sha256-586.pl 36 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295
  1. #! /usr/bin/env perl
  2. # Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
  3. #
  4. # Licensed under the Apache License 2.0 (the "License"). You may not use
  5. # this file except in compliance with the License. You can obtain a copy
  6. # in the file LICENSE in the source distribution or at
  7. # https://www.openssl.org/source/license.html
  8. #
  9. # ====================================================================
  10. # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
  11. # project. The module is, however, dual licensed under OpenSSL and
  12. # CRYPTOGAMS licenses depending on where you obtain it. For further
  13. # details see http://www.openssl.org/~appro/cryptogams/.
  14. # ====================================================================
  15. #
  16. # SHA256 block transform for x86. September 2007.
  17. #
  18. # Performance improvement over compiler generated code varies from
  19. # 10% to 40% [see below]. Not very impressive on some µ-archs, but
  20. # it's 5 times smaller and optimizes amount of writes.
  21. #
  22. # May 2012.
  23. #
  24. # Optimization including two of Pavel Semjanov's ideas, alternative
  25. # Maj and full unroll, resulted in ~20-25% improvement on most CPUs,
  26. # ~7% on Pentium, ~40% on Atom. As fully unrolled loop body is almost
  27. # 15x larger, 8KB vs. 560B, it's fired only for longer inputs. But not
  28. # on P4, where it kills performance, nor Sandy Bridge, where folded
  29. # loop is approximately as fast...
  30. #
  31. # June 2012.
  32. #
  33. # Add AMD XOP-specific code path, >30% improvement on Bulldozer over
  34. # May version, >60% over original. Add AVX+shrd code path, >25%
  35. # improvement on Sandy Bridge over May version, 60% over original.
  36. #
  37. # May 2013.
  38. #
  39. # Replace AMD XOP code path with SSSE3 to cover more processors.
  40. # (Biggest improvement coefficient is on upcoming Atom Silvermont,
  41. # not shown.) Add AVX+BMI code path.
  42. #
  43. # March 2014.
  44. #
  45. # Add support for Intel SHA Extensions.
  46. #
  47. # Performance in clock cycles per processed byte (less is better):
  48. #
  49. # gcc icc x86 asm(*) SIMD x86_64 asm(**)
  50. # Pentium 46 57 40/38 - -
  51. # PIII 36 33 27/24 - -
  52. # P4 41 38 28 - 17.3
  53. # AMD K8 27 25 19/15.5 - 14.9
  54. # Core2 26 23 18/15.6 14.3 13.8
  55. # Westmere 27 - 19/15.7 13.4 12.3
  56. # Sandy Bridge 25 - 15.9 12.4 11.6
  57. # Ivy Bridge 24 - 15.0 11.4 10.3
  58. # Haswell 22 - 13.9 9.46 7.80
  59. # Skylake 20 - 14.9 9.50 7.70
  60. # Bulldozer 36 - 27/22 17.0 13.6
  61. # VIA Nano 36 - 25/22 16.8 16.5
  62. # Atom 50 - 30/25 21.9 18.9
  63. # Silvermont 40 - 34/31 22.9 20.6
  64. # Goldmont 29 - 20 16.3(***)
  65. #
  66. # (*) numbers after slash are for unrolled loop, where applicable;
  67. # (**) x86_64 assembly performance is presented for reference
  68. # purposes, results are best-available;
  69. # (***) SHAEXT result is 4.1, strangely enough better than 64-bit one;
  70. $0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1;
  71. push(@INC,"${dir}","${dir}../../perlasm");
  72. require "x86asm.pl";
  73. $output=pop and open STDOUT,">$output";
  74. &asm_init($ARGV[0],$ARGV[$#ARGV] eq "386");
  75. $xmm=$avx=0;
  76. for (@ARGV) { $xmm=1 if (/-DOPENSSL_IA32_SSE2/); }
  77. if ($xmm && `$ENV{CC} -Wa,-v -c -o /dev/null -x assembler /dev/null 2>&1`
  78. =~ /GNU assembler version ([2-9]\.[0-9]+)/) {
  79. $avx = ($1>=2.19) + ($1>=2.22);
  80. }
  81. if ($xmm && !$avx && $ARGV[0] eq "win32n" &&
  82. `nasm -v 2>&1` =~ /NASM version ([2-9]\.[0-9]+)/) {
  83. $avx = ($1>=2.03) + ($1>=2.10);
  84. }
  85. if ($xmm && !$avx && $ARGV[0] eq "win32" &&
  86. `ml 2>&1` =~ /Version ([0-9]+)\./) {
  87. $avx = ($1>=10) + ($1>=11);
  88. }
  89. if ($xmm && !$avx && `$ENV{CC} -v 2>&1` =~ /((?:clang|LLVM) version|based on LLVM) ([0-9]+\.[0-9]+)/) {
  90. $avx = ($2>=3.0) + ($2>3.0);
  91. }
  92. $shaext=$xmm; ### set to zero if compiling for 1.0.1
  93. $unroll_after = 64*4; # If pre-evicted from L1P cache first spin of
  94. # fully unrolled loop was measured to run about
  95. # 3-4x slower. If slowdown coefficient is N and
  96. # unrolled loop is m times faster, then you break
  97. # even at (N-1)/(m-1) blocks. Then it needs to be
  98. # adjusted for probability of code being evicted,
  99. # code size/cache size=1/4. Typical m is 1.15...
  100. $A="eax";
  101. $E="edx";
  102. $T="ebx";
  103. $Aoff=&DWP(4,"esp");
  104. $Boff=&DWP(8,"esp");
  105. $Coff=&DWP(12,"esp");
  106. $Doff=&DWP(16,"esp");
  107. $Eoff=&DWP(20,"esp");
  108. $Foff=&DWP(24,"esp");
  109. $Goff=&DWP(28,"esp");
  110. $Hoff=&DWP(32,"esp");
  111. $Xoff=&DWP(36,"esp");
  112. $K256="ebp";
  113. sub BODY_16_63() {
  114. &mov ($T,"ecx"); # "ecx" is preloaded
  115. &mov ("esi",&DWP(4*(9+15+16-14),"esp"));
  116. &ror ("ecx",18-7);
  117. &mov ("edi","esi");
  118. &ror ("esi",19-17);
  119. &xor ("ecx",$T);
  120. &shr ($T,3);
  121. &ror ("ecx",7);
  122. &xor ("esi","edi");
  123. &xor ($T,"ecx"); # T = sigma0(X[-15])
  124. &ror ("esi",17);
  125. &add ($T,&DWP(4*(9+15+16),"esp")); # T += X[-16]
  126. &shr ("edi",10);
  127. &add ($T,&DWP(4*(9+15+16-9),"esp")); # T += X[-7]
  128. #&xor ("edi","esi") # sigma1(X[-2])
  129. # &add ($T,"edi"); # T += sigma1(X[-2])
  130. # &mov (&DWP(4*(9+15),"esp"),$T); # save X[0]
  131. &BODY_00_15(1);
  132. }
  133. sub BODY_00_15() {
  134. my $in_16_63=shift;
  135. &mov ("ecx",$E);
  136. &xor ("edi","esi") if ($in_16_63); # sigma1(X[-2])
  137. &mov ("esi",$Foff);
  138. &ror ("ecx",25-11);
  139. &add ($T,"edi") if ($in_16_63); # T += sigma1(X[-2])
  140. &mov ("edi",$Goff);
  141. &xor ("ecx",$E);
  142. &xor ("esi","edi");
  143. &mov ($T,&DWP(4*(9+15),"esp")) if (!$in_16_63);
  144. &mov (&DWP(4*(9+15),"esp"),$T) if ($in_16_63); # save X[0]
  145. &ror ("ecx",11-6);
  146. &and ("esi",$E);
  147. &mov ($Eoff,$E); # modulo-scheduled
  148. &xor ($E,"ecx");
  149. &add ($T,$Hoff); # T += h
  150. &xor ("esi","edi"); # Ch(e,f,g)
  151. &ror ($E,6); # Sigma1(e)
  152. &mov ("ecx",$A);
  153. &add ($T,"esi"); # T += Ch(e,f,g)
  154. &ror ("ecx",22-13);
  155. &add ($T,$E); # T += Sigma1(e)
  156. &mov ("edi",$Boff);
  157. &xor ("ecx",$A);
  158. &mov ($Aoff,$A); # modulo-scheduled
  159. &lea ("esp",&DWP(-4,"esp"));
  160. &ror ("ecx",13-2);
  161. &mov ("esi",&DWP(0,$K256));
  162. &xor ("ecx",$A);
  163. &mov ($E,$Eoff); # e in next iteration, d in this one
  164. &xor ($A,"edi"); # a ^= b
  165. &ror ("ecx",2); # Sigma0(a)
  166. &add ($T,"esi"); # T+= K[i]
  167. &mov (&DWP(0,"esp"),$A); # (b^c) in next round
  168. &add ($E,$T); # d += T
  169. &and ($A,&DWP(4,"esp")); # a &= (b^c)
  170. &add ($T,"ecx"); # T += Sigma0(a)
  171. &xor ($A,"edi"); # h = Maj(a,b,c) = Ch(a^b,c,b)
  172. &mov ("ecx",&DWP(4*(9+15+16-1),"esp")) if ($in_16_63); # preload T
  173. &add ($K256,4);
  174. &add ($A,$T); # h += T
  175. }
  176. &external_label("OPENSSL_ia32cap_P") if (!$i386);
  177. &function_begin("sha256_block_data_order");
  178. &mov ("esi",wparam(0)); # ctx
  179. &mov ("edi",wparam(1)); # inp
  180. &mov ("eax",wparam(2)); # num
  181. &mov ("ebx","esp"); # saved sp
  182. &call (&label("pic_point")); # make it PIC!
  183. &set_label("pic_point");
  184. &blindpop($K256);
  185. &lea ($K256,&DWP(&label("K256")."-".&label("pic_point"),$K256));
  186. &sub ("esp",16);
  187. &and ("esp",-64);
  188. &shl ("eax",6);
  189. &add ("eax","edi");
  190. &mov (&DWP(0,"esp"),"esi"); # ctx
  191. &mov (&DWP(4,"esp"),"edi"); # inp
  192. &mov (&DWP(8,"esp"),"eax"); # inp+num*128
  193. &mov (&DWP(12,"esp"),"ebx"); # saved sp
  194. if (!$i386 && $xmm) {
  195. &picmeup("edx","OPENSSL_ia32cap_P",$K256,&label("K256"));
  196. &mov ("ecx",&DWP(0,"edx"));
  197. &mov ("ebx",&DWP(4,"edx"));
  198. &test ("ecx",1<<20); # check for P4
  199. &jnz (&label("loop"));
  200. &mov ("edx",&DWP(8,"edx")) if ($xmm);
  201. &test ("ecx",1<<24); # check for FXSR
  202. &jz ($unroll_after?&label("no_xmm"):&label("loop"));
  203. &and ("ecx",1<<30); # mask "Intel CPU" bit
  204. &and ("ebx",1<<28|1<<9); # mask AVX and SSSE3 bits
  205. &test ("edx",1<<29) if ($shaext); # check for SHA
  206. &jnz (&label("shaext")) if ($shaext);
  207. &or ("ecx","ebx");
  208. &and ("ecx",1<<28|1<<30);
  209. &cmp ("ecx",1<<28|1<<30);
  210. if ($xmm) {
  211. &je (&label("AVX")) if ($avx);
  212. &test ("ebx",1<<9); # check for SSSE3
  213. &jnz (&label("SSSE3"));
  214. } else {
  215. &je (&label("loop_shrd"));
  216. }
  217. if ($unroll_after) {
  218. &set_label("no_xmm");
  219. &sub ("eax","edi");
  220. &cmp ("eax",$unroll_after);
  221. &jae (&label("unrolled"));
  222. } }
  223. &jmp (&label("loop"));
  224. sub COMPACT_LOOP() {
  225. my $suffix=shift;
  226. &set_label("loop$suffix",$suffix?32:16);
  227. # copy input block to stack reversing byte and dword order
  228. for($i=0;$i<4;$i++) {
  229. &mov ("eax",&DWP($i*16+0,"edi"));
  230. &mov ("ebx",&DWP($i*16+4,"edi"));
  231. &mov ("ecx",&DWP($i*16+8,"edi"));
  232. &bswap ("eax");
  233. &mov ("edx",&DWP($i*16+12,"edi"));
  234. &bswap ("ebx");
  235. &push ("eax");
  236. &bswap ("ecx");
  237. &push ("ebx");
  238. &bswap ("edx");
  239. &push ("ecx");
  240. &push ("edx");
  241. }
  242. &add ("edi",64);
  243. &lea ("esp",&DWP(-4*9,"esp"));# place for A,B,C,D,E,F,G,H
  244. &mov (&DWP(4*(9+16)+4,"esp"),"edi");
  245. # copy ctx->h[0-7] to A,B,C,D,E,F,G,H on stack
  246. &mov ($A,&DWP(0,"esi"));
  247. &mov ("ebx",&DWP(4,"esi"));
  248. &mov ("ecx",&DWP(8,"esi"));
  249. &mov ("edi",&DWP(12,"esi"));
  250. # &mov ($Aoff,$A);
  251. &mov ($Boff,"ebx");
  252. &xor ("ebx","ecx");
  253. &mov ($Coff,"ecx");
  254. &mov ($Doff,"edi");
  255. &mov (&DWP(0,"esp"),"ebx"); # magic
  256. &mov ($E,&DWP(16,"esi"));
  257. &mov ("ebx",&DWP(20,"esi"));
  258. &mov ("ecx",&DWP(24,"esi"));
  259. &mov ("edi",&DWP(28,"esi"));
  260. # &mov ($Eoff,$E);
  261. &mov ($Foff,"ebx");
  262. &mov ($Goff,"ecx");
  263. &mov ($Hoff,"edi");
  264. &set_label("00_15$suffix",16);
  265. &BODY_00_15();
  266. &cmp ("esi",0xc19bf174);
  267. &jne (&label("00_15$suffix"));
  268. &mov ("ecx",&DWP(4*(9+15+16-1),"esp")); # preloaded in BODY_00_15(1)
  269. &jmp (&label("16_63$suffix"));
  270. &set_label("16_63$suffix",16);
  271. &BODY_16_63();
  272. &cmp ("esi",0xc67178f2);
  273. &jne (&label("16_63$suffix"));
  274. &mov ("esi",&DWP(4*(9+16+64)+0,"esp"));#ctx
  275. # &mov ($A,$Aoff);
  276. &mov ("ebx",$Boff);
  277. # &mov ("edi",$Coff);
  278. &mov ("ecx",$Doff);
  279. &add ($A,&DWP(0,"esi"));
  280. &add ("ebx",&DWP(4,"esi"));
  281. &add ("edi",&DWP(8,"esi"));
  282. &add ("ecx",&DWP(12,"esi"));
  283. &mov (&DWP(0,"esi"),$A);
  284. &mov (&DWP(4,"esi"),"ebx");
  285. &mov (&DWP(8,"esi"),"edi");
  286. &mov (&DWP(12,"esi"),"ecx");
  287. # &mov ($E,$Eoff);
  288. &mov ("eax",$Foff);
  289. &mov ("ebx",$Goff);
  290. &mov ("ecx",$Hoff);
  291. &mov ("edi",&DWP(4*(9+16+64)+4,"esp"));#inp
  292. &add ($E,&DWP(16,"esi"));
  293. &add ("eax",&DWP(20,"esi"));
  294. &add ("ebx",&DWP(24,"esi"));
  295. &add ("ecx",&DWP(28,"esi"));
  296. &mov (&DWP(16,"esi"),$E);
  297. &mov (&DWP(20,"esi"),"eax");
  298. &mov (&DWP(24,"esi"),"ebx");
  299. &mov (&DWP(28,"esi"),"ecx");
  300. &lea ("esp",&DWP(4*(9+16+64),"esp"));# destroy frame
  301. &sub ($K256,4*64); # rewind K
  302. &cmp ("edi",&DWP(8,"esp")); # are we done yet?
  303. &jb (&label("loop$suffix"));
  304. }
  305. &COMPACT_LOOP();
  306. &mov ("esp",&DWP(12,"esp")); # restore sp
  307. &function_end_A();
  308. if (!$i386 && !$xmm) {
  309. # ~20% improvement on Sandy Bridge
  310. local *ror = sub { &shrd(@_[0],@_) };
  311. &COMPACT_LOOP("_shrd");
  312. &mov ("esp",&DWP(12,"esp")); # restore sp
  313. &function_end_A();
  314. }
  315. &set_label("K256",64); # Yes! I keep it in the code segment!
  316. @K256=( 0x428a2f98,0x71374491,0xb5c0fbcf,0xe9b5dba5,
  317. 0x3956c25b,0x59f111f1,0x923f82a4,0xab1c5ed5,
  318. 0xd807aa98,0x12835b01,0x243185be,0x550c7dc3,
  319. 0x72be5d74,0x80deb1fe,0x9bdc06a7,0xc19bf174,
  320. 0xe49b69c1,0xefbe4786,0x0fc19dc6,0x240ca1cc,
  321. 0x2de92c6f,0x4a7484aa,0x5cb0a9dc,0x76f988da,
  322. 0x983e5152,0xa831c66d,0xb00327c8,0xbf597fc7,
  323. 0xc6e00bf3,0xd5a79147,0x06ca6351,0x14292967,
  324. 0x27b70a85,0x2e1b2138,0x4d2c6dfc,0x53380d13,
  325. 0x650a7354,0x766a0abb,0x81c2c92e,0x92722c85,
  326. 0xa2bfe8a1,0xa81a664b,0xc24b8b70,0xc76c51a3,
  327. 0xd192e819,0xd6990624,0xf40e3585,0x106aa070,
  328. 0x19a4c116,0x1e376c08,0x2748774c,0x34b0bcb5,
  329. 0x391c0cb3,0x4ed8aa4a,0x5b9cca4f,0x682e6ff3,
  330. 0x748f82ee,0x78a5636f,0x84c87814,0x8cc70208,
  331. 0x90befffa,0xa4506ceb,0xbef9a3f7,0xc67178f2 );
  332. &data_word(@K256);
  333. &data_word(0x00010203,0x04050607,0x08090a0b,0x0c0d0e0f); # byte swap mask
  334. &asciz("SHA256 block transform for x86, CRYPTOGAMS by <appro\@openssl.org>");
  335. ($a,$b,$c,$d,$e,$f,$g,$h)=(0..7); # offsets
  336. sub off { &DWP(4*(((shift)-$i)&7),"esp"); }
  337. if (!$i386 && $unroll_after) {
  338. my @AH=($A,$K256);
  339. &set_label("unrolled",16);
  340. &lea ("esp",&DWP(-96,"esp"));
  341. # copy ctx->h[0-7] to A,B,C,D,E,F,G,H on stack
  342. &mov ($AH[0],&DWP(0,"esi"));
  343. &mov ($AH[1],&DWP(4,"esi"));
  344. &mov ("ecx",&DWP(8,"esi"));
  345. &mov ("ebx",&DWP(12,"esi"));
  346. #&mov (&DWP(0,"esp"),$AH[0]);
  347. &mov (&DWP(4,"esp"),$AH[1]);
  348. &xor ($AH[1],"ecx"); # magic
  349. &mov (&DWP(8,"esp"),"ecx");
  350. &mov (&DWP(12,"esp"),"ebx");
  351. &mov ($E,&DWP(16,"esi"));
  352. &mov ("ebx",&DWP(20,"esi"));
  353. &mov ("ecx",&DWP(24,"esi"));
  354. &mov ("esi",&DWP(28,"esi"));
  355. #&mov (&DWP(16,"esp"),$E);
  356. &mov (&DWP(20,"esp"),"ebx");
  357. &mov (&DWP(24,"esp"),"ecx");
  358. &mov (&DWP(28,"esp"),"esi");
  359. &jmp (&label("grand_loop"));
  360. &set_label("grand_loop",16);
  361. # copy input block to stack reversing byte order
  362. for($i=0;$i<5;$i++) {
  363. &mov ("ebx",&DWP(12*$i+0,"edi"));
  364. &mov ("ecx",&DWP(12*$i+4,"edi"));
  365. &bswap ("ebx");
  366. &mov ("esi",&DWP(12*$i+8,"edi"));
  367. &bswap ("ecx");
  368. &mov (&DWP(32+12*$i+0,"esp"),"ebx");
  369. &bswap ("esi");
  370. &mov (&DWP(32+12*$i+4,"esp"),"ecx");
  371. &mov (&DWP(32+12*$i+8,"esp"),"esi");
  372. }
  373. &mov ("ebx",&DWP($i*12,"edi"));
  374. &add ("edi",64);
  375. &bswap ("ebx");
  376. &mov (&DWP(96+4,"esp"),"edi");
  377. &mov (&DWP(32+12*$i,"esp"),"ebx");
  378. my ($t1,$t2) = ("ecx","esi");
  379. for ($i=0;$i<64;$i++) {
  380. if ($i>=16) {
  381. &mov ($T,$t1); # $t1 is preloaded
  382. # &mov ($t2,&DWP(32+4*(($i+14)&15),"esp"));
  383. &ror ($t1,18-7);
  384. &mov ("edi",$t2);
  385. &ror ($t2,19-17);
  386. &xor ($t1,$T);
  387. &shr ($T,3);
  388. &ror ($t1,7);
  389. &xor ($t2,"edi");
  390. &xor ($T,$t1); # T = sigma0(X[-15])
  391. &ror ($t2,17);
  392. &add ($T,&DWP(32+4*($i&15),"esp")); # T += X[-16]
  393. &shr ("edi",10);
  394. &add ($T,&DWP(32+4*(($i+9)&15),"esp")); # T += X[-7]
  395. #&xor ("edi",$t2) # sigma1(X[-2])
  396. # &add ($T,"edi"); # T += sigma1(X[-2])
  397. # &mov (&DWP(4*(9+15),"esp"),$T); # save X[0]
  398. }
  399. &mov ($t1,$E);
  400. &xor ("edi",$t2) if ($i>=16); # sigma1(X[-2])
  401. &mov ($t2,&off($f));
  402. &ror ($E,25-11);
  403. &add ($T,"edi") if ($i>=16); # T += sigma1(X[-2])
  404. &mov ("edi",&off($g));
  405. &xor ($E,$t1);
  406. &mov ($T,&DWP(32+4*($i&15),"esp")) if ($i<16); # X[i]
  407. &mov (&DWP(32+4*($i&15),"esp"),$T) if ($i>=16 && $i<62); # save X[0]
  408. &xor ($t2,"edi");
  409. &ror ($E,11-6);
  410. &and ($t2,$t1);
  411. &mov (&off($e),$t1); # save $E, modulo-scheduled
  412. &xor ($E,$t1);
  413. &add ($T,&off($h)); # T += h
  414. &xor ("edi",$t2); # Ch(e,f,g)
  415. &ror ($E,6); # Sigma1(e)
  416. &mov ($t1,$AH[0]);
  417. &add ($T,"edi"); # T += Ch(e,f,g)
  418. &ror ($t1,22-13);
  419. &mov ($t2,$AH[0]);
  420. &mov ("edi",&off($b));
  421. &xor ($t1,$AH[0]);
  422. &mov (&off($a),$AH[0]); # save $A, modulo-scheduled
  423. &xor ($AH[0],"edi"); # a ^= b, (b^c) in next round
  424. &ror ($t1,13-2);
  425. &and ($AH[1],$AH[0]); # (b^c) &= (a^b)
  426. &lea ($E,&DWP(@K256[$i],$T,$E)); # T += Sigma1(1)+K[i]
  427. &xor ($t1,$t2);
  428. &xor ($AH[1],"edi"); # h = Maj(a,b,c) = Ch(a^b,c,b)
  429. &mov ($t2,&DWP(32+4*(($i+2)&15),"esp")) if ($i>=15 && $i<63);
  430. &ror ($t1,2); # Sigma0(a)
  431. &add ($AH[1],$E); # h += T
  432. &add ($E,&off($d)); # d += T
  433. &add ($AH[1],$t1); # h += Sigma0(a)
  434. &mov ($t1,&DWP(32+4*(($i+15)&15),"esp")) if ($i>=15 && $i<63);
  435. @AH = reverse(@AH); # rotate(a,h)
  436. ($t1,$t2) = ($t2,$t1); # rotate(t1,t2)
  437. }
  438. &mov ("esi",&DWP(96,"esp")); #ctx
  439. #&mov ($AH[0],&DWP(0,"esp"));
  440. &xor ($AH[1],"edi"); #&mov ($AH[1],&DWP(4,"esp"));
  441. #&mov ("edi", &DWP(8,"esp"));
  442. &mov ("ecx",&DWP(12,"esp"));
  443. &add ($AH[0],&DWP(0,"esi"));
  444. &add ($AH[1],&DWP(4,"esi"));
  445. &add ("edi",&DWP(8,"esi"));
  446. &add ("ecx",&DWP(12,"esi"));
  447. &mov (&DWP(0,"esi"),$AH[0]);
  448. &mov (&DWP(4,"esi"),$AH[1]);
  449. &mov (&DWP(8,"esi"),"edi");
  450. &mov (&DWP(12,"esi"),"ecx");
  451. #&mov (&DWP(0,"esp"),$AH[0]);
  452. &mov (&DWP(4,"esp"),$AH[1]);
  453. &xor ($AH[1],"edi"); # magic
  454. &mov (&DWP(8,"esp"),"edi");
  455. &mov (&DWP(12,"esp"),"ecx");
  456. #&mov ($E,&DWP(16,"esp"));
  457. &mov ("edi",&DWP(20,"esp"));
  458. &mov ("ebx",&DWP(24,"esp"));
  459. &mov ("ecx",&DWP(28,"esp"));
  460. &add ($E,&DWP(16,"esi"));
  461. &add ("edi",&DWP(20,"esi"));
  462. &add ("ebx",&DWP(24,"esi"));
  463. &add ("ecx",&DWP(28,"esi"));
  464. &mov (&DWP(16,"esi"),$E);
  465. &mov (&DWP(20,"esi"),"edi");
  466. &mov (&DWP(24,"esi"),"ebx");
  467. &mov (&DWP(28,"esi"),"ecx");
  468. #&mov (&DWP(16,"esp"),$E);
  469. &mov (&DWP(20,"esp"),"edi");
  470. &mov ("edi",&DWP(96+4,"esp")); # inp
  471. &mov (&DWP(24,"esp"),"ebx");
  472. &mov (&DWP(28,"esp"),"ecx");
  473. &cmp ("edi",&DWP(96+8,"esp")); # are we done yet?
  474. &jb (&label("grand_loop"));
  475. &mov ("esp",&DWP(96+12,"esp")); # restore sp
  476. &function_end_A();
  477. }
  478. if (!$i386 && $xmm) {{{
  479. if ($shaext) {
  480. ######################################################################
  481. # Intel SHA Extensions implementation of SHA256 update function.
  482. #
  483. my ($ctx,$inp,$end)=("esi","edi","eax");
  484. my ($Wi,$ABEF,$CDGH,$TMP)=map("xmm$_",(0..2,7));
  485. my @MSG=map("xmm$_",(3..6));
  486. sub sha256op38 {
  487. my ($opcodelet,$dst,$src)=@_;
  488. if ("$dst:$src" =~ /xmm([0-7]):xmm([0-7])/)
  489. { &data_byte(0x0f,0x38,$opcodelet,0xc0|($1<<3)|$2); }
  490. }
  491. sub sha256rnds2 { sha256op38(0xcb,@_); }
  492. sub sha256msg1 { sha256op38(0xcc,@_); }
  493. sub sha256msg2 { sha256op38(0xcd,@_); }
  494. &set_label("shaext",32);
  495. &sub ("esp",32);
  496. &movdqu ($ABEF,&QWP(0,$ctx)); # DCBA
  497. &lea ($K256,&DWP(0x80,$K256));
  498. &movdqu ($CDGH,&QWP(16,$ctx)); # HGFE
  499. &movdqa ($TMP,&QWP(0x100-0x80,$K256)); # byte swap mask
  500. &pshufd ($Wi,$ABEF,0x1b); # ABCD
  501. &pshufd ($ABEF,$ABEF,0xb1); # CDAB
  502. &pshufd ($CDGH,$CDGH,0x1b); # EFGH
  503. &palignr ($ABEF,$CDGH,8); # ABEF
  504. &punpcklqdq ($CDGH,$Wi); # CDGH
  505. &jmp (&label("loop_shaext"));
  506. &set_label("loop_shaext",16);
  507. &movdqu (@MSG[0],&QWP(0,$inp));
  508. &movdqu (@MSG[1],&QWP(0x10,$inp));
  509. &movdqu (@MSG[2],&QWP(0x20,$inp));
  510. &pshufb (@MSG[0],$TMP);
  511. &movdqu (@MSG[3],&QWP(0x30,$inp));
  512. &movdqa (&QWP(16,"esp"),$CDGH); # offload
  513. &movdqa ($Wi,&QWP(0*16-0x80,$K256));
  514. &paddd ($Wi,@MSG[0]);
  515. &pshufb (@MSG[1],$TMP);
  516. &sha256rnds2 ($CDGH,$ABEF); # 0-3
  517. &pshufd ($Wi,$Wi,0x0e);
  518. &nop ();
  519. &movdqa (&QWP(0,"esp"),$ABEF); # offload
  520. &sha256rnds2 ($ABEF,$CDGH);
  521. &movdqa ($Wi,&QWP(1*16-0x80,$K256));
  522. &paddd ($Wi,@MSG[1]);
  523. &pshufb (@MSG[2],$TMP);
  524. &sha256rnds2 ($CDGH,$ABEF); # 4-7
  525. &pshufd ($Wi,$Wi,0x0e);
  526. &lea ($inp,&DWP(0x40,$inp));
  527. &sha256msg1 (@MSG[0],@MSG[1]);
  528. &sha256rnds2 ($ABEF,$CDGH);
  529. &movdqa ($Wi,&QWP(2*16-0x80,$K256));
  530. &paddd ($Wi,@MSG[2]);
  531. &pshufb (@MSG[3],$TMP);
  532. &sha256rnds2 ($CDGH,$ABEF); # 8-11
  533. &pshufd ($Wi,$Wi,0x0e);
  534. &movdqa ($TMP,@MSG[3]);
  535. &palignr ($TMP,@MSG[2],4);
  536. &nop ();
  537. &paddd (@MSG[0],$TMP);
  538. &sha256msg1 (@MSG[1],@MSG[2]);
  539. &sha256rnds2 ($ABEF,$CDGH);
  540. &movdqa ($Wi,&QWP(3*16-0x80,$K256));
  541. &paddd ($Wi,@MSG[3]);
  542. &sha256msg2 (@MSG[0],@MSG[3]);
  543. &sha256rnds2 ($CDGH,$ABEF); # 12-15
  544. &pshufd ($Wi,$Wi,0x0e);
  545. &movdqa ($TMP,@MSG[0]);
  546. &palignr ($TMP,@MSG[3],4);
  547. &nop ();
  548. &paddd (@MSG[1],$TMP);
  549. &sha256msg1 (@MSG[2],@MSG[3]);
  550. &sha256rnds2 ($ABEF,$CDGH);
  551. for($i=4;$i<16-3;$i++) {
  552. &movdqa ($Wi,&QWP($i*16-0x80,$K256));
  553. &paddd ($Wi,@MSG[0]);
  554. &sha256msg2 (@MSG[1],@MSG[0]);
  555. &sha256rnds2 ($CDGH,$ABEF); # 16-19...
  556. &pshufd ($Wi,$Wi,0x0e);
  557. &movdqa ($TMP,@MSG[1]);
  558. &palignr ($TMP,@MSG[0],4);
  559. &nop ();
  560. &paddd (@MSG[2],$TMP);
  561. &sha256msg1 (@MSG[3],@MSG[0]);
  562. &sha256rnds2 ($ABEF,$CDGH);
  563. push(@MSG,shift(@MSG));
  564. }
  565. &movdqa ($Wi,&QWP(13*16-0x80,$K256));
  566. &paddd ($Wi,@MSG[0]);
  567. &sha256msg2 (@MSG[1],@MSG[0]);
  568. &sha256rnds2 ($CDGH,$ABEF); # 52-55
  569. &pshufd ($Wi,$Wi,0x0e);
  570. &movdqa ($TMP,@MSG[1])
  571. &palignr ($TMP,@MSG[0],4);
  572. &sha256rnds2 ($ABEF,$CDGH);
  573. &paddd (@MSG[2],$TMP);
  574. &movdqa ($Wi,&QWP(14*16-0x80,$K256));
  575. &paddd ($Wi,@MSG[1]);
  576. &sha256rnds2 ($CDGH,$ABEF); # 56-59
  577. &pshufd ($Wi,$Wi,0x0e);
  578. &sha256msg2 (@MSG[2],@MSG[1]);
  579. &movdqa ($TMP,&QWP(0x100-0x80,$K256)); # byte swap mask
  580. &sha256rnds2 ($ABEF,$CDGH);
  581. &movdqa ($Wi,&QWP(15*16-0x80,$K256));
  582. &paddd ($Wi,@MSG[2]);
  583. &nop ();
  584. &sha256rnds2 ($CDGH,$ABEF); # 60-63
  585. &pshufd ($Wi,$Wi,0x0e);
  586. &cmp ($end,$inp);
  587. &nop ();
  588. &sha256rnds2 ($ABEF,$CDGH);
  589. &paddd ($CDGH,&QWP(16,"esp"));
  590. &paddd ($ABEF,&QWP(0,"esp"));
  591. &jnz (&label("loop_shaext"));
  592. &pshufd ($CDGH,$CDGH,0xb1); # DCHG
  593. &pshufd ($TMP,$ABEF,0x1b); # FEBA
  594. &pshufd ($ABEF,$ABEF,0xb1); # BAFE
  595. &punpckhqdq ($ABEF,$CDGH); # DCBA
  596. &palignr ($CDGH,$TMP,8); # HGFE
  597. &mov ("esp",&DWP(32+12,"esp"));
  598. &movdqu (&QWP(0,$ctx),$ABEF);
  599. &movdqu (&QWP(16,$ctx),$CDGH);
  600. &function_end_A();
  601. }
  602. my @X = map("xmm$_",(0..3));
  603. my ($t0,$t1,$t2,$t3) = map("xmm$_",(4..7));
  604. my @AH = ($A,$T);
  605. &set_label("SSSE3",32);
  606. &lea ("esp",&DWP(-96,"esp"));
  607. # copy ctx->h[0-7] to A,B,C,D,E,F,G,H on stack
  608. &mov ($AH[0],&DWP(0,"esi"));
  609. &mov ($AH[1],&DWP(4,"esi"));
  610. &mov ("ecx",&DWP(8,"esi"));
  611. &mov ("edi",&DWP(12,"esi"));
  612. #&mov (&DWP(0,"esp"),$AH[0]);
  613. &mov (&DWP(4,"esp"),$AH[1]);
  614. &xor ($AH[1],"ecx"); # magic
  615. &mov (&DWP(8,"esp"),"ecx");
  616. &mov (&DWP(12,"esp"),"edi");
  617. &mov ($E,&DWP(16,"esi"));
  618. &mov ("edi",&DWP(20,"esi"));
  619. &mov ("ecx",&DWP(24,"esi"));
  620. &mov ("esi",&DWP(28,"esi"));
  621. #&mov (&DWP(16,"esp"),$E);
  622. &mov (&DWP(20,"esp"),"edi");
  623. &mov ("edi",&DWP(96+4,"esp")); # inp
  624. &mov (&DWP(24,"esp"),"ecx");
  625. &mov (&DWP(28,"esp"),"esi");
  626. &movdqa ($t3,&QWP(256,$K256));
  627. &jmp (&label("grand_ssse3"));
  628. &set_label("grand_ssse3",16);
  629. # load input, reverse byte order, add K256[0..15], save to stack
  630. &movdqu (@X[0],&QWP(0,"edi"));
  631. &movdqu (@X[1],&QWP(16,"edi"));
  632. &movdqu (@X[2],&QWP(32,"edi"));
  633. &movdqu (@X[3],&QWP(48,"edi"));
  634. &add ("edi",64);
  635. &pshufb (@X[0],$t3);
  636. &mov (&DWP(96+4,"esp"),"edi");
  637. &pshufb (@X[1],$t3);
  638. &movdqa ($t0,&QWP(0,$K256));
  639. &pshufb (@X[2],$t3);
  640. &movdqa ($t1,&QWP(16,$K256));
  641. &paddd ($t0,@X[0]);
  642. &pshufb (@X[3],$t3);
  643. &movdqa ($t2,&QWP(32,$K256));
  644. &paddd ($t1,@X[1]);
  645. &movdqa ($t3,&QWP(48,$K256));
  646. &movdqa (&QWP(32+0,"esp"),$t0);
  647. &paddd ($t2,@X[2]);
  648. &movdqa (&QWP(32+16,"esp"),$t1);
  649. &paddd ($t3,@X[3]);
  650. &movdqa (&QWP(32+32,"esp"),$t2);
  651. &movdqa (&QWP(32+48,"esp"),$t3);
  652. &jmp (&label("ssse3_00_47"));
  653. &set_label("ssse3_00_47",16);
  654. &add ($K256,64);
  655. sub SSSE3_00_47 () {
  656. my $j = shift;
  657. my $body = shift;
  658. my @X = @_;
  659. my @insns = (&$body,&$body,&$body,&$body); # 120 instructions
  660. eval(shift(@insns));
  661. &movdqa ($t0,@X[1]);
  662. eval(shift(@insns)); # @
  663. eval(shift(@insns));
  664. &movdqa ($t3,@X[3]);
  665. eval(shift(@insns));
  666. eval(shift(@insns));
  667. &palignr ($t0,@X[0],4); # X[1..4]
  668. eval(shift(@insns));
  669. eval(shift(@insns)); # @
  670. eval(shift(@insns));
  671. &palignr ($t3,@X[2],4); # X[9..12]
  672. eval(shift(@insns));
  673. eval(shift(@insns));
  674. eval(shift(@insns));
  675. &movdqa ($t1,$t0);
  676. eval(shift(@insns)); # @
  677. eval(shift(@insns));
  678. &movdqa ($t2,$t0);
  679. eval(shift(@insns));
  680. eval(shift(@insns));
  681. &psrld ($t0,3);
  682. eval(shift(@insns));
  683. eval(shift(@insns)); # @
  684. &paddd (@X[0],$t3); # X[0..3] += X[9..12]
  685. eval(shift(@insns));
  686. eval(shift(@insns));
  687. &psrld ($t2,7);
  688. eval(shift(@insns));
  689. eval(shift(@insns));
  690. eval(shift(@insns)); # @
  691. eval(shift(@insns));
  692. &pshufd ($t3,@X[3],0b11111010); # X[14..15]
  693. eval(shift(@insns));
  694. eval(shift(@insns));
  695. &pslld ($t1,32-18);
  696. eval(shift(@insns));
  697. eval(shift(@insns)); # @
  698. &pxor ($t0,$t2);
  699. eval(shift(@insns));
  700. eval(shift(@insns));
  701. &psrld ($t2,18-7);
  702. eval(shift(@insns));
  703. eval(shift(@insns));
  704. eval(shift(@insns)); # @
  705. &pxor ($t0,$t1);
  706. eval(shift(@insns));
  707. eval(shift(@insns));
  708. &pslld ($t1,18-7);
  709. eval(shift(@insns));
  710. eval(shift(@insns));
  711. eval(shift(@insns)); # @
  712. &pxor ($t0,$t2);
  713. eval(shift(@insns));
  714. eval(shift(@insns));
  715. &movdqa ($t2,$t3);
  716. eval(shift(@insns));
  717. eval(shift(@insns));
  718. eval(shift(@insns)); # @
  719. &pxor ($t0,$t1); # sigma0(X[1..4])
  720. eval(shift(@insns));
  721. eval(shift(@insns));
  722. &psrld ($t3,10);
  723. eval(shift(@insns));
  724. eval(shift(@insns));
  725. eval(shift(@insns)); # @
  726. &paddd (@X[0],$t0); # X[0..3] += sigma0(X[1..4])
  727. eval(shift(@insns));
  728. eval(shift(@insns));
  729. &psrlq ($t2,17);
  730. eval(shift(@insns));
  731. eval(shift(@insns));
  732. eval(shift(@insns)); # @
  733. &pxor ($t3,$t2);
  734. eval(shift(@insns));
  735. eval(shift(@insns));
  736. &psrlq ($t2,19-17);
  737. eval(shift(@insns));
  738. eval(shift(@insns));
  739. eval(shift(@insns)); # @
  740. &pxor ($t3,$t2);
  741. eval(shift(@insns));
  742. eval(shift(@insns));
  743. &pshufd ($t3,$t3,0b10000000);
  744. eval(shift(@insns));
  745. eval(shift(@insns));
  746. eval(shift(@insns)); # @
  747. eval(shift(@insns));
  748. eval(shift(@insns));
  749. eval(shift(@insns));
  750. eval(shift(@insns));
  751. eval(shift(@insns)); # @
  752. eval(shift(@insns));
  753. &psrldq ($t3,8);
  754. eval(shift(@insns));
  755. eval(shift(@insns));
  756. eval(shift(@insns));
  757. &paddd (@X[0],$t3); # X[0..1] += sigma1(X[14..15])
  758. eval(shift(@insns)); # @
  759. eval(shift(@insns));
  760. eval(shift(@insns));
  761. eval(shift(@insns));
  762. eval(shift(@insns));
  763. eval(shift(@insns)); # @
  764. eval(shift(@insns));
  765. &pshufd ($t3,@X[0],0b01010000); # X[16..17]
  766. eval(shift(@insns));
  767. eval(shift(@insns));
  768. eval(shift(@insns));
  769. &movdqa ($t2,$t3);
  770. eval(shift(@insns)); # @
  771. &psrld ($t3,10);
  772. eval(shift(@insns));
  773. &psrlq ($t2,17);
  774. eval(shift(@insns));
  775. eval(shift(@insns));
  776. eval(shift(@insns));
  777. eval(shift(@insns)); # @
  778. &pxor ($t3,$t2);
  779. eval(shift(@insns));
  780. eval(shift(@insns));
  781. &psrlq ($t2,19-17);
  782. eval(shift(@insns));
  783. eval(shift(@insns));
  784. eval(shift(@insns)); # @
  785. &pxor ($t3,$t2);
  786. eval(shift(@insns));
  787. eval(shift(@insns));
  788. eval(shift(@insns));
  789. &pshufd ($t3,$t3,0b00001000);
  790. eval(shift(@insns));
  791. eval(shift(@insns)); # @
  792. &movdqa ($t2,&QWP(16*$j,$K256));
  793. eval(shift(@insns));
  794. eval(shift(@insns));
  795. &pslldq ($t3,8);
  796. eval(shift(@insns));
  797. eval(shift(@insns));
  798. eval(shift(@insns)); # @
  799. eval(shift(@insns));
  800. eval(shift(@insns));
  801. eval(shift(@insns));
  802. eval(shift(@insns));
  803. eval(shift(@insns)); # @
  804. &paddd (@X[0],$t3); # X[2..3] += sigma1(X[16..17])
  805. eval(shift(@insns));
  806. eval(shift(@insns));
  807. eval(shift(@insns));
  808. eval(shift(@insns));
  809. &paddd ($t2,@X[0]);
  810. eval(shift(@insns)); # @
  811. foreach (@insns) { eval; } # remaining instructions
  812. &movdqa (&QWP(32+16*$j,"esp"),$t2);
  813. }
  814. sub body_00_15 () {
  815. (
  816. '&mov ("ecx",$E);',
  817. '&ror ($E,25-11);',
  818. '&mov ("esi",&off($f));',
  819. '&xor ($E,"ecx");',
  820. '&mov ("edi",&off($g));',
  821. '&xor ("esi","edi");',
  822. '&ror ($E,11-6);',
  823. '&and ("esi","ecx");',
  824. '&mov (&off($e),"ecx");', # save $E, modulo-scheduled
  825. '&xor ($E,"ecx");',
  826. '&xor ("edi","esi");', # Ch(e,f,g)
  827. '&ror ($E,6);', # T = Sigma1(e)
  828. '&mov ("ecx",$AH[0]);',
  829. '&add ($E,"edi");', # T += Ch(e,f,g)
  830. '&mov ("edi",&off($b));',
  831. '&mov ("esi",$AH[0]);',
  832. '&ror ("ecx",22-13);',
  833. '&mov (&off($a),$AH[0]);', # save $A, modulo-scheduled
  834. '&xor ("ecx",$AH[0]);',
  835. '&xor ($AH[0],"edi");', # a ^= b, (b^c) in next round
  836. '&add ($E,&off($h));', # T += h
  837. '&ror ("ecx",13-2);',
  838. '&and ($AH[1],$AH[0]);', # (b^c) &= (a^b)
  839. '&xor ("ecx","esi");',
  840. '&add ($E,&DWP(32+4*($i&15),"esp"));', # T += K[i]+X[i]
  841. '&xor ($AH[1],"edi");', # h = Maj(a,b,c) = Ch(a^b,c,b)
  842. '&ror ("ecx",2);', # Sigma0(a)
  843. '&add ($AH[1],$E);', # h += T
  844. '&add ($E,&off($d));', # d += T
  845. '&add ($AH[1],"ecx");'. # h += Sigma0(a)
  846. '@AH = reverse(@AH); $i++;' # rotate(a,h)
  847. );
  848. }
  849. for ($i=0,$j=0; $j<4; $j++) {
  850. &SSSE3_00_47($j,\&body_00_15,@X);
  851. push(@X,shift(@X)); # rotate(@X)
  852. }
  853. &cmp (&DWP(16*$j,$K256),0x00010203);
  854. &jne (&label("ssse3_00_47"));
  855. for ($i=0; $i<16; ) {
  856. foreach(body_00_15()) { eval; }
  857. }
  858. &mov ("esi",&DWP(96,"esp")); #ctx
  859. #&mov ($AH[0],&DWP(0,"esp"));
  860. &xor ($AH[1],"edi"); #&mov ($AH[1],&DWP(4,"esp"));
  861. #&mov ("edi", &DWP(8,"esp"));
  862. &mov ("ecx",&DWP(12,"esp"));
  863. &add ($AH[0],&DWP(0,"esi"));
  864. &add ($AH[1],&DWP(4,"esi"));
  865. &add ("edi",&DWP(8,"esi"));
  866. &add ("ecx",&DWP(12,"esi"));
  867. &mov (&DWP(0,"esi"),$AH[0]);
  868. &mov (&DWP(4,"esi"),$AH[1]);
  869. &mov (&DWP(8,"esi"),"edi");
  870. &mov (&DWP(12,"esi"),"ecx");
  871. #&mov (&DWP(0,"esp"),$AH[0]);
  872. &mov (&DWP(4,"esp"),$AH[1]);
  873. &xor ($AH[1],"edi"); # magic
  874. &mov (&DWP(8,"esp"),"edi");
  875. &mov (&DWP(12,"esp"),"ecx");
  876. #&mov ($E,&DWP(16,"esp"));
  877. &mov ("edi",&DWP(20,"esp"));
  878. &mov ("ecx",&DWP(24,"esp"));
  879. &add ($E,&DWP(16,"esi"));
  880. &add ("edi",&DWP(20,"esi"));
  881. &add ("ecx",&DWP(24,"esi"));
  882. &mov (&DWP(16,"esi"),$E);
  883. &mov (&DWP(20,"esi"),"edi");
  884. &mov (&DWP(20,"esp"),"edi");
  885. &mov ("edi",&DWP(28,"esp"));
  886. &mov (&DWP(24,"esi"),"ecx");
  887. #&mov (&DWP(16,"esp"),$E);
  888. &add ("edi",&DWP(28,"esi"));
  889. &mov (&DWP(24,"esp"),"ecx");
  890. &mov (&DWP(28,"esi"),"edi");
  891. &mov (&DWP(28,"esp"),"edi");
  892. &mov ("edi",&DWP(96+4,"esp")); # inp
  893. &movdqa ($t3,&QWP(64,$K256));
  894. &sub ($K256,3*64); # rewind K
  895. &cmp ("edi",&DWP(96+8,"esp")); # are we done yet?
  896. &jb (&label("grand_ssse3"));
  897. &mov ("esp",&DWP(96+12,"esp")); # restore sp
  898. &function_end_A();
  899. if ($avx) {
  900. &set_label("AVX",32);
  901. if ($avx>1) {
  902. &and ("edx",1<<8|1<<3); # check for BMI2+BMI1
  903. &cmp ("edx",1<<8|1<<3);
  904. &je (&label("AVX_BMI"));
  905. }
  906. &lea ("esp",&DWP(-96,"esp"));
  907. &vzeroall ();
  908. # copy ctx->h[0-7] to A,B,C,D,E,F,G,H on stack
  909. &mov ($AH[0],&DWP(0,"esi"));
  910. &mov ($AH[1],&DWP(4,"esi"));
  911. &mov ("ecx",&DWP(8,"esi"));
  912. &mov ("edi",&DWP(12,"esi"));
  913. #&mov (&DWP(0,"esp"),$AH[0]);
  914. &mov (&DWP(4,"esp"),$AH[1]);
  915. &xor ($AH[1],"ecx"); # magic
  916. &mov (&DWP(8,"esp"),"ecx");
  917. &mov (&DWP(12,"esp"),"edi");
  918. &mov ($E,&DWP(16,"esi"));
  919. &mov ("edi",&DWP(20,"esi"));
  920. &mov ("ecx",&DWP(24,"esi"));
  921. &mov ("esi",&DWP(28,"esi"));
  922. #&mov (&DWP(16,"esp"),$E);
  923. &mov (&DWP(20,"esp"),"edi");
  924. &mov ("edi",&DWP(96+4,"esp")); # inp
  925. &mov (&DWP(24,"esp"),"ecx");
  926. &mov (&DWP(28,"esp"),"esi");
  927. &vmovdqa ($t3,&QWP(256,$K256));
  928. &jmp (&label("grand_avx"));
  929. &set_label("grand_avx",32);
  930. # load input, reverse byte order, add K256[0..15], save to stack
  931. &vmovdqu (@X[0],&QWP(0,"edi"));
  932. &vmovdqu (@X[1],&QWP(16,"edi"));
  933. &vmovdqu (@X[2],&QWP(32,"edi"));
  934. &vmovdqu (@X[3],&QWP(48,"edi"));
  935. &add ("edi",64);
  936. &vpshufb (@X[0],@X[0],$t3);
  937. &mov (&DWP(96+4,"esp"),"edi");
  938. &vpshufb (@X[1],@X[1],$t3);
  939. &vpshufb (@X[2],@X[2],$t3);
  940. &vpaddd ($t0,@X[0],&QWP(0,$K256));
  941. &vpshufb (@X[3],@X[3],$t3);
  942. &vpaddd ($t1,@X[1],&QWP(16,$K256));
  943. &vpaddd ($t2,@X[2],&QWP(32,$K256));
  944. &vpaddd ($t3,@X[3],&QWP(48,$K256));
  945. &vmovdqa (&QWP(32+0,"esp"),$t0);
  946. &vmovdqa (&QWP(32+16,"esp"),$t1);
  947. &vmovdqa (&QWP(32+32,"esp"),$t2);
  948. &vmovdqa (&QWP(32+48,"esp"),$t3);
  949. &jmp (&label("avx_00_47"));
  950. &set_label("avx_00_47",16);
  951. &add ($K256,64);
  952. sub Xupdate_AVX () {
  953. (
  954. '&vpalignr ($t0,@X[1],@X[0],4);', # X[1..4]
  955. '&vpalignr ($t3,@X[3],@X[2],4);', # X[9..12]
  956. '&vpsrld ($t2,$t0,7);',
  957. '&vpaddd (@X[0],@X[0],$t3);', # X[0..3] += X[9..16]
  958. '&vpsrld ($t3,$t0,3);',
  959. '&vpslld ($t1,$t0,14);',
  960. '&vpxor ($t0,$t3,$t2);',
  961. '&vpshufd ($t3,@X[3],0b11111010)',# X[14..15]
  962. '&vpsrld ($t2,$t2,18-7);',
  963. '&vpxor ($t0,$t0,$t1);',
  964. '&vpslld ($t1,$t1,25-14);',
  965. '&vpxor ($t0,$t0,$t2);',
  966. '&vpsrld ($t2,$t3,10);',
  967. '&vpxor ($t0,$t0,$t1);', # sigma0(X[1..4])
  968. '&vpsrlq ($t1,$t3,17);',
  969. '&vpaddd (@X[0],@X[0],$t0);', # X[0..3] += sigma0(X[1..4])
  970. '&vpxor ($t2,$t2,$t1);',
  971. '&vpsrlq ($t3,$t3,19);',
  972. '&vpxor ($t2,$t2,$t3);', # sigma1(X[14..15]
  973. '&vpshufd ($t3,$t2,0b10000100);',
  974. '&vpsrldq ($t3,$t3,8);',
  975. '&vpaddd (@X[0],@X[0],$t3);', # X[0..1] += sigma1(X[14..15])
  976. '&vpshufd ($t3,@X[0],0b01010000)',# X[16..17]
  977. '&vpsrld ($t2,$t3,10);',
  978. '&vpsrlq ($t1,$t3,17);',
  979. '&vpxor ($t2,$t2,$t1);',
  980. '&vpsrlq ($t3,$t3,19);',
  981. '&vpxor ($t2,$t2,$t3);', # sigma1(X[16..17]
  982. '&vpshufd ($t3,$t2,0b11101000);',
  983. '&vpslldq ($t3,$t3,8);',
  984. '&vpaddd (@X[0],@X[0],$t3);' # X[2..3] += sigma1(X[16..17])
  985. );
  986. }
  987. local *ror = sub { &shrd(@_[0],@_) };
  988. sub AVX_00_47 () {
  989. my $j = shift;
  990. my $body = shift;
  991. my @X = @_;
  992. my @insns = (&$body,&$body,&$body,&$body); # 120 instructions
  993. my $insn;
  994. foreach (Xupdate_AVX()) { # 31 instructions
  995. eval;
  996. eval(shift(@insns));
  997. eval(shift(@insns));
  998. eval($insn = shift(@insns));
  999. eval(shift(@insns)) if ($insn =~ /rorx/ && @insns[0] =~ /rorx/);
  1000. }
  1001. &vpaddd ($t2,@X[0],&QWP(16*$j,$K256));
  1002. foreach (@insns) { eval; } # remaining instructions
  1003. &vmovdqa (&QWP(32+16*$j,"esp"),$t2);
  1004. }
  1005. for ($i=0,$j=0; $j<4; $j++) {
  1006. &AVX_00_47($j,\&body_00_15,@X);
  1007. push(@X,shift(@X)); # rotate(@X)
  1008. }
  1009. &cmp (&DWP(16*$j,$K256),0x00010203);
  1010. &jne (&label("avx_00_47"));
  1011. for ($i=0; $i<16; ) {
  1012. foreach(body_00_15()) { eval; }
  1013. }
  1014. &mov ("esi",&DWP(96,"esp")); #ctx
  1015. #&mov ($AH[0],&DWP(0,"esp"));
  1016. &xor ($AH[1],"edi"); #&mov ($AH[1],&DWP(4,"esp"));
  1017. #&mov ("edi", &DWP(8,"esp"));
  1018. &mov ("ecx",&DWP(12,"esp"));
  1019. &add ($AH[0],&DWP(0,"esi"));
  1020. &add ($AH[1],&DWP(4,"esi"));
  1021. &add ("edi",&DWP(8,"esi"));
  1022. &add ("ecx",&DWP(12,"esi"));
  1023. &mov (&DWP(0,"esi"),$AH[0]);
  1024. &mov (&DWP(4,"esi"),$AH[1]);
  1025. &mov (&DWP(8,"esi"),"edi");
  1026. &mov (&DWP(12,"esi"),"ecx");
  1027. #&mov (&DWP(0,"esp"),$AH[0]);
  1028. &mov (&DWP(4,"esp"),$AH[1]);
  1029. &xor ($AH[1],"edi"); # magic
  1030. &mov (&DWP(8,"esp"),"edi");
  1031. &mov (&DWP(12,"esp"),"ecx");
  1032. #&mov ($E,&DWP(16,"esp"));
  1033. &mov ("edi",&DWP(20,"esp"));
  1034. &mov ("ecx",&DWP(24,"esp"));
  1035. &add ($E,&DWP(16,"esi"));
  1036. &add ("edi",&DWP(20,"esi"));
  1037. &add ("ecx",&DWP(24,"esi"));
  1038. &mov (&DWP(16,"esi"),$E);
  1039. &mov (&DWP(20,"esi"),"edi");
  1040. &mov (&DWP(20,"esp"),"edi");
  1041. &mov ("edi",&DWP(28,"esp"));
  1042. &mov (&DWP(24,"esi"),"ecx");
  1043. #&mov (&DWP(16,"esp"),$E);
  1044. &add ("edi",&DWP(28,"esi"));
  1045. &mov (&DWP(24,"esp"),"ecx");
  1046. &mov (&DWP(28,"esi"),"edi");
  1047. &mov (&DWP(28,"esp"),"edi");
  1048. &mov ("edi",&DWP(96+4,"esp")); # inp
  1049. &vmovdqa ($t3,&QWP(64,$K256));
  1050. &sub ($K256,3*64); # rewind K
  1051. &cmp ("edi",&DWP(96+8,"esp")); # are we done yet?
  1052. &jb (&label("grand_avx"));
  1053. &mov ("esp",&DWP(96+12,"esp")); # restore sp
  1054. &vzeroall ();
  1055. &function_end_A();
  1056. if ($avx>1) {
  1057. sub bodyx_00_15 () { # +10%
  1058. (
  1059. '&rorx ("ecx",$E,6)',
  1060. '&rorx ("esi",$E,11)',
  1061. '&mov (&off($e),$E)', # save $E, modulo-scheduled
  1062. '&rorx ("edi",$E,25)',
  1063. '&xor ("ecx","esi")',
  1064. '&andn ("esi",$E,&off($g))',
  1065. '&xor ("ecx","edi")', # Sigma1(e)
  1066. '&and ($E,&off($f))',
  1067. '&mov (&off($a),$AH[0]);', # save $A, modulo-scheduled
  1068. '&or ($E,"esi")', # T = Ch(e,f,g)
  1069. '&rorx ("edi",$AH[0],2)',
  1070. '&rorx ("esi",$AH[0],13)',
  1071. '&lea ($E,&DWP(0,$E,"ecx"))', # T += Sigma1(e)
  1072. '&rorx ("ecx",$AH[0],22)',
  1073. '&xor ("esi","edi")',
  1074. '&mov ("edi",&off($b))',
  1075. '&xor ("ecx","esi")', # Sigma0(a)
  1076. '&xor ($AH[0],"edi")', # a ^= b, (b^c) in next round
  1077. '&add ($E,&off($h))', # T += h
  1078. '&and ($AH[1],$AH[0])', # (b^c) &= (a^b)
  1079. '&add ($E,&DWP(32+4*($i&15),"esp"))', # T += K[i]+X[i]
  1080. '&xor ($AH[1],"edi")', # h = Maj(a,b,c) = Ch(a^b,c,b)
  1081. '&add ("ecx",$E)', # h += T
  1082. '&add ($E,&off($d))', # d += T
  1083. '&lea ($AH[1],&DWP(0,$AH[1],"ecx"));'. # h += Sigma0(a)
  1084. '@AH = reverse(@AH); $i++;' # rotate(a,h)
  1085. );
  1086. }
  1087. &set_label("AVX_BMI",32);
  1088. &lea ("esp",&DWP(-96,"esp"));
  1089. &vzeroall ();
  1090. # copy ctx->h[0-7] to A,B,C,D,E,F,G,H on stack
  1091. &mov ($AH[0],&DWP(0,"esi"));
  1092. &mov ($AH[1],&DWP(4,"esi"));
  1093. &mov ("ecx",&DWP(8,"esi"));
  1094. &mov ("edi",&DWP(12,"esi"));
  1095. #&mov (&DWP(0,"esp"),$AH[0]);
  1096. &mov (&DWP(4,"esp"),$AH[1]);
  1097. &xor ($AH[1],"ecx"); # magic
  1098. &mov (&DWP(8,"esp"),"ecx");
  1099. &mov (&DWP(12,"esp"),"edi");
  1100. &mov ($E,&DWP(16,"esi"));
  1101. &mov ("edi",&DWP(20,"esi"));
  1102. &mov ("ecx",&DWP(24,"esi"));
  1103. &mov ("esi",&DWP(28,"esi"));
  1104. #&mov (&DWP(16,"esp"),$E);
  1105. &mov (&DWP(20,"esp"),"edi");
  1106. &mov ("edi",&DWP(96+4,"esp")); # inp
  1107. &mov (&DWP(24,"esp"),"ecx");
  1108. &mov (&DWP(28,"esp"),"esi");
  1109. &vmovdqa ($t3,&QWP(256,$K256));
  1110. &jmp (&label("grand_avx_bmi"));
  1111. &set_label("grand_avx_bmi",32);
  1112. # load input, reverse byte order, add K256[0..15], save to stack
  1113. &vmovdqu (@X[0],&QWP(0,"edi"));
  1114. &vmovdqu (@X[1],&QWP(16,"edi"));
  1115. &vmovdqu (@X[2],&QWP(32,"edi"));
  1116. &vmovdqu (@X[3],&QWP(48,"edi"));
  1117. &add ("edi",64);
  1118. &vpshufb (@X[0],@X[0],$t3);
  1119. &mov (&DWP(96+4,"esp"),"edi");
  1120. &vpshufb (@X[1],@X[1],$t3);
  1121. &vpshufb (@X[2],@X[2],$t3);
  1122. &vpaddd ($t0,@X[0],&QWP(0,$K256));
  1123. &vpshufb (@X[3],@X[3],$t3);
  1124. &vpaddd ($t1,@X[1],&QWP(16,$K256));
  1125. &vpaddd ($t2,@X[2],&QWP(32,$K256));
  1126. &vpaddd ($t3,@X[3],&QWP(48,$K256));
  1127. &vmovdqa (&QWP(32+0,"esp"),$t0);
  1128. &vmovdqa (&QWP(32+16,"esp"),$t1);
  1129. &vmovdqa (&QWP(32+32,"esp"),$t2);
  1130. &vmovdqa (&QWP(32+48,"esp"),$t3);
  1131. &jmp (&label("avx_bmi_00_47"));
  1132. &set_label("avx_bmi_00_47",16);
  1133. &add ($K256,64);
  1134. for ($i=0,$j=0; $j<4; $j++) {
  1135. &AVX_00_47($j,\&bodyx_00_15,@X);
  1136. push(@X,shift(@X)); # rotate(@X)
  1137. }
  1138. &cmp (&DWP(16*$j,$K256),0x00010203);
  1139. &jne (&label("avx_bmi_00_47"));
  1140. for ($i=0; $i<16; ) {
  1141. foreach(bodyx_00_15()) { eval; }
  1142. }
  1143. &mov ("esi",&DWP(96,"esp")); #ctx
  1144. #&mov ($AH[0],&DWP(0,"esp"));
  1145. &xor ($AH[1],"edi"); #&mov ($AH[1],&DWP(4,"esp"));
  1146. #&mov ("edi", &DWP(8,"esp"));
  1147. &mov ("ecx",&DWP(12,"esp"));
  1148. &add ($AH[0],&DWP(0,"esi"));
  1149. &add ($AH[1],&DWP(4,"esi"));
  1150. &add ("edi",&DWP(8,"esi"));
  1151. &add ("ecx",&DWP(12,"esi"));
  1152. &mov (&DWP(0,"esi"),$AH[0]);
  1153. &mov (&DWP(4,"esi"),$AH[1]);
  1154. &mov (&DWP(8,"esi"),"edi");
  1155. &mov (&DWP(12,"esi"),"ecx");
  1156. #&mov (&DWP(0,"esp"),$AH[0]);
  1157. &mov (&DWP(4,"esp"),$AH[1]);
  1158. &xor ($AH[1],"edi"); # magic
  1159. &mov (&DWP(8,"esp"),"edi");
  1160. &mov (&DWP(12,"esp"),"ecx");
  1161. #&mov ($E,&DWP(16,"esp"));
  1162. &mov ("edi",&DWP(20,"esp"));
  1163. &mov ("ecx",&DWP(24,"esp"));
  1164. &add ($E,&DWP(16,"esi"));
  1165. &add ("edi",&DWP(20,"esi"));
  1166. &add ("ecx",&DWP(24,"esi"));
  1167. &mov (&DWP(16,"esi"),$E);
  1168. &mov (&DWP(20,"esi"),"edi");
  1169. &mov (&DWP(20,"esp"),"edi");
  1170. &mov ("edi",&DWP(28,"esp"));
  1171. &mov (&DWP(24,"esi"),"ecx");
  1172. #&mov (&DWP(16,"esp"),$E);
  1173. &add ("edi",&DWP(28,"esi"));
  1174. &mov (&DWP(24,"esp"),"ecx");
  1175. &mov (&DWP(28,"esi"),"edi");
  1176. &mov (&DWP(28,"esp"),"edi");
  1177. &mov ("edi",&DWP(96+4,"esp")); # inp
  1178. &vmovdqa ($t3,&QWP(64,$K256));
  1179. &sub ($K256,3*64); # rewind K
  1180. &cmp ("edi",&DWP(96+8,"esp")); # are we done yet?
  1181. &jb (&label("grand_avx_bmi"));
  1182. &mov ("esp",&DWP(96+12,"esp")); # restore sp
  1183. &vzeroall ();
  1184. &function_end_A();
  1185. }
  1186. }
  1187. }}}
  1188. &function_end_B("sha256_block_data_order");
  1189. &asm_finish();
  1190. close STDOUT or die "error closing STDOUT: $!";