xref: /openssl/crypto/sha/asm/sha512-586.pl (revision 33388b44)
1#! /usr/bin/env perl
2# Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
3#
4# Licensed under the Apache License 2.0 (the "License").  You may not use
5# this file except in compliance with the License.  You can obtain a copy
6# in the file LICENSE in the source distribution or at
7# https://www.openssl.org/source/license.html
8
9#
10# ====================================================================
11# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
12# project. The module is, however, dual licensed under OpenSSL and
13# CRYPTOGAMS licenses depending on where you obtain it. For further
14# details see http://www.openssl.org/~appro/cryptogams/.
15# ====================================================================
16#
17# SHA512 block transform for x86. September 2007.
18#
19# May 2013.
20#
21# Add SSSE3 code path, 20-25% improvement [over original SSE2 code].
22#
23# Performance in clock cycles per processed byte (less is better):
24#
25#		gcc	icc	x86 asm	SIMD(*)	x86_64(**)
26# Pentium	100	97	61	-	-
27# PIII		75	77	56	-	-
28# P4		116	95	82	34.6	30.8
29# AMD K8	54	55	36	20.7	9.57
30# Core2		66	57	40	15.9	9.97
31# Westmere	70	-	38	12.2	9.58
32# Sandy Bridge	58	-	35	11.9	11.2
33# Ivy Bridge	50	-	33	11.5	8.17
34# Haswell	46	-	29	11.3	7.66
35# Skylake	40	-	26	13.3	7.25
36# Bulldozer	121	-	50	14.0	13.5
37# VIA Nano	91	-	52	33	14.7
38# Atom		126	-	68	48(***)	14.7
39# Silvermont	97	-	58	42(***)	17.5
40# Goldmont	80	-	48	19.5	12.0
41#
42# (*)	whichever best applicable.
43# (**)	x86_64 assembler performance is presented for reference
44#	purposes, the results are for integer-only code.
45# (***)	paddq is incredibly slow on Atom.
46#
47# IALU code-path is optimized for elder Pentiums. On vanilla Pentium
48# performance improvement over compiler generated code reaches ~60%,
49# while on PIII - ~35%. On newer µ-archs improvement varies from 15%
50# to 50%, but it's less important as they are expected to execute SSE2
51# code-path, which is commonly ~2-3x faster [than compiler generated
52# code]. SSE2 code-path is as fast as original sha512-sse2.pl, even
53# though it does not use 128-bit operations. The latter means that
54# SSE2-aware kernel is no longer required to execute the code. Another
55# difference is that new code optimizes amount of writes, but at the
56# cost of increased data cache "footprint" by 1/2KB.
57
58$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
59push(@INC,"${dir}","${dir}../../perlasm");
60require "x86asm.pl";
61
62$output=pop and open STDOUT,">$output";
63
64&asm_init($ARGV[0],$ARGV[$#ARGV] eq "386");
65
66$sse2=0;
67for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
68
69&external_label("OPENSSL_ia32cap_P") if ($sse2);
70
71$Tlo=&DWP(0,"esp");	$Thi=&DWP(4,"esp");
72$Alo=&DWP(8,"esp");	$Ahi=&DWP(8+4,"esp");
73$Blo=&DWP(16,"esp");	$Bhi=&DWP(16+4,"esp");
74$Clo=&DWP(24,"esp");	$Chi=&DWP(24+4,"esp");
75$Dlo=&DWP(32,"esp");	$Dhi=&DWP(32+4,"esp");
76$Elo=&DWP(40,"esp");	$Ehi=&DWP(40+4,"esp");
77$Flo=&DWP(48,"esp");	$Fhi=&DWP(48+4,"esp");
78$Glo=&DWP(56,"esp");	$Ghi=&DWP(56+4,"esp");
79$Hlo=&DWP(64,"esp");	$Hhi=&DWP(64+4,"esp");
80$K512="ebp";
81
82$Asse2=&QWP(0,"esp");
83$Bsse2=&QWP(8,"esp");
84$Csse2=&QWP(16,"esp");
85$Dsse2=&QWP(24,"esp");
86$Esse2=&QWP(32,"esp");
87$Fsse2=&QWP(40,"esp");
88$Gsse2=&QWP(48,"esp");
89$Hsse2=&QWP(56,"esp");
90
91$A="mm0";	# B-D and
92$E="mm4";	# F-H are commonly loaded to respectively mm1-mm3 and
93		# mm5-mm7, but it's done on on-demand basis...
94$BxC="mm2";	# ... except for B^C
95
96sub BODY_00_15_sse2 {
97    my $phase=shift;
98
99	#&movq	("mm5",$Fsse2);			# load f
100	#&movq	("mm6",$Gsse2);			# load g
101
102	&movq	("mm1",$E);			# %mm1 is sliding right
103	 &pxor	("mm5","mm6");			# f^=g
104	&psrlq	("mm1",14);
105	 &movq	($Esse2,$E);			# modulo-scheduled save e
106	 &pand	("mm5",$E);			# f&=e
107	&psllq	($E,23);			# $E is sliding left
108	 &movq	($A,"mm3")			if ($phase<2);
109	 &movq	(&QWP(8*9,"esp"),"mm7")		# save X[i]
110	&movq	("mm3","mm1");			# %mm3 is T1
111	 &psrlq	("mm1",4);
112	 &pxor	("mm5","mm6");			# Ch(e,f,g)
113	&pxor	("mm3",$E);
114	 &psllq	($E,23);
115	&pxor	("mm3","mm1");
116	 &movq	($Asse2,$A);			# modulo-scheduled save a
117	 &paddq	("mm7","mm5");			# X[i]+=Ch(e,f,g)
118	&pxor	("mm3",$E);
119	 &psrlq	("mm1",23);
120	 &paddq	("mm7",$Hsse2);			# X[i]+=h
121	&pxor	("mm3","mm1");
122	 &psllq	($E,4);
123	 &paddq	("mm7",QWP(0,$K512));		# X[i]+=K512[i]
124	&pxor	("mm3",$E);			# T1=Sigma1_512(e)
125
126	 &movq	($E,$Dsse2);			# e = load d, e in next round
127	&paddq	("mm3","mm7");			# T1+=X[i]
128	 &movq	("mm5",$A);			# %mm5 is sliding right
129	 &psrlq	("mm5",28);
130	&paddq	($E,"mm3");			# d += T1
131	 &movq	("mm6",$A);			# %mm6 is sliding left
132	 &movq	("mm7","mm5");
133	 &psllq	("mm6",25);
134	&movq	("mm1",$Bsse2);			# load b
135	 &psrlq	("mm5",6);
136	 &pxor	("mm7","mm6");
137	&sub	("esp",8);
138	 &psllq	("mm6",5);
139	 &pxor	("mm7","mm5");
140	&pxor	($A,"mm1");			# a^b, b^c in next round
141	 &psrlq	("mm5",5);
142	 &pxor	("mm7","mm6");
143	&pand	($BxC,$A);			# (b^c)&(a^b)
144	 &psllq	("mm6",6);
145	 &pxor	("mm7","mm5");
146	&pxor	($BxC,"mm1");			# [h=]Maj(a,b,c)
147	 &pxor	("mm6","mm7");			# Sigma0_512(a)
148	 &movq	("mm7",&QWP(8*(9+16-1),"esp"))	if ($phase!=0);	# pre-fetch
149	 &movq	("mm5",$Fsse2)			if ($phase==0);	# load f
150
151    if ($phase>1) {
152	&paddq	($BxC,"mm6");			# h+=Sigma0(a)
153	 &add	($K512,8);
154	#&paddq	($BxC,"mm3");			# h+=T1
155
156	($A,$BxC) = ($BxC,$A);			# rotate registers
157    } else {
158	&paddq	("mm3",$BxC);			# T1+=Maj(a,b,c)
159	 &movq	($BxC,$A);
160	 &add	($K512,8);
161	&paddq	("mm3","mm6");			# T1+=Sigma0(a)
162	 &movq	("mm6",$Gsse2)			if ($phase==0);	# load g
163	#&movq	($A,"mm3");			# h=T1
164    }
165}
166
167sub BODY_00_15_x86 {
168	#define Sigma1(x)	(ROTR((x),14) ^ ROTR((x),18)  ^ ROTR((x),41))
169	#	LO		lo>>14^hi<<18 ^ lo>>18^hi<<14 ^ hi>>9^lo<<23
170	#	HI		hi>>14^lo<<18 ^ hi>>18^lo<<14 ^ lo>>9^hi<<23
171	&mov	("ecx",$Elo);
172	&mov	("edx",$Ehi);
173	&mov	("esi","ecx");
174
175	&shr	("ecx",9);	# lo>>9
176	&mov	("edi","edx");
177	&shr	("edx",9);	# hi>>9
178	&mov	("ebx","ecx");
179	&shl	("esi",14);	# lo<<14
180	&mov	("eax","edx");
181	&shl	("edi",14);	# hi<<14
182	&xor	("ebx","esi");
183
184	&shr	("ecx",14-9);	# lo>>14
185	&xor	("eax","edi");
186	&shr	("edx",14-9);	# hi>>14
187	&xor	("eax","ecx");
188	&shl	("esi",18-14);	# lo<<18
189	&xor	("ebx","edx");
190	&shl	("edi",18-14);	# hi<<18
191	&xor	("ebx","esi");
192
193	&shr	("ecx",18-14);	# lo>>18
194	&xor	("eax","edi");
195	&shr	("edx",18-14);	# hi>>18
196	&xor	("eax","ecx");
197	&shl	("esi",23-18);	# lo<<23
198	&xor	("ebx","edx");
199	&shl	("edi",23-18);	# hi<<23
200	&xor	("eax","esi");
201	&xor	("ebx","edi");			# T1 = Sigma1(e)
202
203	&mov	("ecx",$Flo);
204	&mov	("edx",$Fhi);
205	&mov	("esi",$Glo);
206	&mov	("edi",$Ghi);
207	 &add	("eax",$Hlo);
208	 &adc	("ebx",$Hhi);			# T1 += h
209	&xor	("ecx","esi");
210	&xor	("edx","edi");
211	&and	("ecx",$Elo);
212	&and	("edx",$Ehi);
213	 &add	("eax",&DWP(8*(9+15)+0,"esp"));
214	 &adc	("ebx",&DWP(8*(9+15)+4,"esp"));	# T1 += X[0]
215	&xor	("ecx","esi");
216	&xor	("edx","edi");			# Ch(e,f,g) = (f^g)&e)^g
217
218	&mov	("esi",&DWP(0,$K512));
219	&mov	("edi",&DWP(4,$K512));		# K[i]
220	&add	("eax","ecx");
221	&adc	("ebx","edx");			# T1 += Ch(e,f,g)
222	&mov	("ecx",$Dlo);
223	&mov	("edx",$Dhi);
224	&add	("eax","esi");
225	&adc	("ebx","edi");			# T1 += K[i]
226	&mov	($Tlo,"eax");
227	&mov	($Thi,"ebx");			# put T1 away
228	&add	("eax","ecx");
229	&adc	("ebx","edx");			# d += T1
230
231	#define Sigma0(x)	(ROTR((x),28) ^ ROTR((x),34) ^ ROTR((x),39))
232	#	LO		lo>>28^hi<<4  ^ hi>>2^lo<<30 ^ hi>>7^lo<<25
233	#	HI		hi>>28^lo<<4  ^ lo>>2^hi<<30 ^ lo>>7^hi<<25
234	&mov	("ecx",$Alo);
235	&mov	("edx",$Ahi);
236	&mov	($Dlo,"eax");
237	&mov	($Dhi,"ebx");
238	&mov	("esi","ecx");
239
240	&shr	("ecx",2);	# lo>>2
241	&mov	("edi","edx");
242	&shr	("edx",2);	# hi>>2
243	&mov	("ebx","ecx");
244	&shl	("esi",4);	# lo<<4
245	&mov	("eax","edx");
246	&shl	("edi",4);	# hi<<4
247	&xor	("ebx","esi");
248
249	&shr	("ecx",7-2);	# lo>>7
250	&xor	("eax","edi");
251	&shr	("edx",7-2);	# hi>>7
252	&xor	("ebx","ecx");
253	&shl	("esi",25-4);	# lo<<25
254	&xor	("eax","edx");
255	&shl	("edi",25-4);	# hi<<25
256	&xor	("eax","esi");
257
258	&shr	("ecx",28-7);	# lo>>28
259	&xor	("ebx","edi");
260	&shr	("edx",28-7);	# hi>>28
261	&xor	("eax","ecx");
262	&shl	("esi",30-25);	# lo<<30
263	&xor	("ebx","edx");
264	&shl	("edi",30-25);	# hi<<30
265	&xor	("eax","esi");
266	&xor	("ebx","edi");			# Sigma0(a)
267
268	&mov	("ecx",$Alo);
269	&mov	("edx",$Ahi);
270	&mov	("esi",$Blo);
271	&mov	("edi",$Bhi);
272	&add	("eax",$Tlo);
273	&adc	("ebx",$Thi);			# T1 = Sigma0(a)+T1
274	&or	("ecx","esi");
275	&or	("edx","edi");
276	&and	("ecx",$Clo);
277	&and	("edx",$Chi);
278	&and	("esi",$Alo);
279	&and	("edi",$Ahi);
280	&or	("ecx","esi");
281	&or	("edx","edi");			# Maj(a,b,c) = ((a|b)&c)|(a&b)
282
283	&add	("eax","ecx");
284	&adc	("ebx","edx");			# T1 += Maj(a,b,c)
285	&mov	($Tlo,"eax");
286	&mov	($Thi,"ebx");
287
288	&mov	(&LB("edx"),&BP(0,$K512));	# pre-fetch LSB of *K
289	&sub	("esp",8);
290	&lea	($K512,&DWP(8,$K512));		# K++
291}
292
293
294&function_begin("sha512_block_data_order");
295	&mov	("esi",wparam(0));	# ctx
296	&mov	("edi",wparam(1));	# inp
297	&mov	("eax",wparam(2));	# num
298	&mov	("ebx","esp");		# saved sp
299
300	&call	(&label("pic_point"));	# make it PIC!
301&set_label("pic_point");
302	&blindpop($K512);
303	&lea	($K512,&DWP(&label("K512")."-".&label("pic_point"),$K512));
304
305	&sub	("esp",16);
306	&and	("esp",-64);
307
308	&shl	("eax",7);
309	&add	("eax","edi");
310	&mov	(&DWP(0,"esp"),"esi");	# ctx
311	&mov	(&DWP(4,"esp"),"edi");	# inp
312	&mov	(&DWP(8,"esp"),"eax");	# inp+num*128
313	&mov	(&DWP(12,"esp"),"ebx");	# saved sp
314
315if ($sse2) {
316	&picmeup("edx","OPENSSL_ia32cap_P",$K512,&label("K512"));
317	&mov	("ecx",&DWP(0,"edx"));
318	&test	("ecx",1<<26);
319	&jz	(&label("loop_x86"));
320
321	&mov	("edx",&DWP(4,"edx"));
322
323	# load ctx->h[0-7]
324	&movq	($A,&QWP(0,"esi"));
325	 &and	("ecx",1<<24);		# XMM registers availability
326	&movq	("mm1",&QWP(8,"esi"));
327	 &and	("edx",1<<9);		# SSSE3 bit
328	&movq	($BxC,&QWP(16,"esi"));
329	 &or	("ecx","edx");
330	&movq	("mm3",&QWP(24,"esi"));
331	&movq	($E,&QWP(32,"esi"));
332	&movq	("mm5",&QWP(40,"esi"));
333	&movq	("mm6",&QWP(48,"esi"));
334	&movq	("mm7",&QWP(56,"esi"));
335	&cmp	("ecx",1<<24|1<<9);
336	&je	(&label("SSSE3"));
337	&sub	("esp",8*10);
338	&jmp	(&label("loop_sse2"));
339
340&set_label("loop_sse2",16);
341	#&movq	($Asse2,$A);
342	&movq	($Bsse2,"mm1");
343	&movq	($Csse2,$BxC);
344	&movq	($Dsse2,"mm3");
345	#&movq	($Esse2,$E);
346	&movq	($Fsse2,"mm5");
347	&movq	($Gsse2,"mm6");
348	&pxor	($BxC,"mm1");			# magic
349	&movq	($Hsse2,"mm7");
350	&movq	("mm3",$A);			# magic
351
352	&mov	("eax",&DWP(0,"edi"));
353	&mov	("ebx",&DWP(4,"edi"));
354	&add	("edi",8);
355	&mov	("edx",15);			# counter
356	&bswap	("eax");
357	&bswap	("ebx");
358	&jmp	(&label("00_14_sse2"));
359
360&set_label("00_14_sse2",16);
361	&movd	("mm1","eax");
362	&mov	("eax",&DWP(0,"edi"));
363	&movd	("mm7","ebx");
364	&mov	("ebx",&DWP(4,"edi"));
365	&add	("edi",8);
366	&bswap	("eax");
367	&bswap	("ebx");
368	&punpckldq("mm7","mm1");
369
370	&BODY_00_15_sse2();
371
372	&dec	("edx");
373	&jnz	(&label("00_14_sse2"));
374
375	&movd	("mm1","eax");
376	&movd	("mm7","ebx");
377	&punpckldq("mm7","mm1");
378
379	&BODY_00_15_sse2(1);
380
381	&pxor	($A,$A);			# A is in %mm3
382	&mov	("edx",32);			# counter
383	&jmp	(&label("16_79_sse2"));
384
385&set_label("16_79_sse2",16);
386    for ($j=0;$j<2;$j++) {			# 2x unroll
387	#&movq	("mm7",&QWP(8*(9+16-1),"esp"));	# prefetched in BODY_00_15
388	&movq	("mm5",&QWP(8*(9+16-14),"esp"));
389	&movq	("mm1","mm7");
390	&psrlq	("mm7",1);
391	 &movq	("mm6","mm5");
392	 &psrlq	("mm5",6);
393	&psllq	("mm1",56);
394	 &paddq	($A,"mm3");			# from BODY_00_15
395	 &movq	("mm3","mm7");
396	&psrlq	("mm7",7-1);
397	 &pxor	("mm3","mm1");
398	 &psllq	("mm1",63-56);
399	&pxor	("mm3","mm7");
400	 &psrlq	("mm7",8-7);
401	&pxor	("mm3","mm1");
402	 &movq	("mm1","mm5");
403	 &psrlq	("mm5",19-6);
404	&pxor	("mm7","mm3");			# sigma0
405
406	 &psllq	("mm6",3);
407	 &pxor	("mm1","mm5");
408	&paddq	("mm7",&QWP(8*(9+16),"esp"));
409	 &pxor	("mm1","mm6");
410	 &psrlq	("mm5",61-19);
411	&paddq	("mm7",&QWP(8*(9+16-9),"esp"));
412	 &pxor	("mm1","mm5");
413	 &psllq	("mm6",45-3);
414	&movq	("mm5",$Fsse2);			# load f
415	 &pxor	("mm1","mm6");			# sigma1
416	&movq	("mm6",$Gsse2);			# load g
417
418	&paddq	("mm7","mm1");			# X[i]
419	#&movq	(&QWP(8*9,"esp"),"mm7");	# moved to BODY_00_15
420
421	&BODY_00_15_sse2(2);
422    }
423	&dec	("edx");
424	&jnz	(&label("16_79_sse2"));
425
426	#&movq	($A,$Asse2);
427	&paddq	($A,"mm3");			# from BODY_00_15
428	&movq	("mm1",$Bsse2);
429	#&movq	($BxC,$Csse2);
430	&movq	("mm3",$Dsse2);
431	#&movq	($E,$Esse2);
432	&movq	("mm5",$Fsse2);
433	&movq	("mm6",$Gsse2);
434	&movq	("mm7",$Hsse2);
435
436	&pxor	($BxC,"mm1");			# de-magic
437	&paddq	($A,&QWP(0,"esi"));
438	&paddq	("mm1",&QWP(8,"esi"));
439	&paddq	($BxC,&QWP(16,"esi"));
440	&paddq	("mm3",&QWP(24,"esi"));
441	&paddq	($E,&QWP(32,"esi"));
442	&paddq	("mm5",&QWP(40,"esi"));
443	&paddq	("mm6",&QWP(48,"esi"));
444	&paddq	("mm7",&QWP(56,"esi"));
445
446	&mov	("eax",8*80);
447	&movq	(&QWP(0,"esi"),$A);
448	&movq	(&QWP(8,"esi"),"mm1");
449	&movq	(&QWP(16,"esi"),$BxC);
450	&movq	(&QWP(24,"esi"),"mm3");
451	&movq	(&QWP(32,"esi"),$E);
452	&movq	(&QWP(40,"esi"),"mm5");
453	&movq	(&QWP(48,"esi"),"mm6");
454	&movq	(&QWP(56,"esi"),"mm7");
455
456	&lea	("esp",&DWP(0,"esp","eax"));	# destroy frame
457	&sub	($K512,"eax");			# rewind K
458
459	&cmp	("edi",&DWP(8*10+8,"esp"));	# are we done yet?
460	&jb	(&label("loop_sse2"));
461
462	&mov	("esp",&DWP(8*10+12,"esp"));	# restore sp
463	&emms	();
464&function_end_A();
465
466&set_label("SSSE3",32);
467{ my ($cnt,$frame)=("ecx","edx");
468  my @X=map("xmm$_",(0..7));
469  my $j;
470  my $i=0;
471
472	&lea	($frame,&DWP(-64,"esp"));
473	&sub	("esp",256);
474
475	# fixed stack frame layout
476	#
477	# +0	A B C D E F G H		# backing store
478	# +64	X[0]+K[i] .. X[15]+K[i]	# XMM->MM xfer area
479	# +192				# XMM off-load ring buffer
480	# +256				# saved parameters
481
482	&movdqa		(@X[1],&QWP(80*8,$K512));		# byte swap mask
483	&movdqu		(@X[0],&QWP(0,"edi"));
484	&pshufb		(@X[0],@X[1]);
485    for ($j=0;$j<8;$j++) {
486	&movdqa		(&QWP(16*(($j-1)%4),$frame),@X[3])	if ($j>4); # off-load
487	&movdqa		(@X[3],&QWP(16*($j%8),$K512));
488	&movdqa		(@X[2],@X[1])				if ($j<7); # perpetuate byte swap mask
489	&movdqu		(@X[1],&QWP(16*($j+1),"edi"))		if ($j<7); # next input
490	&movdqa		(@X[1],&QWP(16*(($j+1)%4),$frame))	if ($j==7);# restore @X[0]
491	&paddq		(@X[3],@X[0]);
492	&pshufb		(@X[1],@X[2])				if ($j<7);
493	&movdqa		(&QWP(16*($j%8)-128,$frame),@X[3]);	# xfer X[i]+K[i]
494
495	push(@X,shift(@X));					# rotate(@X)
496    }
497	#&jmp		(&label("loop_ssse3"));
498	&nop		();
499
500&set_label("loop_ssse3",32);
501	&movdqa		(@X[2],&QWP(16*(($j+1)%4),$frame));	# pre-restore @X[1]
502	&movdqa		(&QWP(16*(($j-1)%4),$frame),@X[3]);	# off-load @X[3]
503	&lea		($K512,&DWP(16*8,$K512));
504
505	#&movq	($Asse2,$A);			# off-load A-H
506	&movq	($Bsse2,"mm1");
507	 &mov	("ebx","edi");
508	&movq	($Csse2,$BxC);
509	 &lea	("edi",&DWP(128,"edi"));	# advance input
510	&movq	($Dsse2,"mm3");
511	 &cmp	("edi","eax");
512	#&movq	($Esse2,$E);
513	&movq	($Fsse2,"mm5");
514	 &cmovb	("ebx","edi");
515	&movq	($Gsse2,"mm6");
516	 &mov	("ecx",4);			# loop counter
517	&pxor	($BxC,"mm1");			# magic
518	&movq	($Hsse2,"mm7");
519	&pxor	("mm3","mm3");			# magic
520
521	&jmp		(&label("00_47_ssse3"));
522
523sub BODY_00_15_ssse3 {		# "phase-less" copy of BODY_00_15_sse2
524	(
525	'&movq	("mm1",$E)',				# %mm1 is sliding right
526	'&movq	("mm7",&QWP(((-8*$i)%128)-128,$frame))',# X[i]+K[i]
527	 '&pxor	("mm5","mm6")',				# f^=g
528	'&psrlq	("mm1",14)',
529	 '&movq	(&QWP(8*($i+4)%64,"esp"),$E)',		# modulo-scheduled save e
530	 '&pand	("mm5",$E)',				# f&=e
531	'&psllq	($E,23)',				# $E is sliding left
532	'&paddq	($A,"mm3")',				# [h+=Maj(a,b,c)]
533	'&movq	("mm3","mm1")',				# %mm3 is T1
534	 '&psrlq("mm1",4)',
535	 '&pxor	("mm5","mm6")',				# Ch(e,f,g)
536	'&pxor	("mm3",$E)',
537	 '&psllq($E,23)',
538	'&pxor	("mm3","mm1")',
539	 '&movq	(&QWP(8*$i%64,"esp"),$A)',		# modulo-scheduled save a
540	 '&paddq("mm7","mm5")',				# X[i]+=Ch(e,f,g)
541	'&pxor	("mm3",$E)',
542	 '&psrlq("mm1",23)',
543	 '&paddq("mm7",&QWP(8*($i+7)%64,"esp"))',	# X[i]+=h
544	'&pxor	("mm3","mm1")',
545	 '&psllq($E,4)',
546	'&pxor	("mm3",$E)',				# T1=Sigma1_512(e)
547
548	 '&movq	($E,&QWP(8*($i+3)%64,"esp"))',		# e = load d, e in next round
549	'&paddq	("mm3","mm7")',				# T1+=X[i]
550	 '&movq	("mm5",$A)',				# %mm5 is sliding right
551	 '&psrlq("mm5",28)',
552	'&paddq	($E,"mm3")',				# d += T1
553	 '&movq	("mm6",$A)',				# %mm6 is sliding left
554	 '&movq	("mm7","mm5")',
555	 '&psllq("mm6",25)',
556	'&movq	("mm1",&QWP(8*($i+1)%64,"esp"))',	# load b
557	 '&psrlq("mm5",6)',
558	 '&pxor	("mm7","mm6")',
559	 '&psllq("mm6",5)',
560	 '&pxor	("mm7","mm5")',
561	'&pxor	($A,"mm1")',				# a^b, b^c in next round
562	 '&psrlq("mm5",5)',
563	 '&pxor	("mm7","mm6")',
564	'&pand	($BxC,$A)',				# (b^c)&(a^b)
565	 '&psllq("mm6",6)',
566	 '&pxor	("mm7","mm5")',
567	'&pxor	($BxC,"mm1")',				# [h=]Maj(a,b,c)
568	 '&pxor	("mm6","mm7")',				# Sigma0_512(a)
569	 '&movq	("mm5",&QWP(8*($i+5-1)%64,"esp"))',	# pre-load f
570	'&paddq	($BxC,"mm6")',				# h+=Sigma0(a)
571	 '&movq	("mm6",&QWP(8*($i+6-1)%64,"esp"))',	# pre-load g
572
573	'($A,$BxC) = ($BxC,$A); $i--;'
574	);
575}
576
577&set_label("00_47_ssse3",32);
578
579    for(;$j<16;$j++) {
580	my ($t0,$t2,$t1)=@X[2..4];
581	my @insns = (&BODY_00_15_ssse3(),&BODY_00_15_ssse3());
582
583	&movdqa		($t2,@X[5]);
584	&movdqa		(@X[1],$t0);			# restore @X[1]
585	&palignr	($t0,@X[0],8);			# X[1..2]
586	&movdqa		(&QWP(16*($j%4),$frame),@X[4]);	# off-load @X[4]
587	 &palignr	($t2,@X[4],8);			# X[9..10]
588
589	&movdqa		($t1,$t0);
590	&psrlq		($t0,7);
591	 &paddq		(@X[0],$t2);			# X[0..1] += X[9..10]
592	&movdqa		($t2,$t1);
593	&psrlq		($t1,1);
594	&psllq		($t2,64-8);
595	&pxor		($t0,$t1);
596	&psrlq		($t1,8-1);
597	&pxor		($t0,$t2);
598	&psllq		($t2,8-1);
599	&pxor		($t0,$t1);
600	 &movdqa	($t1,@X[7]);
601	&pxor		($t0,$t2);			# sigma0(X[1..2])
602	 &movdqa	($t2,@X[7]);
603	 &psrlq		($t1,6);
604	&paddq		(@X[0],$t0);			# X[0..1] += sigma0(X[1..2])
605
606	&movdqa		($t0,@X[7]);
607	&psrlq		($t2,19);
608	&psllq		($t0,64-61);
609	&pxor		($t1,$t2);
610	&psrlq		($t2,61-19);
611	&pxor		($t1,$t0);
612	&psllq		($t0,61-19);
613	&pxor		($t1,$t2);
614	&movdqa		($t2,&QWP(16*(($j+2)%4),$frame));# pre-restore @X[1]
615	&pxor		($t1,$t0);			# sigma0(X[1..2])
616	&movdqa		($t0,&QWP(16*($j%8),$K512));
617	 eval(shift(@insns));
618	&paddq		(@X[0],$t1);			# X[0..1] += sigma0(X[14..15])
619	 eval(shift(@insns));
620	 eval(shift(@insns));
621	 eval(shift(@insns));
622	 eval(shift(@insns));
623	&paddq		($t0,@X[0]);
624	 foreach(@insns) { eval; }
625	&movdqa		(&QWP(16*($j%8)-128,$frame),$t0);# xfer X[i]+K[i]
626
627	push(@X,shift(@X));				# rotate(@X)
628    }
629	&lea		($K512,&DWP(16*8,$K512));
630	&dec		("ecx");
631	&jnz		(&label("00_47_ssse3"));
632
633	&movdqa		(@X[1],&QWP(0,$K512));		# byte swap mask
634	&lea		($K512,&DWP(-80*8,$K512));	# rewind
635	&movdqu		(@X[0],&QWP(0,"ebx"));
636	&pshufb		(@X[0],@X[1]);
637
638    for ($j=0;$j<8;$j++) {	# load next or same block
639	my @insns = (&BODY_00_15_ssse3(),&BODY_00_15_ssse3());
640
641	&movdqa		(&QWP(16*(($j-1)%4),$frame),@X[3])	if ($j>4); # off-load
642	&movdqa		(@X[3],&QWP(16*($j%8),$K512));
643	&movdqa		(@X[2],@X[1])				if ($j<7); # perpetuate byte swap mask
644	&movdqu		(@X[1],&QWP(16*($j+1),"ebx"))		if ($j<7); # next input
645	&movdqa		(@X[1],&QWP(16*(($j+1)%4),$frame))	if ($j==7);# restore @X[0]
646	&paddq		(@X[3],@X[0]);
647	&pshufb		(@X[1],@X[2])				if ($j<7);
648	 foreach(@insns) { eval; }
649	&movdqa		(&QWP(16*($j%8)-128,$frame),@X[3]);# xfer X[i]+K[i]
650
651	push(@X,shift(@X));				# rotate(@X)
652    }
653
654	#&movq	($A,$Asse2);			# load A-H
655	&movq	("mm1",$Bsse2);
656	&paddq	($A,"mm3");			# from BODY_00_15
657	#&movq	($BxC,$Csse2);
658	&movq	("mm3",$Dsse2);
659	#&movq	($E,$Esse2);
660	#&movq	("mm5",$Fsse2);
661	#&movq	("mm6",$Gsse2);
662	&movq	("mm7",$Hsse2);
663
664	&pxor	($BxC,"mm1");			# de-magic
665	&paddq	($A,&QWP(0,"esi"));
666	&paddq	("mm1",&QWP(8,"esi"));
667	&paddq	($BxC,&QWP(16,"esi"));
668	&paddq	("mm3",&QWP(24,"esi"));
669	&paddq	($E,&QWP(32,"esi"));
670	&paddq	("mm5",&QWP(40,"esi"));
671	&paddq	("mm6",&QWP(48,"esi"));
672	&paddq	("mm7",&QWP(56,"esi"));
673
674	&movq	(&QWP(0,"esi"),$A);
675	&movq	(&QWP(8,"esi"),"mm1");
676	&movq	(&QWP(16,"esi"),$BxC);
677	&movq	(&QWP(24,"esi"),"mm3");
678	&movq	(&QWP(32,"esi"),$E);
679	&movq	(&QWP(40,"esi"),"mm5");
680	&movq	(&QWP(48,"esi"),"mm6");
681	&movq	(&QWP(56,"esi"),"mm7");
682
683    	&cmp	("edi","eax")			# are we done yet?
684	&jb	(&label("loop_ssse3"));
685
686	&mov	("esp",&DWP(64+12,$frame));	# restore sp
687	&emms	();
688}
689&function_end_A();
690}
691&set_label("loop_x86",16);
692    # copy input block to stack reversing byte and qword order
693    for ($i=0;$i<8;$i++) {
694	&mov	("eax",&DWP($i*16+0,"edi"));
695	&mov	("ebx",&DWP($i*16+4,"edi"));
696	&mov	("ecx",&DWP($i*16+8,"edi"));
697	&mov	("edx",&DWP($i*16+12,"edi"));
698	&bswap	("eax");
699	&bswap	("ebx");
700	&bswap	("ecx");
701	&bswap	("edx");
702	&push	("eax");
703	&push	("ebx");
704	&push	("ecx");
705	&push	("edx");
706    }
707	&add	("edi",128);
708	&sub	("esp",9*8);		# place for T,A,B,C,D,E,F,G,H
709	&mov	(&DWP(8*(9+16)+4,"esp"),"edi");
710
711	# copy ctx->h[0-7] to A,B,C,D,E,F,G,H on stack
712	&lea	("edi",&DWP(8,"esp"));
713	&mov	("ecx",16);
714	&data_word(0xA5F3F689);		# rep movsd
715
716&set_label("00_15_x86",16);
717	&BODY_00_15_x86();
718
719	&cmp	(&LB("edx"),0x94);
720	&jne	(&label("00_15_x86"));
721
722&set_label("16_79_x86",16);
723	#define sigma0(x)	(ROTR((x),1)  ^ ROTR((x),8)  ^ ((x)>>7))
724	#	LO		lo>>1^hi<<31  ^ lo>>8^hi<<24 ^ lo>>7^hi<<25
725	#	HI		hi>>1^lo<<31  ^ hi>>8^lo<<24 ^ hi>>7
726	&mov	("ecx",&DWP(8*(9+15+16-1)+0,"esp"));
727	&mov	("edx",&DWP(8*(9+15+16-1)+4,"esp"));
728	&mov	("esi","ecx");
729
730	&shr	("ecx",1);	# lo>>1
731	&mov	("edi","edx");
732	&shr	("edx",1);	# hi>>1
733	&mov	("eax","ecx");
734	&shl	("esi",24);	# lo<<24
735	&mov	("ebx","edx");
736	&shl	("edi",24);	# hi<<24
737	&xor	("ebx","esi");
738
739	&shr	("ecx",7-1);	# lo>>7
740	&xor	("eax","edi");
741	&shr	("edx",7-1);	# hi>>7
742	&xor	("eax","ecx");
743	&shl	("esi",31-24);	# lo<<31
744	&xor	("ebx","edx");
745	&shl	("edi",25-24);	# hi<<25
746	&xor	("ebx","esi");
747
748	&shr	("ecx",8-7);	# lo>>8
749	&xor	("eax","edi");
750	&shr	("edx",8-7);	# hi>>8
751	&xor	("eax","ecx");
752	&shl	("edi",31-25);	# hi<<31
753	&xor	("ebx","edx");
754	&xor	("eax","edi");			# T1 = sigma0(X[-15])
755
756	&mov	(&DWP(0,"esp"),"eax");
757	&mov	(&DWP(4,"esp"),"ebx");		# put T1 away
758
759	#define sigma1(x)	(ROTR((x),19) ^ ROTR((x),61) ^ ((x)>>6))
760	#	LO		lo>>19^hi<<13 ^ hi>>29^lo<<3 ^ lo>>6^hi<<26
761	#	HI		hi>>19^lo<<13 ^ lo>>29^hi<<3 ^ hi>>6
762	&mov	("ecx",&DWP(8*(9+15+16-14)+0,"esp"));
763	&mov	("edx",&DWP(8*(9+15+16-14)+4,"esp"));
764	&mov	("esi","ecx");
765
766	&shr	("ecx",6);	# lo>>6
767	&mov	("edi","edx");
768	&shr	("edx",6);	# hi>>6
769	&mov	("eax","ecx");
770	&shl	("esi",3);	# lo<<3
771	&mov	("ebx","edx");
772	&shl	("edi",3);	# hi<<3
773	&xor	("eax","esi");
774
775	&shr	("ecx",19-6);	# lo>>19
776	&xor	("ebx","edi");
777	&shr	("edx",19-6);	# hi>>19
778	&xor	("eax","ecx");
779	&shl	("esi",13-3);	# lo<<13
780	&xor	("ebx","edx");
781	&shl	("edi",13-3);	# hi<<13
782	&xor	("ebx","esi");
783
784	&shr	("ecx",29-19);	# lo>>29
785	&xor	("eax","edi");
786	&shr	("edx",29-19);	# hi>>29
787	&xor	("ebx","ecx");
788	&shl	("edi",26-13);	# hi<<26
789	&xor	("eax","edx");
790	&xor	("eax","edi");			# sigma1(X[-2])
791
792	&mov	("ecx",&DWP(8*(9+15+16)+0,"esp"));
793	&mov	("edx",&DWP(8*(9+15+16)+4,"esp"));
794	&add	("eax",&DWP(0,"esp"));
795	&adc	("ebx",&DWP(4,"esp"));		# T1 = sigma1(X[-2])+T1
796	&mov	("esi",&DWP(8*(9+15+16-9)+0,"esp"));
797	&mov	("edi",&DWP(8*(9+15+16-9)+4,"esp"));
798	&add	("eax","ecx");
799	&adc	("ebx","edx");			# T1 += X[-16]
800	&add	("eax","esi");
801	&adc	("ebx","edi");			# T1 += X[-7]
802	&mov	(&DWP(8*(9+15)+0,"esp"),"eax");
803	&mov	(&DWP(8*(9+15)+4,"esp"),"ebx");	# save X[0]
804
805	&BODY_00_15_x86();
806
807	&cmp	(&LB("edx"),0x17);
808	&jne	(&label("16_79_x86"));
809
810	&mov	("esi",&DWP(8*(9+16+80)+0,"esp"));# ctx
811	&mov	("edi",&DWP(8*(9+16+80)+4,"esp"));# inp
812    for($i=0;$i<4;$i++) {
813	&mov	("eax",&DWP($i*16+0,"esi"));
814	&mov	("ebx",&DWP($i*16+4,"esi"));
815	&mov	("ecx",&DWP($i*16+8,"esi"));
816	&mov	("edx",&DWP($i*16+12,"esi"));
817	&add	("eax",&DWP(8+($i*16)+0,"esp"));
818	&adc	("ebx",&DWP(8+($i*16)+4,"esp"));
819	&mov	(&DWP($i*16+0,"esi"),"eax");
820	&mov	(&DWP($i*16+4,"esi"),"ebx");
821	&add	("ecx",&DWP(8+($i*16)+8,"esp"));
822	&adc	("edx",&DWP(8+($i*16)+12,"esp"));
823	&mov	(&DWP($i*16+8,"esi"),"ecx");
824	&mov	(&DWP($i*16+12,"esi"),"edx");
825    }
826	&add	("esp",8*(9+16+80));		# destroy frame
827	&sub	($K512,8*80);			# rewind K
828
829	&cmp	("edi",&DWP(8,"esp"));		# are we done yet?
830	&jb	(&label("loop_x86"));
831
832	&mov	("esp",&DWP(12,"esp"));		# restore sp
833&function_end_A();
834
835&set_label("K512",64);	# Yes! I keep it in the code segment!
836	&data_word(0xd728ae22,0x428a2f98);	# u64
837	&data_word(0x23ef65cd,0x71374491);	# u64
838	&data_word(0xec4d3b2f,0xb5c0fbcf);	# u64
839	&data_word(0x8189dbbc,0xe9b5dba5);	# u64
840	&data_word(0xf348b538,0x3956c25b);	# u64
841	&data_word(0xb605d019,0x59f111f1);	# u64
842	&data_word(0xaf194f9b,0x923f82a4);	# u64
843	&data_word(0xda6d8118,0xab1c5ed5);	# u64
844	&data_word(0xa3030242,0xd807aa98);	# u64
845	&data_word(0x45706fbe,0x12835b01);	# u64
846	&data_word(0x4ee4b28c,0x243185be);	# u64
847	&data_word(0xd5ffb4e2,0x550c7dc3);	# u64
848	&data_word(0xf27b896f,0x72be5d74);	# u64
849	&data_word(0x3b1696b1,0x80deb1fe);	# u64
850	&data_word(0x25c71235,0x9bdc06a7);	# u64
851	&data_word(0xcf692694,0xc19bf174);	# u64
852	&data_word(0x9ef14ad2,0xe49b69c1);	# u64
853	&data_word(0x384f25e3,0xefbe4786);	# u64
854	&data_word(0x8b8cd5b5,0x0fc19dc6);	# u64
855	&data_word(0x77ac9c65,0x240ca1cc);	# u64
856	&data_word(0x592b0275,0x2de92c6f);	# u64
857	&data_word(0x6ea6e483,0x4a7484aa);	# u64
858	&data_word(0xbd41fbd4,0x5cb0a9dc);	# u64
859	&data_word(0x831153b5,0x76f988da);	# u64
860	&data_word(0xee66dfab,0x983e5152);	# u64
861	&data_word(0x2db43210,0xa831c66d);	# u64
862	&data_word(0x98fb213f,0xb00327c8);	# u64
863	&data_word(0xbeef0ee4,0xbf597fc7);	# u64
864	&data_word(0x3da88fc2,0xc6e00bf3);	# u64
865	&data_word(0x930aa725,0xd5a79147);	# u64
866	&data_word(0xe003826f,0x06ca6351);	# u64
867	&data_word(0x0a0e6e70,0x14292967);	# u64
868	&data_word(0x46d22ffc,0x27b70a85);	# u64
869	&data_word(0x5c26c926,0x2e1b2138);	# u64
870	&data_word(0x5ac42aed,0x4d2c6dfc);	# u64
871	&data_word(0x9d95b3df,0x53380d13);	# u64
872	&data_word(0x8baf63de,0x650a7354);	# u64
873	&data_word(0x3c77b2a8,0x766a0abb);	# u64
874	&data_word(0x47edaee6,0x81c2c92e);	# u64
875	&data_word(0x1482353b,0x92722c85);	# u64
876	&data_word(0x4cf10364,0xa2bfe8a1);	# u64
877	&data_word(0xbc423001,0xa81a664b);	# u64
878	&data_word(0xd0f89791,0xc24b8b70);	# u64
879	&data_word(0x0654be30,0xc76c51a3);	# u64
880	&data_word(0xd6ef5218,0xd192e819);	# u64
881	&data_word(0x5565a910,0xd6990624);	# u64
882	&data_word(0x5771202a,0xf40e3585);	# u64
883	&data_word(0x32bbd1b8,0x106aa070);	# u64
884	&data_word(0xb8d2d0c8,0x19a4c116);	# u64
885	&data_word(0x5141ab53,0x1e376c08);	# u64
886	&data_word(0xdf8eeb99,0x2748774c);	# u64
887	&data_word(0xe19b48a8,0x34b0bcb5);	# u64
888	&data_word(0xc5c95a63,0x391c0cb3);	# u64
889	&data_word(0xe3418acb,0x4ed8aa4a);	# u64
890	&data_word(0x7763e373,0x5b9cca4f);	# u64
891	&data_word(0xd6b2b8a3,0x682e6ff3);	# u64
892	&data_word(0x5defb2fc,0x748f82ee);	# u64
893	&data_word(0x43172f60,0x78a5636f);	# u64
894	&data_word(0xa1f0ab72,0x84c87814);	# u64
895	&data_word(0x1a6439ec,0x8cc70208);	# u64
896	&data_word(0x23631e28,0x90befffa);	# u64
897	&data_word(0xde82bde9,0xa4506ceb);	# u64
898	&data_word(0xb2c67915,0xbef9a3f7);	# u64
899	&data_word(0xe372532b,0xc67178f2);	# u64
900	&data_word(0xea26619c,0xca273ece);	# u64
901	&data_word(0x21c0c207,0xd186b8c7);	# u64
902	&data_word(0xcde0eb1e,0xeada7dd6);	# u64
903	&data_word(0xee6ed178,0xf57d4f7f);	# u64
904	&data_word(0x72176fba,0x06f067aa);	# u64
905	&data_word(0xa2c898a6,0x0a637dc5);	# u64
906	&data_word(0xbef90dae,0x113f9804);	# u64
907	&data_word(0x131c471b,0x1b710b35);	# u64
908	&data_word(0x23047d84,0x28db77f5);	# u64
909	&data_word(0x40c72493,0x32caab7b);	# u64
910	&data_word(0x15c9bebc,0x3c9ebe0a);	# u64
911	&data_word(0x9c100d4c,0x431d67c4);	# u64
912	&data_word(0xcb3e42b6,0x4cc5d4be);	# u64
913	&data_word(0xfc657e2a,0x597f299c);	# u64
914	&data_word(0x3ad6faec,0x5fcb6fab);	# u64
915	&data_word(0x4a475817,0x6c44198c);	# u64
916
917	&data_word(0x04050607,0x00010203);	# byte swap
918	&data_word(0x0c0d0e0f,0x08090a0b);	# mask
919&function_end_B("sha512_block_data_order");
920&asciz("SHA512 block transform for x86, CRYPTOGAMS by <appro\@openssl.org>");
921
922&asm_finish();
923
924close STDOUT or die "error closing STDOUT: $!";
925