1#! /usr/bin/env perl 2# Copyright 2007-2023 The OpenSSL Project Authors. All Rights Reserved. 3# 4# Licensed under the Apache License 2.0 (the "License"). You may not use 5# this file except in compliance with the License. You can obtain a copy 6# in the file LICENSE in the source distribution or at 7# https://www.openssl.org/source/license.html 8 9 10# ==================================================================== 11# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL 12# project. The module is, however, dual licensed under OpenSSL and 13# CRYPTOGAMS licenses depending on where you obtain it. For further 14# details see http://www.openssl.org/~appro/cryptogams/. 15# ==================================================================== 16 17# sha1_block procedure for ARMv4. 18# 19# January 2007. 20 21# Size/performance trade-off 22# ==================================================================== 23# impl size in bytes comp cycles[*] measured performance 24# ==================================================================== 25# thumb 304 3212 4420 26# armv4-small 392/+29% 1958/+64% 2250/+96% 27# armv4-compact 740/+89% 1552/+26% 1840/+22% 28# armv4-large 1420/+92% 1307/+19% 1370/+34%[***] 29# full unroll ~5100/+260% ~1260/+4% ~1300/+5% 30# ==================================================================== 31# thumb = same as 'small' but in Thumb instructions[**] and 32# with recurring code in two private functions; 33# small = detached Xload/update, loops are folded; 34# compact = detached Xload/update, 5x unroll; 35# large = interleaved Xload/update, 5x unroll; 36# full unroll = interleaved Xload/update, full unroll, estimated[!]; 37# 38# [*] Manually counted instructions in "grand" loop body. Measured 39# performance is affected by prologue and epilogue overhead, 40# i-cache availability, branch penalties, etc. 41# [**] While each Thumb instruction is twice smaller, they are not as 42# diverse as ARM ones: e.g., there are only two arithmetic 43# instructions with 3 arguments, no [fixed] rotate, addressing 44# modes are limited. As result it takes more instructions to do 45# the same job in Thumb, therefore the code is never twice as 46# small and always slower. 47# [***] which is also ~35% better than compiler generated code. Dual- 48# issue Cortex A8 core was measured to process input block in 49# ~990 cycles. 50 51# August 2010. 52# 53# Rescheduling for dual-issue pipeline resulted in 13% improvement on 54# Cortex A8 core and in absolute terms ~870 cycles per input block 55# [or 13.6 cycles per byte]. 56 57# February 2011. 58# 59# Profiler-assisted and platform-specific optimization resulted in 10% 60# improvement on Cortex A8 core and 12.2 cycles per byte. 61 62# September 2013. 63# 64# Add NEON implementation (see sha1-586.pl for background info). On 65# Cortex A8 it was measured to process one byte in 6.7 cycles or >80% 66# faster than integer-only code. Because [fully unrolled] NEON code 67# is ~2.5x larger and there are some redundant instructions executed 68# when processing last block, improvement is not as big for smallest 69# blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per 70# byte, which is also >80% faster than integer-only code. Cortex-A15 71# is even faster spending 5.6 cycles per byte outperforming integer- 72# only code by factor of 2. 73 74# May 2014. 75# 76# Add ARMv8 code path performing at 2.35 cpb on Apple A7. 77 78# $output is the last argument if it looks like a file (it has an extension) 79# $flavour is the first argument if it doesn't look like a file 80$output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef; 81$flavour = $#ARGV >= 0 && $ARGV[0] !~ m|\.| ? shift : undef; 82 83if ($flavour && $flavour ne "void") { 84 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1; 85 ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or 86 ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or 87 die "can't locate arm-xlate.pl"; 88 89 open STDOUT,"| \"$^X\" $xlate $flavour \"$output\"" 90 or die "can't call $xlate: $!"; 91} else { 92 $output and open STDOUT,">$output"; 93} 94 95$ctx="r0"; 96$inp="r1"; 97$len="r2"; 98$a="r3"; 99$b="r4"; 100$c="r5"; 101$d="r6"; 102$e="r7"; 103$K="r8"; 104$t0="r9"; 105$t1="r10"; 106$t2="r11"; 107$t3="r12"; 108$Xi="r14"; 109@V=($a,$b,$c,$d,$e); 110 111sub Xupdate { 112my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_; 113$code.=<<___; 114 ldr $t0,[$Xi,#15*4] 115 ldr $t1,[$Xi,#13*4] 116 ldr $t2,[$Xi,#7*4] 117 add $e,$K,$e,ror#2 @ E+=K_xx_xx 118 ldr $t3,[$Xi,#2*4] 119 eor $t0,$t0,$t1 120 eor $t2,$t2,$t3 @ 1 cycle stall 121 eor $t1,$c,$d @ F_xx_xx 122 mov $t0,$t0,ror#31 123 add $e,$e,$a,ror#27 @ E+=ROR(A,27) 124 eor $t0,$t0,$t2,ror#31 125 str $t0,[$Xi,#-4]! 126 $opt1 @ F_xx_xx 127 $opt2 @ F_xx_xx 128 add $e,$e,$t0 @ E+=X[i] 129___ 130} 131 132sub BODY_00_15 { 133my ($a,$b,$c,$d,$e)=@_; 134$code.=<<___; 135#if __ARM_ARCH__<7 136 ldrb $t1,[$inp,#2] 137 ldrb $t0,[$inp,#3] 138 ldrb $t2,[$inp,#1] 139 add $e,$K,$e,ror#2 @ E+=K_00_19 140 ldrb $t3,[$inp],#4 141 orr $t0,$t0,$t1,lsl#8 142 eor $t1,$c,$d @ F_xx_xx 143 orr $t0,$t0,$t2,lsl#16 144 add $e,$e,$a,ror#27 @ E+=ROR(A,27) 145 orr $t0,$t0,$t3,lsl#24 146#else 147 ldr $t0,[$inp],#4 @ handles unaligned 148 add $e,$K,$e,ror#2 @ E+=K_00_19 149 eor $t1,$c,$d @ F_xx_xx 150 add $e,$e,$a,ror#27 @ E+=ROR(A,27) 151#ifdef __ARMEL__ 152 rev $t0,$t0 @ byte swap 153#endif 154#endif 155 and $t1,$b,$t1,ror#2 156 add $e,$e,$t0 @ E+=X[i] 157 eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D) 158 str $t0,[$Xi,#-4]! 159 add $e,$e,$t1 @ E+=F_00_19(B,C,D) 160___ 161} 162 163sub BODY_16_19 { 164my ($a,$b,$c,$d,$e)=@_; 165 &Xupdate(@_,"and $t1,$b,$t1,ror#2"); 166$code.=<<___; 167 eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D) 168 add $e,$e,$t1 @ E+=F_00_19(B,C,D) 169___ 170} 171 172sub BODY_20_39 { 173my ($a,$b,$c,$d,$e)=@_; 174 &Xupdate(@_,"eor $t1,$b,$t1,ror#2"); 175$code.=<<___; 176 add $e,$e,$t1 @ E+=F_20_39(B,C,D) 177___ 178} 179 180sub BODY_40_59 { 181my ($a,$b,$c,$d,$e)=@_; 182 &Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d"); 183$code.=<<___; 184 add $e,$e,$t1 @ E+=F_40_59(B,C,D) 185 add $e,$e,$t2,ror#2 186___ 187} 188 189$code=<<___; 190#include "arm_arch.h" 191 192#if defined(__thumb2__) 193.syntax unified 194.thumb 195#else 196.code 32 197#endif 198 199.text 200 201.global sha1_block_data_order 202.type sha1_block_data_order,%function 203 204.align 5 205sha1_block_data_order: 206#if __ARM_MAX_ARCH__>=7 207.Lsha1_block: 208 ldr r12,.LOPENSSL_armcap 209# if !defined(_WIN32) 210 adr r3,.Lsha1_block 211 ldr r12,[r3,r12] @ OPENSSL_armcap_P 212# endif 213# if defined(__APPLE__) || defined(_WIN32) 214 ldr r12,[r12] 215# endif 216 tst r12,#ARMV8_SHA1 217 bne .LARMv8 218 tst r12,#ARMV7_NEON 219 bne .LNEON 220#endif 221 stmdb sp!,{r4-r12,lr} 222 add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp 223 ldmia $ctx,{$a,$b,$c,$d,$e} 224.Lloop: 225 ldr $K,.LK_00_19 226 mov $Xi,sp 227 sub sp,sp,#15*4 228 mov $c,$c,ror#30 229 mov $d,$d,ror#30 230 mov $e,$e,ror#30 @ [6] 231.L_00_15: 232___ 233for($i=0;$i<5;$i++) { 234 &BODY_00_15(@V); unshift(@V,pop(@V)); 235} 236$code.=<<___; 237#if defined(__thumb2__) 238 mov $t3,sp 239 teq $Xi,$t3 240#else 241 teq $Xi,sp 242#endif 243 bne .L_00_15 @ [((11+4)*5+2)*3] 244 sub sp,sp,#25*4 245___ 246 &BODY_00_15(@V); unshift(@V,pop(@V)); 247 &BODY_16_19(@V); unshift(@V,pop(@V)); 248 &BODY_16_19(@V); unshift(@V,pop(@V)); 249 &BODY_16_19(@V); unshift(@V,pop(@V)); 250 &BODY_16_19(@V); unshift(@V,pop(@V)); 251$code.=<<___; 252 253 ldr $K,.LK_20_39 @ [+15+16*4] 254 cmn sp,#0 @ [+3], clear carry to denote 20_39 255.L_20_39_or_60_79: 256___ 257for($i=0;$i<5;$i++) { 258 &BODY_20_39(@V); unshift(@V,pop(@V)); 259} 260$code.=<<___; 261#if defined(__thumb2__) 262 mov $t3,sp 263 teq $Xi,$t3 264#else 265 teq $Xi,sp @ preserve carry 266#endif 267 bne .L_20_39_or_60_79 @ [+((12+3)*5+2)*4] 268 bcs .L_done @ [+((12+3)*5+2)*4], spare 300 bytes 269 270 ldr $K,.LK_40_59 271 sub sp,sp,#20*4 @ [+2] 272.L_40_59: 273___ 274for($i=0;$i<5;$i++) { 275 &BODY_40_59(@V); unshift(@V,pop(@V)); 276} 277$code.=<<___; 278#if defined(__thumb2__) 279 mov $t3,sp 280 teq $Xi,$t3 281#else 282 teq $Xi,sp 283#endif 284 bne .L_40_59 @ [+((12+5)*5+2)*4] 285 286 ldr $K,.LK_60_79 287 sub sp,sp,#20*4 288 cmp sp,#0 @ set carry to denote 60_79 289 b .L_20_39_or_60_79 @ [+4], spare 300 bytes 290.L_done: 291 add sp,sp,#80*4 @ "deallocate" stack frame 292 ldmia $ctx,{$K,$t0,$t1,$t2,$t3} 293 add $a,$K,$a 294 add $b,$t0,$b 295 add $c,$t1,$c,ror#2 296 add $d,$t2,$d,ror#2 297 add $e,$t3,$e,ror#2 298 stmia $ctx,{$a,$b,$c,$d,$e} 299 teq $inp,$len 300 bne .Lloop @ [+18], total 1307 301 302#if __ARM_ARCH__>=5 303 ldmia sp!,{r4-r12,pc} 304#else 305 ldmia sp!,{r4-r12,lr} 306 tst lr,#1 307 moveq pc,lr @ be binary compatible with V4, yet 308 bx lr @ interoperable with Thumb ISA:-) 309#endif 310.size sha1_block_data_order,.-sha1_block_data_order 311 312.align 5 313.LK_00_19: .word 0x5a827999 314.LK_20_39: .word 0x6ed9eba1 315.LK_40_59: .word 0x8f1bbcdc 316.LK_60_79: .word 0xca62c1d6 317#if __ARM_MAX_ARCH__>=7 318.LOPENSSL_armcap: 319# ifdef _WIN32 320.word OPENSSL_armcap_P 321# else 322.word OPENSSL_armcap_P-.Lsha1_block 323# endif 324#endif 325.asciz "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>" 326.align 5 327___ 328##################################################################### 329# NEON stuff 330# 331{{{ 332my @V=($a,$b,$c,$d,$e); 333my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14)); 334my $Xi=4; 335my @X=map("q$_",(8..11,0..3)); 336my @Tx=("q12","q13"); 337my ($K,$zero)=("q14","q15"); 338my $j=0; 339 340sub AUTOLOAD() # thunk [simplified] x86-style perlasm 341{ my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./; 342 my $arg = pop; 343 $arg = "#$arg" if ($arg*1 eq $arg); 344 $code .= "\t$opcode\t".join(',',@_,$arg)."\n"; 345} 346 347sub body_00_19 () { 348 ( 349 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. 350 '&bic ($t0,$d,$b)', 351 '&add ($e,$e,$Ki)', # e+=X[i]+K 352 '&and ($t1,$c,$b)', 353 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))', 354 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) 355 '&eor ($t1,$t1,$t0)', # F_00_19 356 '&mov ($b,$b,"ror#2")', # b=ROR(b,2) 357 '&add ($e,$e,$t1);'. # e+=F_00_19 358 '$j++; unshift(@V,pop(@V));' 359 ) 360} 361sub body_20_39 () { 362 ( 363 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. 364 '&eor ($t0,$b,$d)', 365 '&add ($e,$e,$Ki)', # e+=X[i]+K 366 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)', 367 '&eor ($t1,$t0,$c)', # F_20_39 368 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) 369 '&mov ($b,$b,"ror#2")', # b=ROR(b,2) 370 '&add ($e,$e,$t1);'. # e+=F_20_39 371 '$j++; unshift(@V,pop(@V));' 372 ) 373} 374sub body_40_59 () { 375 ( 376 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'. 377 '&add ($e,$e,$Ki)', # e+=X[i]+K 378 '&and ($t0,$c,$d)', 379 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))', 380 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27) 381 '&eor ($t1,$c,$d)', 382 '&add ($e,$e,$t0)', 383 '&and ($t1,$t1,$b)', 384 '&mov ($b,$b,"ror#2")', # b=ROR(b,2) 385 '&add ($e,$e,$t1);'. # e+=F_40_59 386 '$j++; unshift(@V,pop(@V));' 387 ) 388} 389 390sub Xupdate_16_31 () 391{ use integer; 392 my $body = shift; 393 my @insns = (&$body,&$body,&$body,&$body); 394 my ($a,$b,$c,$d,$e); 395 396 &vext_8 (@X[0],@X[-4&7],@X[-3&7],8); # compose "X[-14]" in "X[0]" 397 eval(shift(@insns)); 398 eval(shift(@insns)); 399 eval(shift(@insns)); 400 &vadd_i32 (@Tx[1],@X[-1&7],$K); 401 eval(shift(@insns)); 402 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0); 403 eval(shift(@insns)); 404 &vext_8 (@Tx[0],@X[-1&7],$zero,4); # "X[-3]", 3 words 405 eval(shift(@insns)); 406 eval(shift(@insns)); 407 eval(shift(@insns)); 408 &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"^="X[-16]" 409 eval(shift(@insns)); 410 eval(shift(@insns)); 411 &veor (@Tx[0],@Tx[0],@X[-2&7]); # "X[-3]"^"X[-8]" 412 eval(shift(@insns)); 413 eval(shift(@insns)); 414 &veor (@Tx[0],@Tx[0],@X[0]); # "X[0]"^="X[-3]"^"X[-8] 415 eval(shift(@insns)); 416 eval(shift(@insns)); 417 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer 418 &sub ($Xfer,$Xfer,64) if ($Xi%4==0); 419 eval(shift(@insns)); 420 eval(shift(@insns)); 421 &vext_8 (@Tx[1],$zero,@Tx[0],4); # "X[0]"<<96, extract one dword 422 eval(shift(@insns)); 423 eval(shift(@insns)); 424 &vadd_i32 (@X[0],@Tx[0],@Tx[0]); 425 eval(shift(@insns)); 426 eval(shift(@insns)); 427 &vsri_32 (@X[0],@Tx[0],31); # "X[0]"<<<=1 428 eval(shift(@insns)); 429 eval(shift(@insns)); 430 eval(shift(@insns)); 431 &vshr_u32 (@Tx[0],@Tx[1],30); 432 eval(shift(@insns)); 433 eval(shift(@insns)); 434 &vshl_u32 (@Tx[1],@Tx[1],2); 435 eval(shift(@insns)); 436 eval(shift(@insns)); 437 &veor (@X[0],@X[0],@Tx[0]); 438 eval(shift(@insns)); 439 eval(shift(@insns)); 440 &veor (@X[0],@X[0],@Tx[1]); # "X[0]"^=("X[0]">>96)<<<2 441 442 foreach (@insns) { eval; } # remaining instructions [if any] 443 444 $Xi++; push(@X,shift(@X)); # "rotate" X[] 445} 446 447sub Xupdate_32_79 () 448{ use integer; 449 my $body = shift; 450 my @insns = (&$body,&$body,&$body,&$body); 451 my ($a,$b,$c,$d,$e); 452 453 &vext_8 (@Tx[0],@X[-2&7],@X[-1&7],8); # compose "X[-6]" 454 eval(shift(@insns)); 455 eval(shift(@insns)); 456 eval(shift(@insns)); 457 &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"="X[-32]"^"X[-16]" 458 eval(shift(@insns)); 459 eval(shift(@insns)); 460 &veor (@X[0],@X[0],@X[-7&7]); # "X[0]"^="X[-28]" 461 eval(shift(@insns)); 462 eval(shift(@insns)); 463 &vadd_i32 (@Tx[1],@X[-1&7],$K); 464 eval(shift(@insns)); 465 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0); 466 eval(shift(@insns)); 467 &veor (@Tx[0],@Tx[0],@X[0]); # "X[-6]"^="X[0]" 468 eval(shift(@insns)); 469 eval(shift(@insns)); 470 &vshr_u32 (@X[0],@Tx[0],30); 471 eval(shift(@insns)); 472 eval(shift(@insns)); 473 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer 474 &sub ($Xfer,$Xfer,64) if ($Xi%4==0); 475 eval(shift(@insns)); 476 eval(shift(@insns)); 477 &vsli_32 (@X[0],@Tx[0],2); # "X[0]"="X[-6]"<<<2 478 479 foreach (@insns) { eval; } # remaining instructions [if any] 480 481 $Xi++; push(@X,shift(@X)); # "rotate" X[] 482} 483 484sub Xuplast_80 () 485{ use integer; 486 my $body = shift; 487 my @insns = (&$body,&$body,&$body,&$body); 488 my ($a,$b,$c,$d,$e); 489 490 &vadd_i32 (@Tx[1],@X[-1&7],$K); 491 eval(shift(@insns)); 492 eval(shift(@insns)); 493 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); 494 &sub ($Xfer,$Xfer,64); 495 496 &teq ($inp,$len); 497 &sub ($K_XX_XX,$K_XX_XX,16); # rewind $K_XX_XX 498 &it ("eq"); 499 &subeq ($inp,$inp,64); # reload last block to avoid SEGV 500 &vld1_8 ("{@X[-4&7]-@X[-3&7]}","[$inp]!"); 501 eval(shift(@insns)); 502 eval(shift(@insns)); 503 &vld1_8 ("{@X[-2&7]-@X[-1&7]}","[$inp]!"); 504 eval(shift(@insns)); 505 eval(shift(@insns)); 506 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!"); # load K_00_19 507 eval(shift(@insns)); 508 eval(shift(@insns)); 509 &vrev32_8 (@X[-4&7],@X[-4&7]); 510 511 foreach (@insns) { eval; } # remaining instructions 512 513 $Xi=0; 514} 515 516sub Xloop() 517{ use integer; 518 my $body = shift; 519 my @insns = (&$body,&$body,&$body,&$body); 520 my ($a,$b,$c,$d,$e); 521 522 &vrev32_8 (@X[($Xi-3)&7],@X[($Xi-3)&7]); 523 eval(shift(@insns)); 524 eval(shift(@insns)); 525 &vadd_i32 (@X[$Xi&7],@X[($Xi-4)&7],$K); 526 eval(shift(@insns)); 527 eval(shift(@insns)); 528 &vst1_32 ("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU 529 530 foreach (@insns) { eval; } 531 532 $Xi++; 533} 534 535$code.=<<___; 536#if __ARM_MAX_ARCH__>=7 537.arch armv7-a 538.fpu neon 539 540.type sha1_block_data_order_neon,%function 541.align 4 542sha1_block_data_order_neon: 543.LNEON: 544 stmdb sp!,{r4-r12,lr} 545 add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp 546 @ dmb @ errata #451034 on early Cortex A8 547 @ vstmdb sp!,{d8-d15} @ ABI specification says so 548 mov $saved_sp,sp 549 sub $Xfer,sp,#64 550 adr $K_XX_XX,.LK_00_19 551 bic $Xfer,$Xfer,#15 @ align for 128-bit stores 552 553 ldmia $ctx,{$a,$b,$c,$d,$e} @ load context 554 mov sp,$Xfer @ alloca 555 556 vld1.8 {@X[-4&7]-@X[-3&7]},[$inp]! @ handles unaligned 557 veor $zero,$zero,$zero 558 vld1.8 {@X[-2&7]-@X[-1&7]},[$inp]! 559 vld1.32 {${K}\[]},[$K_XX_XX,:32]! @ load K_00_19 560 vrev32.8 @X[-4&7],@X[-4&7] @ yes, even on 561 vrev32.8 @X[-3&7],@X[-3&7] @ big-endian... 562 vrev32.8 @X[-2&7],@X[-2&7] 563 vadd.i32 @X[0],@X[-4&7],$K 564 vrev32.8 @X[-1&7],@X[-1&7] 565 vadd.i32 @X[1],@X[-3&7],$K 566 vst1.32 {@X[0]},[$Xfer,:128]! 567 vadd.i32 @X[2],@X[-2&7],$K 568 vst1.32 {@X[1]},[$Xfer,:128]! 569 vst1.32 {@X[2]},[$Xfer,:128]! 570 ldr $Ki,[sp] @ big RAW stall 571 572.Loop_neon: 573___ 574 &Xupdate_16_31(\&body_00_19); 575 &Xupdate_16_31(\&body_00_19); 576 &Xupdate_16_31(\&body_00_19); 577 &Xupdate_16_31(\&body_00_19); 578 &Xupdate_32_79(\&body_00_19); 579 &Xupdate_32_79(\&body_20_39); 580 &Xupdate_32_79(\&body_20_39); 581 &Xupdate_32_79(\&body_20_39); 582 &Xupdate_32_79(\&body_20_39); 583 &Xupdate_32_79(\&body_20_39); 584 &Xupdate_32_79(\&body_40_59); 585 &Xupdate_32_79(\&body_40_59); 586 &Xupdate_32_79(\&body_40_59); 587 &Xupdate_32_79(\&body_40_59); 588 &Xupdate_32_79(\&body_40_59); 589 &Xupdate_32_79(\&body_20_39); 590 &Xuplast_80(\&body_20_39); 591 &Xloop(\&body_20_39); 592 &Xloop(\&body_20_39); 593 &Xloop(\&body_20_39); 594$code.=<<___; 595 ldmia $ctx,{$Ki,$t0,$t1,$Xfer} @ accumulate context 596 add $a,$a,$Ki 597 ldr $Ki,[$ctx,#16] 598 add $b,$b,$t0 599 add $c,$c,$t1 600 add $d,$d,$Xfer 601 it eq 602 moveq sp,$saved_sp 603 add $e,$e,$Ki 604 it ne 605 ldrne $Ki,[sp] 606 stmia $ctx,{$a,$b,$c,$d,$e} 607 itt ne 608 addne $Xfer,sp,#3*16 609 bne .Loop_neon 610 611 @ vldmia sp!,{d8-d15} 612 ldmia sp!,{r4-r12,pc} 613.size sha1_block_data_order_neon,.-sha1_block_data_order_neon 614#endif 615___ 616}}} 617##################################################################### 618# ARMv8 stuff 619# 620{{{ 621my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3)); 622my @MSG=map("q$_",(4..7)); 623my @Kxx=map("q$_",(8..11)); 624my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14)); 625my $_byte = ($flavour =~ /win/ ? "DCB" : ".byte"); 626 627$code.=<<___; 628#if __ARM_MAX_ARCH__>=7 629 630# if defined(__thumb2__) 631# define INST(a,b,c,d) $_byte c,d|0xf,a,b 632# else 633# define INST(a,b,c,d) $_byte a,b,c,d|0x10 634# endif 635 636.type sha1_block_data_order_armv8,%function 637.align 5 638sha1_block_data_order_armv8: 639.LARMv8: 640 vstmdb sp!,{d8-d15} @ ABI specification says so 641 642 veor $E,$E,$E 643 adr r3,.LK_00_19 644 vld1.32 {$ABCD},[$ctx]! 645 vld1.32 {$E\[0]},[$ctx] 646 sub $ctx,$ctx,#16 647 vld1.32 {@Kxx[0]\[]},[r3,:32]! 648 vld1.32 {@Kxx[1]\[]},[r3,:32]! 649 vld1.32 {@Kxx[2]\[]},[r3,:32]! 650 vld1.32 {@Kxx[3]\[]},[r3,:32] 651 652.Loop_v8: 653 vld1.8 {@MSG[0]-@MSG[1]},[$inp]! 654 vld1.8 {@MSG[2]-@MSG[3]},[$inp]! 655 vrev32.8 @MSG[0],@MSG[0] 656 vrev32.8 @MSG[1],@MSG[1] 657 658 vadd.i32 $W0,@Kxx[0],@MSG[0] 659 vrev32.8 @MSG[2],@MSG[2] 660 vmov $ABCD_SAVE,$ABCD @ offload 661 subs $len,$len,#1 662 663 vadd.i32 $W1,@Kxx[0],@MSG[1] 664 vrev32.8 @MSG[3],@MSG[3] 665 sha1h $E1,$ABCD @ 0 666 sha1c $ABCD,$E,$W0 667 vadd.i32 $W0,@Kxx[$j],@MSG[2] 668 sha1su0 @MSG[0],@MSG[1],@MSG[2] 669___ 670for ($j=0,$i=1;$i<20-3;$i++) { 671my $f=("c","p","m","p")[$i/5]; 672$code.=<<___; 673 sha1h $E0,$ABCD @ $i 674 sha1$f $ABCD,$E1,$W1 675 vadd.i32 $W1,@Kxx[$j],@MSG[3] 676 sha1su1 @MSG[0],@MSG[3] 677___ 678$code.=<<___ if ($i<20-4); 679 sha1su0 @MSG[1],@MSG[2],@MSG[3] 680___ 681 ($E0,$E1)=($E1,$E0); ($W0,$W1)=($W1,$W0); 682 push(@MSG,shift(@MSG)); $j++ if ((($i+3)%5)==0); 683} 684$code.=<<___; 685 sha1h $E0,$ABCD @ $i 686 sha1p $ABCD,$E1,$W1 687 vadd.i32 $W1,@Kxx[$j],@MSG[3] 688 689 sha1h $E1,$ABCD @ 18 690 sha1p $ABCD,$E0,$W0 691 692 sha1h $E0,$ABCD @ 19 693 sha1p $ABCD,$E1,$W1 694 695 vadd.i32 $E,$E,$E0 696 vadd.i32 $ABCD,$ABCD,$ABCD_SAVE 697 bne .Loop_v8 698 699 vst1.32 {$ABCD},[$ctx]! 700 vst1.32 {$E\[0]},[$ctx] 701 702 vldmia sp!,{d8-d15} 703 ret @ bx lr 704.size sha1_block_data_order_armv8,.-sha1_block_data_order_armv8 705#endif 706___ 707}}} 708$code.=<<___; 709#if __ARM_MAX_ARCH__>=7 710.extern OPENSSL_armcap_P 711.hidden OPENSSL_armcap_P 712#endif 713___ 714 715{ my %opcode = ( 716 "sha1c" => 0xf2000c40, "sha1p" => 0xf2100c40, 717 "sha1m" => 0xf2200c40, "sha1su0" => 0xf2300c40, 718 "sha1h" => 0xf3b902c0, "sha1su1" => 0xf3ba0380 ); 719 720 sub unsha1 { 721 my ($mnemonic,$arg)=@_; 722 723 if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) { 724 my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19) 725 |(($2&7)<<17)|(($2&8)<<4) 726 |(($3&7)<<1) |(($3&8)<<2); 727 # since ARMv7 instructions are always encoded little-endian. 728 # correct solution is to use .inst directive, but older 729 # assemblers don't implement it:-( 730 731 # this fix-up provides Thumb encoding in conjunction with INST 732 $word &= ~0x10000000 if (($word & 0x0f000000) == 0x02000000); 733 sprintf "INST(0x%02x,0x%02x,0x%02x,0x%02x)\t@ %s %s", 734 $word&0xff,($word>>8)&0xff, 735 ($word>>16)&0xff,($word>>24)&0xff, 736 $mnemonic,$arg; 737 } 738 } 739} 740 741foreach (split($/,$code)) { 742 s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo or 743 s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo; 744 745 s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo; 746 747 s/\bret\b/bx lr/o or 748 s/\bbx\s+lr\b/.word\t0xe12fff1e/o; # make it possible to compile with -march=armv4 749 750 print $_,$/; 751} 752 753close STDOUT or die "error closing STDOUT: $!"; # enforce flush 754
