summaryrefslogtreecommitdiff
path: root/src
diff options
context:
space:
mode:
authorjsing <>2026-05-07 15:38:03 +0000
committerjsing <>2026-05-07 15:38:03 +0000
commitccc4eae3de33ef320762657c4be6c9dfd9c2de82 (patch)
tree81f773dc013844248de1103391a3e49d252c1587 /src
parent97930339bcae324ce6c463f52bdcdf98c4be2941 (diff)
downloadopenbsd-ccc4eae3de33ef320762657c4be6c9dfd9c2de82.tar.gz
openbsd-ccc4eae3de33ef320762657c4be6c9dfd9c2de82.tar.bz2
openbsd-ccc4eae3de33ef320762657c4be6c9dfd9c2de82.zip
Use a define based instruction separator in SHA assembly.
Unfortunately, not all assemblers use the same instruction separator. In particular, LLVM on macOS uses %% as an instruction separator, while most other assemblers use a semi-colon. ok kenjiro@ tb@
Diffstat (limited to 'src')
-rw-r--r--src/lib/libcrypto/crypto_assembly.h8
-rw-r--r--src/lib/libcrypto/sha/sha1_aarch64_ce.S32
-rw-r--r--src/lib/libcrypto/sha/sha1_amd64_generic.S70
-rw-r--r--src/lib/libcrypto/sha/sha1_amd64_shani.S18
-rw-r--r--src/lib/libcrypto/sha/sha256_aarch64_ce.S16
-rw-r--r--src/lib/libcrypto/sha/sha256_amd64_generic.S104
-rw-r--r--src/lib/libcrypto/sha/sha256_amd64_shani.S28
-rw-r--r--src/lib/libcrypto/sha/sha512_aarch64_ce.S30
-rw-r--r--src/lib/libcrypto/sha/sha512_amd64_generic.S104
9 files changed, 219 insertions, 191 deletions
diff --git a/src/lib/libcrypto/crypto_assembly.h b/src/lib/libcrypto/crypto_assembly.h
index 0ae78a81ab..8f53ea51b6 100644
--- a/src/lib/libcrypto/crypto_assembly.h
+++ b/src/lib/libcrypto/crypto_assembly.h
@@ -1,4 +1,4 @@
1/* $OpenBSD: crypto_assembly.h,v 1.1 2026/03/28 13:09:55 jsing Exp $ */ 1/* $OpenBSD: crypto_assembly.h,v 1.2 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2026 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2026 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -27,4 +27,10 @@
27#endif 27#endif
28#endif 28#endif
29 29
30#if defined(__APPLE__) && defined(__aarch64__)
31#define CRYPTO_ASSEMBLY_SEPARATOR %%
32#else
33#define CRYPTO_ASSEMBLY_SEPARATOR ;
34#endif
35
30#endif 36#endif
diff --git a/src/lib/libcrypto/sha/sha1_aarch64_ce.S b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
index 641500a1e5..e6b1a33018 100644
--- a/src/lib/libcrypto/sha/sha1_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha1_aarch64_ce.S,v 1.5 2026/01/25 08:22:17 jsing Exp $ */ 1/* $OpenBSD: sha1_aarch64_ce.S,v 1.6 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -15,6 +15,10 @@
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */ 16 */
17 17
18#include "crypto_assembly.h"
19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
18/* 22/*
19 * SHA-1 implementation using the ARM Cryptographic Extension (CE). 23 * SHA-1 implementation using the ARM Cryptographic Extension (CE).
20 * 24 *
@@ -65,7 +69,7 @@
65 * W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1). 69 * W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1).
66 */ 70 */
67#define sha1_message_schedule_update(m0, m1, m2, m3) \ 71#define sha1_message_schedule_update(m0, m1, m2, m3) \
68 sha1su0 m0.4s, m1.4s, m2.4s; \ 72 sha1su0 m0.4s, m1.4s, m2.4s _SEP \
69 sha1su1 m0.4s, m3.4s 73 sha1su1 m0.4s, m3.4s
70 74
71/* 75/*
@@ -75,27 +79,27 @@
75 */ 79 */
76 80
77#define sha1_round1(h0, h1, w, k) \ 81#define sha1_round1(h0, h1, w, k) \
78 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ 82 add tmp0.4s, w.4s, k.4s /* Tt = Wt + Kt */ _SEP \
79 mov tmp1, h0.s[0]; \ 83 mov tmp1, h0.s[0] _SEP \
80 sha1c h0##q, h1##s, tmp0.4s; \ 84 sha1c h0##q, h1##s, tmp0.4s _SEP \
81 sha1h h1##s, tmp1 85 sha1h h1##s, tmp1
82 86
83#define sha1_round2(h0, h1, w, k) \ 87#define sha1_round2(h0, h1, w, k) \
84 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ 88 add tmp0.4s, w.4s, k.4s /* Tt = Wt + Kt */ _SEP \
85 mov tmp1, h0.s[0]; \ 89 mov tmp1, h0.s[0] _SEP \
86 sha1p h0##q, h1##s, tmp0.4s; \ 90 sha1p h0##q, h1##s, tmp0.4s _SEP \
87 sha1h h1##s, tmp1 91 sha1h h1##s, tmp1
88 92
89#define sha1_round3(h0, h1, w, k) \ 93#define sha1_round3(h0, h1, w, k) \
90 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ 94 add tmp0.4s, w.4s, k.4s /* Tt = Wt + Kt */ _SEP \
91 mov tmp1, h0.s[0]; \ 95 mov tmp1, h0.s[0] _SEP \
92 sha1m h0##q, h1##s, tmp0.4s; \ 96 sha1m h0##q, h1##s, tmp0.4s _SEP \
93 sha1h h1##s, tmp1 97 sha1h h1##s, tmp1
94 98
95#define sha1_round4(h0, h1, w, k) \ 99#define sha1_round4(h0, h1, w, k) \
96 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ 100 add tmp0.4s, w.4s, k.4s /* Tt = Wt + Kt */ _SEP \
97 mov tmp1, h0.s[0]; \ 101 mov tmp1, h0.s[0] _SEP \
98 sha1p h0##q, h1##s, tmp0.4s; \ 102 sha1p h0##q, h1##s, tmp0.4s _SEP \
99 sha1h h1##s, tmp1 103 sha1h h1##s, tmp1
100 104
101.arch armv8-a+sha2 105.arch armv8-a+sha2
diff --git a/src/lib/libcrypto/sha/sha1_amd64_generic.S b/src/lib/libcrypto/sha/sha1_amd64_generic.S
index 57709c0a1f..a44bd2fdec 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_generic.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha1_amd64_generic.S,v 1.5 2026/03/28 13:11:28 jsing Exp $ */ 1/* $OpenBSD: sha1_amd64_generic.S,v 1.6 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -17,6 +17,8 @@
17 17
18#include "crypto_assembly.h" 18#include "crypto_assembly.h"
19 19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
20#define ctx %rdi 22#define ctx %rdi
21#define in %rsi 23#define in %rsi
22#define num %rdx 24#define num %rdx
@@ -40,8 +42,8 @@
40 * Wt = Mt 42 * Wt = Mt
41 */ 43 */
42#define sha1_message_schedule_load(idx, m, w, wt) \ 44#define sha1_message_schedule_load(idx, m, w, wt) \
43 movl ((idx&0xf)*4)(m), wt; \ 45 movl ((idx&0xf)*4)(m), wt _SEP \
44 bswapl wt; \ 46 bswapl wt _SEP \
45 movl wt, ((idx&0xf)*4)(w) 47 movl wt, ((idx&0xf)*4)(w)
46 48
47/* 49/*
@@ -50,11 +52,11 @@
50 * W0 = rol(W13 ^ W8 ^ W2 ^ W0, 1) 52 * W0 = rol(W13 ^ W8 ^ W2 ^ W0, 1)
51 */ 53 */
52#define sha1_message_schedule_update(idx, w, wt) \ 54#define sha1_message_schedule_update(idx, w, wt) \
53 movl (((idx-3)&0xf)*4)(w), wt; /* W13 */ \ 55 movl (((idx-3)&0xf)*4)(w), wt /* W13 */ _SEP \
54 xorl (((idx-8)&0xf)*4)(w), wt; /* W8 */ \ 56 xorl (((idx-8)&0xf)*4)(w), wt /* W8 */ _SEP \
55 xorl (((idx-14)&0xf)*4)(w), wt; /* W2 */ \ 57 xorl (((idx-14)&0xf)*4)(w), wt /* W2 */ _SEP \
56 xorl (((idx)&0xf)*4)(w), wt; /* W0 */ \ 58 xorl (((idx)&0xf)*4)(w), wt /* W0 */ _SEP \
57 roll $1, wt; \ 59 roll $1, wt _SEP \
58 \ 60 \
59 movl wt, ((idx&0xf)*4)(w) 61 movl wt, ((idx&0xf)*4)(w)
60 62
@@ -69,13 +71,13 @@
69 * Upon completion b = rol(b, 30), e = T, pending rotation. 71 * Upon completion b = rol(b, 30), e = T, pending rotation.
70 */ 72 */
71#define sha1_round(a, b, c, d, e, kt, wt) \ 73#define sha1_round(a, b, c, d, e, kt, wt) \
72 leal kt(wt, e, 1), e; /* Kt + Wt */ \ 74 leal kt(wt, e, 1), e /* Kt + Wt */ _SEP \
73 \ 75 \
74 movl a, tmp1; /* rol(a, 5) */ \ 76 movl a, tmp1 /* rol(a, 5) */ _SEP \
75 roll $5, tmp1; \ 77 roll $5, tmp1 _SEP \
76 addl tmp1, e; \ 78 addl tmp1, e _SEP \
77 \ 79 \
78 roll $30, b; /* rol(b, 30) */ 80 roll $30, b /* rol(b, 30) */
79 81
80/* 82/*
81 * Compute a SHA-1 round with Ch: 83 * Compute a SHA-1 round with Ch:
@@ -87,11 +89,11 @@
87 * Upon completion b = rol(b, 30), e = T, pending rotation. 89 * Upon completion b = rol(b, 30), e = T, pending rotation.
88 */ 90 */
89#define sha1_round_ch(a, b, c, d, e, kt, wt) \ 91#define sha1_round_ch(a, b, c, d, e, kt, wt) \
90 movl c, tmp2; /* Ch */ \ 92 movl c, tmp2 /* Ch */ _SEP \
91 xorl d, tmp2; /* Ch */ \ 93 xorl d, tmp2 /* Ch */ _SEP \
92 andl b, tmp2; /* Ch */ \ 94 andl b, tmp2 /* Ch */ _SEP \
93 xorl d, tmp2; /* Ch */ \ 95 xorl d, tmp2 /* Ch */ _SEP \
94 addl tmp2, e; /* Ch */ \ 96 addl tmp2, e /* Ch */ _SEP \
95 \ 97 \
96 sha1_round(a, b, c, d, e, kt, wt) 98 sha1_round(a, b, c, d, e, kt, wt)
97 99
@@ -105,10 +107,10 @@
105 * Upon completion b = rol(b, 30), e = T, pending rotation. 107 * Upon completion b = rol(b, 30), e = T, pending rotation.
106 */ 108 */
107#define sha1_round_parity(a, b, c, d, e, kt, wt) \ 109#define sha1_round_parity(a, b, c, d, e, kt, wt) \
108 movl b, tmp2; /* Parity */ \ 110 movl b, tmp2 /* Parity */ _SEP \
109 xorl c, tmp2; /* Parity */ \ 111 xorl c, tmp2 /* Parity */ _SEP \
110 xorl d, tmp2; /* Parity */ \ 112 xorl d, tmp2 /* Parity */ _SEP \
111 addl tmp2, e; /* Parity */ \ 113 addl tmp2, e /* Parity */ _SEP \
112 \ 114 \
113 sha1_round(a, b, c, d, e, kt, wt) 115 sha1_round(a, b, c, d, e, kt, wt)
114 116
@@ -122,34 +124,34 @@
122 * Upon completion b = rol(b, 30), e = T, pending rotation. 124 * Upon completion b = rol(b, 30), e = T, pending rotation.
123 */ 125 */
124#define sha1_round_maj(a, b, c, d, e, kt, wt) \ 126#define sha1_round_maj(a, b, c, d, e, kt, wt) \
125 movl c, tmp2; /* Maj */ \ 127 movl c, tmp2 /* Maj */ _SEP \
126 xorl d, tmp2; /* Maj */ \ 128 xorl d, tmp2 /* Maj */ _SEP \
127 andl b, tmp2; /* Maj */ \ 129 andl b, tmp2 /* Maj */ _SEP \
128 movl c, tmp3; /* Maj */ \ 130 movl c, tmp3 /* Maj */ _SEP \
129 andl d, tmp3; /* Maj */ \ 131 andl d, tmp3 /* Maj */ _SEP \
130 xorl tmp2, tmp3; /* Maj */ \ 132 xorl tmp2, tmp3 /* Maj */ _SEP \
131 addl tmp3, e; /* Maj */ \ 133 addl tmp3, e /* Maj */ _SEP \
132 \ 134 \
133 sha1_round(a, b, c, d, e, kt, wt) 135 sha1_round(a, b, c, d, e, kt, wt)
134 136
135#define sha1_round1_load(idx, a, b, c, d, e) \ 137#define sha1_round1_load(idx, a, b, c, d, e) \
136 sha1_message_schedule_load(idx, in, %rsp, tmp0); \ 138 sha1_message_schedule_load(idx, in, %rsp, tmp0) _SEP \
137 sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0) 139 sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0)
138 140
139#define sha1_round1_update(idx, a, b, c, d, e) \ 141#define sha1_round1_update(idx, a, b, c, d, e) \
140 sha1_message_schedule_update(idx, %rsp, tmp0); \ 142 sha1_message_schedule_update(idx, %rsp, tmp0) _SEP \
141 sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0) 143 sha1_round_ch(a, b, c, d, e, 0x5a827999, tmp0)
142 144
143#define sha1_round2_update(idx, a, b, c, d, e) \ 145#define sha1_round2_update(idx, a, b, c, d, e) \
144 sha1_message_schedule_update(idx, %rsp, tmp0); \ 146 sha1_message_schedule_update(idx, %rsp, tmp0) _SEP \
145 sha1_round_parity(a, b, c, d, e, 0x6ed9eba1, tmp0) 147 sha1_round_parity(a, b, c, d, e, 0x6ed9eba1, tmp0)
146 148
147#define sha1_round3_update(idx, a, b, c, d, e) \ 149#define sha1_round3_update(idx, a, b, c, d, e) \
148 sha1_message_schedule_update(idx, %rsp, tmp0); \ 150 sha1_message_schedule_update(idx, %rsp, tmp0) _SEP \
149 sha1_round_maj(a, b, c, d, e, 0x8f1bbcdc, tmp0) 151 sha1_round_maj(a, b, c, d, e, 0x8f1bbcdc, tmp0)
150 152
151#define sha1_round4_update(idx, a, b, c, d, e) \ 153#define sha1_round4_update(idx, a, b, c, d, e) \
152 sha1_message_schedule_update(idx, %rsp, tmp0); \ 154 sha1_message_schedule_update(idx, %rsp, tmp0) _SEP \
153 sha1_round_parity(a, b, c, d, e, 0xca62c1d6, tmp0) 155 sha1_round_parity(a, b, c, d, e, 0xca62c1d6, tmp0)
154 156
155.section .text 157.section .text
diff --git a/src/lib/libcrypto/sha/sha1_amd64_shani.S b/src/lib/libcrypto/sha/sha1_amd64_shani.S
index 7fc5168907..201688785c 100644
--- a/src/lib/libcrypto/sha/sha1_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha1_amd64_shani.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha1_amd64_shani.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */ 1/* $OpenBSD: sha1_amd64_shani.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -17,6 +17,8 @@
17 17
18#include "crypto_assembly.h" 18#include "crypto_assembly.h"
19 19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
20/* 22/*
21 * SHA-1 implementation using the Intel SHA extensions: 23 * SHA-1 implementation using the Intel SHA extensions:
22 * 24 *
@@ -45,25 +47,25 @@
45 47
46 48
47#define sha1_message_schedule_load(idx, m, xmsg) \ 49#define sha1_message_schedule_load(idx, m, xmsg) \
48 movdqu (idx*16)(m), xmsg; \ 50 movdqu (idx*16)(m), xmsg _SEP \
49 pshufb xshufmask, xmsg 51 pshufb xshufmask, xmsg
50 52
51#define sha1_message_schedule_update(xm0, xm1, xm2, xm3) \ 53#define sha1_message_schedule_update(xm0, xm1, xm2, xm3) \
52 sha1msg1 xm1, xm0; \ 54 sha1msg1 xm1, xm0 _SEP \
53 pxor xm2, xm0; \ 55 pxor xm2, xm0 _SEP \
54 sha1msg2 xm3, xm0 56 sha1msg2 xm3, xm0
55 57
56#define sha1_shani_round(fn, xmsg, xe, xe_next) \ 58#define sha1_shani_round(fn, xmsg, xe, xe_next) \
57 sha1nexte xmsg, xe; \ 59 sha1nexte xmsg, xe _SEP \
58 movdqa xabcd, xe_next; \ 60 movdqa xabcd, xe_next _SEP \
59 sha1rnds4 fn, xe, xabcd 61 sha1rnds4 fn, xe, xabcd
60 62
61#define sha1_shani_round_load(fn, idx, m, xmsg, xe, xe_next) \ 63#define sha1_shani_round_load(fn, idx, m, xmsg, xe, xe_next) \
62 sha1_message_schedule_load(idx, m, xmsg); \ 64 sha1_message_schedule_load(idx, m, xmsg) _SEP \
63 sha1_shani_round(fn, xmsg, xe, xe_next) 65 sha1_shani_round(fn, xmsg, xe, xe_next)
64 66
65#define sha1_shani_round_update(fn, xm0, xm1, xm2, xm3, xe, xe_next) \ 67#define sha1_shani_round_update(fn, xm0, xm1, xm2, xm3, xe, xe_next) \
66 sha1_message_schedule_update(xm0, xm1, xm2, xm3); \ 68 sha1_message_schedule_update(xm0, xm1, xm2, xm3) _SEP \
67 sha1_shani_round(fn, xm0, xe, xe_next) 69 sha1_shani_round(fn, xm0, xe, xe_next)
68 70
69 71
diff --git a/src/lib/libcrypto/sha/sha256_aarch64_ce.S b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
index 8a26f91b06..d96ee7ebff 100644
--- a/src/lib/libcrypto/sha/sha256_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha256_aarch64_ce.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha256_aarch64_ce.S,v 1.6 2026/01/25 08:22:17 jsing Exp $ */ 1/* $OpenBSD: sha256_aarch64_ce.S,v 1.7 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -15,6 +15,10 @@
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */ 16 */
17 17
18#include "crypto_assembly.h"
19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
18/* 22/*
19 * SHA-256 implementation using the ARM Cryptographic Extension (CE). 23 * SHA-256 implementation using the ARM Cryptographic Extension (CE).
20 * 24 *
@@ -68,7 +72,7 @@
68 * W0:W1:W2:W3 = sigma1(W14:W15:W0:W1) + W9:W10:W12:W13 + W0:W1:W2:W3 72 * W0:W1:W2:W3 = sigma1(W14:W15:W0:W1) + W9:W10:W12:W13 + W0:W1:W2:W3
69 */ 73 */
70#define sha256_message_schedule_update(m0, m1, m2, m3) \ 74#define sha256_message_schedule_update(m0, m1, m2, m3) \
71 sha256su0 m0.4s, m1.4s; \ 75 sha256su0 m0.4s, m1.4s _SEP \
72 sha256su1 m0.4s, m2.4s, m3.4s 76 sha256su1 m0.4s, m2.4s, m3.4s
73 77
74/* 78/*
@@ -77,16 +81,16 @@
77 * sha256h/sha256h2. 81 * sha256h/sha256h2.
78 */ 82 */
79#define sha256_round(h0, h1, w, k) \ 83#define sha256_round(h0, h1, w, k) \
80 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \ 84 add tmp0.4s, w.4s, k.4s /* Tt = Wt + Kt */ _SEP \
81 mov tmp1.16b, h0.16b; \ 85 mov tmp1.16b, h0.16b _SEP \
82 sha256h h0##q, h1##q, tmp0.4s; \ 86 sha256h h0##q, h1##q, tmp0.4s _SEP \
83 sha256h2 h1##q, tmp1##q, tmp0.4s 87 sha256h2 h1##q, tmp1##q, tmp0.4s
84 88
85#define sha256_round_initial(h0, h1, w, k) \ 89#define sha256_round_initial(h0, h1, w, k) \
86 sha256_round(h0, h1, w, k) 90 sha256_round(h0, h1, w, k)
87 91
88#define sha256_round_update(h0, h1, m0, m1, m2, m3, k) \ 92#define sha256_round_update(h0, h1, m0, m1, m2, m3, k) \
89 sha256_message_schedule_update(m0, m1, m2, m3); \ 93 sha256_message_schedule_update(m0, m1, m2, m3) _SEP \
90 sha256_round(h0, h1, m0, k) 94 sha256_round(h0, h1, m0, k)
91 95
92.arch armv8-a+sha2 96.arch armv8-a+sha2
diff --git a/src/lib/libcrypto/sha/sha256_amd64_generic.S b/src/lib/libcrypto/sha/sha256_amd64_generic.S
index 52ad974eab..f74af0b145 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_generic.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha256_amd64_generic.S,v 1.6 2026/03/28 13:11:28 jsing Exp $ */ 1/* $OpenBSD: sha256_amd64_generic.S,v 1.7 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -17,6 +17,8 @@
17 17
18#include "crypto_assembly.h" 18#include "crypto_assembly.h"
19 19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
20#define ctx %rdi 22#define ctx %rdi
21#define in %rsi 23#define in %rsi
22#define num %rdx 24#define num %rdx
@@ -45,8 +47,8 @@
45 * Wt = Mt 47 * Wt = Mt
46 */ 48 */
47#define sha256_message_schedule_load(idx, m, w, wt) \ 49#define sha256_message_schedule_load(idx, m, w, wt) \
48 movl (m, round, 4), wt; \ 50 movl (m, round, 4), wt _SEP \
49 bswapl wt; \ 51 bswapl wt _SEP \
50 movl wt, ((idx&0xf)*4)(w) 52 movl wt, ((idx&0xf)*4)(w)
51 53
52/* 54/*
@@ -58,25 +60,25 @@
58 * sigma1(x) = ror(x, 17) ^ ror(x, 19) ^ (x >> 10) 60 * sigma1(x) = ror(x, 17) ^ ror(x, 19) ^ (x >> 10)
59 */ 61 */
60#define sha256_message_schedule_update(idx, w, wt) \ 62#define sha256_message_schedule_update(idx, w, wt) \
61 movl (((idx-2)&0xf)*4)(w), wt; /* sigma1 */ \ 63 movl (((idx-2)&0xf)*4)(w), wt /* sigma1 */ _SEP \
62 movl wt, tmp1; /* sigma1 */ \ 64 movl wt, tmp1 /* sigma1 */ _SEP \
63 rorl $(19-17), tmp1; /* sigma1 */ \ 65 rorl $(19-17), tmp1 /* sigma1 */ _SEP \
64 xorl wt, tmp1; /* sigma1 */ \ 66 xorl wt, tmp1 /* sigma1 */ _SEP \
65 rorl $17, tmp1; /* sigma1 */ \ 67 rorl $17, tmp1 /* sigma1 */ _SEP \
66 shrl $10, wt; /* sigma1 */ \ 68 shrl $10, wt /* sigma1 */ _SEP \
67 xorl tmp1, wt; /* sigma1 */ \ 69 xorl tmp1, wt /* sigma1 */ _SEP \
68 \ 70 \
69 addl (((idx-7)&0xf)*4)(w), wt; /* Wt-7 */ \ 71 addl (((idx-7)&0xf)*4)(w), wt /* Wt-7 */ _SEP \
70 addl (((idx-16)&0xf)*4)(w), wt; /* Wt-16 */ \ 72 addl (((idx-16)&0xf)*4)(w), wt /* Wt-16 */ _SEP \
71 \ 73 \
72 movl (((idx-15)&0xf)*4)(w), tmp2; /* sigma0 */ \ 74 movl (((idx-15)&0xf)*4)(w), tmp2 /* sigma0 */ _SEP \
73 movl tmp2, tmp3; /* sigma0 */ \ 75 movl tmp2, tmp3 /* sigma0 */ _SEP \
74 rorl $(18-7), tmp2; /* sigma0 */ \ 76 rorl $(18-7), tmp2 /* sigma0 */ _SEP \
75 xorl tmp3, tmp2; /* sigma0 */ \ 77 xorl tmp3, tmp2 /* sigma0 */ _SEP \
76 rorl $7, tmp2; /* sigma0 */ \ 78 rorl $7, tmp2 /* sigma0 */ _SEP \
77 shrl $3, tmp3; /* sigma0 */ \ 79 shrl $3, tmp3 /* sigma0 */ _SEP \
78 xorl tmp3, tmp2; /* sigma0 */ \ 80 xorl tmp3, tmp2 /* sigma0 */ _SEP \
79 addl tmp2, wt; /* sigma0 */ \ 81 addl tmp2, wt /* sigma0 */ _SEP \
80 \ 82 \
81 movl wt, ((idx&0xf)*4)(w) 83 movl wt, ((idx&0xf)*4)(w)
82 84
@@ -94,49 +96,49 @@
94 * Upon completion d = d + T1, h = T1 + T2, pending rotation. 96 * Upon completion d = d + T1, h = T1 + T2, pending rotation.
95 */ 97 */
96#define sha256_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \ 98#define sha256_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \
97 addl wt, h; /* T1 Wt */ \ 99 addl wt, h /* T1 Wt */ _SEP \
98 addl (k256, round, 4), h; /* T1 Kt */ \ 100 addl (k256, round, 4), h /* T1 Kt */ _SEP \
99 \ 101 \
100 movl e, tmp1; /* T1 Sigma1 */ \ 102 movl e, tmp1 /* T1 Sigma1 */ _SEP \
101 rorl $(25-11), tmp1; /* T1 Sigma1 */ \ 103 rorl $(25-11), tmp1 /* T1 Sigma1 */ _SEP \
102 xorl e, tmp1; /* T1 Sigma1 */ \ 104 xorl e, tmp1 /* T1 Sigma1 */ _SEP \
103 rorl $(11-6), tmp1; /* T1 Sigma1 */ \ 105 rorl $(11-6), tmp1 /* T1 Sigma1 */ _SEP \
104 xorl e, tmp1; /* T1 Sigma1 */ \ 106 xorl e, tmp1 /* T1 Sigma1 */ _SEP \
105 rorl $6, tmp1; /* T1 Sigma1 */ \ 107 rorl $6, tmp1 /* T1 Sigma1 */ _SEP \
106 addl tmp1, h; /* T1 Sigma1 */ \ 108 addl tmp1, h /* T1 Sigma1 */ _SEP \
107 \ 109 \
108 movl f, tmp2; /* T1 Ch */ \ 110 movl f, tmp2 /* T1 Ch */ _SEP \
109 xorl g, tmp2; /* T1 Ch */ \ 111 xorl g, tmp2 /* T1 Ch */ _SEP \
110 andl e, tmp2; /* T1 Ch */ \ 112 andl e, tmp2 /* T1 Ch */ _SEP \
111 xorl g, tmp2; /* T1 Ch */ \ 113 xorl g, tmp2 /* T1 Ch */ _SEP \
112 addl tmp2, h; /* T1 Ch */ \ 114 addl tmp2, h /* T1 Ch */ _SEP \
113 \ 115 \
114 addl h, d; /* d += T1 */ \ 116 addl h, d /* d += T1 */ _SEP \
115 \ 117 \
116 movl a, tmp1; /* T2 Sigma0 */ \ 118 movl a, tmp1 /* T2 Sigma0 */ _SEP \
117 rorl $(22-13), tmp1; /* T2 Sigma0 */ \ 119 rorl $(22-13), tmp1 /* T2 Sigma0 */ _SEP \
118 xorl a, tmp1; /* T2 Sigma0 */ \ 120 xorl a, tmp1 /* T2 Sigma0 */ _SEP \
119 rorl $(13-2), tmp1; /* T2 Sigma0 */ \ 121 rorl $(13-2), tmp1 /* T2 Sigma0 */ _SEP \
120 xorl a, tmp1; /* T2 Sigma0 */ \ 122 xorl a, tmp1 /* T2 Sigma0 */ _SEP \
121 rorl $2, tmp1; /* T2 Sigma0 */ \ 123 rorl $2, tmp1 /* T2 Sigma0 */ _SEP \
122 addl tmp1, h; /* T2 Sigma0 */ \ 124 addl tmp1, h /* T2 Sigma0 */ _SEP \
123 \ 125 \
124 movl b, tmp2; /* T2 Maj */ \ 126 movl b, tmp2 /* T2 Maj */ _SEP \
125 xorl c, tmp2; /* T2 Maj */ \ 127 xorl c, tmp2 /* T2 Maj */ _SEP \
126 andl a, tmp2; /* T2 Maj */ \ 128 andl a, tmp2 /* T2 Maj */ _SEP \
127 movl b, tmp3; /* T2 Maj */ \ 129 movl b, tmp3 /* T2 Maj */ _SEP \
128 andl c, tmp3; /* T2 Maj */ \ 130 andl c, tmp3 /* T2 Maj */ _SEP \
129 xorl tmp2, tmp3; /* T2 Maj */ \ 131 xorl tmp2, tmp3 /* T2 Maj */ _SEP \
130 addl tmp3, h; /* T2 Maj */ \ 132 addl tmp3, h /* T2 Maj */ _SEP \
131 \ 133 \
132 addq $1, round 134 addq $1, round
133 135
134#define sha256_round_load(idx, a, b, c, d, e, f, g, h) \ 136#define sha256_round_load(idx, a, b, c, d, e, f, g, h) \
135 sha256_message_schedule_load(idx, in, %rsp, tmp0); \ 137 sha256_message_schedule_load(idx, in, %rsp, tmp0) _SEP \
136 sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0) 138 sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0)
137 139
138#define sha256_round_update(idx, a, b, c, d, e, f, g, h) \ 140#define sha256_round_update(idx, a, b, c, d, e, f, g, h) \
139 sha256_message_schedule_update(idx, %rsp, tmp0); \ 141 sha256_message_schedule_update(idx, %rsp, tmp0) _SEP \
140 sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0) 142 sha256_round(idx, a, b, c, d, e, f, g, h, k256, %rsp, tmp0)
141 143
142.section .text 144.section .text
diff --git a/src/lib/libcrypto/sha/sha256_amd64_shani.S b/src/lib/libcrypto/sha/sha256_amd64_shani.S
index d86be5be68..2684c809ba 100644
--- a/src/lib/libcrypto/sha/sha256_amd64_shani.S
+++ b/src/lib/libcrypto/sha/sha256_amd64_shani.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha256_amd64_shani.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */ 1/* $OpenBSD: sha256_amd64_shani.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -17,6 +17,8 @@
17 17
18#include "crypto_assembly.h" 18#include "crypto_assembly.h"
19 19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
20/* 22/*
21 * SHA-256 implementation using the Intel SHA extensions: 23 * SHA-256 implementation using the Intel SHA extensions:
22 * 24 *
@@ -50,30 +52,30 @@
50#define xtmp0 %xmm12 52#define xtmp0 %xmm12
51 53
52#define sha256_message_schedule_load(idx, m, xmsgtmp) \ 54#define sha256_message_schedule_load(idx, m, xmsgtmp) \
53 movdqu (idx*16)(m), xmsg; \ 55 movdqu (idx*16)(m), xmsg _SEP \
54 pshufb xshufmask, xmsg; \ 56 pshufb xshufmask, xmsg _SEP \
55 movdqa xmsg, xmsgtmp 57 movdqa xmsg, xmsgtmp
56 58
57#define sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3) \ 59#define sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3) \
58 sha256msg1 xmt1, xmt0; \ 60 sha256msg1 xmt1, xmt0 _SEP \
59 movdqa xmt3, xmsgtmp4; \ 61 movdqa xmt3, xmsgtmp4 _SEP \
60 palignr $4, xmt2, xmsgtmp4; \ 62 palignr $4, xmt2, xmsgtmp4 _SEP \
61 paddd xmsgtmp4, xmt0; \ 63 paddd xmsgtmp4, xmt0 _SEP \
62 sha256msg2 xmt3, xmt0 64 sha256msg2 xmt3, xmt0
63 65
64#define sha256_shani_round(idx) \ 66#define sha256_shani_round(idx) \
65 paddd (idx*16)(k256), xmsg; \ 67 paddd (idx*16)(k256), xmsg _SEP \
66 sha256rnds2 xmsg, xhs0, xhs1; \ 68 sha256rnds2 xmsg, xhs0, xhs1 _SEP \
67 pshufd $0x0e, xmsg, xmsg; \ 69 pshufd $0x0e, xmsg, xmsg _SEP \
68 sha256rnds2 xmsg, xhs1, xhs0 70 sha256rnds2 xmsg, xhs1, xhs0
69 71
70#define sha256_shani_round_load(idx, m, xmsgtmp) \ 72#define sha256_shani_round_load(idx, m, xmsgtmp) \
71 sha256_message_schedule_load(idx, m, xmsgtmp); \ 73 sha256_message_schedule_load(idx, m, xmsgtmp) _SEP \
72 sha256_shani_round(idx) 74 sha256_shani_round(idx)
73 75
74#define sha256_shani_round_update(idx, xmt0, xmt1, xmt2, xmt3) \ 76#define sha256_shani_round_update(idx, xmt0, xmt1, xmt2, xmt3) \
75 sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3); \ 77 sha256_message_schedule_update(xmt0, xmt1, xmt2, xmt3) _SEP \
76 movdqa xmt0, xmsg; \ 78 movdqa xmt0, xmsg _SEP \
77 sha256_shani_round(idx) 79 sha256_shani_round(idx)
78 80
79.section .text 81.section .text
diff --git a/src/lib/libcrypto/sha/sha512_aarch64_ce.S b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
index 6efe775ff5..71d18fbcd4 100644
--- a/src/lib/libcrypto/sha/sha512_aarch64_ce.S
+++ b/src/lib/libcrypto/sha/sha512_aarch64_ce.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha512_aarch64_ce.S,v 1.4 2026/01/25 08:22:17 jsing Exp $ */ 1/* $OpenBSD: sha512_aarch64_ce.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -15,6 +15,10 @@
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */ 16 */
17 17
18#include "crypto_assembly.h"
19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
18/* 22/*
19 * SHA-512 implementation using the ARM Cryptographic Extension (CE). 23 * SHA-512 implementation using the ARM Cryptographic Extension (CE).
20 * 24 *
@@ -103,9 +107,9 @@
103 * W0 = sigma1(W14) + W9 + sigma0(W1) + W0 107 * W0 = sigma1(W14) + W9 + sigma0(W1) + W0
104 */ 108 */
105#define sha512_message_schedule_update(m0, m1, m4, m5, m7) \ 109#define sha512_message_schedule_update(m0, m1, m4, m5, m7) \
106 sha512su0 m0.2d, m1.2d; /* W0 += sigma0(W1) */ \ 110 sha512su0 m0.2d, m1.2d /* W0 += sigma0(W1) */ _SEP \
107 ext tmp2.16b, m4.16b, m5.16b, #8; /* W9:W10 */ \ 111 ext tmp2.16b, m4.16b, m5.16b, #8 /* W9:W10 */ _SEP \
108 sha512su1 m0.2d, m7.2d, tmp2.2d; /* W0 += sigma1(W14) + W9 */ 112 sha512su1 m0.2d, m7.2d, tmp2.2d /* W0 += sigma1(W14) + W9 */
109 113
110/* 114/*
111 * Compute two SHA-512 rounds by adding W0:W1 + K0:K1, then computing T1 for two 115 * Compute two SHA-512 rounds by adding W0:W1 + K0:K1, then computing T1 for two
@@ -142,20 +146,20 @@
142 * These values are then rotated by the caller to perform the next two rounds. 146 * These values are then rotated by the caller to perform the next two rounds.
143 */ 147 */
144#define sha512_round(h0, h1, h2, h3, h4, h5, w, k) \ 148#define sha512_round(h0, h1, h2, h3, h4, h5, w, k) \
145 add h4.2d, w.2d, k.2d; /* W0:W1 += K0:K1 */ \ 149 add h4.2d, w.2d, k.2d /* W0:W1 += K0:K1 */ _SEP \
146 ext h4.16b, h4.16b, h4.16b, #8; /* W1:W0 (swap) */ \ 150 ext h4.16b, h4.16b, h4.16b, #8 /* W1:W0 (swap) */ _SEP \
147 add h4.2d, h4.2d, h3.2d; /* W1:W0 += g:h */ \ 151 add h4.2d, h4.2d, h3.2d /* W1:W0 += g:h */ _SEP \
148 ext tmp0.16b, h2.16b, h3.16b, #8; /* f:g */ \ 152 ext tmp0.16b, h2.16b, h3.16b, #8 /* f:g */ _SEP \
149 ext tmp1.16b, h1.16b, h2.16b, #8; /* d:e */ \ 153 ext tmp1.16b, h1.16b, h2.16b, #8 /* d:e */ _SEP \
150 sha512h h4##q, tmp0##q, tmp1.2d; /* T1 */ \ 154 sha512h h4##q, tmp0##q, tmp1.2d /* T1 */ _SEP \
151 add h5.2d, h1.2d, h4.2d; /* c:d + T1 */ \ 155 add h5.2d, h1.2d, h4.2d /* c:d + T1 */ _SEP \
152 sha512h2 h4##q, h1##q, h0.2d; /* T1 + T2 */ 156 sha512h2 h4##q, h1##q, h0.2d /* T1 + T2 */
153 157
154#define sha512_round_initial(h0, h1, h2, h3, h4, h5, w, k) \ 158#define sha512_round_initial(h0, h1, h2, h3, h4, h5, w, k) \
155 sha512_round(h0, h1, h2, h3, h4, h5, w, k) 159 sha512_round(h0, h1, h2, h3, h4, h5, w, k)
156 160
157#define sha512_round_update(h0, h1, h2, h3, h4, h5, m0, m1, m2, m3, m4, k) \ 161#define sha512_round_update(h0, h1, h2, h3, h4, h5, m0, m1, m2, m3, m4, k) \
158 sha512_message_schedule_update(m0, m1, m2, m3, m4) \ 162 sha512_message_schedule_update(m0, m1, m2, m3, m4) _SEP \
159 sha512_round(h0, h1, h2, h3, h4, h5, m0, k) 163 sha512_round(h0, h1, h2, h3, h4, h5, m0, k)
160 164
161.arch armv8-a+sha3 165.arch armv8-a+sha3
diff --git a/src/lib/libcrypto/sha/sha512_amd64_generic.S b/src/lib/libcrypto/sha/sha512_amd64_generic.S
index de759875f4..fac9d95655 100644
--- a/src/lib/libcrypto/sha/sha512_amd64_generic.S
+++ b/src/lib/libcrypto/sha/sha512_amd64_generic.S
@@ -1,4 +1,4 @@
1/* $OpenBSD: sha512_amd64_generic.S,v 1.4 2026/03/28 13:11:28 jsing Exp $ */ 1/* $OpenBSD: sha512_amd64_generic.S,v 1.5 2026/05/07 15:38:03 jsing Exp $ */
2/* 2/*
3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org> 3 * Copyright (c) 2024 Joel Sing <jsing@openbsd.org>
4 * 4 *
@@ -17,6 +17,8 @@
17 17
18#include "crypto_assembly.h" 18#include "crypto_assembly.h"
19 19
20#define _SEP CRYPTO_ASSEMBLY_SEPARATOR
21
20#define ctx %rdi 22#define ctx %rdi
21#define in %rsi 23#define in %rsi
22#define num %rdx 24#define num %rdx
@@ -45,8 +47,8 @@
45 * Wt = Mt 47 * Wt = Mt
46 */ 48 */
47#define sha512_message_schedule_load(idx, m, w, wt) \ 49#define sha512_message_schedule_load(idx, m, w, wt) \
48 movq (m, round, 8), wt; \ 50 movq (m, round, 8), wt _SEP \
49 bswapq wt; \ 51 bswapq wt _SEP \
50 movq wt, ((idx&0xf)*8)(w) 52 movq wt, ((idx&0xf)*8)(w)
51 53
52/* 54/*
@@ -59,25 +61,25 @@
59 * 61 *
60 */ 62 */
61#define sha512_message_schedule_update(idx, w, wt) \ 63#define sha512_message_schedule_update(idx, w, wt) \
62 movq (((idx-2)&0xf)*8)(w), wt; /* sigma1 */ \ 64 movq (((idx-2)&0xf)*8)(w), wt /* sigma1 */ _SEP \
63 movq wt, tmp1; /* sigma1 */ \ 65 movq wt, tmp1 /* sigma1 */ _SEP \
64 rorq $(61-19), tmp1; /* sigma1 */ \ 66 rorq $(61-19), tmp1 /* sigma1 */ _SEP \
65 xorq wt, tmp1; /* sigma1 */ \ 67 xorq wt, tmp1 /* sigma1 */ _SEP \
66 rorq $19, tmp1; /* sigma1 */ \ 68 rorq $19, tmp1 /* sigma1 */ _SEP \
67 shrq $6, wt; /* sigma1 */ \ 69 shrq $6, wt /* sigma1 */ _SEP \
68 xorq tmp1, wt; /* sigma1 */ \ 70 xorq tmp1, wt /* sigma1 */ _SEP \
69 \ 71 \
70 addq (((idx-7)&0xf)*8)(w), wt; /* Wt-7 */ \ 72 addq (((idx-7)&0xf)*8)(w), wt /* Wt-7 */ _SEP \
71 addq (((idx-16)&0xf)*8)(w), wt; /* Wt-16 */ \ 73 addq (((idx-16)&0xf)*8)(w), wt /* Wt-16 */ _SEP \
72 \ 74 \
73 movq (((idx-15)&0xf)*8)(w), tmp2; /* sigma0 */ \ 75 movq (((idx-15)&0xf)*8)(w), tmp2 /* sigma0 */ _SEP \
74 movq tmp2, tmp3; /* sigma0 */ \ 76 movq tmp2, tmp3 /* sigma0 */ _SEP \
75 rorq $(8-1), tmp2; /* sigma0 */ \ 77 rorq $(8-1), tmp2 /* sigma0 */ _SEP \
76 xorq tmp3, tmp2; /* sigma0 */ \ 78 xorq tmp3, tmp2 /* sigma0 */ _SEP \
77 rorq $1, tmp2; /* sigma0 */ \ 79 rorq $1, tmp2 /* sigma0 */ _SEP \
78 shrq $7, tmp3; /* sigma0 */ \ 80 shrq $7, tmp3 /* sigma0 */ _SEP \
79 xorq tmp3, tmp2; /* sigma0 */ \ 81 xorq tmp3, tmp2 /* sigma0 */ _SEP \
80 addq tmp2, wt; /* sigma0 */ \ 82 addq tmp2, wt /* sigma0 */ _SEP \
81 \ 83 \
82 movq wt, ((idx&0xf)*8)(w) 84 movq wt, ((idx&0xf)*8)(w)
83 85
@@ -95,49 +97,49 @@
95 * Upon completion d = d + T1, h = T1 + T2, pending rotation. 97 * Upon completion d = d + T1, h = T1 + T2, pending rotation.
96 */ 98 */
97#define sha512_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \ 99#define sha512_round(idx, a, b, c, d, e, f, g, h, k, w, wt) \
98 addq wt, h; /* T1 Wt */ \ 100 addq wt, h /* T1 Wt */ _SEP \
99 addq (k512, round, 8), h; /* T1 Kt */ \ 101 addq (k512, round, 8), h /* T1 Kt */ _SEP \
100 \ 102 \
101 movq e, tmp1; /* T1 Sigma1 */ \ 103 movq e, tmp1 /* T1 Sigma1 */ _SEP \
102 rorq $(41-18), tmp1; /* T1 Sigma1 */ \ 104 rorq $(41-18), tmp1 /* T1 Sigma1 */ _SEP \
103 xorq e, tmp1; /* T1 Sigma1 */ \ 105 xorq e, tmp1 /* T1 Sigma1 */ _SEP \
104 rorq $(18-14), tmp1; /* T1 Sigma1 */ \ 106 rorq $(18-14), tmp1 /* T1 Sigma1 */ _SEP \
105 xorq e, tmp1; /* T1 Sigma1 */ \ 107 xorq e, tmp1 /* T1 Sigma1 */ _SEP \
106 rorq $14, tmp1; /* T1 Sigma1 */ \ 108 rorq $14, tmp1 /* T1 Sigma1 */ _SEP \
107 addq tmp1, h; /* T1 Sigma1 */ \ 109 addq tmp1, h /* T1 Sigma1 */ _SEP \
108 \ 110 \
109 movq f, tmp2; /* T1 Ch */ \ 111 movq f, tmp2 /* T1 Ch */ _SEP \
110 xorq g, tmp2; /* T1 Ch */ \ 112 xorq g, tmp2 /* T1 Ch */ _SEP \
111 andq e, tmp2; /* T1 Ch */ \ 113 andq e, tmp2 /* T1 Ch */ _SEP \
112 xorq g, tmp2; /* T1 Ch */ \ 114 xorq g, tmp2 /* T1 Ch */ _SEP \
113 addq tmp2, h; /* T1 Ch */ \ 115 addq tmp2, h /* T1 Ch */ _SEP \
114 \ 116 \
115 addq h, d; /* d += T1 */ \ 117 addq h, d /* d += T1 */ _SEP \
116 \ 118 \
117 movq a, tmp1; /* T2 Sigma0 */ \ 119 movq a, tmp1 /* T2 Sigma0 */ _SEP \
118 rorq $(39-34), tmp1; /* T2 Sigma0 */ \ 120 rorq $(39-34), tmp1 /* T2 Sigma0 */ _SEP \
119 xorq a, tmp1; /* T2 Sigma0 */ \ 121 xorq a, tmp1 /* T2 Sigma0 */ _SEP \
120 rorq $(34-28), tmp1; /* T2 Sigma0 */ \ 122 rorq $(34-28), tmp1 /* T2 Sigma0 */ _SEP \
121 xorq a, tmp1; /* T2 Sigma0 */ \ 123 xorq a, tmp1 /* T2 Sigma0 */ _SEP \
122 rorq $28, tmp1; /* T2 Sigma0 */ \ 124 rorq $28, tmp1 /* T2 Sigma0 */ _SEP \
123 addq tmp1, h; /* T2 Sigma0 */ \ 125 addq tmp1, h /* T2 Sigma0 */ _SEP \
124 \ 126 \
125 movq b, tmp2; /* T2 Maj */ \ 127 movq b, tmp2 /* T2 Maj */ _SEP \
126 xorq c, tmp2; /* T2 Maj */ \ 128 xorq c, tmp2 /* T2 Maj */ _SEP \
127 andq a, tmp2; /* T2 Maj */ \ 129 andq a, tmp2 /* T2 Maj */ _SEP \
128 movq b, tmp3; /* T2 Maj */ \ 130 movq b, tmp3 /* T2 Maj */ _SEP \
129 andq c, tmp3; /* T2 Maj */ \ 131 andq c, tmp3 /* T2 Maj */ _SEP \
130 xorq tmp2, tmp3; /* T2 Maj */ \ 132 xorq tmp2, tmp3 /* T2 Maj */ _SEP \
131 addq tmp3, h; /* T2 Maj */ \ 133 addq tmp3, h /* T2 Maj */ _SEP \
132 \ 134 \
133 addq $1, round 135 addq $1, round
134 136
135#define sha512_round_load(idx, a, b, c, d, e, f, g, h) \ 137#define sha512_round_load(idx, a, b, c, d, e, f, g, h) \
136 sha512_message_schedule_load(idx, in, %rsp, tmp0); \ 138 sha512_message_schedule_load(idx, in, %rsp, tmp0) _SEP \
137 sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0) 139 sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0)
138 140
139#define sha512_round_update(idx, a, b, c, d, e, f, g, h) \ 141#define sha512_round_update(idx, a, b, c, d, e, f, g, h) \
140 sha512_message_schedule_update(idx, %rsp, tmp0); \ 142 sha512_message_schedule_update(idx, %rsp, tmp0) _SEP \
141 sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0) 143 sha512_round(idx, a, b, c, d, e, f, g, h, k512, %rsp, tmp0)
142 144
143.section .text 145.section .text
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2026-09-04 10:22:05 +0000