));
172                 &mov($B,&DWP(4*($i+1),$T));
173                 &mov($C,&DWP(4*($i+2),$T));
174                 &mov($D,&DWP(4*($i+3),$T));
175                 &bswap($A);
176                 &bswap($B);
177                 &bswap($C);
178                 &bswap($D);
179                 &mov(&swtmp($i+0),$A);
180                 &mov(&swtmp($i+1),$B);
181                 &mov(&swtmp($i+2),$C);
182                 &mov(&swtmp($i+3),$D);
183                 }
184         &mov(&wparam(1),$T);    # redundant in 1st spin
185
186         &mov($A,&DWP(0,$tmp1)); # load SHA_CTX
187         &mov($B,&DWP(4,$tmp1));
188         &mov($C,&DWP(8,$tmp1));
189         &mov($D,&DWP(12,$tmp1));
190         # E is pre-loaded
191
192         &set_label("shortcut");
193         # keep a note of shortcut label so it can be used outside the block.
194         $shortcut = &label("shortcut");
195
196         for($i=0;$i<16;$i++)    { &BODY_00_15($i,@V); unshift(@V,pop(@V)); }
197         for(;$i<20;$i++)        { &BODY_16_19($i,@V); unshift(@V,pop(@V)); }
198         for(;$i<40;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
199         for(;$i<60;$i++)        { &BODY_40_59($i,@V); unshift(@V,pop(@V)); }
200         for(;$i<80;$i++)        { &BODY_20_39($i,@V); unshift(@V,pop(@V)); }
201
202         (($V[5] eq $D) and ($V[0] eq $E)) or die;       # double-check
203
204         &mov($tmp1,&wparam(0)); # re-load SHA_CTX*
205         &mov($D,&wparam(1));    # D is last "T" and is discarded
206
207         &add($E,&DWP(0,$tmp1)); # E is last "A"...
208         &add($T,&DWP(4,$tmp1));
209         &add($A,&DWP(8,$tmp1));
210         &add($B,&DWP(12,$tmp1));
211         &add($C,&DWP(16,$tmp1));
212
213         &mov(&DWP(0,$tmp1),$E); # update SHA_CTX
214          &add($D,64);           # advance input pointer
215         &mov(&DWP(4,$tmp1),$T);
216          &cmp($D,&wparam(2));   # have we reached the end yet?
217         &mov(&DWP(8,$tmp1),$A);
218          &mov($E,$C);           # C is last "E" which needs to be "pre-loaded"
219         &mov(&DWP(12,$tmp1),$B);
220          &mov($T,$D);           # input pointer
221         &mov(&DWP(16,$tmp1),$C);
222         &jb(&label("loop"));
223
224         &stack_pop(16);
225 &function_end("sha1_block_asm_data_order");
226
227 &function_begin("sha1_block_asm_host_order",16);
228         &mov($tmp1,&wparam(0)); # SHA_CTX *c
229         &mov($T,&wparam(1));    # const void *input
230         #&mov($A,&wparam(2));   # size_t num, always 1
231         &stack_push(16);        # allocate X[16]
232         &lea($A,&DWP(64,$T));   # this works, because num is always 1 here
233         &mov(&wparam(2),$A);    # pointer beyond the end of input
234
235         # just copy input to X
236         for ($i=0; $i<16; $i+=4)
237                 {
238                 &mov($A,&DWP(4*($i+0),$T));
239                 &mov($B,&DWP(4*($i+1),$T));
240                 &mov($C,&DWP(4*($i+2),$T));
241                 &mov($D,&DWP(4*($i+3),$T));
242                 &mov(&swtmp($i+0),$A);
243                 &mov(&swtmp($i+1),$B);
244                 &mov(&swtmp($i+2),$C);
245                 &mov(&swtmp($i+3),$D);
246                 }
247
248         &mov($A,&DWP(0,$tmp1)); # load SHA_CTX
249         &mov($B,&DWP(4,$tmp1));
250         &mov($C,&DWP(8,$tmp1));
251         &mov($D,&DWP(12,$tmp1));
252         &mov($E,&DWP(16,$tmp1));
253
254         &jmp($shortcut);        # this works, because num is always 1
255 &function_end_B("sha1_block_asm_host_order");
256
257 &asm_finish();