summaryrefslogtreecommitdiff
path: root/src/lib/libcrypto/sha/sha1_aarch64_ce.S
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib/libcrypto/sha/sha1_aarch64_ce.S')
-rw-r--r--src/lib/libcrypto/sha/sha1_aarch64_ce.S214
1 files changed, 214 insertions, 0 deletions
diff --git a/src/lib/libcrypto/sha/sha1_aarch64_ce.S b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
new file mode 100644
index 0000000000..8ccf230298
--- /dev/null
+++ b/src/lib/libcrypto/sha/sha1_aarch64_ce.S
@@ -0,0 +1,214 @@
1/* $OpenBSD: sha1_aarch64_ce.S,v 1.1 2025/06/28 12:51:08 jsing Exp $ */
2/*
3 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 */
17
18/*
19 * SHA-1 implementation using the ARM Cryptographic Extension (CE).
20 *
21 * There are six instructions for hardware acceleration of SHA-1 - the
22 * documentation for these instructions is woefully inadequate:
23 *
24 * sha1c: hash update (choose)
25 * sha1h: fixed rotate
26 * sha1m: hash update (majority)
27 * sha1p: hash update (parity)
28 * sha1su0: message schedule update with sigma0 for four rounds
29 * sha1su1: message schedule update with sigma1 for four rounds
30 */
31
32#define ctx x0
33#define in x1
34#define num x2
35
36/* Note: the lower 64 bits of v8 through v15 are callee saved. */
37
38#define hc0 v16
39#define hc1 v17
40#define hc1s s17
41
42#define hs0 v18
43#define hs1 v19
44#define hs1s s19
45
46#define w0 v20
47#define w1 v21
48#define w2 v22
49#define w3 v23
50
51#define k0 v24
52#define k1 v25
53#define k2 v26
54#define k3 v27
55
56#define tmp0 v28
57#define tmp1 s29
58
59#define tmp2 w11
60
61/*
62 * Update message schedule for m0 (W0:W1:W2:W3), using m1 (W4:W5:W6:W7),
63 * m2 (W8:W9:W10:11) and m3 (W12:W13:W14:W15). The sha1su0 instruction computes
64 * W0 = W8 ^ W2 ^ W0, while sha1su1 computes rol(W0 ^ W13, 1).
65 */
66#define sha1_message_schedule_update(m0, m1, m2, m3) \
67 sha1su0 m0.4s, m1.4s, m2.4s; \
68 sha1su1 m0.4s, m3.4s;
69
70/*
71 * Compute four SHA-1 rounds by adding W0:W1:W2:W3 + K0:K1:K2:K3, then
72 * computing the remainder of each round (including the shuffle) via
73 * sha1{c,p,m}/sha1h.
74 */
75
76#define sha1_round1(h0, h1, w, k) \
77 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
78 mov tmp1, h0.s[0]; \
79 sha1c h0, h1, tmp0.4s; \
80 sha1h h1, tmp1;
81
82#define sha1_round2(h0, h1, w, k) \
83 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
84 mov tmp1, h0.s[0]; \
85 sha1p h0, h1, tmp0.4s; \
86 sha1h h1, tmp1;
87
88#define sha1_round3(h0, h1, w, k) \
89 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
90 mov tmp1, h0.s[0]; \
91 sha1m h0, h1, tmp0.4s; \
92 sha1h h1, tmp1;
93
94#define sha1_round4(h0, h1, w, k) \
95 add tmp0.4s, w.4s, k.4s; /* Tt = Wt + Kt */ \
96 mov tmp1, h0.s[0]; \
97 sha1p h0, h1, tmp0.4s; \
98 sha1h h1, tmp1;
99
100.arch armv8-a+sha2
101
102.text
103
104/*
105 * void sha1_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
106 *
107 * Standard ARM ABI: x0 = ctx, x1 = in, x2 = num
108 */
109.globl sha1_block_ce
110.type sha1_block_ce,@function
111sha1_block_ce:
112
113 /*
114 * Load SHA-1 round constants.
115 */
116
117 /* Round 1 - 0x5a827999 */
118 movz tmp2, #0x5a82, lsl #16
119 movk tmp2, #0x7999
120 dup k0.4s, tmp2
121
122 /* Round 2 - 0x6ed9eba1 */
123 movz tmp2, #0x6ed9, lsl #16
124 movk tmp2, #0xeba1
125 dup k1.4s, tmp2
126
127 /* Round 3 - 0x8f1bbcdc */
128 movz tmp2, #0x8f1b, lsl #16
129 movk tmp2, #0xbcdc
130 dup k2.4s, tmp2
131
132 /* Round 4 - 0xca62c1d6 */
133 movz tmp2, #0xca62, lsl #16
134 movk tmp2, #0xc1d6
135 dup k3.4s, tmp2
136
137 /* Load current hash state from context (hc0 = a:b:c:d, hc1 = e). */
138 ld1 {hc0.4s}, [ctx]
139 ldr hc1s, [ctx, #(4*4)]
140
141block_loop:
142 /* Copy current hash state. */
143 mov hs0.4s, hc0.4s
144 mov hs1s, hc1.s[0]
145
146 /* Load and byte swap message schedule. */
147 ld1 {w0.16b, w1.16b, w2.16b, w3.16b}, [in], #64
148 rev32 w0.16b, w0.16b
149 rev32 w1.16b, w1.16b
150 rev32 w2.16b, w2.16b
151 rev32 w3.16b, w3.16b
152
153 /* Rounds 0 through 15 (four rounds at a time). */
154 sha1_round1(hs0, hs1s, w0, k0)
155 sha1_round1(hs0, hs1s, w1, k0)
156 sha1_round1(hs0, hs1s, w2, k0)
157 sha1_round1(hs0, hs1s, w3, k0)
158
159 /* Rounds 16 through 31 (four rounds at a time). */
160 sha1_message_schedule_update(w0, w1, w2, w3)
161 sha1_message_schedule_update(w1, w2, w3, w0)
162 sha1_message_schedule_update(w2, w3, w0, w1)
163 sha1_message_schedule_update(w3, w0, w1, w2)
164
165 sha1_round1(hs0, hs1s, w0, k0)
166 sha1_round2(hs0, hs1s, w1, k1)
167 sha1_round2(hs0, hs1s, w2, k1)
168 sha1_round2(hs0, hs1s, w3, k1)
169
170 /* Rounds 32 through 47 (four rounds at a time). */
171 sha1_message_schedule_update(w0, w1, w2, w3)
172 sha1_message_schedule_update(w1, w2, w3, w0)
173 sha1_message_schedule_update(w2, w3, w0, w1)
174 sha1_message_schedule_update(w3, w0, w1, w2)
175
176 sha1_round2(hs0, hs1s, w0, k1)
177 sha1_round2(hs0, hs1s, w1, k1)
178 sha1_round3(hs0, hs1s, w2, k2)
179 sha1_round3(hs0, hs1s, w3, k2)
180
181 /* Rounds 48 through 63 (four rounds at a time). */
182 sha1_message_schedule_update(w0, w1, w2, w3)
183 sha1_message_schedule_update(w1, w2, w3, w0)
184 sha1_message_schedule_update(w2, w3, w0, w1)
185 sha1_message_schedule_update(w3, w0, w1, w2)
186
187 sha1_round3(hs0, hs1s, w0, k2)
188 sha1_round3(hs0, hs1s, w1, k2)
189 sha1_round3(hs0, hs1s, w2, k2)
190 sha1_round4(hs0, hs1s, w3, k3)
191
192 /* Rounds 64 through 79 (four rounds at a time). */
193 sha1_message_schedule_update(w0, w1, w2, w3)
194 sha1_message_schedule_update(w1, w2, w3, w0)
195 sha1_message_schedule_update(w2, w3, w0, w1)
196 sha1_message_schedule_update(w3, w0, w1, w2)
197
198 sha1_round4(hs0, hs1s, w0, k3)
199 sha1_round4(hs0, hs1s, w1, k3)
200 sha1_round4(hs0, hs1s, w2, k3)
201 sha1_round4(hs0, hs1s, w3, k3)
202
203 /* Add intermediate state to hash state. */
204 add hc0.4s, hc0.4s, hs0.4s
205 add hc1.4s, hc1.4s, hs1.4s
206
207 sub num, num, #1
208 cbnz num, block_loop
209
210 /* Store hash state to context. */
211 st1 {hc0.4s}, [ctx]
212 str hc1s, [ctx, #(4*4)]
213
214 ret
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-08-17 02:31:25 +0000