2 # Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
4 # Licensed under the Apache License 2.0 (the "License"). You may not use
5 # this file except in compliance with the License. You can obtain a copy
6 # in the file LICENSE in the source distribution or at
7 # https://www.openssl.org/source/license.html
9 # ====================================================================
10 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
11 # project. The module is, however, dual licensed under OpenSSL and
12 # CRYPTOGAMS licenses depending on where you obtain it. For further
13 # details see http://www.openssl.org/~appro/cryptogams/.
14 # ====================================================================
16 # Keccak-1600 for ARMv8.
20 # This is straightforward KECCAK_1X_ALT implementation. It makes no
21 # sense to attempt SIMD/NEON implementation for following reason.
22 # 64-bit lanes of vector registers can't be addressed as easily as in
23 # 32-bit mode. This means that 64-bit NEON is bound to be slower than
24 # 32-bit NEON, and this implementation is faster than 32-bit NEON on
25 # same processor. Even though it takes more scalar xor's and andn's,
26 # it gets compensated by availability of rotate. Not to forget that
27 # most processors achieve higher issue rate with scalar instructions.
31 # Add hardware-assisted ARMv8.2 implementation. It's KECCAK_1X_ALT
32 # variant with register permutation/rotation twist that allows to
33 # eliminate copies to temporary registers. If you look closely you'll
34 # notice that it uses only one lane of vector registers. The new
35 # instructions effectively facilitate parallel hashing, which we don't
36 # support [yet?]. But lowest-level core procedure is prepared for it.
37 # The inner round is 67 [vector] instructions, so it's not actually
38 # obvious that it will provide performance improvement [in serial
39 # hash] as long as vector instructions issue rate is limited to 1 per
42 ######################################################################
43 # Numbers are cycles per processed byte.
56 # (*) Corresponds to SHA3-256. No improvement coefficients are listed
57 # because they vary too much from compiler to compiler. Newer
58 # compiler does much better and improvement varies from 5% on
59 # Cortex-A57 to 25% on Cortex-A53. While in comparison to older
60 # compiler this code is at least 2x faster...
62 # $output is the last argument if it looks like a file (it has an extension)
63 # $flavour is the first argument if it doesn't look like a file
64 $output = $#ARGV >= 0 && $ARGV[$#ARGV] =~ m|\.\w+$| ? pop : undef;
65 $flavour = $#ARGV >= 0 && $ARGV[0] !~ m|\.| ? shift : undef;
67 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
68 ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
69 ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
70 die "can't locate arm-xlate.pl";
72 open OUT,"| \"$^X\" $xlate $flavour \"$output\""
73 or die "can't call $xlate: $!";
76 my @rhotates = ([ 0, 1, 62, 28, 27 ],
77 [ 36, 44, 6, 55, 20 ],
78 [ 3, 10, 43, 25, 39 ],
79 [ 41, 45, 15, 21, 8 ],
80 [ 18, 2, 61, 56, 14 ]);
85 .align 8 // strategic alignment and padding that allows to use
86 // address value as loop termination condition...
90 .quad 0x0000000000000001
91 .quad 0x0000000000008082
92 .quad 0x800000000000808a
93 .quad 0x8000000080008000
94 .quad 0x000000000000808b
95 .quad 0x0000000080000001
96 .quad 0x8000000080008081
97 .quad 0x8000000000008009
98 .quad 0x000000000000008a
99 .quad 0x0000000000000088
100 .quad 0x0000000080008009
101 .quad 0x000000008000000a
102 .quad 0x000000008000808b
103 .quad 0x800000000000008b
104 .quad 0x8000000000008089
105 .quad 0x8000000000008003
106 .quad 0x8000000000008002
107 .quad 0x8000000000000080
108 .quad 0x000000000000800a
109 .quad 0x800000008000000a
110 .quad 0x8000000080008081
111 .quad 0x8000000000008080
112 .quad 0x0000000080000001
113 .quad 0x8000000080008008
117 my @A = map([ "x$_", "x".($_+1), "x".($_+2), "x".($_+3), "x".($_+4) ],
119 $A[3][3] = "x25"; # x18 is reserved
121 my @C = map("x$_", (26,27,28,30));
124 .type KeccakF1600_int,%function
128 .inst 0xd503233f // paciasp
129 stp $C[2],x30,[sp,#16] // 32 bytes on top are mine
133 ////////////////////////////////////////// Theta
134 eor $C[0],$A[0][0],$A[1][0]
135 stp $A[0][4],$A[1][4],[sp,#0] // offload pair...
136 eor $C[1],$A[0][1],$A[1][1]
137 eor $C[2],$A[0][2],$A[1][2]
138 eor $C[3],$A[0][3],$A[1][3]
143 eor $C[4],$A[0][4],$A[1][4]
144 eor $C[0],$C[0],$A[2][0]
145 eor $C[1],$C[1],$A[2][1]
146 eor $C[2],$C[2],$A[2][2]
147 eor $C[3],$C[3],$A[2][3]
148 eor $C[4],$C[4],$A[2][4]
149 eor $C[0],$C[0],$A[3][0]
150 eor $C[1],$C[1],$A[3][1]
151 eor $C[2],$C[2],$A[3][2]
152 eor $C[3],$C[3],$A[3][3]
153 eor $C[4],$C[4],$A[3][4]
154 eor $C[0],$C[0],$A[4][0]
155 eor $C[2],$C[2],$A[4][2]
156 eor $C[1],$C[1],$A[4][1]
157 eor $C[3],$C[3],$A[4][3]
158 eor $C[4],$C[4],$A[4][4]
160 eor $C[5],$C[0],$C[2],ror#63
162 eor $A[0][1],$A[0][1],$C[5]
163 eor $A[1][1],$A[1][1],$C[5]
164 eor $A[2][1],$A[2][1],$C[5]
165 eor $A[3][1],$A[3][1],$C[5]
166 eor $A[4][1],$A[4][1],$C[5]
168 eor $C[5],$C[1],$C[3],ror#63
169 eor $C[2],$C[2],$C[4],ror#63
170 eor $C[3],$C[3],$C[0],ror#63
171 eor $C[4],$C[4],$C[1],ror#63
173 eor $C[1], $A[0][2],$C[5] // mov $C[1],$A[0][2]
174 eor $A[1][2],$A[1][2],$C[5]
175 eor $A[2][2],$A[2][2],$C[5]
176 eor $A[3][2],$A[3][2],$C[5]
177 eor $A[4][2],$A[4][2],$C[5]
179 eor $A[0][0],$A[0][0],$C[4]
180 eor $A[1][0],$A[1][0],$C[4]
181 eor $A[2][0],$A[2][0],$C[4]
182 eor $A[3][0],$A[3][0],$C[4]
183 eor $A[4][0],$A[4][0],$C[4]
188 ldp $A[0][4],$A[1][4],[sp,#0] // re-load offloaded data
189 eor $C[0], $A[0][3],$C[2] // mov $C[0],$A[0][3]
190 eor $A[1][3],$A[1][3],$C[2]
191 eor $A[2][3],$A[2][3],$C[2]
192 eor $A[3][3],$A[3][3],$C[2]
193 eor $A[4][3],$A[4][3],$C[2]
195 eor $C[2], $A[0][4],$C[3] // mov $C[2],$A[0][4]
196 eor $A[1][4],$A[1][4],$C[3]
197 eor $A[2][4],$A[2][4],$C[3]
198 eor $A[3][4],$A[3][4],$C[3]
199 eor $A[4][4],$A[4][4],$C[3]
201 ////////////////////////////////////////// Rho+Pi
203 ror $A[0][1],$A[1][1],#64-$rhotates[1][1]
205 ror $A[0][2],$A[2][2],#64-$rhotates[2][2]
207 ror $A[0][3],$A[3][3],#64-$rhotates[3][3]
209 ror $A[0][4],$A[4][4],#64-$rhotates[4][4]
211 ror $A[1][1],$A[1][4],#64-$rhotates[1][4]
212 ror $A[2][2],$A[2][3],#64-$rhotates[2][3]
213 ror $A[3][3],$A[3][2],#64-$rhotates[3][2]
214 ror $A[4][4],$A[4][1],#64-$rhotates[4][1]
216 ror $A[1][4],$A[4][2],#64-$rhotates[4][2]
217 ror $A[2][3],$A[3][4],#64-$rhotates[3][4]
218 ror $A[3][2],$A[2][1],#64-$rhotates[2][1]
219 ror $A[4][1],$A[1][3],#64-$rhotates[1][3]
221 ror $A[4][2],$A[2][4],#64-$rhotates[2][4]
222 ror $A[3][4],$A[4][3],#64-$rhotates[4][3]
223 ror $A[2][1],$A[1][2],#64-$rhotates[1][2]
224 ror $A[1][3],$A[3][1],#64-$rhotates[3][1]
226 ror $A[2][4],$A[4][0],#64-$rhotates[4][0]
227 ror $A[4][3],$A[3][0],#64-$rhotates[3][0]
228 ror $A[1][2],$A[2][0],#64-$rhotates[2][0]
229 ror $A[3][1],$A[1][0],#64-$rhotates[1][0]
231 ror $A[1][0],$C[0],#64-$rhotates[0][3]
232 ror $A[2][0],$C[3],#64-$rhotates[0][1]
233 ror $A[3][0],$C[2],#64-$rhotates[0][4]
234 ror $A[4][0],$C[1],#64-$rhotates[0][2]
236 ////////////////////////////////////////// Chi+Iota
237 bic $C[0],$A[0][2],$A[0][1]
238 bic $C[1],$A[0][3],$A[0][2]
239 bic $C[2],$A[0][0],$A[0][4]
240 bic $C[3],$A[0][1],$A[0][0]
241 eor $A[0][0],$A[0][0],$C[0]
242 bic $C[0],$A[0][4],$A[0][3]
243 eor $A[0][1],$A[0][1],$C[1]
245 eor $A[0][3],$A[0][3],$C[2]
246 eor $A[0][4],$A[0][4],$C[3]
247 eor $A[0][2],$A[0][2],$C[0]
248 ldr $C[3],[$C[1]],#8 // Iota[i++]
250 bic $C[0],$A[1][2],$A[1][1]
251 tst $C[1],#255 // are we done?
253 bic $C[1],$A[1][3],$A[1][2]
254 bic $C[2],$A[1][0],$A[1][4]
255 eor $A[0][0],$A[0][0],$C[3] // A[0][0] ^= Iota
256 bic $C[3],$A[1][1],$A[1][0]
257 eor $A[1][0],$A[1][0],$C[0]
258 bic $C[0],$A[1][4],$A[1][3]
259 eor $A[1][1],$A[1][1],$C[1]
260 eor $A[1][3],$A[1][3],$C[2]
261 eor $A[1][4],$A[1][4],$C[3]
262 eor $A[1][2],$A[1][2],$C[0]
264 bic $C[0],$A[2][2],$A[2][1]
265 bic $C[1],$A[2][3],$A[2][2]
266 bic $C[2],$A[2][0],$A[2][4]
267 bic $C[3],$A[2][1],$A[2][0]
268 eor $A[2][0],$A[2][0],$C[0]
269 bic $C[0],$A[2][4],$A[2][3]
270 eor $A[2][1],$A[2][1],$C[1]
271 eor $A[2][3],$A[2][3],$C[2]
272 eor $A[2][4],$A[2][4],$C[3]
273 eor $A[2][2],$A[2][2],$C[0]
275 bic $C[0],$A[3][2],$A[3][1]
276 bic $C[1],$A[3][3],$A[3][2]
277 bic $C[2],$A[3][0],$A[3][4]
278 bic $C[3],$A[3][1],$A[3][0]
279 eor $A[3][0],$A[3][0],$C[0]
280 bic $C[0],$A[3][4],$A[3][3]
281 eor $A[3][1],$A[3][1],$C[1]
282 eor $A[3][3],$A[3][3],$C[2]
283 eor $A[3][4],$A[3][4],$C[3]
284 eor $A[3][2],$A[3][2],$C[0]
286 bic $C[0],$A[4][2],$A[4][1]
287 bic $C[1],$A[4][3],$A[4][2]
288 bic $C[2],$A[4][0],$A[4][4]
289 bic $C[3],$A[4][1],$A[4][0]
290 eor $A[4][0],$A[4][0],$C[0]
291 bic $C[0],$A[4][4],$A[4][3]
292 eor $A[4][1],$A[4][1],$C[1]
293 eor $A[4][3],$A[4][3],$C[2]
294 eor $A[4][4],$A[4][4],$C[3]
295 eor $A[4][2],$A[4][2],$C[0]
300 .inst 0xd50323bf // autiasp
302 .size KeccakF1600_int,.-KeccakF1600_int
304 .type KeccakF1600,%function
307 .inst 0xd503233f // paciasp
308 stp x29,x30,[sp,#-128]!
317 str x0,[sp,#32] // offload argument
319 ldp $A[0][0],$A[0][1],[x0,#16*0]
320 ldp $A[0][2],$A[0][3],[$C[0],#16*1]
321 ldp $A[0][4],$A[1][0],[$C[0],#16*2]
322 ldp $A[1][1],$A[1][2],[$C[0],#16*3]
323 ldp $A[1][3],$A[1][4],[$C[0],#16*4]
324 ldp $A[2][0],$A[2][1],[$C[0],#16*5]
325 ldp $A[2][2],$A[2][3],[$C[0],#16*6]
326 ldp $A[2][4],$A[3][0],[$C[0],#16*7]
327 ldp $A[3][1],$A[3][2],[$C[0],#16*8]
328 ldp $A[3][3],$A[3][4],[$C[0],#16*9]
329 ldp $A[4][0],$A[4][1],[$C[0],#16*10]
330 ldp $A[4][2],$A[4][3],[$C[0],#16*11]
331 ldr $A[4][4],[$C[0],#16*12]
336 stp $A[0][0],$A[0][1],[$C[0],#16*0]
337 stp $A[0][2],$A[0][3],[$C[0],#16*1]
338 stp $A[0][4],$A[1][0],[$C[0],#16*2]
339 stp $A[1][1],$A[1][2],[$C[0],#16*3]
340 stp $A[1][3],$A[1][4],[$C[0],#16*4]
341 stp $A[2][0],$A[2][1],[$C[0],#16*5]
342 stp $A[2][2],$A[2][3],[$C[0],#16*6]
343 stp $A[2][4],$A[3][0],[$C[0],#16*7]
344 stp $A[3][1],$A[3][2],[$C[0],#16*8]
345 stp $A[3][3],$A[3][4],[$C[0],#16*9]
346 stp $A[4][0],$A[4][1],[$C[0],#16*10]
347 stp $A[4][2],$A[4][3],[$C[0],#16*11]
348 str $A[4][4],[$C[0],#16*12]
350 ldp x19,x20,[x29,#16]
352 ldp x21,x22,[x29,#32]
353 ldp x23,x24,[x29,#48]
354 ldp x25,x26,[x29,#64]
355 ldp x27,x28,[x29,#80]
356 ldp x29,x30,[sp],#128
357 .inst 0xd50323bf // autiasp
359 .size KeccakF1600,.-KeccakF1600
362 .type SHA3_absorb,%function
365 .inst 0xd503233f // paciasp
366 stp x29,x30,[sp,#-128]!
375 stp x0,x1,[sp,#32] // offload arguments
378 mov $C[0],x0 // uint64_t A[5][5]
379 mov $C[1],x1 // const void *inp
380 mov $C[2],x2 // size_t len
381 mov $C[3],x3 // size_t bsz
382 ldp $A[0][0],$A[0][1],[$C[0],#16*0]
383 ldp $A[0][2],$A[0][3],[$C[0],#16*1]
384 ldp $A[0][4],$A[1][0],[$C[0],#16*2]
385 ldp $A[1][1],$A[1][2],[$C[0],#16*3]
386 ldp $A[1][3],$A[1][4],[$C[0],#16*4]
387 ldp $A[2][0],$A[2][1],[$C[0],#16*5]
388 ldp $A[2][2],$A[2][3],[$C[0],#16*6]
389 ldp $A[2][4],$A[3][0],[$C[0],#16*7]
390 ldp $A[3][1],$A[3][2],[$C[0],#16*8]
391 ldp $A[3][3],$A[3][4],[$C[0],#16*9]
392 ldp $A[4][0],$A[4][1],[$C[0],#16*10]
393 ldp $A[4][2],$A[4][3],[$C[0],#16*11]
394 ldr $A[4][4],[$C[0],#16*12]
399 subs $C[0],$C[2],$C[3] // len - bsz
402 str $C[0],[sp,#48] // save len - bsz
404 for (my $i=0; $i<24; $i+=2) {
407 ldr $C[0],[$C[1]],#8 // *inp++
411 eor $A[$i/5][$i%5],$A[$i/5][$i%5],$C[0]
414 ldr $C[0],[$C[1]],#8 // *inp++
418 eor $A[$j/5][$j%5],$A[$j/5][$j%5],$C[0]
423 ldr $C[0],[$C[1]],#8 // *inp++
427 eor $A[4][4],$A[4][4],$C[0]
430 str $C[1],[sp,#40] // save inp
434 ldr $C[1],[sp,#40] // restore arguments
435 ldp $C[2],$C[3],[sp,#48]
441 stp $A[0][0],$A[0][1],[$C[1],#16*0]
442 stp $A[0][2],$A[0][3],[$C[1],#16*1]
443 stp $A[0][4],$A[1][0],[$C[1],#16*2]
444 stp $A[1][1],$A[1][2],[$C[1],#16*3]
445 stp $A[1][3],$A[1][4],[$C[1],#16*4]
446 stp $A[2][0],$A[2][1],[$C[1],#16*5]
447 stp $A[2][2],$A[2][3],[$C[1],#16*6]
448 stp $A[2][4],$A[3][0],[$C[1],#16*7]
449 stp $A[3][1],$A[3][2],[$C[1],#16*8]
450 stp $A[3][3],$A[3][4],[$C[1],#16*9]
451 stp $A[4][0],$A[4][1],[$C[1],#16*10]
452 stp $A[4][2],$A[4][3],[$C[1],#16*11]
453 str $A[4][4],[$C[1],#16*12]
455 mov x0,$C[2] // return value
456 ldp x19,x20,[x29,#16]
458 ldp x21,x22,[x29,#32]
459 ldp x23,x24,[x29,#48]
460 ldp x25,x26,[x29,#64]
461 ldp x27,x28,[x29,#80]
462 ldp x29,x30,[sp],#128
463 .inst 0xd50323bf // autiasp
465 .size SHA3_absorb,.-SHA3_absorb
468 my ($A_flat,$out,$len,$bsz) = map("x$_",(19..22));
471 .type SHA3_squeeze,%function
474 .inst 0xd503233f // paciasp
475 stp x29,x30,[sp,#-48]!
480 mov $A_flat,x0 // put aside arguments
537 .inst 0xd50323bf // autiasp
539 .size SHA3_squeeze,.-SHA3_squeeze
543 my @A = map([ "v".$_.".16b", "v".($_+1).".16b", "v".($_+2).".16b",
544 "v".($_+3).".16b", "v".($_+4).".16b" ],
547 my @C = map("v$_.16b", (25..31));
548 my @D = @C[4,5,6,2,3];
551 .type KeccakF1600_ce,%function
559 ////////////////////////////////////////////////// Theta
560 eor3 $C[0],$A[4][0],$A[3][0],$A[2][0]
561 eor3 $C[1],$A[4][1],$A[3][1],$A[2][1]
562 eor3 $C[2],$A[4][2],$A[3][2],$A[2][2]
563 eor3 $C[3],$A[4][3],$A[3][3],$A[2][3]
564 eor3 $C[4],$A[4][4],$A[3][4],$A[2][4]
565 eor3 $C[0],$C[0], $A[1][0],$A[0][0]
566 eor3 $C[1],$C[1], $A[1][1],$A[0][1]
567 eor3 $C[2],$C[2], $A[1][2],$A[0][2]
568 eor3 $C[3],$C[3], $A[1][3],$A[0][3]
569 eor3 $C[4],$C[4], $A[1][4],$A[0][4]
571 rax1 $C[5],$C[0],$C[2] // D[1]
572 rax1 $C[6],$C[1],$C[3] // D[2]
573 rax1 $C[2],$C[2],$C[4] // D[3]
574 rax1 $C[3],$C[3],$C[0] // D[4]
575 rax1 $C[4],$C[4],$C[1] // D[0]
577 ////////////////////////////////////////////////// Theta+Rho+Pi
578 xar $C[0], $A[0][1],$D[1],#64-$rhotates[0][1] // C[0]=A[2][0]
580 xar $A[0][1],$A[1][1],$D[1],#64-$rhotates[1][1]
581 xar $A[1][1],$A[1][4],$D[4],#64-$rhotates[1][4]
582 xar $A[1][4],$A[4][2],$D[2],#64-$rhotates[4][2]
583 xar $A[4][2],$A[2][4],$D[4],#64-$rhotates[2][4]
584 xar $A[2][4],$A[4][0],$D[0],#64-$rhotates[4][0]
586 xar $C[1], $A[0][2],$D[2],#64-$rhotates[0][2] // C[1]=A[4][0]
588 xar $A[0][2],$A[2][2],$D[2],#64-$rhotates[2][2]
589 xar $A[2][2],$A[2][3],$D[3],#64-$rhotates[2][3]
590 xar $A[2][3],$A[3][4],$D[4],#64-$rhotates[3][4]
591 xar $A[3][4],$A[4][3],$D[3],#64-$rhotates[4][3]
592 xar $A[4][3],$A[3][0],$D[0],#64-$rhotates[3][0]
594 xar $A[3][0],$A[0][4],$D[4],#64-$rhotates[0][4]
596 xar $D[4], $A[4][4],$D[4],#64-$rhotates[4][4] // D[4]=A[0][4]
597 xar $A[4][4],$A[4][1],$D[1],#64-$rhotates[4][1]
598 xar $A[1][3],$A[1][3],$D[3],#64-$rhotates[1][3] // A[1][3]=A[4][1]
599 xar $A[0][4],$A[3][1],$D[1],#64-$rhotates[3][1] // A[0][4]=A[1][3]
600 xar $A[3][1],$A[1][0],$D[0],#64-$rhotates[1][0]
602 xar $A[1][0],$A[0][3],$D[3],#64-$rhotates[0][3]
604 eor $A[0][0],$A[0][0],$D[0]
606 xar $D[3], $A[3][3],$D[3],#64-$rhotates[3][3] // D[3]=A[0][3]
607 xar $A[0][3],$A[3][2],$D[2],#64-$rhotates[3][2] // A[0][3]=A[3][3]
608 xar $D[1], $A[2][1],$D[1],#64-$rhotates[2][1] // D[1]=A[3][2]
609 xar $D[2], $A[1][2],$D[2],#64-$rhotates[1][2] // D[2]=A[2][1]
610 xar $D[0], $A[2][0],$D[0],#64-$rhotates[2][0] // D[0]=A[1][2]
612 ////////////////////////////////////////////////// Chi+Iota
613 bcax $A[4][0],$C[1], $A[4][2],$A[1][3] // A[1][3]=A[4][1]
614 bcax $A[4][1],$A[1][3],$A[4][3],$A[4][2] // A[1][3]=A[4][1]
615 bcax $A[4][2],$A[4][2],$A[4][4],$A[4][3]
616 bcax $A[4][3],$A[4][3],$C[1], $A[4][4]
617 bcax $A[4][4],$A[4][4],$A[1][3],$C[1] // A[1][3]=A[4][1]
619 ld1r {$C[1]},[x10],#8
621 bcax $A[3][2],$D[1], $A[3][4],$A[0][3] // A[0][3]=A[3][3]
622 bcax $A[3][3],$A[0][3],$A[3][0],$A[3][4] // A[0][3]=A[3][3]
623 bcax $A[3][4],$A[3][4],$A[3][1],$A[3][0]
624 bcax $A[3][0],$A[3][0],$D[1], $A[3][1]
625 bcax $A[3][1],$A[3][1],$A[0][3],$D[1] // A[0][3]=A[3][3]
627 bcax $A[2][0],$C[0], $A[2][2],$D[2]
628 bcax $A[2][1],$D[2], $A[2][3],$A[2][2]
629 bcax $A[2][2],$A[2][2],$A[2][4],$A[2][3]
630 bcax $A[2][3],$A[2][3],$C[0], $A[2][4]
631 bcax $A[2][4],$A[2][4],$D[2], $C[0]
633 bcax $A[1][2],$D[0], $A[1][4],$A[0][4] // A[0][4]=A[1][3]
634 bcax $A[1][3],$A[0][4],$A[1][0],$A[1][4] // A[0][4]=A[1][3]
635 bcax $A[1][4],$A[1][4],$A[1][1],$A[1][0]
636 bcax $A[1][0],$A[1][0],$D[0], $A[1][1]
637 bcax $A[1][1],$A[1][1],$A[0][4],$D[0] // A[0][4]=A[1][3]
639 bcax $A[0][3],$D[3], $A[0][0],$D[4]
640 bcax $A[0][4],$D[4], $A[0][1],$A[0][0]
641 bcax $A[0][0],$A[0][0],$A[0][2],$A[0][1]
642 bcax $A[0][1],$A[0][1],$D[3], $A[0][2]
643 bcax $A[0][2],$A[0][2],$D[4], $D[3]
645 eor $A[0][0],$A[0][0],$C[1]
651 .size KeccakF1600_ce,.-KeccakF1600_ce
653 .type KeccakF1600_cext,%function
656 .inst 0xd503233f // paciasp
657 stp x29,x30,[sp,#-80]!
659 stp d8,d9,[sp,#16] // per ABI requirement
664 for($i=0; $i<24; $i+=2) { # load A[5][5]
667 ldp d$i,d$j,[x0,#8*$i]
675 for($i=0; $i<24; $i+=2) { # store A[5][5]
678 stp d$i,d$j,[x0,#8*$i]
689 .inst 0xd50323bf // autiasp
691 .size KeccakF1600_cext,.-KeccakF1600_cext
695 my ($ctx,$inp,$len,$bsz) = map("x$_",(0..3));
698 .globl SHA3_absorb_cext
699 .type SHA3_absorb_cext,%function
702 .inst 0xd503233f // paciasp
703 stp x29,x30,[sp,#-80]!
705 stp d8,d9,[sp,#16] // per ABI requirement
710 for($i=0; $i<24; $i+=2) { # load A[5][5]
713 ldp d$i,d$j,[x0,#8*$i]
722 subs $len,$len,$bsz // len - bsz
725 for (my $i=0; $i<24; $i+=2) {
728 ldr d31,[$inp],#8 // *inp++
730 rev64 v31.16b,v31.16b
732 eor $A[$i/5][$i%5],$A[$i/5][$i%5],v31.16b
734 blo .Lprocess_block_ce
735 ldr d31,[$inp],#8 // *inp++
737 rev64 v31.16b,v31.16b
739 eor $A[$j/5][$j%5],$A[$j/5][$j%5],v31.16b
740 beq .Lprocess_block_ce
744 ldr d31,[$inp],#8 // *inp++
746 rev64 v31.16b,v31.16b
748 eor $A[4][4],$A[4][4],v31.16b
759 for($i=0; $i<24; $i+=2) { # store A[5][5]
762 stp d$i,d$j,[x0,#8*$i]
767 add x0,$len,$bsz // return value
774 .inst 0xd50323bf // autiasp
776 .size SHA3_absorb_cext,.-SHA3_absorb_cext
780 my ($ctx,$out,$len,$bsz) = map("x$_",(0..3));
782 .globl SHA3_squeeze_cext
783 .type SHA3_squeeze_cext,%function
786 .inst 0xd503233f // paciasp
787 stp x29,x30,[sp,#-16]!
795 blo .Lsqueeze_tail_ce
800 beq .Lsqueeze_done_ce
817 beq .Lsqueeze_done_ce
821 beq .Lsqueeze_done_ce
825 beq .Lsqueeze_done_ce
829 beq .Lsqueeze_done_ce
833 beq .Lsqueeze_done_ce
837 beq .Lsqueeze_done_ce
842 .inst 0xd50323bf // autiasp
844 .size SHA3_squeeze_cext,.-SHA3_squeeze_cext
848 .asciz "Keccak-1600 absorb and squeeze for ARMv8, CRYPTOGAMS by <appro\@openssl.org>"
852 "rax1" => 0xce608c00, "eor3" => 0xce000000,
853 "bcax" => 0xce200000, "xar" => 0xce800000 );
856 my ($mnemonic,$arg)=@_;
858 $arg =~ m/[qv]([0-9]+)[^,]*,\s*[qv]([0-9]+)[^,]*(?:,\s*[qv]([0-9]+)[^,]*(?:,\s*[qv#]([0-9\-]+))?)?/
860 sprintf ".inst\t0x%08x\t//%s %s",
861 $opcode{$mnemonic}|$1|($2<<5)|($3<<16)|(eval($4)<<10),
866 foreach(split("\n",$code)) {
868 s/\`([^\`]*)\`/eval($1)/ge;
870 m/\bld1r\b/ and s/\.16b/.2d/g or
871 s/\b(eor3|rax1|xar|bcax)\s+(v.*)/unsha3($1,$2)/ge;
876 close STDOUT or die "error closing STDOUT";