3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
10 # IALU(*)/gcc-4.4 NEON
12 # ARM11xx(ARMv6) 7.78/+100% -
13 # Cortex-A5 6.30/+130% 2.96
14 # Cortex-A8 6.25/+115% 2.36
15 # Cortex-A9 5.10/+95% 2.55
16 # Cortex-A15 3.79/+85% 1.25(**)
17 # Snapdragon S4 5.70/+100% 1.48(**)
19 # (*) this is for -march=armv6, i.e. with bunch of ldrb loading data;
20 # (**) these are trade-off results, they can be improved by ~8% but at
21 # the cost of 15/12% regression on Cortex-A5/A7, it's even possible
22 # to improve Cortex-A9 result, but then A5/A7 loose more than 20%;
25 if ($flavour=~/\w[\w\-]*\.\w+$/) { $output=$flavour; undef $flavour; }
26 else { while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} }
28 if ($flavour && $flavour ne "void") {
29 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
30 ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
31 ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
32 die "can't locate arm-xlate.pl";
34 open STDOUT,"| \"$^X\" $xlate $flavour $output";
36 open STDOUT,">$output";
39 ($ctx,$inp,$len,$padbit)=map("r$_",(0..3));
45 #if defined(__thumb2__)
53 .globl poly1305_blocks
55 .type poly1305_init,%function
63 str r3,[$ctx,#0] @ zero hash value
68 str r3,[$ctx,#36] @ is_base2_26
77 #if __ARM_MAX_ARCH__>=7
78 adr r11,.Lpoly1305_init
79 ldr r12,.LOPENSSL_armcap
84 and r3,r10,#-4 @ 0x0ffffffc
95 #if __ARM_MAX_ARCH__>=7
96 ldr r12,[r11,r12] @ OPENSSL_armcap_P
110 #if __ARM_MAX_ARCH__>=7
111 tst r12,#ARMV7_NEON @ check for NEON
113 adr r9,poly1305_blocks_neon
114 adr r11,poly1305_blocks
119 adr r12,poly1305_emit
120 adr r10,poly1305_emit_neon
129 addeq r12,r11,#(poly1305_emit-.Lpoly1305_init)
130 addne r12,r11,#(poly1305_emit_neon-.Lpoly1305_init)
131 addeq r11,r11,#(poly1305_blocks-.Lpoly1305_init)
132 addne r11,r11,#(poly1305_blocks_neon-.Lpoly1305_init)
135 orr r12,r12,#1 @ thumb-ify address
157 #if __ARM_MAX_ARCH__>=7
158 stmia r2,{r11,r12} @ fill functions table
169 moveq pc,lr @ be binary compatible with V4, yet
170 bx lr @ interoperable with Thumb ISA:-)
172 .size poly1305_init,.-poly1305_init
175 my ($h0,$h1,$h2,$h3,$h4,$r0,$r1,$r2,$r3)=map("r$_",(4..12));
176 my ($s1,$s2,$s3)=($r1,$r2,$r3);
179 .type poly1305_blocks,%function
182 stmdb sp!,{r3-r11,lr}
188 add $len,$len,$inp @ end pointer
191 ldmia $ctx,{$h0-$r3} @ load context
193 str $ctx,[sp,#12] @ offload stuff
203 ldrb r0,[lr],#16 @ load input
207 addhi $h4,$h4,#1 @ 1<<128
217 adds $h0,$h0,r3 @ accumulate input
239 str lr,[sp,#8] @ offload input pointer
241 add $s1,$r1,$r1,lsr#2
244 ldr r0,[lr],#16 @ load input
248 addhi $h4,$h4,#1 @ padbit
258 adds $h0,$h0,r0 @ accumulate input
259 str lr,[sp,#8] @ offload input pointer
261 add $s1,$r1,$r1,lsr#2
264 add $s2,$r2,$r2,lsr#2
266 add $s3,$r3,$r3,lsr#2
273 ldr $r1,[sp,#20] @ reload $r1
279 str r0,[sp,#0] @ future $h0
281 ldr $r2,[sp,#24] @ reload $r2
282 adds r2,r2,r1 @ d1+=d0>>32
284 adc lr,r3,#0 @ future $h2
285 str r2,[sp,#4] @ future $h1
290 ldr $r3,[sp,#28] @ reload $r3
302 adds $h2,lr,r0 @ d2+=d1>>32
303 ldr lr,[sp,#8] @ reload input pointer
305 adds $h3,r2,r1 @ d3+=d2>>32
306 ldr r0,[sp,#16] @ reload end pointer
308 add $h4,$h4,r3 @ h4+=d3>>32
312 add r1,r1,r1,lsr#2 @ *=5
318 cmp r0,lr @ done yet?
323 stmia $ctx,{$h0-$h4} @ store the result
327 ldmia sp!,{r3-r11,pc}
329 ldmia sp!,{r3-r11,lr}
331 moveq pc,lr @ be binary compatible with V4, yet
332 bx lr @ interoperable with Thumb ISA:-)
334 .size poly1305_blocks,.-poly1305_blocks
338 my ($ctx,$mac,$nonce)=map("r$_",(0..2));
339 my ($h0,$h1,$h2,$h3,$h4,$g0,$g1,$g2,$g3)=map("r$_",(3..11));
343 .type poly1305_emit,%function
347 .Lpoly1305_emit_enter:
350 adds $g0,$h0,#5 @ compare to modulus
355 tst $g4,#4 @ did it carry/borrow?
432 moveq pc,lr @ be binary compatible with V4, yet
433 bx lr @ interoperable with Thumb ISA:-)
435 .size poly1305_emit,.-poly1305_emit
438 my ($R0,$R1,$S1,$R2,$S2,$R3,$S3,$R4,$S4) = map("d$_",(0..9));
439 my ($D0,$D1,$D2,$D3,$D4, $H0,$H1,$H2,$H3,$H4) = map("q$_",(5..14));
440 my ($T0,$T1,$MASK) = map("q$_",(15,4,0));
442 my ($in2,$zeros,$tbl0,$tbl1) = map("r$_",(4..7));
445 #if __ARM_MAX_ARCH__>=7
448 .type poly1305_init_neon,%function
451 ldr r4,[$ctx,#20] @ load key base 2^32
456 and r2,r4,#0x03ffffff @ base 2^32 -> base 2^26
464 and r3,r3,#0x03ffffff
465 and r4,r4,#0x03ffffff
466 and r5,r5,#0x03ffffff
468 vdup.32 $R0,r2 @ r^1 in both lanes
469 add r2,r3,r3,lsl#2 @ *5
482 mov $zeros,#2 @ counter
485 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
486 @ d0 = h0*r0 + h4*5*r1 + h3*5*r2 + h2*5*r3 + h1*5*r4
487 @ d1 = h1*r0 + h0*r1 + h4*5*r2 + h3*5*r3 + h2*5*r4
488 @ d2 = h2*r0 + h1*r1 + h0*r2 + h4*5*r3 + h3*5*r4
489 @ d3 = h3*r0 + h2*r1 + h1*r2 + h0*r3 + h4*5*r4
490 @ d4 = h4*r0 + h3*r1 + h2*r2 + h1*r3 + h0*r4
492 vmull.u32 $D0,$R0,${R0}[1]
493 vmull.u32 $D1,$R1,${R0}[1]
494 vmull.u32 $D2,$R2,${R0}[1]
495 vmull.u32 $D3,$R3,${R0}[1]
496 vmull.u32 $D4,$R4,${R0}[1]
498 vmlal.u32 $D0,$R4,${S1}[1]
499 vmlal.u32 $D1,$R0,${R1}[1]
500 vmlal.u32 $D2,$R1,${R1}[1]
501 vmlal.u32 $D3,$R2,${R1}[1]
502 vmlal.u32 $D4,$R3,${R1}[1]
504 vmlal.u32 $D0,$R3,${S2}[1]
505 vmlal.u32 $D1,$R4,${S2}[1]
506 vmlal.u32 $D3,$R1,${R2}[1]
507 vmlal.u32 $D2,$R0,${R2}[1]
508 vmlal.u32 $D4,$R2,${R2}[1]
510 vmlal.u32 $D0,$R2,${S3}[1]
511 vmlal.u32 $D3,$R0,${R3}[1]
512 vmlal.u32 $D1,$R3,${S3}[1]
513 vmlal.u32 $D2,$R4,${S3}[1]
514 vmlal.u32 $D4,$R1,${R3}[1]
516 vmlal.u32 $D3,$R4,${S4}[1]
517 vmlal.u32 $D0,$R1,${S4}[1]
518 vmlal.u32 $D1,$R2,${S4}[1]
519 vmlal.u32 $D2,$R3,${S4}[1]
520 vmlal.u32 $D4,$R0,${R4}[1]
522 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
523 @ lazy reduction as discussed in "NEON crypto" by D.J. Bernstein
530 vadd.i64 $D4,$D4,$T0 @ h3 -> h4
531 vbic.i32 $D3#lo,#0xfc000000 @ &=0x03ffffff
532 vadd.i64 $D1,$D1,$T1 @ h0 -> h1
533 vbic.i32 $D0#lo,#0xfc000000
535 vshrn.u64 $T0#lo,$D4,#26
539 vadd.i64 $D2,$D2,$T1 @ h1 -> h2
540 vbic.i32 $D4#lo,#0xfc000000
541 vbic.i32 $D1#lo,#0xfc000000
543 vadd.i32 $D0#lo,$D0#lo,$T0#lo
544 vshl.u32 $T0#lo,$T0#lo,#2
545 vshrn.u64 $T1#lo,$D2,#26
547 vadd.i32 $D0#lo,$D0#lo,$T0#lo @ h4 -> h0
548 vadd.i32 $D3#lo,$D3#lo,$T1#lo @ h2 -> h3
549 vbic.i32 $D2#lo,#0xfc000000
551 vshr.u32 $T0#lo,$D0#lo,#26
552 vbic.i32 $D0#lo,#0xfc000000
553 vshr.u32 $T1#lo,$D3#lo,#26
554 vbic.i32 $D3#lo,#0xfc000000
555 vadd.i32 $D1#lo,$D1#lo,$T0#lo @ h0 -> h1
556 vadd.i32 $D4#lo,$D4#lo,$T1#lo @ h3 -> h4
558 subs $zeros,$zeros,#1
559 beq .Lsquare_break_neon
561 add $tbl0,$ctx,#(48+0*9*4)
562 add $tbl1,$ctx,#(48+1*9*4)
564 vtrn.32 $R0,$D0#lo @ r^2:r^1
570 vshl.u32 $S2,$R2,#2 @ *5
579 vst4.32 {${R0}[0],${R1}[0],${S1}[0],${R2}[0]},[$tbl0]!
580 vst4.32 {${R0}[1],${R1}[1],${S1}[1],${R2}[1]},[$tbl1]!
581 vst4.32 {${S2}[0],${R3}[0],${S3}[0],${R4}[0]},[$tbl0]!
582 vst4.32 {${S2}[1],${R3}[1],${S3}[1],${R4}[1]},[$tbl1]!
583 vst1.32 {${S4}[0]},[$tbl0,:32]
584 vst1.32 {${S4}[1]},[$tbl1,:32]
590 add $tbl0,$ctx,#(48+2*4*9)
591 add $tbl1,$ctx,#(48+3*4*9)
593 vmov $R0,$D0#lo @ r^4:r^3
594 vshl.u32 $S1,$D1#lo,#2 @ *5
596 vshl.u32 $S2,$D2#lo,#2
598 vshl.u32 $S3,$D3#lo,#2
600 vshl.u32 $S4,$D4#lo,#2
602 vadd.i32 $S1,$S1,$D1#lo
603 vadd.i32 $S2,$S2,$D2#lo
604 vadd.i32 $S3,$S3,$D3#lo
605 vadd.i32 $S4,$S4,$D4#lo
607 vst4.32 {${R0}[0],${R1}[0],${S1}[0],${R2}[0]},[$tbl0]!
608 vst4.32 {${R0}[1],${R1}[1],${S1}[1],${R2}[1]},[$tbl1]!
609 vst4.32 {${S2}[0],${R3}[0],${S3}[0],${R4}[0]},[$tbl0]!
610 vst4.32 {${S2}[1],${R3}[1],${S3}[1],${R4}[1]},[$tbl1]!
611 vst1.32 {${S4}[0]},[$tbl0]
612 vst1.32 {${S4}[1]},[$tbl1]
615 .size poly1305_init_neon,.-poly1305_init_neon
617 .type poly1305_blocks_neon,%function
619 poly1305_blocks_neon:
620 ldr ip,[$ctx,#36] @ is_base2_26
626 tst ip,ip @ is_base2_26?
631 vstmdb sp!,{d8-d15} @ ABI specification says so
633 tst ip,ip @ is_base2_26?
637 bl poly1305_init_neon
639 ldr r4,[$ctx,#0] @ load hash value base 2^32
645 and r2,r4,#0x03ffffff @ base 2^32 -> base 2^26
647 veor $D0#lo,$D0#lo,$D0#lo
650 veor $D1#lo,$D1#lo,$D1#lo
653 veor $D2#lo,$D2#lo,$D2#lo
656 veor $D3#lo,$D3#lo,$D3#lo
657 and r3,r3,#0x03ffffff
659 veor $D4#lo,$D4#lo,$D4#lo
660 and r4,r4,#0x03ffffff
662 and r5,r5,#0x03ffffff
663 str r1,[$ctx,#36] @ is_base2_26
677 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
680 veor $D0#lo,$D0#lo,$D0#lo
681 veor $D1#lo,$D1#lo,$D1#lo
682 veor $D2#lo,$D2#lo,$D2#lo
683 veor $D3#lo,$D3#lo,$D3#lo
684 veor $D4#lo,$D4#lo,$D4#lo
685 vld4.32 {$D0#lo[0],$D1#lo[0],$D2#lo[0],$D3#lo[0]},[$ctx]!
687 vld1.32 {$D4#lo[0]},[$ctx]
688 sub $ctx,$ctx,#16 @ rewind
692 mov $padbit,$padbit,lsl#24
696 vld4.32 {$H0#lo[0],$H1#lo[0],$H2#lo[0],$H3#lo[0]},[$inp]!
697 vmov.32 $H4#lo[0],$padbit
707 vsri.u32 $H4#lo,$H3#lo,#8 @ base 2^32 -> base 2^26
708 vshl.u32 $H3#lo,$H3#lo,#18
710 vsri.u32 $H3#lo,$H2#lo,#14
711 vshl.u32 $H2#lo,$H2#lo,#12
712 vadd.i32 $H4#hi,$H4#lo,$D4#lo @ add hash value and move to #hi
714 vbic.i32 $H3#lo,#0xfc000000
715 vsri.u32 $H2#lo,$H1#lo,#20
716 vshl.u32 $H1#lo,$H1#lo,#6
718 vbic.i32 $H2#lo,#0xfc000000
719 vsri.u32 $H1#lo,$H0#lo,#26
720 vadd.i32 $H3#hi,$H3#lo,$D3#lo
722 vbic.i32 $H0#lo,#0xfc000000
723 vbic.i32 $H1#lo,#0xfc000000
724 vadd.i32 $H2#hi,$H2#lo,$D2#lo
726 vadd.i32 $H0#hi,$H0#lo,$D0#lo
727 vadd.i32 $H1#hi,$H1#lo,$D1#lo
743 vmov.i32 $H4,#1<<24 @ padbit, yes, always
744 vld4.32 {$H0#lo,$H1#lo,$H2#lo,$H3#lo},[$inp] @ inp[0:1]
746 vld4.32 {$H0#hi,$H1#hi,$H2#hi,$H3#hi},[$in2] @ inp[2:3] (or 0)
751 addhi $tbl1,$ctx,#(48+1*9*4)
752 addhi $tbl0,$ctx,#(48+3*9*4)
760 vsri.u32 $H4,$H3,#8 @ base 2^32 -> base 2^26
766 vbic.i32 $H3,#0xfc000000
770 vbic.i32 $H2,#0xfc000000
773 vbic.i32 $H0,#0xfc000000
774 vbic.i32 $H1,#0xfc000000
778 vld4.32 {${R0}[1],${R1}[1],${S1}[1],${R2}[1]},[$tbl1]! @ load r^2
779 vld4.32 {${R0}[0],${R1}[0],${S1}[0],${R2}[0]},[$tbl0]! @ load r^4
780 vld4.32 {${S2}[1],${R3}[1],${S3}[1],${R4}[1]},[$tbl1]!
781 vld4.32 {${S2}[0],${R3}[0],${S3}[0],${R4}[0]},[$tbl0]!
786 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
787 @ ((inp[0]*r^4+inp[2]*r^2+inp[4])*r^4+inp[6]*r^2
788 @ ((inp[1]*r^4+inp[3]*r^2+inp[5])*r^3+inp[7]*r
789 @ \___________________/
790 @ ((inp[0]*r^4+inp[2]*r^2+inp[4])*r^4+inp[6]*r^2+inp[8])*r^2
791 @ ((inp[1]*r^4+inp[3]*r^2+inp[5])*r^4+inp[7]*r^2+inp[9])*r
792 @ \___________________/ \____________________/
794 @ Note that we start with inp[2:3]*r^2. This is because it
795 @ doesn't depend on reduction in previous iteration.
796 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
797 @ d4 = h4*r0 + h3*r1 + h2*r2 + h1*r3 + h0*r4
798 @ d3 = h3*r0 + h2*r1 + h1*r2 + h0*r3 + h4*5*r4
799 @ d2 = h2*r0 + h1*r1 + h0*r2 + h4*5*r3 + h3*5*r4
800 @ d1 = h1*r0 + h0*r1 + h4*5*r2 + h3*5*r3 + h2*5*r4
801 @ d0 = h0*r0 + h4*5*r1 + h3*5*r2 + h2*5*r3 + h1*5*r4
803 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
806 vadd.i32 $H2#lo,$H2#lo,$D2#lo @ accumulate inp[0:1]
807 vmull.u32 $D2,$H2#hi,${R0}[1]
808 vadd.i32 $H0#lo,$H0#lo,$D0#lo
809 vmull.u32 $D0,$H0#hi,${R0}[1]
810 vadd.i32 $H3#lo,$H3#lo,$D3#lo
811 vmull.u32 $D3,$H3#hi,${R0}[1]
812 vmlal.u32 $D2,$H1#hi,${R1}[1]
813 vadd.i32 $H1#lo,$H1#lo,$D1#lo
814 vmull.u32 $D1,$H1#hi,${R0}[1]
816 vadd.i32 $H4#lo,$H4#lo,$D4#lo
817 vmull.u32 $D4,$H4#hi,${R0}[1]
819 vmlal.u32 $D0,$H4#hi,${S1}[1]
824 vmlal.u32 $D3,$H2#hi,${R1}[1]
825 vld1.32 ${S4}[1],[$tbl1,:32]
826 vmlal.u32 $D1,$H0#hi,${R1}[1]
827 vmlal.u32 $D4,$H3#hi,${R1}[1]
829 vmlal.u32 $D0,$H3#hi,${S2}[1]
830 vmlal.u32 $D3,$H1#hi,${R2}[1]
831 vmlal.u32 $D4,$H2#hi,${R2}[1]
832 vmlal.u32 $D1,$H4#hi,${S2}[1]
833 vmlal.u32 $D2,$H0#hi,${R2}[1]
835 vmlal.u32 $D3,$H0#hi,${R3}[1]
836 vmlal.u32 $D0,$H2#hi,${S3}[1]
837 vmlal.u32 $D4,$H1#hi,${R3}[1]
838 vmlal.u32 $D1,$H3#hi,${S3}[1]
839 vmlal.u32 $D2,$H4#hi,${S3}[1]
841 vmlal.u32 $D3,$H4#hi,${S4}[1]
842 vmlal.u32 $D0,$H1#hi,${S4}[1]
843 vmlal.u32 $D4,$H0#hi,${R4}[1]
844 vmlal.u32 $D1,$H2#hi,${S4}[1]
845 vmlal.u32 $D2,$H3#hi,${S4}[1]
847 vld4.32 {$H0#hi,$H1#hi,$H2#hi,$H3#hi},[$in2] @ inp[2:3] (or 0)
850 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
851 @ (hash+inp[0:1])*r^4 and accumulate
853 vmlal.u32 $D3,$H3#lo,${R0}[0]
854 vmlal.u32 $D0,$H0#lo,${R0}[0]
855 vmlal.u32 $D4,$H4#lo,${R0}[0]
856 vmlal.u32 $D1,$H1#lo,${R0}[0]
857 vmlal.u32 $D2,$H2#lo,${R0}[0]
858 vld1.32 ${S4}[0],[$tbl0,:32]
860 vmlal.u32 $D3,$H2#lo,${R1}[0]
861 vmlal.u32 $D0,$H4#lo,${S1}[0]
862 vmlal.u32 $D4,$H3#lo,${R1}[0]
863 vmlal.u32 $D1,$H0#lo,${R1}[0]
864 vmlal.u32 $D2,$H1#lo,${R1}[0]
866 vmlal.u32 $D3,$H1#lo,${R2}[0]
867 vmlal.u32 $D0,$H3#lo,${S2}[0]
868 vmlal.u32 $D4,$H2#lo,${R2}[0]
869 vmlal.u32 $D1,$H4#lo,${S2}[0]
870 vmlal.u32 $D2,$H0#lo,${R2}[0]
872 vmlal.u32 $D3,$H0#lo,${R3}[0]
873 vmlal.u32 $D0,$H2#lo,${S3}[0]
874 vmlal.u32 $D4,$H1#lo,${R3}[0]
875 vmlal.u32 $D1,$H3#lo,${S3}[0]
876 vmlal.u32 $D3,$H4#lo,${S4}[0]
878 vmlal.u32 $D2,$H4#lo,${S3}[0]
879 vmlal.u32 $D0,$H1#lo,${S4}[0]
880 vmlal.u32 $D4,$H0#lo,${R4}[0]
881 vmov.i32 $H4,#1<<24 @ padbit, yes, always
882 vmlal.u32 $D1,$H2#lo,${S4}[0]
883 vmlal.u32 $D2,$H3#lo,${S4}[0]
885 vld4.32 {$H0#lo,$H1#lo,$H2#lo,$H3#lo},[$inp] @ inp[0:1]
894 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
895 @ lazy reduction interleaved with base 2^32 -> base 2^26
901 vadd.i64 $D4,$D4,$T0 @ h3 -> h4
902 vbic.i32 $D3#lo,#0xfc000000
903 vsri.u32 $H4,$H3,#8 @ base 2^32 -> base 2^26
904 vadd.i64 $D1,$D1,$T1 @ h0 -> h1
906 vbic.i32 $D0#lo,#0xfc000000
908 vshrn.u64 $T0#lo,$D4,#26
912 vadd.i64 $D2,$D2,$T1 @ h1 -> h2
914 vbic.i32 $D4#lo,#0xfc000000
916 vbic.i32 $D1#lo,#0xfc000000
918 vadd.i32 $D0#lo,$D0#lo,$T0#lo
919 vshl.u32 $T0#lo,$T0#lo,#2
920 vbic.i32 $H3,#0xfc000000
921 vshrn.u64 $T1#lo,$D2,#26
923 vadd.i32 $D0#lo,$D0#lo,$T0#lo @ h4 -> h0
925 vadd.i32 $D3#lo,$D3#lo,$T1#lo @ h2 -> h3
927 vbic.i32 $D2#lo,#0xfc000000
928 vbic.i32 $H2,#0xfc000000
930 vshr.u32 $T0#lo,$D0#lo,#26
931 vbic.i32 $D0#lo,#0xfc000000
933 vbic.i32 $H0,#0xfc000000
934 vshr.u32 $T1#lo,$D3#lo,#26
935 vbic.i32 $D3#lo,#0xfc000000
936 vadd.i32 $D1#lo,$D1#lo,$T0#lo @ h0 -> h1
937 vadd.i32 $D4#lo,$D4#lo,$T1#lo @ h3 -> h4
938 vbic.i32 $H1,#0xfc000000
943 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
944 @ multiply (inp[0:1]+hash) or inp[2:3] by r^2:r^1
946 add $tbl1,$ctx,#(48+0*9*4)
947 add $tbl0,$ctx,#(48+1*9*4)
955 vadd.i32 $H2#hi,$H2#lo,$D2#lo @ add hash value and move to #hi
956 vadd.i32 $H0#hi,$H0#lo,$D0#lo
957 vadd.i32 $H3#hi,$H3#lo,$D3#lo
958 vadd.i32 $H1#hi,$H1#lo,$D1#lo
959 vadd.i32 $H4#hi,$H4#lo,$D4#lo
962 vld4.32 {${R0}[1],${R1}[1],${S1}[1],${R2}[1]},[$tbl1]! @ load r^1
963 vld4.32 {${R0}[0],${R1}[0],${S1}[0],${R2}[0]},[$tbl0]! @ load r^2
965 vadd.i32 $H2#lo,$H2#lo,$D2#lo @ can be redundant
966 vmull.u32 $D2,$H2#hi,$R0
967 vadd.i32 $H0#lo,$H0#lo,$D0#lo
968 vmull.u32 $D0,$H0#hi,$R0
969 vadd.i32 $H3#lo,$H3#lo,$D3#lo
970 vmull.u32 $D3,$H3#hi,$R0
971 vadd.i32 $H1#lo,$H1#lo,$D1#lo
972 vmull.u32 $D1,$H1#hi,$R0
973 vadd.i32 $H4#lo,$H4#lo,$D4#lo
974 vmull.u32 $D4,$H4#hi,$R0
976 vmlal.u32 $D0,$H4#hi,$S1
977 vld4.32 {${S2}[1],${R3}[1],${S3}[1],${R4}[1]},[$tbl1]!
978 vmlal.u32 $D3,$H2#hi,$R1
979 vld4.32 {${S2}[0],${R3}[0],${S3}[0],${R4}[0]},[$tbl0]!
980 vmlal.u32 $D1,$H0#hi,$R1
981 vmlal.u32 $D4,$H3#hi,$R1
982 vmlal.u32 $D2,$H1#hi,$R1
984 vmlal.u32 $D3,$H1#hi,$R2
985 vld1.32 ${S4}[1],[$tbl1,:32]
986 vmlal.u32 $D0,$H3#hi,$S2
987 vld1.32 ${S4}[0],[$tbl0,:32]
988 vmlal.u32 $D4,$H2#hi,$R2
989 vmlal.u32 $D1,$H4#hi,$S2
990 vmlal.u32 $D2,$H0#hi,$R2
992 vmlal.u32 $D3,$H0#hi,$R3
996 addne $tbl1,$ctx,#(48+2*9*4)
997 vmlal.u32 $D0,$H2#hi,$S3
1001 addne $tbl0,$ctx,#(48+3*9*4)
1002 vmlal.u32 $D4,$H1#hi,$R3
1003 vmlal.u32 $D1,$H3#hi,$S3
1004 vmlal.u32 $D2,$H4#hi,$S3
1006 vmlal.u32 $D3,$H4#hi,$S4
1007 vorn $MASK,$MASK,$MASK @ all-ones, can be redundant
1008 vmlal.u32 $D0,$H1#hi,$S4
1009 vshr.u64 $MASK,$MASK,#38
1010 vmlal.u32 $D4,$H0#hi,$R4
1011 vmlal.u32 $D1,$H2#hi,$S4
1012 vmlal.u32 $D2,$H3#hi,$S4
1016 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
1017 @ (hash+inp[0:1])*r^4:r^3 and accumulate
1019 vld4.32 {${R0}[1],${R1}[1],${S1}[1],${R2}[1]},[$tbl1]! @ load r^3
1020 vld4.32 {${R0}[0],${R1}[0],${S1}[0],${R2}[0]},[$tbl0]! @ load r^4
1022 vmlal.u32 $D2,$H2#lo,$R0
1023 vmlal.u32 $D0,$H0#lo,$R0
1024 vmlal.u32 $D3,$H3#lo,$R0
1025 vmlal.u32 $D1,$H1#lo,$R0
1026 vmlal.u32 $D4,$H4#lo,$R0
1028 vmlal.u32 $D0,$H4#lo,$S1
1029 vld4.32 {${S2}[1],${R3}[1],${S3}[1],${R4}[1]},[$tbl1]!
1030 vmlal.u32 $D3,$H2#lo,$R1
1031 vld4.32 {${S2}[0],${R3}[0],${S3}[0],${R4}[0]},[$tbl0]!
1032 vmlal.u32 $D1,$H0#lo,$R1
1033 vmlal.u32 $D4,$H3#lo,$R1
1034 vmlal.u32 $D2,$H1#lo,$R1
1036 vmlal.u32 $D3,$H1#lo,$R2
1037 vld1.32 ${S4}[1],[$tbl1,:32]
1038 vmlal.u32 $D0,$H3#lo,$S2
1039 vld1.32 ${S4}[0],[$tbl0,:32]
1040 vmlal.u32 $D4,$H2#lo,$R2
1041 vmlal.u32 $D1,$H4#lo,$S2
1042 vmlal.u32 $D2,$H0#lo,$R2
1044 vmlal.u32 $D3,$H0#lo,$R3
1045 vmlal.u32 $D0,$H2#lo,$S3
1046 vmlal.u32 $D4,$H1#lo,$R3
1047 vmlal.u32 $D1,$H3#lo,$S3
1048 vmlal.u32 $D2,$H4#lo,$S3
1050 vmlal.u32 $D3,$H4#lo,$S4
1051 vorn $MASK,$MASK,$MASK @ all-ones
1052 vmlal.u32 $D0,$H1#lo,$S4
1053 vshr.u64 $MASK,$MASK,#38
1054 vmlal.u32 $D4,$H0#lo,$R4
1055 vmlal.u32 $D1,$H2#lo,$S4
1056 vmlal.u32 $D2,$H3#lo,$S4
1059 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
1060 @ horizontal addition
1062 vadd.i64 $D3#lo,$D3#lo,$D3#hi
1063 vadd.i64 $D0#lo,$D0#lo,$D0#hi
1064 vadd.i64 $D4#lo,$D4#lo,$D4#hi
1065 vadd.i64 $D1#lo,$D1#lo,$D1#hi
1066 vadd.i64 $D2#lo,$D2#lo,$D2#hi
1068 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
1069 @ lazy reduction, but without narrowing
1071 vshr.u64 $T0,$D3,#26
1072 vand.i64 $D3,$D3,$MASK
1073 vshr.u64 $T1,$D0,#26
1074 vand.i64 $D0,$D0,$MASK
1075 vadd.i64 $D4,$D4,$T0 @ h3 -> h4
1076 vadd.i64 $D1,$D1,$T1 @ h0 -> h1
1078 vshr.u64 $T0,$D4,#26
1079 vand.i64 $D4,$D4,$MASK
1080 vshr.u64 $T1,$D1,#26
1081 vand.i64 $D1,$D1,$MASK
1082 vadd.i64 $D2,$D2,$T1 @ h1 -> h2
1084 vadd.i64 $D0,$D0,$T0
1086 vshr.u64 $T1,$D2,#26
1087 vand.i64 $D2,$D2,$MASK
1088 vadd.i64 $D0,$D0,$T0 @ h4 -> h0
1089 vadd.i64 $D3,$D3,$T1 @ h2 -> h3
1091 vshr.u64 $T0,$D0,#26
1092 vand.i64 $D0,$D0,$MASK
1093 vshr.u64 $T1,$D3,#26
1094 vand.i64 $D3,$D3,$MASK
1095 vadd.i64 $D1,$D1,$T0 @ h0 -> h1
1096 vadd.i64 $D4,$D4,$T1 @ h3 -> h4
1101 @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
1104 vst4.32 {$D0#lo[0],$D1#lo[0],$D2#lo[0],$D3#lo[0]},[$ctx]!
1105 vst1.32 {$D4#lo[0]},[$ctx]
1107 vldmia sp!,{d8-d15} @ epilogue
1111 .size poly1305_blocks_neon,.-poly1305_blocks_neon
1113 .type poly1305_emit_neon,%function
1116 ldr ip,[$ctx,#36] @ is_base2_26
1121 beq .Lpoly1305_emit_enter
1123 ldmia $ctx,{$h0-$h4}
1126 adds $h0,$h0,$h1,lsl#26 @ base 2^26 -> base 2^32
1128 adcs $h1,$h1,$h2,lsl#20
1130 adcs $h2,$h2,$h3,lsl#14
1132 adcs $h3,$h3,$h4,lsl#8
1133 adc $h4,$g0,$h4,lsr#24 @ can be partially reduced ...
1135 and $g0,$h4,#-4 @ ... so reduce
1137 add $g0,$g0,$g0,lsr#2 @ *= 5
1143 adds $g0,$h0,#5 @ compare to modulus
1148 tst $g4,#4 @ did it carry/borrow?
1169 ldr $g3,[$nonce,#12]
1171 adds $h0,$h0,$g0 @ accumulate nonce
1182 str $h0,[$mac,#0] @ store the result
1189 .size poly1305_emit_neon,.-poly1305_emit_neon
1193 .long 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0
1195 .word OPENSSL_armcap_P-.Lpoly1305_init
1200 .asciz "Poly1305 for ARMv4/NEON, CRYPTOGAMS by <appro\@openssl.org>"
1202 #if __ARM_MAX_ARCH__>=7
1203 .comm OPENSSL_armcap_P,4,4
1207 foreach (split("\n",$code)) {
1208 s/\`([^\`]*)\`/eval $1/geo;
1210 s/\bq([0-9]+)#(lo|hi)/sprintf "d%d",2*$1+($2 eq "hi")/geo or
1211 s/\bret\b/bx lr/go or
1212 s/\bbx\s+lr\b/.word\t0xe12fff1e/go; # make it possible to compile with -march=armv4
1216 close STDOUT; # enforce flush