crypto/sha/asm/sha1-armv4-large.pl

   1 #! /usr/bin/env perl
   2 # Copyright 2007-2016 The OpenSSL Project Authors. All Rights Reserved.
   3 #
   4 # Licensed under the Apache License 2.0 (the "License").  You may not use
   5 # this file except in compliance with the License.  You can obtain a copy
   6 # in the file LICENSE in the source distribution or at
   7 # https://www.openssl.org/source/license.html
   8
   9
  10 # ====================================================================
  11 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
  12 # project. The module is, however, dual licensed under OpenSSL and
  13 # CRYPTOGAMS licenses depending on where you obtain it. For further
  14 # details see http://www.openssl.org/~appro/cryptogams/.
  15 # ====================================================================
  16
  17 # sha1_block procedure for ARMv4.
  18 #
  19 # January 2007.
  20
  21 # Size/performance trade-off
  22 # ====================================================================
  23 # impl          size in bytes   comp cycles[*]  measured performance
  24 # ====================================================================
  25 # thumb         304             3212            4420
  26 # armv4-small   392/+29%        1958/+64%       2250/+96%
  27 # armv4-compact 740/+89%        1552/+26%       1840/+22%
  28 # armv4-large   1420/+92%       1307/+19%       1370/+34%[***]
  29 # full unroll   ~5100/+260%     ~1260/+4%       ~1300/+5%
  30 # ====================================================================
  31 # thumb         = same as 'small' but in Thumb instructions[**] and
  32 #                 with recurring code in two private functions;
  33 # small         = detached Xload/update, loops are folded;
  34 # compact       = detached Xload/update, 5x unroll;
  35 # large         = interleaved Xload/update, 5x unroll;
  36 # full unroll   = interleaved Xload/update, full unroll, estimated[!];
  37 #
  38 # [*]   Manually counted instructions in "grand" loop body. Measured
  39 #       performance is affected by prologue and epilogue overhead,
  40 #       i-cache availability, branch penalties, etc.
  41 # [**]  While each Thumb instruction is twice smaller, they are not as
  42 #       diverse as ARM ones: e.g., there are only two arithmetic
  43 #       instructions with 3 arguments, no [fixed] rotate, addressing
  44 #       modes are limited. As result it takes more instructions to do
  45 #       the same job in Thumb, therefore the code is never twice as
  46 #       small and always slower.
  47 # [***] which is also ~35% better than compiler generated code. Dual-
  48 #       issue Cortex A8 core was measured to process input block in
  49 #       ~990 cycles.
  50
  51 # August 2010.
  52 #
  53 # Rescheduling for dual-issue pipeline resulted in 13% improvement on
  54 # Cortex A8 core and in absolute terms ~870 cycles per input block
  55 # [or 13.6 cycles per byte].
  56
  57 # February 2011.
  58 #
  59 # Profiler-assisted and platform-specific optimization resulted in 10%
  60 # improvement on Cortex A8 core and 12.2 cycles per byte.
  61
  62 # September 2013.
  63 #
  64 # Add NEON implementation (see sha1-586.pl for background info). On
  65 # Cortex A8 it was measured to process one byte in 6.7 cycles or >80%
  66 # faster than integer-only code. Because [fully unrolled] NEON code
  67 # is ~2.5x larger and there are some redundant instructions executed
  68 # when processing last block, improvement is not as big for smallest
  69 # blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per
  70 # byte, which is also >80% faster than integer-only code. Cortex-A15
  71 # is even faster spending 5.6 cycles per byte outperforming integer-
  72 # only code by factor of 2.
  73
  74 # May 2014.
  75 #
  76 # Add ARMv8 code path performing at 2.35 cpb on Apple A7.
  77
  78 # $output is the last argument if it looks like a file (it has an extension)
  79 # $flavour is the first argument if it doesn't look like a file
  80 $output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef;
  81 $flavour = $#ARGV >= 0 && $ARGV[0] !~ m|\.| ? shift : undef;
  82
  83 if ($flavour && $flavour ne "void") {
  84     $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
  85     ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
  86     ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
  87     die "can't locate arm-xlate.pl";
  88
  89     open STDOUT,"| \"$^X\" $xlate $flavour \"$output\""
  90         or die "can't call $xlate: $!";
  91 } else {
  92     $output and open STDOUT,">$output";
  93 }
  94
  95 $ctx="r0";
  96 $inp="r1";
  97 $len="r2";
  98 $a="r3";
  99 $b="r4";
 100 $c="r5";
 101 $d="r6";
 102 $e="r7";
 103 $K="r8";
 104 $t0="r9";
 105 $t1="r10";
 106 $t2="r11";
 107 $t3="r12";
 108 $Xi="r14";
 109 @V=($a,$b,$c,$d,$e);
 110
 111 sub Xupdate {
 112 my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_;
 113 $code.=<<___;
 114         ldr     $t0,[$Xi,#15*4]
 115         ldr     $t1,[$Xi,#13*4]
 116         ldr     $t2,[$Xi,#7*4]
 117         add     $e,$K,$e,ror#2                  @ E+=K_xx_xx
 118         ldr     $t3,[$Xi,#2*4]
 119         eor     $t0,$t0,$t1
 120         eor     $t2,$t2,$t3                     @ 1 cycle stall
 121         eor     $t1,$c,$d                       @ F_xx_xx
 122         mov     $t0,$t0,ror#31
 123         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 124         eor     $t0,$t0,$t2,ror#31
 125         str     $t0,[$Xi,#-4]!
 126         $opt1                                   @ F_xx_xx
 127         $opt2                                   @ F_xx_xx
 128         add     $e,$e,$t0                       @ E+=X[i]
 129 ___
 130 }
 131
 132 sub BODY_00_15 {
 133 my ($a,$b,$c,$d,$e)=@_;
 134 $code.=<<___;
 135 #if __ARM_ARCH__<7
 136         ldrb    $t1,[$inp,#2]
 137         ldrb    $t0,[$inp,#3]
 138         ldrb    $t2,[$inp,#1]
 139         add     $e,$K,$e,ror#2                  @ E+=K_00_19
 140         ldrb    $t3,[$inp],#4
 141         orr     $t0,$t0,$t1,lsl#8
 142         eor     $t1,$c,$d                       @ F_xx_xx
 143         orr     $t0,$t0,$t2,lsl#16
 144         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 145         orr     $t0,$t0,$t3,lsl#24
 146 #else
 147         ldr     $t0,[$inp],#4                   @ handles unaligned
 148         add     $e,$K,$e,ror#2                  @ E+=K_00_19
 149         eor     $t1,$c,$d                       @ F_xx_xx
 150         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 151 #ifdef __ARMEL__
 152         rev     $t0,$t0                         @ byte swap
 153 #endif
 154 #endif
 155         and     $t1,$b,$t1,ror#2
 156         add     $e,$e,$t0                       @ E+=X[i]
 157         eor     $t1,$t1,$d,ror#2                @ F_00_19(B,C,D)
 158         str     $t0,[$Xi,#-4]!
 159         add     $e,$e,$t1                       @ E+=F_00_19(B,C,D)
 160 ___
 161 }
 162
 163 sub BODY_16_19 {
 164 my ($a,$b,$c,$d,$e)=@_;
 165         &Xupdate(@_,"and $t1,$b,$t1,ror#2");
 166 $code.=<<___;
 167         eor     $t1,$t1,$d,ror#2                @ F_00_19(B,C,D)
 168         add     $e,$e,$t1                       @ E+=F_00_19(B,C,D)
 169 ___
 170 }
 171
 172 sub BODY_20_39 {
 173 my ($a,$b,$c,$d,$e)=@_;
 174         &Xupdate(@_,"eor $t1,$b,$t1,ror#2");
 175 $code.=<<___;
 176         add     $e,$e,$t1                       @ E+=F_20_39(B,C,D)
 177 ___
 178 }
 179
 180 sub BODY_40_59 {
 181 my ($a,$b,$c,$d,$e)=@_;
 182         &Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d");
 183 $code.=<<___;
 184         add     $e,$e,$t1                       @ E+=F_40_59(B,C,D)
 185         add     $e,$e,$t2,ror#2
 186 ___
 187 }
 188
 189 $code=<<___;
 190 #include "arm_arch.h"
 191
 192 #if defined(__thumb2__)
 193 .syntax unified
 194 .thumb
 195 #else
 196 .code   32
 197 #endif
 198
 199 .text
 200
 201 .global sha1_block_data_order
 202 .type   sha1_block_data_order,%function
 203
 204 .align  5
 205 sha1_block_data_order:
 206 #if __ARM_MAX_ARCH__>=7
 207 .Lsha1_block:
 208         ldr     r12,.LOPENSSL_armcap
 209 # if !defined(_WIN32)
 210         adr     r3,.Lsha1_block
 211         ldr     r12,[r3,r12]            @ OPENSSL_armcap_P
 212 # endif
 213 # if defined(__APPLE__) || defined(_WIN32)
 214         ldr     r12,[r12]
 215 # endif
 216         tst     r12,#ARMV8_SHA1
 217         bne     .LARMv8
 218         tst     r12,#ARMV7_NEON
 219         bne     .LNEON
 220 #endif
 221         stmdb   sp!,{r4-r12,lr}
 222         add     $len,$inp,$len,lsl#6    @ $len to point at the end of $inp
 223         ldmia   $ctx,{$a,$b,$c,$d,$e}
 224 .Lloop:
 225         ldr     $K,.LK_00_19
 226         mov     $Xi,sp
 227         sub     sp,sp,#15*4
 228         mov     $c,$c,ror#30
 229         mov     $d,$d,ror#30
 230         mov     $e,$e,ror#30            @ [6]
 231 .L_00_15:
 232 ___
 233 for($i=0;$i<5;$i++) {
 234         &BODY_00_15(@V);        unshift(@V,pop(@V));
 235 }
 236 $code.=<<___;
 237 #if defined(__thumb2__)
 238         mov     $t3,sp
 239         teq     $Xi,$t3
 240 #else
 241         teq     $Xi,sp
 242 #endif
 243         bne     .L_00_15                @ [((11+4)*5+2)*3]
 244         sub     sp,sp,#25*4
 245 ___
 246         &BODY_00_15(@V);        unshift(@V,pop(@V));
 247         &BODY_16_19(@V);        unshift(@V,pop(@V));
 248         &BODY_16_19(@V);        unshift(@V,pop(@V));
 249         &BODY_16_19(@V);        unshift(@V,pop(@V));
 250         &BODY_16_19(@V);        unshift(@V,pop(@V));
 251 $code.=<<___;
 252
 253         ldr     $K,.LK_20_39            @ [+15+16*4]
 254         cmn     sp,#0                   @ [+3], clear carry to denote 20_39
 255 .L_20_39_or_60_79:
 256 ___
 257 for($i=0;$i<5;$i++) {
 258         &BODY_20_39(@V);        unshift(@V,pop(@V));
 259 }
 260 $code.=<<___;
 261 #if defined(__thumb2__)
 262         mov     $t3,sp
 263         teq     $Xi,$t3
 264 #else
 265         teq     $Xi,sp                  @ preserve carry
 266 #endif
 267         bne     .L_20_39_or_60_79       @ [+((12+3)*5+2)*4]
 268         bcs     .L_done                 @ [+((12+3)*5+2)*4], spare 300 bytes
 269
 270         ldr     $K,.LK_40_59
 271         sub     sp,sp,#20*4             @ [+2]
 272 .L_40_59:
 273 ___
 274 for($i=0;$i<5;$i++) {
 275         &BODY_40_59(@V);        unshift(@V,pop(@V));
 276 }
 277 $code.=<<___;
 278 #if defined(__thumb2__)
 279         mov     $t3,sp
 280         teq     $Xi,$t3
 281 #else
 282         teq     $Xi,sp
 283 #endif
 284         bne     .L_40_59                @ [+((12+5)*5+2)*4]
 285
 286         ldr     $K,.LK_60_79
 287         sub     sp,sp,#20*4
 288         cmp     sp,#0                   @ set carry to denote 60_79
 289         b       .L_20_39_or_60_79       @ [+4], spare 300 bytes
 290 .L_done:
 291         add     sp,sp,#80*4             @ "deallocate" stack frame
 292         ldmia   $ctx,{$K,$t0,$t1,$t2,$t3}
 293         add     $a,$K,$a
 294         add     $b,$t0,$b
 295         add     $c,$t1,$c,ror#2
 296         add     $d,$t2,$d,ror#2
 297         add     $e,$t3,$e,ror#2
 298         stmia   $ctx,{$a,$b,$c,$d,$e}
 299         teq     $inp,$len
 300         bne     .Lloop                  @ [+18], total 1307
 301
 302 #if __ARM_ARCH__>=5
 303         ldmia   sp!,{r4-r12,pc}
 304 #else
 305         ldmia   sp!,{r4-r12,lr}
 306         tst     lr,#1
 307         moveq   pc,lr                   @ be binary compatible with V4, yet
 308         bx      lr                      @ interoperable with Thumb ISA:-)
 309 #endif
 310 .size   sha1_block_data_order,.-sha1_block_data_order
 311
 312 .align  5
 313 .LK_00_19:      .word   0x5a827999
 314 .LK_20_39:      .word   0x6ed9eba1
 315 .LK_40_59:      .word   0x8f1bbcdc
 316 .LK_60_79:      .word   0xca62c1d6
 317 #if __ARM_MAX_ARCH__>=7
 318 .LOPENSSL_armcap:
 319 # ifdef _WIN32
 320 .word   OPENSSL_armcap_P
 321 # else
 322 .word   OPENSSL_armcap_P-.Lsha1_block
 323 # endif
 324 #endif
 325 .asciz  "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>"
 326 .align  5
 327 ___
 328 #####################################################################
 329 # NEON stuff
 330 #
 331 {{{
 332 my @V=($a,$b,$c,$d,$e);
 333 my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14));
 334 my $Xi=4;
 335 my @X=map("q$_",(8..11,0..3));
 336 my @Tx=("q12","q13");
 337 my ($K,$zero)=("q14","q15");
 338 my $j=0;
 339
 340 sub AUTOLOAD()          # thunk [simplified] x86-style perlasm
 341 { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./;
 342   my $arg = pop;
 343     $arg = "#$arg" if ($arg*1 eq $arg);
 344     $code .= "\t$opcode\t".join(',',@_,$arg)."\n";
 345 }
 346
 347 sub body_00_19 () {
 348         (
 349         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 350         '&bic   ($t0,$d,$b)',
 351         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 352         '&and   ($t1,$c,$b)',
 353         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
 354         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 355         '&eor   ($t1,$t1,$t0)',         # F_00_19
 356         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 357         '&add   ($e,$e,$t1);'.          # e+=F_00_19
 358         '$j++;  unshift(@V,pop(@V));'
 359         )
 360 }
 361 sub body_20_39 () {
 362         (
 363         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 364         '&eor   ($t0,$b,$d)',
 365         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 366         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)',
 367         '&eor   ($t1,$t0,$c)',          # F_20_39
 368         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 369         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 370         '&add   ($e,$e,$t1);'.          # e+=F_20_39
 371         '$j++;  unshift(@V,pop(@V));'
 372         )
 373 }
 374 sub body_40_59 () {
 375         (
 376         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 377         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 378         '&and   ($t0,$c,$d)',
 379         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
 380         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 381         '&eor   ($t1,$c,$d)',
 382         '&add   ($e,$e,$t0)',
 383         '&and   ($t1,$t1,$b)',
 384         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 385         '&add   ($e,$e,$t1);'.          # e+=F_40_59
 386         '$j++;  unshift(@V,pop(@V));'
 387         )
 388 }
 389
 390 sub Xupdate_16_31 ()
 391 { use integer;
 392   my $body = shift;
 393   my @insns = (&$body,&$body,&$body,&$body);
 394   my ($a,$b,$c,$d,$e);
 395
 396         &vext_8         (@X[0],@X[-4&7],@X[-3&7],8);    # compose "X[-14]" in "X[0]"
 397          eval(shift(@insns));
 398          eval(shift(@insns));
 399          eval(shift(@insns));
 400           &vadd_i32     (@Tx[1],@X[-1&7],$K);
 401          eval(shift(@insns));
 402           &vld1_32      ("{$K\[]}","[$K_XX_XX,:32]!")   if ($Xi%5==0);
 403          eval(shift(@insns));
 404         &vext_8         (@Tx[0],@X[-1&7],$zero,4);      # "X[-3]", 3 words
 405          eval(shift(@insns));
 406          eval(shift(@insns));
 407          eval(shift(@insns));
 408         &veor           (@X[0],@X[0],@X[-4&7]);         # "X[0]"^="X[-16]"
 409          eval(shift(@insns));
 410          eval(shift(@insns));
 411         &veor           (@Tx[0],@Tx[0],@X[-2&7]);       # "X[-3]"^"X[-8]"
 412          eval(shift(@insns));
 413          eval(shift(@insns));
 414         &veor           (@Tx[0],@Tx[0],@X[0]);          # "X[0]"^="X[-3]"^"X[-8]
 415          eval(shift(@insns));
 416          eval(shift(@insns));
 417           &vst1_32      ("{@Tx[1]}","[$Xfer,:128]!");   # X[]+K xfer
 418           &sub          ($Xfer,$Xfer,64)                if ($Xi%4==0);
 419          eval(shift(@insns));
 420          eval(shift(@insns));
 421         &vext_8         (@Tx[1],$zero,@Tx[0],4);        # "X[0]"<<96, extract one dword
 422          eval(shift(@insns));
 423          eval(shift(@insns));
 424         &vadd_i32       (@X[0],@Tx[0],@Tx[0]);
 425          eval(shift(@insns));
 426          eval(shift(@insns));
 427         &vsri_32        (@X[0],@Tx[0],31);              # "X[0]"<<<=1
 428          eval(shift(@insns));
 429          eval(shift(@insns));
 430          eval(shift(@insns));
 431         &vshr_u32       (@Tx[0],@Tx[1],30);
 432          eval(shift(@insns));
 433          eval(shift(@insns));
 434         &vshl_u32       (@Tx[1],@Tx[1],2);
 435          eval(shift(@insns));
 436          eval(shift(@insns));
 437         &veor           (@X[0],@X[0],@Tx[0]);
 438          eval(shift(@insns));
 439          eval(shift(@insns));
 440         &veor           (@X[0],@X[0],@Tx[1]);           # "X[0]"^=("X[0]">>96)<<<2
 441
 442         foreach (@insns) { eval; }      # remaining instructions [if any]
 443
 444   $Xi++;        push(@X,shift(@X));     # "rotate" X[]
 445 }
 446
 447 sub Xupdate_32_79 ()
 448 { use integer;
 449   my $body = shift;
 450   my @insns = (&$body,&$body,&$body,&$body);
 451   my ($a,$b,$c,$d,$e);
 452
 453         &vext_8         (@Tx[0],@X[-2&7],@X[-1&7],8);   # compose "X[-6]"
 454          eval(shift(@insns));
 455          eval(shift(@insns));
 456          eval(shift(@insns));
 457         &veor           (@X[0],@X[0],@X[-4&7]);         # "X[0]"="X[-32]"^"X[-16]"
 458          eval(shift(@insns));
 459          eval(shift(@insns));
 460         &veor           (@X[0],@X[0],@X[-7&7]);         # "X[0]"^="X[-28]"
 461          eval(shift(@insns));
 462          eval(shift(@insns));
 463           &vadd_i32     (@Tx[1],@X[-1&7],$K);
 464          eval(shift(@insns));
 465           &vld1_32      ("{$K\[]}","[$K_XX_XX,:32]!")   if ($Xi%5==0);
 466          eval(shift(@insns));
 467         &veor           (@Tx[0],@Tx[0],@X[0]);          # "X[-6]"^="X[0]"
 468          eval(shift(@insns));
 469          eval(shift(@insns));
 470         &vshr_u32       (@X[0],@Tx[0],30);
 471          eval(shift(@insns));
 472          eval(shift(@insns));
 473           &vst1_32      ("{@Tx[1]}","[$Xfer,:128]!");   # X[]+K xfer
 474           &sub          ($Xfer,$Xfer,64)                if ($Xi%4==0);
 475          eval(shift(@insns));
 476          eval(shift(@insns));
 477         &vsli_32        (@X[0],@Tx[0],2);               # "X[0]"="X[-6]"<<<2
 478
 479         foreach (@insns) { eval; }      # remaining instructions [if any]
 480
 481   $Xi++;        push(@X,shift(@X));     # "rotate" X[]
 482 }
 483
 484 sub Xuplast_80 ()
 485 { use integer;
 486   my $body = shift;
 487   my @insns = (&$body,&$body,&$body,&$body);
 488   my ($a,$b,$c,$d,$e);
 489
 490         &vadd_i32       (@Tx[1],@X[-1&7],$K);
 491          eval(shift(@insns));
 492          eval(shift(@insns));
 493         &vst1_32        ("{@Tx[1]}","[$Xfer,:128]!");
 494         &sub            ($Xfer,$Xfer,64);
 495
 496         &teq            ($inp,$len);
 497         &sub            ($K_XX_XX,$K_XX_XX,16); # rewind $K_XX_XX
 498         &it             ("eq");
 499         &subeq          ($inp,$inp,64);         # reload last block to avoid SEGV
 500         &vld1_8         ("{@X[-4&7]-@X[-3&7]}","[$inp]!");
 501          eval(shift(@insns));
 502          eval(shift(@insns));
 503         &vld1_8         ("{@X[-2&7]-@X[-1&7]}","[$inp]!");
 504          eval(shift(@insns));
 505          eval(shift(@insns));
 506         &vld1_32        ("{$K\[]}","[$K_XX_XX,:32]!");  # load K_00_19
 507          eval(shift(@insns));
 508          eval(shift(@insns));
 509         &vrev32_8       (@X[-4&7],@X[-4&7]);
 510
 511         foreach (@insns) { eval; }              # remaining instructions
 512
 513    $Xi=0;
 514 }
 515
 516 sub Xloop()
 517 { use integer;
 518   my $body = shift;
 519   my @insns = (&$body,&$body,&$body,&$body);
 520   my ($a,$b,$c,$d,$e);
 521
 522         &vrev32_8       (@X[($Xi-3)&7],@X[($Xi-3)&7]);
 523          eval(shift(@insns));
 524          eval(shift(@insns));
 525         &vadd_i32       (@X[$Xi&7],@X[($Xi-4)&7],$K);
 526          eval(shift(@insns));
 527          eval(shift(@insns));
 528         &vst1_32        ("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU
 529
 530         foreach (@insns) { eval; }
 531
 532   $Xi++;
 533 }
 534
 535 $code.=<<___;
 536 #if __ARM_MAX_ARCH__>=7
 537 .arch   armv7-a
 538 .fpu    neon
 539
 540 .type   sha1_block_data_order_neon,%function
 541 .align  4
 542 sha1_block_data_order_neon:
 543 .LNEON:
 544         stmdb   sp!,{r4-r12,lr}
 545         add     $len,$inp,$len,lsl#6    @ $len to point at the end of $inp
 546         @ dmb                           @ errata #451034 on early Cortex A8
 547         @ vstmdb        sp!,{d8-d15}    @ ABI specification says so
 548         mov     $saved_sp,sp
 549         sub     $Xfer,sp,#64
 550         adr     $K_XX_XX,.LK_00_19
 551         bic     $Xfer,$Xfer,#15         @ align for 128-bit stores
 552
 553         ldmia   $ctx,{$a,$b,$c,$d,$e}   @ load context
 554         mov     sp,$Xfer                @ alloca
 555
 556         vld1.8          {@X[-4&7]-@X[-3&7]},[$inp]!     @ handles unaligned
 557         veor            $zero,$zero,$zero
 558         vld1.8          {@X[-2&7]-@X[-1&7]},[$inp]!
 559         vld1.32         {${K}\[]},[$K_XX_XX,:32]!       @ load K_00_19
 560         vrev32.8        @X[-4&7],@X[-4&7]               @ yes, even on
 561         vrev32.8        @X[-3&7],@X[-3&7]               @ big-endian...
 562         vrev32.8        @X[-2&7],@X[-2&7]
 563         vadd.i32        @X[0],@X[-4&7],$K
 564         vrev32.8        @X[-1&7],@X[-1&7]
 565         vadd.i32        @X[1],@X[-3&7],$K
 566         vst1.32         {@X[0]},[$Xfer,:128]!
 567         vadd.i32        @X[2],@X[-2&7],$K
 568         vst1.32         {@X[1]},[$Xfer,:128]!
 569         vst1.32         {@X[2]},[$Xfer,:128]!
 570         ldr             $Ki,[sp]                        @ big RAW stall
 571
 572 .Loop_neon:
 573 ___
 574         &Xupdate_16_31(\&body_00_19);
 575         &Xupdate_16_31(\&body_00_19);
 576         &Xupdate_16_31(\&body_00_19);
 577         &Xupdate_16_31(\&body_00_19);
 578         &Xupdate_32_79(\&body_00_19);
 579         &Xupdate_32_79(\&body_20_39);
 580         &Xupdate_32_79(\&body_20_39);
 581         &Xupdate_32_79(\&body_20_39);
 582         &Xupdate_32_79(\&body_20_39);
 583         &Xupdate_32_79(\&body_20_39);
 584         &Xupdate_32_79(\&body_40_59);
 585         &Xupdate_32_79(\&body_40_59);
 586         &Xupdate_32_79(\&body_40_59);
 587         &Xupdate_32_79(\&body_40_59);
 588         &Xupdate_32_79(\&body_40_59);
 589         &Xupdate_32_79(\&body_20_39);
 590         &Xuplast_80(\&body_20_39);
 591         &Xloop(\&body_20_39);
 592         &Xloop(\&body_20_39);
 593         &Xloop(\&body_20_39);
 594 $code.=<<___;
 595         ldmia   $ctx,{$Ki,$t0,$t1,$Xfer}        @ accumulate context
 596         add     $a,$a,$Ki
 597         ldr     $Ki,[$ctx,#16]
 598         add     $b,$b,$t0
 599         add     $c,$c,$t1
 600         add     $d,$d,$Xfer
 601         it      eq
 602         moveq   sp,$saved_sp
 603         add     $e,$e,$Ki
 604         it      ne
 605         ldrne   $Ki,[sp]
 606         stmia   $ctx,{$a,$b,$c,$d,$e}
 607         itt     ne
 608         addne   $Xfer,sp,#3*16
 609         bne     .Loop_neon
 610
 611         @ vldmia        sp!,{d8-d15}
 612         ldmia   sp!,{r4-r12,pc}
 613 .size   sha1_block_data_order_neon,.-sha1_block_data_order_neon
 614 #endif
 615 ___
 616 }}}
 617 #####################################################################
 618 # ARMv8 stuff
 619 #
 620 {{{
 621 my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3));
 622 my @MSG=map("q$_",(4..7));
 623 my @Kxx=map("q$_",(8..11));
 624 my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14));
 625 my $_byte = ($flavour =~ /win/ ? "DCB" : ".byte");
 626
 627 $code.=<<___;
 628 #if __ARM_MAX_ARCH__>=7
 629
 630 # if defined(__thumb2__)
 631 #  define INST(a,b,c,d) $_byte  c,d|0xf,a,b
 632 # else
 633 #  define INST(a,b,c,d) $_byte  a,b,c,d|0x10
 634 # endif
 635
 636 .type   sha1_block_data_order_armv8,%function
 637 .align  5
 638 sha1_block_data_order_armv8:
 639 .LARMv8:
 640         vstmdb  sp!,{d8-d15}            @ ABI specification says so
 641
 642         veor    $E,$E,$E
 643         adr     r3,.LK_00_19
 644         vld1.32 {$ABCD},[$ctx]!
 645         vld1.32 {$E\[0]},[$ctx]
 646         sub     $ctx,$ctx,#16
 647         vld1.32 {@Kxx[0]\[]},[r3,:32]!
 648         vld1.32 {@Kxx[1]\[]},[r3,:32]!
 649         vld1.32 {@Kxx[2]\[]},[r3,:32]!
 650         vld1.32 {@Kxx[3]\[]},[r3,:32]
 651
 652 .Loop_v8:
 653         vld1.8          {@MSG[0]-@MSG[1]},[$inp]!
 654         vld1.8          {@MSG[2]-@MSG[3]},[$inp]!
 655         vrev32.8        @MSG[0],@MSG[0]
 656         vrev32.8        @MSG[1],@MSG[1]
 657
 658         vadd.i32        $W0,@Kxx[0],@MSG[0]
 659         vrev32.8        @MSG[2],@MSG[2]
 660         vmov            $ABCD_SAVE,$ABCD        @ offload
 661         subs            $len,$len,#1
 662
 663         vadd.i32        $W1,@Kxx[0],@MSG[1]
 664         vrev32.8        @MSG[3],@MSG[3]
 665         sha1h           $E1,$ABCD               @ 0
 666         sha1c           $ABCD,$E,$W0
 667         vadd.i32        $W0,@Kxx[$j],@MSG[2]
 668         sha1su0         @MSG[0],@MSG[1],@MSG[2]
 669 ___
 670 for ($j=0,$i=1;$i<20-3;$i++) {
 671 my $f=("c","p","m","p")[$i/5];
 672 $code.=<<___;
 673         sha1h           $E0,$ABCD               @ $i
 674         sha1$f          $ABCD,$E1,$W1
 675         vadd.i32        $W1,@Kxx[$j],@MSG[3]
 676         sha1su1         @MSG[0],@MSG[3]
 677 ___
 678 $code.=<<___ if ($i<20-4);
 679         sha1su0         @MSG[1],@MSG[2],@MSG[3]
 680 ___
 681         ($E0,$E1)=($E1,$E0);    ($W0,$W1)=($W1,$W0);
 682         push(@MSG,shift(@MSG)); $j++ if ((($i+3)%5)==0);
 683 }
 684 $code.=<<___;
 685         sha1h           $E0,$ABCD               @ $i
 686         sha1p           $ABCD,$E1,$W1
 687         vadd.i32        $W1,@Kxx[$j],@MSG[3]
 688
 689         sha1h           $E1,$ABCD               @ 18
 690         sha1p           $ABCD,$E0,$W0
 691
 692         sha1h           $E0,$ABCD               @ 19
 693         sha1p           $ABCD,$E1,$W1
 694
 695         vadd.i32        $E,$E,$E0
 696         vadd.i32        $ABCD,$ABCD,$ABCD_SAVE
 697         bne             .Loop_v8
 698
 699         vst1.32         {$ABCD},[$ctx]!
 700         vst1.32         {$E\[0]},[$ctx]
 701
 702         vldmia  sp!,{d8-d15}
 703         ret                                     @ bx lr
 704 .size   sha1_block_data_order_armv8,.-sha1_block_data_order_armv8
 705 #endif
 706 ___
 707 }}}
 708 $code.=<<___;
 709 #if __ARM_MAX_ARCH__>=7
 710 .comm   OPENSSL_armcap_P,4,4
 711 #endif
 712 ___
 713
 714 {   my  %opcode = (
 715         "sha1c"         => 0xf2000c40,  "sha1p"         => 0xf2100c40,
 716         "sha1m"         => 0xf2200c40,  "sha1su0"       => 0xf2300c40,
 717         "sha1h"         => 0xf3b902c0,  "sha1su1"       => 0xf3ba0380   );
 718
 719     sub unsha1 {
 720         my ($mnemonic,$arg)=@_;
 721
 722         if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) {
 723             my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19)
 724                                          |(($2&7)<<17)|(($2&8)<<4)
 725                                          |(($3&7)<<1) |(($3&8)<<2);
 726             # since ARMv7 instructions are always encoded little-endian.
 727             # correct solution is to use .inst directive, but older
 728             # assemblers don't implement it:-(
 729
 730             # this fix-up provides Thumb encoding in conjunction with INST
 731             $word &= ~0x10000000 if (($word & 0x0f000000) == 0x02000000);
 732             sprintf "INST(0x%02x,0x%02x,0x%02x,0x%02x)\t@ %s %s",
 733                         $word&0xff,($word>>8)&0xff,
 734                         ($word>>16)&0xff,($word>>24)&0xff,
 735                         $mnemonic,$arg;
 736         }
 737     }
 738 }
 739
 740 foreach (split($/,$code)) {
 741         s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo        or
 742         s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo;
 743
 744         s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo;
 745
 746         s/\bret\b/bx    lr/o            or
 747         s/\bbx\s+lr\b/.word\t0xe12fff1e/o;      # make it possible to compile with -march=armv4
 748
 749         print $_,$/;
 750 }
 751
 752 close STDOUT; # enforce flush