3 # ====================================================================
4 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
5 # project. The module is, however, dual licensed under OpenSSL and
6 # CRYPTOGAMS licenses depending on where you obtain it. For further
7 # details see http://www.openssl.org/~appro/cryptogams/.
8 # ====================================================================
10 # sha1_block procedure for ARMv4.
14 # Size/performance trade-off
15 # ====================================================================
16 # impl size in bytes comp cycles[*] measured performance
17 # ====================================================================
19 # armv4-small 392/+29% 1958/+64% 2250/+96%
20 # armv4-compact 740/+89% 1552/+26% 1840/+22%
21 # armv4-large 1420/+92% 1307/+19% 1370/+34%[***]
22 # full unroll ~5100/+260% ~1260/+4% ~1300/+5%
23 # ====================================================================
24 # thumb = same as 'small' but in Thumb instructions[**] and
25 # with recurring code in two private functions;
26 # small = detached Xload/update, loops are folded;
27 # compact = detached Xload/update, 5x unroll;
28 # large = interleaved Xload/update, 5x unroll;
29 # full unroll = interleaved Xload/update, full unroll, estimated[!];
31 # [*] Manually counted instructions in "grand" loop body. Measured
32 # performance is affected by prologue and epilogue overhead,
33 # i-cache availability, branch penalties, etc.
34 # [**] While each Thumb instruction is twice smaller, they are not as
35 # diverse as ARM ones: e.g., there are only two arithmetic
36 # instructions with 3 arguments, no [fixed] rotate, addressing
37 # modes are limited. As result it takes more instructions to do
38 # the same job in Thumb, therefore the code is never twice as
39 # small and always slower.
40 # [***] which is also ~35% better than compiler generated code. Dual-
41 # issue Cortex A8 core was measured to process input block in
46 # Rescheduling for dual-issue pipeline resulted in 13% improvement on
47 # Cortex A8 core and in absolute terms ~870 cycles per input block
48 # [or 13.6 cycles per byte].
52 # Profiler-assisted and platform-specific optimization resulted in 10%
53 # improvement on Cortex A8 core and 12.2 cycles per byte.
57 # Add NEON implementation (see sha1-586.pl for background info). On
58 # Cortex A8 it was measured to process one byte in 6.7 cycles or >80%
59 # faster than integer-only code. Because [fully unrolled] NEON code
60 # is ~2.5x larger and there are some redundant instructions executed
61 # when processing last block, improvement is not as big for smallest
62 # blocks, only ~30%. Snapdragon S4 is a tad faster, 6.4 cycles per
63 # byte, which is also >80% faster than integer-only code. Cortex-A15
64 # is even faster spending 5.6 cycles per byte outperforming integer-
65 # only code by factor of 2.
69 # Add ARMv8 code path performing at 2.35 cpb on Apple A7.
72 if ($flavour=~/\w[\w\-]*\.\w+$/) { $output=$flavour; undef $flavour; }
73 else { while (($output=shift) && ($output!~/\w[\w\-]*\.\w+$/)) {} }
75 if ($flavour && $flavour ne "void") {
76 $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
77 ( $xlate="${dir}arm-xlate.pl" and -f $xlate ) or
78 ( $xlate="${dir}../../perlasm/arm-xlate.pl" and -f $xlate) or
79 die "can't locate arm-xlate.pl";
81 open STDOUT,"| \"$^X\" $xlate $flavour $output";
83 open STDOUT,">$output";
103 my ($a,$b,$c,$d,$e,$opt1,$opt2)=@_;
108 add $e,$K,$e,ror#2 @ E+=K_xx_xx
111 eor $t2,$t2,$t3 @ 1 cycle stall
112 eor $t1,$c,$d @ F_xx_xx
114 add $e,$e,$a,ror#27 @ E+=ROR(A,27)
115 eor $t0,$t0,$t2,ror#31
119 add $e,$e,$t0 @ E+=X[i]
124 my ($a,$b,$c,$d,$e)=@_;
130 add $e,$K,$e,ror#2 @ E+=K_00_19
132 orr $t0,$t0,$t1,lsl#8
133 eor $t1,$c,$d @ F_xx_xx
134 orr $t0,$t0,$t2,lsl#16
135 add $e,$e,$a,ror#27 @ E+=ROR(A,27)
136 orr $t0,$t0,$t3,lsl#24
138 ldr $t0,[$inp],#4 @ handles unaligned
139 add $e,$K,$e,ror#2 @ E+=K_00_19
140 eor $t1,$c,$d @ F_xx_xx
141 add $e,$e,$a,ror#27 @ E+=ROR(A,27)
143 rev $t0,$t0 @ byte swap
147 add $e,$e,$t0 @ E+=X[i]
148 eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D)
150 add $e,$e,$t1 @ E+=F_00_19(B,C,D)
155 my ($a,$b,$c,$d,$e)=@_;
156 &Xupdate(@_,"and $t1,$b,$t1,ror#2");
158 eor $t1,$t1,$d,ror#2 @ F_00_19(B,C,D)
159 add $e,$e,$t1 @ E+=F_00_19(B,C,D)
164 my ($a,$b,$c,$d,$e)=@_;
165 &Xupdate(@_,"eor $t1,$b,$t1,ror#2");
167 add $e,$e,$t1 @ E+=F_20_39(B,C,D)
172 my ($a,$b,$c,$d,$e)=@_;
173 &Xupdate(@_,"and $t1,$b,$t1,ror#2","and $t2,$c,$d");
175 add $e,$e,$t1 @ E+=F_40_59(B,C,D)
181 #include "arm_arch.h"
184 #if defined(__thumb2__)
191 .global sha1_block_data_order
192 .type sha1_block_data_order,%function
195 sha1_block_data_order:
196 #if __ARM_MAX_ARCH__>=7
199 ldr r12,.LOPENSSL_armcap
200 ldr r12,[r3,r12] @ OPENSSL_armcap_P
209 stmdb sp!,{r4-r12,lr}
210 add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp
211 ldmia $ctx,{$a,$b,$c,$d,$e}
218 mov $e,$e,ror#30 @ [6]
221 for($i=0;$i<5;$i++) {
222 &BODY_00_15(@V); unshift(@V,pop(@V));
225 #if defined(__thumb2__)
231 bne .L_00_15 @ [((11+4)*5+2)*3]
234 &BODY_00_15(@V); unshift(@V,pop(@V));
235 &BODY_16_19(@V); unshift(@V,pop(@V));
236 &BODY_16_19(@V); unshift(@V,pop(@V));
237 &BODY_16_19(@V); unshift(@V,pop(@V));
238 &BODY_16_19(@V); unshift(@V,pop(@V));
241 ldr $K,.LK_20_39 @ [+15+16*4]
242 cmn sp,#0 @ [+3], clear carry to denote 20_39
245 for($i=0;$i<5;$i++) {
246 &BODY_20_39(@V); unshift(@V,pop(@V));
249 #if defined(__thumb2__)
253 teq $Xi,sp @ preserve carry
255 bne .L_20_39_or_60_79 @ [+((12+3)*5+2)*4]
256 bcs .L_done @ [+((12+3)*5+2)*4], spare 300 bytes
259 sub sp,sp,#20*4 @ [+2]
262 for($i=0;$i<5;$i++) {
263 &BODY_40_59(@V); unshift(@V,pop(@V));
266 #if defined(__thumb2__)
272 bne .L_40_59 @ [+((12+5)*5+2)*4]
276 cmp sp,#0 @ set carry to denote 60_79
277 b .L_20_39_or_60_79 @ [+4], spare 300 bytes
279 add sp,sp,#80*4 @ "deallocate" stack frame
280 ldmia $ctx,{$K,$t0,$t1,$t2,$t3}
286 stmia $ctx,{$a,$b,$c,$d,$e}
288 bne .Lloop @ [+18], total 1307
291 ldmia sp!,{r4-r12,pc}
293 ldmia sp!,{r4-r12,lr}
295 moveq pc,lr @ be binary compatible with V4, yet
296 bx lr @ interoperable with Thumb ISA:-)
298 .size sha1_block_data_order,.-sha1_block_data_order
301 .LK_00_19: .word 0x5a827999
302 .LK_20_39: .word 0x6ed9eba1
303 .LK_40_59: .word 0x8f1bbcdc
304 .LK_60_79: .word 0xca62c1d6
305 #if __ARM_MAX_ARCH__>=7
307 .word OPENSSL_armcap_P-.Lsha1_block
309 .asciz "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by <appro\@openssl.org>"
312 #####################################################################
316 my @V=($a,$b,$c,$d,$e);
317 my ($K_XX_XX,$Ki,$t0,$t1,$Xfer,$saved_sp)=map("r$_",(8..12,14));
319 my @X=map("q$_",(8..11,0..3));
320 my @Tx=("q12","q13");
321 my ($K,$zero)=("q14","q15");
324 sub AUTOLOAD() # thunk [simplified] x86-style perlasm
325 { my $opcode = $AUTOLOAD; $opcode =~ s/.*:://; $opcode =~ s/_/\./;
327 $arg = "#$arg" if ($arg*1 eq $arg);
328 $code .= "\t$opcode\t".join(',',@_,$arg)."\n";
333 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'.
335 '&add ($e,$e,$Ki)', # e+=X[i]+K
337 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
338 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27)
339 '&eor ($t1,$t1,$t0)', # F_00_19
340 '&mov ($b,$b,"ror#2")', # b=ROR(b,2)
341 '&add ($e,$e,$t1);'. # e+=F_00_19
342 '$j++; unshift(@V,pop(@V));'
347 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'.
349 '&add ($e,$e,$Ki)', # e+=X[i]+K
350 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15)) if ($j<79)',
351 '&eor ($t1,$t0,$c)', # F_20_39
352 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27)
353 '&mov ($b,$b,"ror#2")', # b=ROR(b,2)
354 '&add ($e,$e,$t1);'. # e+=F_20_39
355 '$j++; unshift(@V,pop(@V));'
360 '($a,$b,$c,$d,$e)=@V;'. # '$code.="@ $j\n";'.
361 '&add ($e,$e,$Ki)', # e+=X[i]+K
363 '&ldr ($Ki,sprintf "[sp,#%d]",4*(($j+1)&15))',
364 '&add ($e,$e,$a,"ror#27")', # e+=ROR(A,27)
368 '&mov ($b,$b,"ror#2")', # b=ROR(b,2)
369 '&add ($e,$e,$t1);'. # e+=F_40_59
370 '$j++; unshift(@V,pop(@V));'
377 my @insns = (&$body,&$body,&$body,&$body);
380 &vext_8 (@X[0],@X[-4&7],@X[-3&7],8); # compose "X[-14]" in "X[0]"
384 &vadd_i32 (@Tx[1],@X[-1&7],$K);
386 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0);
388 &vext_8 (@Tx[0],@X[-1&7],$zero,4); # "X[-3]", 3 words
392 &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"^="X[-16]"
395 &veor (@Tx[0],@Tx[0],@X[-2&7]); # "X[-3]"^"X[-8]"
398 &veor (@Tx[0],@Tx[0],@X[0]); # "X[0]"^="X[-3]"^"X[-8]
401 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer
402 &sub ($Xfer,$Xfer,64) if ($Xi%4==0);
405 &vext_8 (@Tx[1],$zero,@Tx[0],4); # "X[0]"<<96, extract one dword
408 &vadd_i32 (@X[0],@Tx[0],@Tx[0]);
411 &vsri_32 (@X[0],@Tx[0],31); # "X[0]"<<<=1
415 &vshr_u32 (@Tx[0],@Tx[1],30);
418 &vshl_u32 (@Tx[1],@Tx[1],2);
421 &veor (@X[0],@X[0],@Tx[0]);
424 &veor (@X[0],@X[0],@Tx[1]); # "X[0]"^=("X[0]">>96)<<<2
426 foreach (@insns) { eval; } # remaining instructions [if any]
428 $Xi++; push(@X,shift(@X)); # "rotate" X[]
434 my @insns = (&$body,&$body,&$body,&$body);
437 &vext_8 (@Tx[0],@X[-2&7],@X[-1&7],8); # compose "X[-6]"
441 &veor (@X[0],@X[0],@X[-4&7]); # "X[0]"="X[-32]"^"X[-16]"
444 &veor (@X[0],@X[0],@X[-7&7]); # "X[0]"^="X[-28]"
447 &vadd_i32 (@Tx[1],@X[-1&7],$K);
449 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!") if ($Xi%5==0);
451 &veor (@Tx[0],@Tx[0],@X[0]); # "X[-6]"^="X[0]"
454 &vshr_u32 (@X[0],@Tx[0],30);
457 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!"); # X[]+K xfer
458 &sub ($Xfer,$Xfer,64) if ($Xi%4==0);
461 &vsli_32 (@X[0],@Tx[0],2); # "X[0]"="X[-6]"<<<2
463 foreach (@insns) { eval; } # remaining instructions [if any]
465 $Xi++; push(@X,shift(@X)); # "rotate" X[]
471 my @insns = (&$body,&$body,&$body,&$body);
474 &vadd_i32 (@Tx[1],@X[-1&7],$K);
477 &vst1_32 ("{@Tx[1]}","[$Xfer,:128]!");
478 &sub ($Xfer,$Xfer,64);
481 &sub ($K_XX_XX,$K_XX_XX,16); # rewind $K_XX_XX
483 &subeq ($inp,$inp,64); # reload last block to avoid SEGV
484 &vld1_8 ("{@X[-4&7]-@X[-3&7]}","[$inp]!");
487 &vld1_8 ("{@X[-2&7]-@X[-1&7]}","[$inp]!");
490 &vld1_32 ("{$K\[]}","[$K_XX_XX,:32]!"); # load K_00_19
493 &vrev32_8 (@X[-4&7],@X[-4&7]);
495 foreach (@insns) { eval; } # remaining instructions
503 my @insns = (&$body,&$body,&$body,&$body);
506 &vrev32_8 (@X[($Xi-3)&7],@X[($Xi-3)&7]);
509 &vadd_i32 (@X[$Xi&7],@X[($Xi-4)&7],$K);
512 &vst1_32 ("{@X[$Xi&7]}","[$Xfer,:128]!");# X[]+K xfer to IALU
514 foreach (@insns) { eval; }
520 #if __ARM_MAX_ARCH__>=7
524 .type sha1_block_data_order_neon,%function
526 sha1_block_data_order_neon:
528 stmdb sp!,{r4-r12,lr}
529 add $len,$inp,$len,lsl#6 @ $len to point at the end of $inp
530 @ dmb @ errata #451034 on early Cortex A8
531 @ vstmdb sp!,{d8-d15} @ ABI specification says so
534 adr $K_XX_XX,.LK_00_19
535 bic $Xfer,$Xfer,#15 @ align for 128-bit stores
537 ldmia $ctx,{$a,$b,$c,$d,$e} @ load context
538 mov sp,$Xfer @ alloca
540 vld1.8 {@X[-4&7]-@X[-3&7]},[$inp]! @ handles unaligned
541 veor $zero,$zero,$zero
542 vld1.8 {@X[-2&7]-@X[-1&7]},[$inp]!
543 vld1.32 {${K}\[]},[$K_XX_XX,:32]! @ load K_00_19
544 vrev32.8 @X[-4&7],@X[-4&7] @ yes, even on
545 vrev32.8 @X[-3&7],@X[-3&7] @ big-endian...
546 vrev32.8 @X[-2&7],@X[-2&7]
547 vadd.i32 @X[0],@X[-4&7],$K
548 vrev32.8 @X[-1&7],@X[-1&7]
549 vadd.i32 @X[1],@X[-3&7],$K
550 vst1.32 {@X[0]},[$Xfer,:128]!
551 vadd.i32 @X[2],@X[-2&7],$K
552 vst1.32 {@X[1]},[$Xfer,:128]!
553 vst1.32 {@X[2]},[$Xfer,:128]!
554 ldr $Ki,[sp] @ big RAW stall
558 &Xupdate_16_31(\&body_00_19);
559 &Xupdate_16_31(\&body_00_19);
560 &Xupdate_16_31(\&body_00_19);
561 &Xupdate_16_31(\&body_00_19);
562 &Xupdate_32_79(\&body_00_19);
563 &Xupdate_32_79(\&body_20_39);
564 &Xupdate_32_79(\&body_20_39);
565 &Xupdate_32_79(\&body_20_39);
566 &Xupdate_32_79(\&body_20_39);
567 &Xupdate_32_79(\&body_20_39);
568 &Xupdate_32_79(\&body_40_59);
569 &Xupdate_32_79(\&body_40_59);
570 &Xupdate_32_79(\&body_40_59);
571 &Xupdate_32_79(\&body_40_59);
572 &Xupdate_32_79(\&body_40_59);
573 &Xupdate_32_79(\&body_20_39);
574 &Xuplast_80(\&body_20_39);
575 &Xloop(\&body_20_39);
576 &Xloop(\&body_20_39);
577 &Xloop(\&body_20_39);
579 ldmia $ctx,{$Ki,$t0,$t1,$Xfer} @ accumulate context
590 stmia $ctx,{$a,$b,$c,$d,$e}
595 @ vldmia sp!,{d8-d15}
596 ldmia sp!,{r4-r12,pc}
597 .size sha1_block_data_order_neon,.-sha1_block_data_order_neon
601 #####################################################################
605 my ($ABCD,$E,$E0,$E1)=map("q$_",(0..3));
606 my @MSG=map("q$_",(4..7));
607 my @Kxx=map("q$_",(8..11));
608 my ($W0,$W1,$ABCD_SAVE)=map("q$_",(12..14));
611 #if __ARM_MAX_ARCH__>=7
613 # if defined(__thumb2__)
614 # define INST(a,b,c,d) .byte c,d|0xf,a,b
616 # define INST(a,b,c,d) .byte a,b,c,d|0x10
619 .type sha1_block_data_order_armv8,%function
621 sha1_block_data_order_armv8:
623 vstmdb sp!,{d8-d15} @ ABI specification says so
627 vld1.32 {$ABCD},[$ctx]!
628 vld1.32 {$E\[0]},[$ctx]
630 vld1.32 {@Kxx[0]\[]},[r3,:32]!
631 vld1.32 {@Kxx[1]\[]},[r3,:32]!
632 vld1.32 {@Kxx[2]\[]},[r3,:32]!
633 vld1.32 {@Kxx[3]\[]},[r3,:32]
636 vld1.8 {@MSG[0]-@MSG[1]},[$inp]!
637 vld1.8 {@MSG[2]-@MSG[3]},[$inp]!
638 vrev32.8 @MSG[0],@MSG[0]
639 vrev32.8 @MSG[1],@MSG[1]
641 vadd.i32 $W0,@Kxx[0],@MSG[0]
642 vrev32.8 @MSG[2],@MSG[2]
643 vmov $ABCD_SAVE,$ABCD @ offload
646 vadd.i32 $W1,@Kxx[0],@MSG[1]
647 vrev32.8 @MSG[3],@MSG[3]
650 vadd.i32 $W0,@Kxx[$j],@MSG[2]
651 sha1su0 @MSG[0],@MSG[1],@MSG[2]
653 for ($j=0,$i=1;$i<20-3;$i++) {
654 my $f=("c","p","m","p")[$i/5];
658 vadd.i32 $W1,@Kxx[$j],@MSG[3]
659 sha1su1 @MSG[0],@MSG[3]
661 $code.=<<___ if ($i<20-4);
662 sha1su0 @MSG[1],@MSG[2],@MSG[3]
664 ($E0,$E1)=($E1,$E0); ($W0,$W1)=($W1,$W0);
665 push(@MSG,shift(@MSG)); $j++ if ((($i+3)%5)==0);
670 vadd.i32 $W1,@Kxx[$j],@MSG[3]
679 vadd.i32 $ABCD,$ABCD,$ABCD_SAVE
682 vst1.32 {$ABCD},[$ctx]!
683 vst1.32 {$E\[0]},[$ctx]
687 .size sha1_block_data_order_armv8,.-sha1_block_data_order_armv8
692 #if __ARM_MAX_ARCH__>=7
693 .comm OPENSSL_armcap_P,4,4
698 "sha1c" => 0xf2000c40, "sha1p" => 0xf2100c40,
699 "sha1m" => 0xf2200c40, "sha1su0" => 0xf2300c40,
700 "sha1h" => 0xf3b902c0, "sha1su1" => 0xf3ba0380 );
703 my ($mnemonic,$arg)=@_;
705 if ($arg =~ m/q([0-9]+)(?:,\s*q([0-9]+))?,\s*q([0-9]+)/o) {
706 my $word = $opcode{$mnemonic}|(($1&7)<<13)|(($1&8)<<19)
707 |(($2&7)<<17)|(($2&8)<<4)
708 |(($3&7)<<1) |(($3&8)<<2);
709 # since ARMv7 instructions are always encoded little-endian.
710 # correct solution is to use .inst directive, but older
711 # assemblers don't implement it:-(
713 # this fix-up provides Thumb encoding in conjunction with INST
714 $word &= ~0x10000000 if (($word & 0x0f000000) == 0x02000000);
715 sprintf "INST(0x%02x,0x%02x,0x%02x,0x%02x)\t@ %s %s",
716 $word&0xff,($word>>8)&0xff,
717 ($word>>16)&0xff,($word>>24)&0xff,
723 foreach (split($/,$code)) {
724 s/{q([0-9]+)\[\]}/sprintf "{d%d[],d%d[]}",2*$1,2*$1+1/eo or
725 s/{q([0-9]+)\[0\]}/sprintf "{d%d[0]}",2*$1/eo;
727 s/\b(sha1\w+)\s+(q.*)/unsha1($1,$2)/geo;
730 s/\bbx\s+lr\b/.word\t0xe12fff1e/o; # make it possible to compile with -march=armv4
735 close STDOUT; # enforce flush