crypto/sha/asm/sha1-armv4-large.pl

   1 #!/usr/bin/env perl
   2
   3 # ====================================================================
   4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
   5 # project. The module is, however, dual licensed under OpenSSL and
   6 # CRYPTOGAMS licenses depending on where you obtain it. For further
   7 # details see http://www.openssl.org/~appro/cryptogams/.
   8 # ====================================================================
   9
  10 # sha1_block procedure for ARMv4.
  11 #
  12 # January 2007.
  13
  14 # Size/performance trade-off
  15 # ====================================================================
  16 # impl          size in bytes   comp cycles[*]  measured performance
  17 # ====================================================================
  18 # thumb         304             3212            4420
  19 # armv4-small   392/+29%        1958/+64%       2250/+96%
  20 # armv4-compact 740/+89%        1552/+26%       1840/+22%
  21 # armv4-large   1420/+92%       1307/+19%       1370/+34%[***]
  22 # full unroll   ~5100/+260%     ~1260/+4%       ~1300/+5%
  23 # ====================================================================
  24 # thumb         = same as 'small' but in Thumb instructions[**] and
  25 #                 with recurring code in two private functions;
  26 # small         = detached Xload/update, loops are folded;
  27 # compact       = detached Xload/update, 5x unroll;
  28 # large         = interleaved Xload/update, 5x unroll;
  29 # full unroll   = interleaved Xload/update, full unroll, estimated[!];
  30 #
  31 # [*]   Manually counted instructions in "grand" loop body. Measured
  32 #       performance is affected by prologue and epilogue overhead,
  33 #       i-cache availability, branch penalties, etc.
  34 # [**]  While each Thumb instruction is twice smaller, they are not as
  35 #       diverse as ARM ones: e.g., there are only two arithmetic
  36 #       instructions with 3 arguments, no [fixed] rotate, addressing
  37 #       modes are limited. As result it takes more instructions to do
  38 #       the same job in Thumb, therefore the code is never twice as
  39 #       small and always slower.
  40 # [***] which is also ~35% better than compiler generated code. Dual-
  41 #       issue Cortex A8 core was measured to process input block in
  42 #       ~990 cycles.
  43
  44 # August 2010.
  45 #
  46 # Rescheduling for dual-issue pipeline resulted in 13% improvement on
  47 # Cortex A8 core and in absolute terms ~870 cycles per input block
  48 # [or 13.6 cycles per byte].
  49
  50 # February 2011.
  51 #
  52 # Profiler-assisted and platform-specific optimization resulted in 10%
  53 # improvement on Cortex A8 core and 12.2 cycles per byte.
  54
  55 # September 2013.
  56 #
  57 # Add NEON implementation (see sha1-586.pl for background info). On
  58 # Cortex A8 it was measured to process one byte in 6.7 cycles or >80%
  59 # faster than integer-only code. Because [fully unrolled] NEON code
  60 # is ~2.5x larger and there are some redundant instructions executed
  61 # when processing last block, improvement is not as big for smallest
  62 # blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per
  63 # byte, which is also >80% faster than integer-only code. Cortex-A15
  64 # is even faster spending 5.6 cycles per byte outperforming integer-
  65 # only code by factor of 2.
  66
  67 # May 2014.
  68 #
  69 # Add ARMv8 code path performing at 2.35 cpb on Apple A7.
  70
  71 $flavour = shift;
  72 if ($flavour=~/^\w[\w\-]*\.\w+$/) { $output=$flavour; undef $flavour; }
  73 else { while (($output=shift) && ($output!~/^\w[\w\-]*\.\w+$/)) {} }
  74
  75 if ($flavour && $flavour ne "void") {
  76     $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
  77     ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
  78     ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
  79     die "can't locate arm-xlate.pl";
  80
  81     open STDOUT,"| \"$^X\" $xlate $flavour $output";
  82 } else {
  83     open STDOUT,">$output";
  84 }
  85
  86 $ctx="r0";
  87 $inp="r1";
  88 $len="r2";
  89 $a="r3";
  90 $b="r4";
  91 $c="r5";
  92 $d="r6";
  93 $e="r7";
  94 $K="r8";
  95 $t0="r9";
  96 $t1="r10";
  97 $t2="r11";
  98 $t3="r12";
  99 $Xi="r14";
 100 @V=($a,$b,$c,$d,$e);
 101
 102 sub Xupdate {
 103 my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_;
 104 $code.=<<___;
 105         ldr     $t0,[$Xi,#15*4]
 106         ldr     $t1,[$Xi,#13*4]
 107         ldr     $t2,[$Xi,#7*4]
 108         add     $e,$K,$e,ror#2                  @ E+=K_xx_xx
 109         ldr     $t3,[$Xi,#2*4]
 110         eor     $t0,$t0,$t1
 111         eor     $t2,$t2,$t3                     @ 1 cycle stall
 112         eor     $t1,$c,$d                       @ F_xx_xx
 113         mov     $t0,$t0,ror#31
 114         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 115         eor     $t0,$t0,$t2,ror#31
 116         str     $t0,[$Xi,#-4]!
 117         $opt1                                   @ F_xx_xx
 118         $opt2                                   @ F_xx_xx
 119         add     $e,$e,$t0                       @ E+=X[i]
 120 ___
 121 }
 122
 123 sub BODY_00_15 {
 124 my ($a,$b,$c,$d,$e)=@_;
 125 $code.=<<___;
 126 #if __ARM_ARCH__<7
 127         ldrb    $t1,[$inp,#2]
 128         ldrb    $t0,[$inp,#3]
 129         ldrb    $t2,[$inp,#1]
 130         add     $e,$K,$e,ror#2                  @ E+=K_00_19
 131         ldrb    $t3,[$inp],#4
 132         orr     $t0,$t0,$t1,lsl#8
 133         eor     $t1,$c,$d                       @ F_xx_xx
 134         orr     $t0,$t0,$t2,lsl#16
 135         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 136         orr     $t0,$t0,$t3,lsl#24
 137 #else
 138         ldr     $t0,[$inp],#4                   @ handles unaligned
 139         add     $e,$K,$e,ror#2                  @ E+=K_00_19
 140         eor     $t1,$c,$d                       @ F_xx_xx
 141         add     $e,$e,$a,ror#27                 @ E+=ROR(A,27)
 142 #ifdef __ARMEL__
 143         rev     $t0,$t0                         @ byte swap
 144 #endif
 145 #endif
 146         and     $t1,$b,$t1,ror#2
 147         add     $e,$e,$t0                       @ E+=X[i]
 148         eor     $t1,$t1,$d,ror#2                @ F_00_19(B,C,D)
 149         str     $t0,[$Xi,#-4]!
 150         add     $e,$e,$t1                       @ E+=F_00_19(B,C,D)
 151 ___
 152 }
 153
 154 sub BODY_16_19 {
 155 my ($a,$b,$c,$d,$e)=@_;
 156         &Xupdate(@_,"and $t1,$b,$t1,ror#2");
 157 $code.=<<___;
 158         eor     $t1,$t1,$d,ror#2                @ F_00_19(B,C,D)
 159         add     $e,$e,$t1                       @ E+=F_00_19(B,C,D)
 160 ___
 161 }
 162
 163 sub BODY_20_39 {
 164 my ($a,$b,$c,$d,$e)=@_;
 165         &Xupdate(@_,"eor $t1,$b,$t1,ror#2");
 166 $code.=<<___;
 167         add     $e,$e,$t1                       @ E+=F_20_39(B,C,D)
 168 ___
 169 }
 170
 171 sub BODY_40_59 {
 172 my ($a,$b,$c,$d,$e)=@_;
 173         &Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d");
 174 $code.=<<___;
 175         add     $e,$e,$t1                       @ E+=F_40_59(B,C,D)
 176         add     $e,$e,$t2,ror#2
 177 ___
 178 }
 179
 180 $code=<<___;
 181 #include "arm_arch.h"
 182
 183 .text
 184 #if defined(__thumb2__) && !defined(__APPLE__)
 185 .syntax unified
 186 .thumb
 187 #else
 188 .code   32
 189 #endif
 190
 191 .global sha1_block_data_order
 192 .type   sha1_block_data_order,%function
 193
 194 .align  5
 195 sha1_block_data_order:
 196 #if __ARM_MAX_ARCH__>=7
 197 .Lsha1_block:
 198         adr     r3,.Lsha1_block
 199         ldr     r12,.LOPENSSL_armcap
 200         ldr     r12,[r3,r12]            @ OPENSSL_armcap_P
 201 #ifdef  __APPLE__
 202         ldr     r12,[r12]
 203 #endif
 204         tst     r12,#ARMV8_SHA1
 205         bne     .LARMv8
 206         tst     r12,#ARMV7_NEON
 207         bne     .LNEON
 208 #endif
 209         stmdb   sp!,{r4-r12,lr}
 210         add     $len,$inp,$len,lsl#6    @ $len to point at the end of $inp
 211         ldmia   $ctx,{$a,$b,$c,$d,$e}
 212 .Lloop:
 213         ldr     $K,.LK_00_19
 214         mov     $Xi,sp
 215         sub     sp,sp,#15*4
 216         mov     $c,$c,ror#30
 217         mov     $d,$d,ror#30
 218         mov     $e,$e,ror#30            @ [6]
 219 .L_00_15:
 220 ___
 221 for($i=0;$i<5;$i++) {
 222         &BODY_00_15(@V);        unshift(@V,pop(@V));
 223 }
 224 $code.=<<___;
 225 #if defined(__thumb2__) && !defined(__APPLE__)
 226         mov     $t3,sp
 227         teq     $Xi,$t3
 228 #else
 229         teq     $Xi,sp
 230 #endif
 231         bne     .L_00_15                @ [((11+4)*5+2)*3]
 232         sub     sp,sp,#25*4
 233 ___
 234         &BODY_00_15(@V);        unshift(@V,pop(@V));
 235         &BODY_16_19(@V);        unshift(@V,pop(@V));
 236         &BODY_16_19(@V);        unshift(@V,pop(@V));
 237         &BODY_16_19(@V);        unshift(@V,pop(@V));
 238         &BODY_16_19(@V);        unshift(@V,pop(@V));
 239 $code.=<<___;
 240
 241         ldr     $K,.LK_20_39            @ [+15+16*4]
 242         cmn     sp,#0                   @ [+3], clear carry to denote 20_39
 243 .L_20_39_or_60_79:
 244 ___
 245 for($i=0;$i<5;$i++) {
 246         &BODY_20_39(@V);        unshift(@V,pop(@V));
 247 }
 248 $code.=<<___;
 249 #if defined(__thumb2__) && !defined(__APPLE__)
 250         mov     $t3,sp
 251         teq     $Xi,$t3
 252 #else
 253         teq     $Xi,sp                  @ preserve carry
 254 #endif
 255         bne     .L_20_39_or_60_79       @ [+((12+3)*5+2)*4]
 256         bcs     .L_done                 @ [+((12+3)*5+2)*4], spare 300 bytes
 257
 258         ldr     $K,.LK_40_59
 259         sub     sp,sp,#20*4             @ [+2]
 260 .L_40_59:
 261 ___
 262 for($i=0;$i<5;$i++) {
 263         &BODY_40_59(@V);        unshift(@V,pop(@V));
 264 }
 265 $code.=<<___;
 266 #if defined(__thumb2__) && !defined(__APPLE__)
 267         mov     $t3,sp
 268         teq     $Xi,$t3
 269 #else
 270         teq     $Xi,sp
 271 #endif
 272         bne     .L_40_59                @ [+((12+5)*5+2)*4]
 273
 274         ldr     $K,.LK_60_79
 275         sub     sp,sp,#20*4
 276         cmp     sp,#0                   @ set carry to denote 60_79
 277         b       .L_20_39_or_60_79       @ [+4], spare 300 bytes
 278 .L_done:
 279         add     sp,sp,#80*4             @ "deallocate" stack frame
 280         ldmia   $ctx,{$K,$t0,$t1,$t2,$t3}
 281         add     $a,$K,$a
 282         add     $b,$t0,$b
 283         add     $c,$t1,$c,ror#2
 284         add     $d,$t2,$d,ror#2
 285         add     $e,$t3,$e,ror#2
 286         stmia   $ctx,{$a,$b,$c,$d,$e}
 287         teq     $inp,$len
 288         bne     .Lloop                  @ [+18], total 1307
 289
 290 #if __ARM_ARCH__>=5
 291         ldmia   sp!,{r4-r12,pc}
 292 #else
 293         ldmia   sp!,{r4-r12,lr}
 294         tst     lr,#1
 295         moveq   pc,lr                   @ be binary compatible with V4, yet
 296         bx      lr                      @ interoperable with Thumb ISA:-)
 297 #endif
 298 .size   sha1_block_data_order,.-sha1_block_data_order
 299
 300 .align  5
 301 .LK_00_19:      .word   0x5a827999
 302 .LK_20_39:      .word   0x6ed9eba1
 303 .LK_40_59:      .word   0x8f1bbcdc
 304 .LK_60_79:      .word   0xca62c1d6
 305 #if __ARM_MAX_ARCH__>=7
 306 .LOPENSSL_armcap:
 307 .word   OPENSSL_armcap_P-.Lsha1_block
 308 #endif
 309 .asciz  "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>"
 310 .align  5
 311 ___
 312 #####################################################################
 313 # NEON stuff
 314 #
 315 {{{
 316 my @V=($a,$b,$c,$d,$e);
 317 my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14));
 318 my $Xi=4;
 319 my @X=map("q$_",(8..11,0..3));
 320 my @Tx=("q12","q13");
 321 my ($K,$zero)=("q14","q15");
 322 my $j=0;
 323
 324 sub AUTOLOAD()          # thunk [simplified] x86-style perlasm
 325 { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./;
 326   my $arg = pop;
 327     $arg = "#$arg" if ($arg*1 eq $arg);
 328     $code .= "\t$opcode\t".join(',',@_,$arg)."\n";
 329 }
 330
 331 sub body_00_19 () {
 332         (
 333         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 334         '&bic   ($t0,$d,$b)',
 335         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 336         '&and   ($t1,$c,$b)',
 337         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
 338         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 339         '&eor   ($t1,$t1,$t0)',         # F_00_19
 340         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 341         '&add   ($e,$e,$t1);'.          # e+=F_00_19
 342         '$j++;  unshift(@V,pop(@V));'
 343         )
 344 }
 345 sub body_20_39 () {
 346         (
 347         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 348         '&eor   ($t0,$b,$d)',
 349         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 350         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)',
 351         '&eor   ($t1,$t0,$c)',          # F_20_39
 352         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 353         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 354         '&add   ($e,$e,$t1);'.          # e+=F_20_39
 355         '$j++;  unshift(@V,pop(@V));'
 356         )
 357 }
 358 sub body_40_59 () {
 359         (
 360         '($a,$b,$c,$d,$e)=@V;'.         # '$code.="@ $j\n";'.
 361         '&add   ($e,$e,$Ki)',           # e+=X[i]+K
 362         '&and   ($t0,$c,$d)',
 363         '&ldr   ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
 364         '&add   ($e,$e,$a,"ror#27")',   # e+=ROR(A,27)
 365         '&eor   ($t1,$c,$d)',
 366         '&add   ($e,$e,$t0)',
 367         '&and   ($t1,$t1,$b)',
 368         '&mov   ($b,$b,"ror#2")',       # b=ROR(b,2)
 369         '&add   ($e,$e,$t1);'.          # e+=F_40_59
 370         '$j++;  unshift(@V,pop(@V));'
 371         )
 372 }
 373
 374 sub Xupdate_16_31 ()
 375 { use integer;
 376   my $body = shift;
 377   my @insns = (&$body,&$body,&$body,&$body);
 378   my ($a,$b,$c,$d,$e);
 379
 380         &vext_8         (@X[0],@X[-4&7],@X[-3&7],8);    # compose "X[-14]" in "X[0]"
 381          eval(shift(@insns));
 382          eval(shift(@insns));
 383          eval(shift(@insns));
 384           &vadd_i32     (@Tx[1],@X[-1&7],$K);
 385          eval(shift(@insns));
 386           &vld1_32      ("{$K\[]}","[$K_XX_XX,:32]!")   if ($Xi%5==0);
 387          eval(shift(@insns));
 388         &vext_8         (@Tx[0],@X[-1&7],$zero,4);      # "X[-3]", 3 words
 389          eval(shift(@insns));
 390          eval(shift(@insns));
 391          eval(shift(@insns));
 392         &veor           (@X[0],@X[0],@X[-4&7]);         # "X[0]"^="X[-16]"
 393          eval(shift(@insns));
 394          eval(shift(@insns));
 395         &veor           (@Tx[0],@Tx[0],@X[-2&7]);       # "X[-3]"^"X[-8]"
 396          eval(shift(@insns));
 397          eval(shift(@insns));
 398         &veor           (@Tx[0],@Tx[0],@X[0]);          # "X[0]"^="X[-3]"^"X[-8]
 399          eval(shift(@insns));
 400          eval(shift(@insns));
 401           &vst1_32      ("{@Tx[1]}","[$Xfer,:128]!");   # X[]+K xfer
 402           &sub          ($Xfer,$Xfer,64)                if ($Xi%4==0);
 403          eval(shift(@insns));
 404          eval(shift(@insns));
 405         &vext_8         (@Tx[1],$zero,@Tx[0],4);        # "X[0]"<<96, extract one dword
 406          eval(shift(@insns));
 407          eval(shift(@insns));
 408         &vadd_i32       (@X[0],@Tx[0],@Tx[0]);
 409          eval(shift(@insns));
 410          eval(shift(@insns));
 411         &vsri_32        (@X[0],@Tx[0],31);              # "X[0]"<<<=1
 412          eval(shift(@insns));
 413          eval(shift(@insns));
 414          eval(shift(@insns));
 415         &vshr_u32       (@Tx[0],@Tx[1],30);
 416          eval(shift(@insns));
 417          eval(shift(@insns));
 418         &vshl_u32       (@Tx[1],@Tx[1],2);
 419          eval(shift(@insns));
 420          eval(shift(@insns));
 421         &veor           (@X[0],@X[0],@Tx[0]);
 422          eval(shift(@insns));
 423          eval(shift(@insns));
 424         &veor           (@X[0],@X[0],@Tx[1]);           # "X[0]"^=("X[0]">>96)<<<2
 425
 426         foreach (@insns) { eval; }      # remaining instructions [if any]
 427
 428   $Xi++;        push(@X,shift(@X));     # "rotate" X[]
 429 }
 430
 431 sub Xupdate_32_79 ()
 432 { use integer;
 433   my $body = shift;
 434   my @insns = (&$body,&$body,&$body,&$body);
 435   my ($a,$b,$c,$d,$e);
 436
 437         &vext_8         (@Tx[0],@X[-2&7],@X[-1&7],8);   # compose "X[-6]"
 438          eval(shift(@insns));
 439          eval(shift(@insns));
 440          eval(shift(@insns));
 441         &veor           (@X[0],@X[0],@X[-4&7]);         # "X[0]"="X[-32]"^"X[-16]"
 442          eval(shift(@insns));
 443          eval(shift(@insns));
 444         &veor           (@X[0],@X[0],@X[-7&7]);         # "X[0]"^="X[-28]"
 445          eval(shift(@insns));
 446          eval(shift(@insns));
 447           &vadd_i32     (@Tx[1],@X[-1&7],$K);
 448          eval(shift(@insns));
 449           &vld1_32      ("{$K\[]}","[$K_XX_XX,:32]!")   if ($Xi%5==0);
 450          eval(shift(@insns));
 451         &veor           (@Tx[0],@Tx[0],@X[0]);          # "X[-6]"^="X[0]"
 452          eval(shift(@insns));
 453          eval(shift(@insns));
 454         &vshr_u32       (@X[0],@Tx[0],30);
 455          eval(shift(@insns));
 456          eval(shift(@insns));
 457           &vst1_32      ("{@Tx[1]}","[$Xfer,:128]!");   # X[]+K xfer
 458           &sub          ($Xfer,$Xfer,64)                if ($Xi%4==0);
 459          eval(shift(@insns));
 460          eval(shift(@insns));
 461         &vsli_32        (@X[0],@Tx[0],2);               # "X[0]"="X[-6]"<<<2
 462
 463         foreach (@insns) { eval; }      # remaining instructions [if any]
 464
 465   $Xi++;        push(@X,shift(@X));     # "rotate" X[]
 466 }
 467
 468 sub Xuplast_80 ()
 469 { use integer;
 470   my $body = shift;
 471   my @insns = (&$body,&$body,&$body,&$body);
 472   my ($a,$b,$c,$d,$e);
 473
 474         &vadd_i32       (@Tx[1],@X[-1&7],$K);
 475          eval(shift(@insns));
 476          eval(shift(@insns));
 477         &vst1_32        ("{@Tx[1]}","[$Xfer,:128]!");
 478         &sub            ($Xfer,$Xfer,64);
 479
 480         &teq            ($inp,$len);
 481         &sub            ($K_XX_XX,$K_XX_XX,16); # rewind $K_XX_XX
 482         &it             ("eq");
 483         &subeq          ($inp,$inp,64);         # reload last block to avoid SEGV
 484         &vld1_8         ("{@X[-4&7]-@X[-3&7]}","[$inp]!");
 485          eval(shift(@insns));
 486          eval(shift(@insns));
 487         &vld1_8         ("{@X[-2&7]-@X[-1&7]}","[$inp]!");
 488          eval(shift(@insns));
 489          eval(shift(@insns));
 490         &vld1_32        ("{$K\[]}","[$K_XX_XX,:32]!");  # load K_00_19
 491          eval(shift(@insns));
 492          eval(shift(@insns));
 493         &vrev32_8       (@X[-4&7],@X[-4&7]);
 494
 495         foreach (@insns) { eval; }              # remaining instructions
 496
 497    $Xi=0;
 498 }
 499
 500 sub Xloop()
 501 { use integer;
 502   my $body = shift;
 503   my @insns = (&$body,&$body,&$body,&$body);
 504   my ($a,$b,$c,$d,$e);
 505
 506         &vrev32_8       (@X[($Xi-3)&7],@X[($Xi-3)&7]);
 507          eval(shift(@insns));
 508          eval(shift(@insns));
 509         &vadd_i32       (@X[$Xi&7],@X[($Xi-4)&7],$K);
 510          eval(shift(@insns));
 511          eval(shift(@insns));
 512         &vst1_32        ("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU
 513
 514         foreach (@insns) { eval; }
 515
 516   $Xi++;
 517 }
 518
 519 $code.=<<___;
 520 #if __ARM_MAX_ARCH__>=7
 521 .arch   armv7-a
 522 .fpu    neon
 523
 524 .type   sha1_block_data_order_neon,%function
 525 .align  4
 526 sha1_block_data_order_neon:
 527 .LNEON:
 528         stmdb   sp!,{r4-r12,lr}
 529         add     $len,$inp,$len,lsl#6    @ $len to point at the end of $inp
 530         @ dmb                           @ errata #451034 on early Cortex A8
 531         @ vstmdb        sp!,{d8-d15}    @ ABI specification says so
 532         mov     $saved_sp,sp
 533         sub     $Xfer,sp,#64
 534         adr     $K_XX_XX,.LK_00_19
 535         bic     $Xfer,$Xfer,#15         @ align for 128-bit stores
 536
 537         ldmia   $ctx,{$a,$b,$c,$d,$e}   @ load context
 538         mov     sp,$Xfer                @ alloca
 539
 540         vld1.8          {@X[-4&7]-@X[-3&7]},[$inp]!     @ handles unaligned
 541         veor            $zero,$zero,$zero
 542         vld1.8          {@X[-2&7]-@X[-1&7]},[$inp]!
 543         vld1.32         {${K}\[]},[$K_XX_XX,:32]!       @ load K_00_19
 544         vrev32.8        @X[-4&7],@X[-4&7]               @ yes, even on
 545         vrev32.8        @X[-3&7],@X[-3&7]               @ big-endian...
 546         vrev32.8        @X[-2&7],@X[-2&7]
 547         vadd.i32        @X[0],@X[-4&7],$K
 548         vrev32.8        @X[-1&7],@X[-1&7]
 549         vadd.i32        @X[1],@X[-3&7],$K
 550         vst1.32         {@X[0]},[$Xfer,:128]!
 551         vadd.i32        @X[2],@X[-2&7],$K
 552         vst1.32         {@X[1]},[$Xfer,:128]!
 553         vst1.32         {@X[2]},[$Xfer,:128]!
 554         ldr             $Ki,[sp]                        @ big RAW stall
 555
 556 .Loop_neon:
 557 ___
 558         &Xupdate_16_31(\&body_00_19);
 559         &Xupdate_16_31(\&body_00_19);
 560         &Xupdate_16_31(\&body_00_19);
 561         &Xupdate_16_31(\&body_00_19);
 562         &Xupdate_32_79(\&body_00_19);
 563         &Xupdate_32_79(\&body_20_39);
 564         &Xupdate_32_79(\&body_20_39);
 565         &Xupdate_32_79(\&body_20_39);
 566         &Xupdate_32_79(\&body_20_39);
 567         &Xupdate_32_79(\&body_20_39);
 568         &Xupdate_32_79(\&body_40_59);
 569         &Xupdate_32_79(\&body_40_59);
 570         &Xupdate_32_79(\&body_40_59);
 571         &Xupdate_32_79(\&body_40_59);
 572         &Xupdate_32_79(\&body_40_59);
 573         &Xupdate_32_79(\&body_20_39);
 574         &Xuplast_80(\&body_20_39);
 575         &Xloop(\&body_20_39);
 576         &Xloop(\&body_20_39);
 577         &Xloop(\&body_20_39);
 578 $code.=<<___;
 579         ldmia   $ctx,{$Ki,$t0,$t1,$Xfer}        @ accumulate context
 580         add     $a,$a,$Ki
 581         ldr     $Ki,[$ctx,#16]
 582         add     $b,$b,$t0
 583         add     $c,$c,$t1
 584         add     $d,$d,$Xfer
 585         it      eq
 586         moveq   sp,$saved_sp
 587         add     $e,$e,$Ki
 588         it      ne
 589         ldrne   $Ki,[sp]
 590         stmia   $ctx,{$a,$b,$c,$d,$e}
 591         itt     ne
 592         addne   $Xfer,sp,#3*16
 593         bne     .Loop_neon
 594
 595         @ vldmia        sp!,{d8-d15}
 596         ldmia   sp!,{r4-r12,pc}
 597 .size   sha1_block_data_order_neon,.-sha1_block_data_order_neon
 598 #endif
 599 ___
 600 }}}
 601 #####################################################################
 602 # ARMv8 stuff
 603 #
 604 {{{
 605 my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3));
 606 my @MSG=map("q$_",(4..7));
 607 my @Kxx=map("q$_",(8..11));
 608 my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14));
 609
 610 $code.=<<___;
 611 #if __ARM_MAX_ARCH__>=7
 612
 613 # if defined(__thumb2__) && !defined(__APPLE__)
 614 #  define INST(a,b,c,d) .byte   c,d|0xf,a,b
 615 # else
 616 #  define INST(a,b,c,d) .byte   a,b,c,d|0x10
 617 # endif
 618
 619 .type   sha1_block_data_order_armv8,%function
 620 .align  5
 621 sha1_block_data_order_armv8:
 622 .LARMv8:
 623         vstmdb  sp!,{d8-d15}            @ ABI specification says so
 624
 625         veor    $E,$E,$E
 626         adr     r3,.LK_00_19
 627         vld1.32 {$ABCD},[$ctx]!
 628         vld1.32 {$E\[0]},[$ctx]
 629         sub     $ctx,$ctx,#16
 630         vld1.32 {@Kxx[0]\[]},[r3,:32]!
 631         vld1.32 {@Kxx[1]\[]},[r3,:32]!
 632         vld1.32 {@Kxx[2]\[]},[r3,:32]!
 633         vld1.32 {@Kxx[3]\[]},[r3,:32]
 634
 635 .Loop_v8:
 636         vld1.8          {@MSG[0]-@MSG[1]},[$inp]!
 637         vld1.8          {@MSG[2]-@MSG[3]},[$inp]!
 638         vrev32.8        @MSG[0],@MSG[0]
 639         vrev32.8        @MSG[1],@MSG[1]
 640
 641         vadd.i32        $W0,@Kxx[0],@MSG[0]
 642         vrev32.8        @MSG[2],@MSG[2]
 643         vmov            $ABCD_SAVE,$ABCD        @ offload
 644         subs            $len,$len,#1
 645
 646         vadd.i32        $W1,@Kxx[0],@MSG[1]
 647         vrev32.8        @MSG[3],@MSG[3]
 648         sha1h           $E1,$ABCD               @ 0
 649         sha1c           $ABCD,$E,$W0
 650         vadd.i32        $W0,@Kxx[$j],@MSG[2]
 651         sha1su0         @MSG[0],@MSG[1],@MSG[2]
 652 ___
 653 for ($j=0,$i=1;$i<20-3;$i++) {
 654 my $f=("c","p","m","p")[$i/5];
 655 $code.=<<___;
 656         sha1h           $E0,$ABCD               @ $i
 657         sha1$f          $ABCD,$E1,$W1
 658         vadd.i32        $W1,@Kxx[$j],@MSG[3]
 659         sha1su1         @MSG[0],@MSG[3]
 660 ___
 661 $code.=<<___ if ($i<20-4);
 662         sha1su0         @MSG[1],@MSG[2],@MSG[3]
 663 ___
 664         ($E0,$E1)=($E1,$E0);    ($W0,$W1)=($W1,$W0);
 665         push(@MSG,shift(@MSG)); $j++ if ((($i+3)%5)==0);
 666 }
 667 $code.=<<___;
 668         sha1h           $E0,$ABCD               @ $i
 669         sha1p           $ABCD,$E1,$W1
 670         vadd.i32        $W1,@Kxx[$j],@MSG[3]
 671
 672         sha1h           $E1,$ABCD               @ 18
 673         sha1p           $ABCD,$E0,$W0
 674
 675         sha1h           $E0,$ABCD               @ 19
 676         sha1p           $ABCD,$E1,$W1
 677
 678         vadd.i32        $E,$E,$E0
 679         vadd.i32        $ABCD,$ABCD,$ABCD_SAVE
 680         bne             .Loop_v8
 681
 682         vst1.32         {$ABCD},[$ctx]!
 683         vst1.32         {$E\[0]},[$ctx]
 684
 685         vldmia  sp!,{d8-d15}
 686         ret                                     @ bx lr
 687 .size   sha1_block_data_order_armv8,.-sha1_block_data_order_armv8
 688 #endif
 689 ___
 690 }}}
 691 $code.=<<___;
 692 #if __ARM_MAX_ARCH__>=7
 693 .comm   OPENSSL_armcap_P,4,4
 694 #endif
 695 ___
 696
 697 {   my  %opcode = (
 698         "sha1c"         => 0xf2000c40,  "sha1p"         => 0xf2100c40,
 699         "sha1m"         => 0xf2200c40,  "sha1su0"       => 0xf2300c40,
 700         "sha1h"         => 0xf3b902c0,  "sha1su1"       => 0xf3ba0380   );
 701
 702     sub unsha1 {
 703         my ($mnemonic,$arg)=@_;
 704
 705         if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) {
 706             my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19)
 707                                          |(($2&7)<<17)|(($2&8)<<4)
 708                                          |(($3&7)<<1) |(($3&8)<<2);
 709             # since ARMv7 instructions are always encoded little-endian.
 710             # correct solution is to use .inst directive, but older
 711             # assemblers don't implement it:-(
 712
 713             # this fix-up provides Thumb encoding in conjunction with INST
 714             $word &= ~0x10000000 if (($word & 0x0f000000) == 0x02000000);
 715             sprintf "INST(0x%02x,0x%02x,0x%02x,0x%02x)\t@ %s %s",
 716                         $word&0xff,($word>>8)&0xff,
 717                         ($word>>16)&0xff,($word>>24)&0xff,
 718                         $mnemonic,$arg;
 719         }
 720     }
 721 }
 722
 723 foreach (split($/,$code)) {
 724         s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo        or
 725         s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo;
 726
 727         s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo;
 728
 729         s/\bret\b/bx    lr/o            or
 730         s/\bbx\s+lr\b/.word\t0xe12fff1e/o;      # make it possible to compile with -march=armv4
 731
 732         print $_,$/;
 733 }
 734
 735 close STDOUT; # enforce flush