xref: /openssl/crypto/sha/asm/sha1-armv4-large.pl (revision da1c088f)
1#! /usr/bin/env perl
2# Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9
10# ====================================================================
11# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12# project. The module is, however, dual licensed under OpenSSL and
13# CRYPTOGAMS licenses depending on where you obtain it. For further
14# details see http://www.openssl.org/~appro/cryptogams/.
15# ====================================================================
16
17# sha1_block procedure for ARMv4.
18#
19# January 2007.
20
21# Size/performance trade-off
22# ====================================================================
23# impl		size in bytes	comp cycles[*]	measured performance
24# ====================================================================
25# thumb		304		3212		4420
26# armv4-small	392/+29%	1958/+64%	2250/+96%
27# armv4-compact	740/+89%	1552/+26%	1840/+22%
28# armv4-large	1420/+92%	1307/+19%	1370/+34%[***]
29# full unroll	~5100/+260%	~1260/+4%	~1300/+5%
30# ====================================================================
31# thumb		= same as 'small' but in Thumb instructions[**] and
32#		  with recurring code in two private functions;
33# small		= detached Xload/update, loops are folded;
34# compact	= detached Xload/update, 5x unroll;
35# large		= interleaved Xload/update, 5x unroll;
36# full unroll	= interleaved Xload/update, full unroll, estimated[!];
37#
38# [*]	Manually counted instructions in "grand" loop body. Measured
39#	performance is affected by prologue and epilogue overhead,
40#	i-cache availability, branch penalties, etc.
41# [**]	While each Thumb instruction is twice smaller, they are not as
42#	diverse as ARM ones: e.g., there are only two arithmetic
43#	instructions with 3 arguments, no [fixed] rotate, addressing
44#	modes are limited. As result it takes more instructions to do
45#	the same job in Thumb, therefore the code is never twice as
46#	small and always slower.
47# [***]	which is also ~35% better than compiler generated code. Dual-
48#	issue Cortex A8 core was measured to process input block in
49#	~990 cycles.
50
51# August 2010.
52#
53# Rescheduling for dual-issue pipeline resulted in 13% improvement on
54# Cortex A8 core and in absolute terms ~870 cycles per input block
55# [or 13.6 cycles per byte].
56
57# February 2011.
58#
59# Profiler-assisted and platform-specific optimization resulted in 10%
60# improvement on Cortex A8 core and 12.2 cycles per byte.
61
62# September 2013.
63#
64# Add NEON implementation (see sha1-586.pl for background info). On
65# Cortex A8 it was measured to process one byte in 6.7 cycles or >80%
66# faster than integer-only code. Because [fully unrolled] NEON code
67# is ~2.5x larger and there are some redundant instructions executed
68# when processing last block, improvement is not as big for smallest
69# blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per
70# byte, which is also >80% faster than integer-only code. Cortex-A15
71# is even faster spending 5.6 cycles per byte outperforming integer-
72# only code by factor of 2.
73
74# May 2014.
75#
76# Add ARMv8 code path performing at 2.35 cpb on Apple A7.
77
78# $output is the last argument if it looks like a file (it has an extension)
79# $flavour is the first argument if it doesn't look like a file
80$output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef;
81$flavour = $#ARGV >= 0 && $ARGV[0] !~ m|\.| ? shift : undef;
82
83if ($flavour && $flavour ne "void") {
84    $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
85    ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
86    ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
87    die "can't locate arm-xlate.pl";
88
89    open STDOUT,"| \"$^X\" $xlate $flavour \"$output\""
90        or die "can't call $xlate: $!";
91} else {
92    $output and open STDOUT,">$output";
93}
94
95$ctx="r0";
96$inp="r1";
97$len="r2";
98$a="r3";
99$b="r4";
100$c="r5";
101$d="r6";
102$e="r7";
103$K="r8";
104$t0="r9";
105$t1="r10";
106$t2="r11";
107$t3="r12";
108$Xi="r14";
109@V=($a,$b,$c,$d,$e);
110
111sub Xupdate {
112my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_;
113$code.=<<___;
114	ldr	$t0,[$Xi,#15*4]
115	ldr	$t1,[$Xi,#13*4]
116	ldr	$t2,[$Xi,#7*4]
117	add	$e,$K,$e,ror#2			@ E+=K_xx_xx
118	ldr	$t3,[$Xi,#2*4]
119	eor	$t0,$t0,$t1
120	eor	$t2,$t2,$t3			@ 1 cycle stall
121	eor	$t1,$c,$d			@ F_xx_xx
122	mov	$t0,$t0,ror#31
123	add	$e,$e,$a,ror#27			@ E+=ROR(A,27)
124	eor	$t0,$t0,$t2,ror#31
125	str	$t0,[$Xi,#-4]!
126	$opt1					@ F_xx_xx
127	$opt2					@ F_xx_xx
128	add	$e,$e,$t0			@ E+=X[i]
129___
130}
131
132sub BODY_00_15 {
133my ($a,$b,$c,$d,$e)=@_;
134$code.=<<___;
135#if __ARM_ARCH__<7
136	ldrb	$t1,[$inp,#2]
137	ldrb	$t0,[$inp,#3]
138	ldrb	$t2,[$inp,#1]
139	add	$e,$K,$e,ror#2			@ E+=K_00_19
140	ldrb	$t3,[$inp],#4
141	orr	$t0,$t0,$t1,lsl#8
142	eor	$t1,$c,$d			@ F_xx_xx
143	orr	$t0,$t0,$t2,lsl#16
144	add	$e,$e,$a,ror#27			@ E+=ROR(A,27)
145	orr	$t0,$t0,$t3,lsl#24
146#else
147	ldr	$t0,[$inp],#4			@ handles unaligned
148	add	$e,$K,$e,ror#2			@ E+=K_00_19
149	eor	$t1,$c,$d			@ F_xx_xx
150	add	$e,$e,$a,ror#27			@ E+=ROR(A,27)
151#ifdef __ARMEL__
152	rev	$t0,$t0				@ byte swap
153#endif
154#endif
155	and	$t1,$b,$t1,ror#2
156	add	$e,$e,$t0			@ E+=X[i]
157	eor	$t1,$t1,$d,ror#2		@ F_00_19(B,C,D)
158	str	$t0,[$Xi,#-4]!
159	add	$e,$e,$t1			@ E+=F_00_19(B,C,D)
160___
161}
162
163sub BODY_16_19 {
164my ($a,$b,$c,$d,$e)=@_;
165	&Xupdate(@_,"and $t1,$b,$t1,ror#2");
166$code.=<<___;
167	eor	$t1,$t1,$d,ror#2		@ F_00_19(B,C,D)
168	add	$e,$e,$t1			@ E+=F_00_19(B,C,D)
169___
170}
171
172sub BODY_20_39 {
173my ($a,$b,$c,$d,$e)=@_;
174	&Xupdate(@_,"eor $t1,$b,$t1,ror#2");
175$code.=<<___;
176	add	$e,$e,$t1			@ E+=F_20_39(B,C,D)
177___
178}
179
180sub BODY_40_59 {
181my ($a,$b,$c,$d,$e)=@_;
182	&Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d");
183$code.=<<___;
184	add	$e,$e,$t1			@ E+=F_40_59(B,C,D)
185	add	$e,$e,$t2,ror#2
186___
187}
188
189$code=<<___;
190#include "arm_arch.h"
191
192#if defined(__thumb2__)
193.syntax	unified
194.thumb
195#else
196.code	32
197#endif
198
199.text
200
201.global	sha1_block_data_order
202.type	sha1_block_data_order,%function
203
204.align	5
205sha1_block_data_order:
206#if __ARM_MAX_ARCH__>=7
207.Lsha1_block:
208	ldr	r12,.LOPENSSL_armcap
209# if !defined(_WIN32)
210	adr	r3,.Lsha1_block
211	ldr	r12,[r3,r12]		@ OPENSSL_armcap_P
212# endif
213# if defined(__APPLE__) || defined(_WIN32)
214	ldr	r12,[r12]
215# endif
216	tst	r12,#ARMV8_SHA1
217	bne	.LARMv8
218	tst	r12,#ARMV7_NEON
219	bne	.LNEON
220#endif
221	stmdb	sp!,{r4-r12,lr}
222	add	$len,$inp,$len,lsl#6	@ $len to point at the end of $inp
223	ldmia	$ctx,{$a,$b,$c,$d,$e}
224.Lloop:
225	ldr	$K,.LK_00_19
226	mov	$Xi,sp
227	sub	sp,sp,#15*4
228	mov	$c,$c,ror#30
229	mov	$d,$d,ror#30
230	mov	$e,$e,ror#30		@ [6]
231.L_00_15:
232___
233for($i=0;$i<5;$i++) {
234	&BODY_00_15(@V);	unshift(@V,pop(@V));
235}
236$code.=<<___;
237#if defined(__thumb2__)
238	mov	$t3,sp
239	teq	$Xi,$t3
240#else
241	teq	$Xi,sp
242#endif
243	bne	.L_00_15		@ [((11+4)*5+2)*3]
244	sub	sp,sp,#25*4
245___
246	&BODY_00_15(@V);	unshift(@V,pop(@V));
247	&BODY_16_19(@V);	unshift(@V,pop(@V));
248	&BODY_16_19(@V);	unshift(@V,pop(@V));
249	&BODY_16_19(@V);	unshift(@V,pop(@V));
250	&BODY_16_19(@V);	unshift(@V,pop(@V));
251$code.=<<___;
252
253	ldr	$K,.LK_20_39		@ [+15+16*4]
254	cmn	sp,#0			@ [+3], clear carry to denote 20_39
255.L_20_39_or_60_79:
256___
257for($i=0;$i<5;$i++) {
258	&BODY_20_39(@V);	unshift(@V,pop(@V));
259}
260$code.=<<___;
261#if defined(__thumb2__)
262	mov	$t3,sp
263	teq	$Xi,$t3
264#else
265	teq	$Xi,sp			@ preserve carry
266#endif
267	bne	.L_20_39_or_60_79	@ [+((12+3)*5+2)*4]
268	bcs	.L_done			@ [+((12+3)*5+2)*4], spare 300 bytes
269
270	ldr	$K,.LK_40_59
271	sub	sp,sp,#20*4		@ [+2]
272.L_40_59:
273___
274for($i=0;$i<5;$i++) {
275	&BODY_40_59(@V);	unshift(@V,pop(@V));
276}
277$code.=<<___;
278#if defined(__thumb2__)
279	mov	$t3,sp
280	teq	$Xi,$t3
281#else
282	teq	$Xi,sp
283#endif
284	bne	.L_40_59		@ [+((12+5)*5+2)*4]
285
286	ldr	$K,.LK_60_79
287	sub	sp,sp,#20*4
288	cmp	sp,#0			@ set carry to denote 60_79
289	b	.L_20_39_or_60_79	@ [+4], spare 300 bytes
290.L_done:
291	add	sp,sp,#80*4		@ "deallocate" stack frame
292	ldmia	$ctx,{$K,$t0,$t1,$t2,$t3}
293	add	$a,$K,$a
294	add	$b,$t0,$b
295	add	$c,$t1,$c,ror#2
296	add	$d,$t2,$d,ror#2
297	add	$e,$t3,$e,ror#2
298	stmia	$ctx,{$a,$b,$c,$d,$e}
299	teq	$inp,$len
300	bne	.Lloop			@ [+18], total 1307
301
302#if __ARM_ARCH__>=5
303	ldmia	sp!,{r4-r12,pc}
304#else
305	ldmia	sp!,{r4-r12,lr}
306	tst	lr,#1
307	moveq	pc,lr			@ be binary compatible with V4, yet
308	bx	lr			@ interoperable with Thumb ISA:-)
309#endif
310.size	sha1_block_data_order,.-sha1_block_data_order
311
312.align	5
313.LK_00_19:	.word	0x5a827999
314.LK_20_39:	.word	0x6ed9eba1
315.LK_40_59:	.word	0x8f1bbcdc
316.LK_60_79:	.word	0xca62c1d6
317#if __ARM_MAX_ARCH__>=7
318.LOPENSSL_armcap:
319# ifdef	_WIN32
320.word	OPENSSL_armcap_P
321# else
322.word	OPENSSL_armcap_P-.Lsha1_block
323# endif
324#endif
325.asciz	"SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>"
326.align	5
327___
328#####################################################################
329# NEON stuff
330#
331{{{
332my @V=($a,$b,$c,$d,$e);
333my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14));
334my $Xi=4;
335my @X=map("q$_",(8..11,0..3));
336my @Tx=("q12","q13");
337my ($K,$zero)=("q14","q15");
338my $j=0;
339
340sub AUTOLOAD()          # thunk [simplified] x86-style perlasm
341{ my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./;
342  my $arg = pop;
343    $arg = "#$arg" if ($arg*1 eq $arg);
344    $code .= "\t$opcode\t".join(',',@_,$arg)."\n";
345}
346
347sub body_00_19 () {
348	(
349	'($a,$b,$c,$d,$e)=@V;'.		# '$code.="@ $j\n";'.
350	'&bic	($t0,$d,$b)',
351	'&add	($e,$e,$Ki)',		# e+=X[i]+K
352	'&and	($t1,$c,$b)',
353	'&ldr	($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
354	'&add	($e,$e,$a,"ror#27")',	# e+=ROR(A,27)
355	'&eor	($t1,$t1,$t0)',		# F_00_19
356	'&mov	($b,$b,"ror#2")',	# b=ROR(b,2)
357	'&add	($e,$e,$t1);'.		# e+=F_00_19
358	'$j++;	unshift(@V,pop(@V));'
359	)
360}
361sub body_20_39 () {
362	(
363	'($a,$b,$c,$d,$e)=@V;'.		# '$code.="@ $j\n";'.
364	'&eor	($t0,$b,$d)',
365	'&add	($e,$e,$Ki)',		# e+=X[i]+K
366	'&ldr	($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)',
367	'&eor	($t1,$t0,$c)',		# F_20_39
368	'&add	($e,$e,$a,"ror#27")',	# e+=ROR(A,27)
369	'&mov	($b,$b,"ror#2")',	# b=ROR(b,2)
370	'&add	($e,$e,$t1);'.		# e+=F_20_39
371	'$j++;	unshift(@V,pop(@V));'
372	)
373}
374sub body_40_59 () {
375	(
376	'($a,$b,$c,$d,$e)=@V;'.		# '$code.="@ $j\n";'.
377	'&add	($e,$e,$Ki)',		# e+=X[i]+K
378	'&and	($t0,$c,$d)',
379	'&ldr	($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
380	'&add	($e,$e,$a,"ror#27")',	# e+=ROR(A,27)
381	'&eor	($t1,$c,$d)',
382	'&add	($e,$e,$t0)',
383	'&and	($t1,$t1,$b)',
384	'&mov	($b,$b,"ror#2")',	# b=ROR(b,2)
385	'&add	($e,$e,$t1);'.		# e+=F_40_59
386	'$j++;	unshift(@V,pop(@V));'
387	)
388}
389
390sub Xupdate_16_31 ()
391{ use integer;
392  my $body = shift;
393  my @insns = (&$body,&$body,&$body,&$body);
394  my ($a,$b,$c,$d,$e);
395
396	&vext_8		(@X[0],@X[-4&7],@X[-3&7],8);	# compose "X[-14]" in "X[0]"
397	 eval(shift(@insns));
398	 eval(shift(@insns));
399	 eval(shift(@insns));
400	  &vadd_i32	(@Tx[1],@X[-1&7],$K);
401	 eval(shift(@insns));
402	  &vld1_32	("{$K\[]}","[$K_XX_XX,:32]!")	if ($Xi%5==0);
403	 eval(shift(@insns));
404	&vext_8		(@Tx[0],@X[-1&7],$zero,4);	# "X[-3]", 3 words
405	 eval(shift(@insns));
406	 eval(shift(@insns));
407	 eval(shift(@insns));
408	&veor		(@X[0],@X[0],@X[-4&7]);		# "X[0]"^="X[-16]"
409	 eval(shift(@insns));
410	 eval(shift(@insns));
411	&veor		(@Tx[0],@Tx[0],@X[-2&7]);	# "X[-3]"^"X[-8]"
412	 eval(shift(@insns));
413	 eval(shift(@insns));
414	&veor		(@Tx[0],@Tx[0],@X[0]);		# "X[0]"^="X[-3]"^"X[-8]
415	 eval(shift(@insns));
416	 eval(shift(@insns));
417	  &vst1_32	("{@Tx[1]}","[$Xfer,:128]!");	# X[]+K xfer
418	  &sub		($Xfer,$Xfer,64)		if ($Xi%4==0);
419	 eval(shift(@insns));
420	 eval(shift(@insns));
421	&vext_8		(@Tx[1],$zero,@Tx[0],4);	# "X[0]"<<96, extract one dword
422	 eval(shift(@insns));
423	 eval(shift(@insns));
424	&vadd_i32	(@X[0],@Tx[0],@Tx[0]);
425	 eval(shift(@insns));
426	 eval(shift(@insns));
427	&vsri_32	(@X[0],@Tx[0],31);		# "X[0]"<<<=1
428	 eval(shift(@insns));
429	 eval(shift(@insns));
430	 eval(shift(@insns));
431	&vshr_u32	(@Tx[0],@Tx[1],30);
432	 eval(shift(@insns));
433	 eval(shift(@insns));
434	&vshl_u32	(@Tx[1],@Tx[1],2);
435	 eval(shift(@insns));
436	 eval(shift(@insns));
437	&veor		(@X[0],@X[0],@Tx[0]);
438	 eval(shift(@insns));
439	 eval(shift(@insns));
440	&veor		(@X[0],@X[0],@Tx[1]);		# "X[0]"^=("X[0]">>96)<<<2
441
442	foreach (@insns) { eval; }	# remaining instructions [if any]
443
444  $Xi++;	push(@X,shift(@X));	# "rotate" X[]
445}
446
447sub Xupdate_32_79 ()
448{ use integer;
449  my $body = shift;
450  my @insns = (&$body,&$body,&$body,&$body);
451  my ($a,$b,$c,$d,$e);
452
453	&vext_8		(@Tx[0],@X[-2&7],@X[-1&7],8);	# compose "X[-6]"
454	 eval(shift(@insns));
455	 eval(shift(@insns));
456	 eval(shift(@insns));
457	&veor		(@X[0],@X[0],@X[-4&7]);		# "X[0]"="X[-32]"^"X[-16]"
458	 eval(shift(@insns));
459	 eval(shift(@insns));
460	&veor		(@X[0],@X[0],@X[-7&7]);		# "X[0]"^="X[-28]"
461	 eval(shift(@insns));
462	 eval(shift(@insns));
463	  &vadd_i32	(@Tx[1],@X[-1&7],$K);
464	 eval(shift(@insns));
465	  &vld1_32	("{$K\[]}","[$K_XX_XX,:32]!")	if ($Xi%5==0);
466	 eval(shift(@insns));
467	&veor		(@Tx[0],@Tx[0],@X[0]);		# "X[-6]"^="X[0]"
468	 eval(shift(@insns));
469	 eval(shift(@insns));
470	&vshr_u32	(@X[0],@Tx[0],30);
471	 eval(shift(@insns));
472	 eval(shift(@insns));
473	  &vst1_32	("{@Tx[1]}","[$Xfer,:128]!");	# X[]+K xfer
474	  &sub		($Xfer,$Xfer,64)		if ($Xi%4==0);
475	 eval(shift(@insns));
476	 eval(shift(@insns));
477	&vsli_32	(@X[0],@Tx[0],2);		# "X[0]"="X[-6]"<<<2
478
479	foreach (@insns) { eval; }	# remaining instructions [if any]
480
481  $Xi++;	push(@X,shift(@X));	# "rotate" X[]
482}
483
484sub Xuplast_80 ()
485{ use integer;
486  my $body = shift;
487  my @insns = (&$body,&$body,&$body,&$body);
488  my ($a,$b,$c,$d,$e);
489
490	&vadd_i32	(@Tx[1],@X[-1&7],$K);
491	 eval(shift(@insns));
492	 eval(shift(@insns));
493	&vst1_32	("{@Tx[1]}","[$Xfer,:128]!");
494	&sub		($Xfer,$Xfer,64);
495
496	&teq		($inp,$len);
497	&sub		($K_XX_XX,$K_XX_XX,16);	# rewind $K_XX_XX
498	&it		("eq");
499	&subeq		($inp,$inp,64);		# reload last block to avoid SEGV
500	&vld1_8		("{@X[-4&7]-@X[-3&7]}","[$inp]!");
501	 eval(shift(@insns));
502	 eval(shift(@insns));
503	&vld1_8		("{@X[-2&7]-@X[-1&7]}","[$inp]!");
504	 eval(shift(@insns));
505	 eval(shift(@insns));
506	&vld1_32	("{$K\[]}","[$K_XX_XX,:32]!");	# load K_00_19
507	 eval(shift(@insns));
508	 eval(shift(@insns));
509	&vrev32_8	(@X[-4&7],@X[-4&7]);
510
511	foreach (@insns) { eval; }		# remaining instructions
512
513   $Xi=0;
514}
515
516sub Xloop()
517{ use integer;
518  my $body = shift;
519  my @insns = (&$body,&$body,&$body,&$body);
520  my ($a,$b,$c,$d,$e);
521
522	&vrev32_8	(@X[($Xi-3)&7],@X[($Xi-3)&7]);
523	 eval(shift(@insns));
524	 eval(shift(@insns));
525	&vadd_i32	(@X[$Xi&7],@X[($Xi-4)&7],$K);
526	 eval(shift(@insns));
527	 eval(shift(@insns));
528	&vst1_32	("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU
529
530	foreach (@insns) { eval; }
531
532  $Xi++;
533}
534
535$code.=<<___;
536#if __ARM_MAX_ARCH__>=7
537.arch	armv7-a
538.fpu	neon
539
540.type	sha1_block_data_order_neon,%function
541.align	4
542sha1_block_data_order_neon:
543.LNEON:
544	stmdb	sp!,{r4-r12,lr}
545	add	$len,$inp,$len,lsl#6	@ $len to point at the end of $inp
546	@ dmb				@ errata #451034 on early Cortex A8
547	@ vstmdb	sp!,{d8-d15}	@ ABI specification says so
548	mov	$saved_sp,sp
549	sub	$Xfer,sp,#64
550	adr	$K_XX_XX,.LK_00_19
551	bic	$Xfer,$Xfer,#15		@ align for 128-bit stores
552
553	ldmia	$ctx,{$a,$b,$c,$d,$e}	@ load context
554	mov	sp,$Xfer		@ alloca
555
556	vld1.8		{@X[-4&7]-@X[-3&7]},[$inp]!	@ handles unaligned
557	veor		$zero,$zero,$zero
558	vld1.8		{@X[-2&7]-@X[-1&7]},[$inp]!
559	vld1.32		{${K}\[]},[$K_XX_XX,:32]!	@ load K_00_19
560	vrev32.8	@X[-4&7],@X[-4&7]		@ yes, even on
561	vrev32.8	@X[-3&7],@X[-3&7]		@ big-endian...
562	vrev32.8	@X[-2&7],@X[-2&7]
563	vadd.i32	@X[0],@X[-4&7],$K
564	vrev32.8	@X[-1&7],@X[-1&7]
565	vadd.i32	@X[1],@X[-3&7],$K
566	vst1.32		{@X[0]},[$Xfer,:128]!
567	vadd.i32	@X[2],@X[-2&7],$K
568	vst1.32		{@X[1]},[$Xfer,:128]!
569	vst1.32		{@X[2]},[$Xfer,:128]!
570	ldr		$Ki,[sp]			@ big RAW stall
571
572.Loop_neon:
573___
574	&Xupdate_16_31(\&body_00_19);
575	&Xupdate_16_31(\&body_00_19);
576	&Xupdate_16_31(\&body_00_19);
577	&Xupdate_16_31(\&body_00_19);
578	&Xupdate_32_79(\&body_00_19);
579	&Xupdate_32_79(\&body_20_39);
580	&Xupdate_32_79(\&body_20_39);
581	&Xupdate_32_79(\&body_20_39);
582	&Xupdate_32_79(\&body_20_39);
583	&Xupdate_32_79(\&body_20_39);
584	&Xupdate_32_79(\&body_40_59);
585	&Xupdate_32_79(\&body_40_59);
586	&Xupdate_32_79(\&body_40_59);
587	&Xupdate_32_79(\&body_40_59);
588	&Xupdate_32_79(\&body_40_59);
589	&Xupdate_32_79(\&body_20_39);
590	&Xuplast_80(\&body_20_39);
591	&Xloop(\&body_20_39);
592	&Xloop(\&body_20_39);
593	&Xloop(\&body_20_39);
594$code.=<<___;
595	ldmia	$ctx,{$Ki,$t0,$t1,$Xfer}	@ accumulate context
596	add	$a,$a,$Ki
597	ldr	$Ki,[$ctx,#16]
598	add	$b,$b,$t0
599	add	$c,$c,$t1
600	add	$d,$d,$Xfer
601	it	eq
602	moveq	sp,$saved_sp
603	add	$e,$e,$Ki
604	it	ne
605	ldrne	$Ki,[sp]
606	stmia	$ctx,{$a,$b,$c,$d,$e}
607	itt	ne
608	addne	$Xfer,sp,#3*16
609	bne	.Loop_neon
610
611	@ vldmia	sp!,{d8-d15}
612	ldmia	sp!,{r4-r12,pc}
613.size	sha1_block_data_order_neon,.-sha1_block_data_order_neon
614#endif
615___
616}}}
617#####################################################################
618# ARMv8 stuff
619#
620{{{
621my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3));
622my @MSG=map("q$_",(4..7));
623my @Kxx=map("q$_",(8..11));
624my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14));
625my $_byte = ($flavour =~ /win/ ? "DCB" : ".byte");
626
627$code.=<<___;
628#if __ARM_MAX_ARCH__>=7
629
630# if defined(__thumb2__)
631#  define INST(a,b,c,d)	$_byte	c,d|0xf,a,b
632# else
633#  define INST(a,b,c,d)	$_byte	a,b,c,d|0x10
634# endif
635
636.type	sha1_block_data_order_armv8,%function
637.align	5
638sha1_block_data_order_armv8:
639.LARMv8:
640	vstmdb	sp!,{d8-d15}		@ ABI specification says so
641
642	veor	$E,$E,$E
643	adr	r3,.LK_00_19
644	vld1.32	{$ABCD},[$ctx]!
645	vld1.32	{$E\[0]},[$ctx]
646	sub	$ctx,$ctx,#16
647	vld1.32	{@Kxx[0]\[]},[r3,:32]!
648	vld1.32	{@Kxx[1]\[]},[r3,:32]!
649	vld1.32	{@Kxx[2]\[]},[r3,:32]!
650	vld1.32	{@Kxx[3]\[]},[r3,:32]
651
652.Loop_v8:
653	vld1.8		{@MSG[0]-@MSG[1]},[$inp]!
654	vld1.8		{@MSG[2]-@MSG[3]},[$inp]!
655	vrev32.8	@MSG[0],@MSG[0]
656	vrev32.8	@MSG[1],@MSG[1]
657
658	vadd.i32	$W0,@Kxx[0],@MSG[0]
659	vrev32.8	@MSG[2],@MSG[2]
660	vmov		$ABCD_SAVE,$ABCD	@ offload
661	subs		$len,$len,#1
662
663	vadd.i32	$W1,@Kxx[0],@MSG[1]
664	vrev32.8	@MSG[3],@MSG[3]
665	sha1h		$E1,$ABCD		@ 0
666	sha1c		$ABCD,$E,$W0
667	vadd.i32	$W0,@Kxx[$j],@MSG[2]
668	sha1su0		@MSG[0],@MSG[1],@MSG[2]
669___
670for ($j=0,$i=1;$i<20-3;$i++) {
671my $f=("c","p","m","p")[$i/5];
672$code.=<<___;
673	sha1h		$E0,$ABCD		@ $i
674	sha1$f		$ABCD,$E1,$W1
675	vadd.i32	$W1,@Kxx[$j],@MSG[3]
676	sha1su1		@MSG[0],@MSG[3]
677___
678$code.=<<___ if ($i<20-4);
679	sha1su0		@MSG[1],@MSG[2],@MSG[3]
680___
681	($E0,$E1)=($E1,$E0);	($W0,$W1)=($W1,$W0);
682	push(@MSG,shift(@MSG));	$j++ if ((($i+3)%5)==0);
683}
684$code.=<<___;
685	sha1h		$E0,$ABCD		@ $i
686	sha1p		$ABCD,$E1,$W1
687	vadd.i32	$W1,@Kxx[$j],@MSG[3]
688
689	sha1h		$E1,$ABCD		@ 18
690	sha1p		$ABCD,$E0,$W0
691
692	sha1h		$E0,$ABCD		@ 19
693	sha1p		$ABCD,$E1,$W1
694
695	vadd.i32	$E,$E,$E0
696	vadd.i32	$ABCD,$ABCD,$ABCD_SAVE
697	bne		.Loop_v8
698
699	vst1.32		{$ABCD},[$ctx]!
700	vst1.32		{$E\[0]},[$ctx]
701
702	vldmia	sp!,{d8-d15}
703	ret					@ bx lr
704.size	sha1_block_data_order_armv8,.-sha1_block_data_order_armv8
705#endif
706___
707}}}
708$code.=<<___;
709#if __ARM_MAX_ARCH__>=7
710.extern	OPENSSL_armcap_P
711#endif
712___
713
714{   my  %opcode = (
715	"sha1c"		=> 0xf2000c40,	"sha1p"		=> 0xf2100c40,
716	"sha1m"		=> 0xf2200c40,	"sha1su0"	=> 0xf2300c40,
717	"sha1h"		=> 0xf3b902c0,	"sha1su1"	=> 0xf3ba0380	);
718
719    sub unsha1 {
720	my ($mnemonic,$arg)=@_;
721
722	if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) {
723	    my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19)
724					 |(($2&7)<<17)|(($2&8)<<4)
725					 |(($3&7)<<1) |(($3&8)<<2);
726	    # since ARMv7 instructions are always encoded little-endian.
727	    # correct solution is to use .inst directive, but older
728	    # assemblers don't implement it:-(
729
730	    # this fix-up provides Thumb encoding in conjunction with INST
731	    $word &= ~0x10000000 if (($word & 0x0f000000) == 0x02000000);
732	    sprintf "INST(0x%02x,0x%02x,0x%02x,0x%02x)\t@ %s %s",
733			$word&0xff,($word>>8)&0xff,
734			($word>>16)&0xff,($word>>24)&0xff,
735			$mnemonic,$arg;
736	}
737    }
738}
739
740foreach (split($/,$code)) {
741	s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo	or
742	s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo;
743
744	s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo;
745
746	s/\bret\b/bx	lr/o		or
747	s/\bbx\s+lr\b/.word\t0xe12fff1e/o;	# make it possible to compile with -march=armv4
748
749	print $_,$/;
750}
751
752close STDOUT or die "error closing STDOUT: $!"; # enforce flush
753