sha1-586.pl revision 656d9c7f52f88b3a3daccafa7655dec086c4756e
1#!/usr/bin/env perl 2 3# ==================================================================== 4# [Re]written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL 5# project. The module is, however, dual licensed under OpenSSL and 6# CRYPTOGAMS licenses depending on where you obtain it. For further 7# details see http://www.openssl.org/~appro/cryptogams/. 8# ==================================================================== 9 10# "[Re]written" was achieved in two major overhauls. In 2004 BODY_* 11# functions were re-implemented to address P4 performance issue [see 12# commentary below], and in 2006 the rest was rewritten in order to 13# gain freedom to liberate licensing terms. 14 15# It was noted that Intel IA-32 C compiler generates code which 16# performs ~30% *faster* on P4 CPU than original *hand-coded* 17# SHA1 assembler implementation. To address this problem (and 18# prove that humans are still better than machines:-), the 19# original code was overhauled, which resulted in following 20# performance changes: 21# 22# compared with original compared with Intel cc 23# assembler impl. generated code 24# Pentium -16% +48% 25# PIII/AMD +8% +16% 26# P4 +85%(!) +45% 27# 28# As you can see Pentium came out as looser:-( Yet I reckoned that 29# improvement on P4 outweights the loss and incorporate this 30# re-tuned code to 0.9.7 and later. 31# ---------------------------------------------------------------- 32# <appro@fy.chalmers.se> 33 34$0 =~ m/(.*[\/\\])[^\/\\]+$/; $dir=$1; 35push(@INC,"${dir}","${dir}../../perlasm"); 36require "x86asm.pl"; 37 38&asm_init($ARGV[0],"sha1-586.pl",$ARGV[$#ARGV] eq "386"); 39 40$A="eax"; 41$B="ebx"; 42$C="ecx"; 43$D="edx"; 44$E="edi"; 45$T="esi"; 46$tmp1="ebp"; 47 48@V=($A,$B,$C,$D,$E,$T); 49 50sub BODY_00_15 51 { 52 local($n,$a,$b,$c,$d,$e,$f)=@_; 53 54 &comment("00_15 $n"); 55 56 &mov($f,$c); # f to hold F_00_19(b,c,d) 57 if ($n==0) { &mov($tmp1,$a); } 58 else { &mov($a,$tmp1); } 59 &rotl($tmp1,5); # tmp1=ROTATE(a,5) 60 &xor($f,$d); 61 &add($tmp1,$e); # tmp1+=e; 62 &and($f,$b); 63 &mov($e,&swtmp($n%16)); # e becomes volatile and is loaded 64 # with xi, also note that e becomes 65 # f in next round... 66 &xor($f,$d); # f holds F_00_19(b,c,d) 67 &rotr($b,2); # b=ROTATE(b,30) 68 &lea($tmp1,&DWP(0x5a827999,$tmp1,$e)); # tmp1+=K_00_19+xi 69 70 if ($n==15) { &add($f,$tmp1); } # f+=tmp1 71 else { &add($tmp1,$f); } # f becomes a in next round 72 } 73 74sub BODY_16_19 75 { 76 local($n,$a,$b,$c,$d,$e,$f)=@_; 77 78 &comment("16_19 $n"); 79 80 &mov($f,&swtmp($n%16)); # f to hold Xupdate(xi,xa,xb,xc,xd) 81 &mov($tmp1,$c); # tmp1 to hold F_00_19(b,c,d) 82 &xor($f,&swtmp(($n+2)%16)); 83 &xor($tmp1,$d); 84 &xor($f,&swtmp(($n+8)%16)); 85 &and($tmp1,$b); # tmp1 holds F_00_19(b,c,d) 86 &rotr($b,2); # b=ROTATE(b,30) 87 &xor($f,&swtmp(($n+13)%16)); # f holds xa^xb^xc^xd 88 &rotl($f,1); # f=ROTATE(f,1) 89 &xor($tmp1,$d); # tmp1=F_00_19(b,c,d) 90 &mov(&swtmp($n%16),$f); # xi=f 91 &lea($f,&DWP(0x5a827999,$f,$e));# f+=K_00_19+e 92 &mov($e,$a); # e becomes volatile 93 &rotl($e,5); # e=ROTATE(a,5) 94 &add($f,$tmp1); # f+=F_00_19(b,c,d) 95 &add($f,$e); # f+=ROTATE(a,5) 96 } 97 98sub BODY_20_39 99 { 100 local($n,$a,$b,$c,$d,$e,$f)=@_; 101 local $K=($n<40)?0x6ed9eba1:0xca62c1d6; 102 103 &comment("20_39 $n"); 104 105 &mov($tmp1,$b); # tmp1 to hold F_20_39(b,c,d) 106 &mov($f,&swtmp($n%16)); # f to hold Xupdate(xi,xa,xb,xc,xd) 107 &rotr($b,2); # b=ROTATE(b,30) 108 &xor($f,&swtmp(($n+2)%16)); 109 &xor($tmp1,$c); 110 &xor($f,&swtmp(($n+8)%16)); 111 &xor($tmp1,$d); # tmp1 holds F_20_39(b,c,d) 112 &xor($f,&swtmp(($n+13)%16)); # f holds xa^xb^xc^xd 113 &rotl($f,1); # f=ROTATE(f,1) 114 &add($tmp1,$e); 115 &mov(&swtmp($n%16),$f); # xi=f 116 &mov($e,$a); # e becomes volatile 117 &rotl($e,5); # e=ROTATE(a,5) 118 &lea($f,&DWP($K,$f,$tmp1)); # f+=K_20_39+e 119 &add($f,$e); # f+=ROTATE(a,5) 120 } 121 122sub BODY_40_59 123 { 124 local($n,$a,$b,$c,$d,$e,$f)=@_; 125 126 &comment("40_59 $n"); 127 128 &mov($f,&swtmp($n%16)); # f to hold Xupdate(xi,xa,xb,xc,xd) 129 &mov($tmp1,&swtmp(($n+2)%16)); 130 &xor($f,$tmp1); 131 &mov($tmp1,&swtmp(($n+8)%16)); 132 &xor($f,$tmp1); 133 &mov($tmp1,&swtmp(($n+13)%16)); 134 &xor($f,$tmp1); # f holds xa^xb^xc^xd 135 &mov($tmp1,$b); # tmp1 to hold F_40_59(b,c,d) 136 &rotl($f,1); # f=ROTATE(f,1) 137 &or($tmp1,$c); 138 &mov(&swtmp($n%16),$f); # xi=f 139 &and($tmp1,$d); 140 &lea($f,&DWP(0x8f1bbcdc,$f,$e));# f+=K_40_59+e 141 &mov($e,$b); # e becomes volatile and is used 142 # to calculate F_40_59(b,c,d) 143 &rotr($b,2); # b=ROTATE(b,30) 144 &and($e,$c); 145 &or($tmp1,$e); # tmp1 holds F_40_59(b,c,d) 146 &mov($e,$a); 147 &rotl($e,5); # e=ROTATE(a,5) 148 &add($f,$tmp1); # f+=tmp1; 149 &add($f,$e); # f+=ROTATE(a,5) 150 } 151 152&function_begin("sha1_block_data_order",16); 153 &mov($tmp1,&wparam(0)); # SHA_CTX *c 154 &mov($T,&wparam(1)); # const void *input 155 &mov($A,&wparam(2)); # size_t num 156 &stack_push(16); # allocate X[16] 157 &shl($A,6); 158 &add($A,$T); 159 &mov(&wparam(2),$A); # pointer beyond the end of input 160 &mov($E,&DWP(16,$tmp1));# pre-load E 161 162 &set_label("loop",16); 163 164 # copy input chunk to X, but reversing byte order! 165 for ($i=0; $i<16; $i+=4) 166 { 167 &mov($A,&DWP(4*($i+0),$T)); 168 &mov($B,&DWP(4*($i+1),$T)); 169 &mov($C,&DWP(4*($i+2),$T)); 170 &mov($D,&DWP(4*($i+3),$T)); 171 &bswap($A); 172 &bswap($B); 173 &bswap($C); 174 &bswap($D); 175 &mov(&swtmp($i+0),$A); 176 &mov(&swtmp($i+1),$B); 177 &mov(&swtmp($i+2),$C); 178 &mov(&swtmp($i+3),$D); 179 } 180 &mov(&wparam(1),$T); # redundant in 1st spin 181 182 &mov($A,&DWP(0,$tmp1)); # load SHA_CTX 183 &mov($B,&DWP(4,$tmp1)); 184 &mov($C,&DWP(8,$tmp1)); 185 &mov($D,&DWP(12,$tmp1)); 186 # E is pre-loaded 187 188 for($i=0;$i<16;$i++) { &BODY_00_15($i,@V); unshift(@V,pop(@V)); } 189 for(;$i<20;$i++) { &BODY_16_19($i,@V); unshift(@V,pop(@V)); } 190 for(;$i<40;$i++) { &BODY_20_39($i,@V); unshift(@V,pop(@V)); } 191 for(;$i<60;$i++) { &BODY_40_59($i,@V); unshift(@V,pop(@V)); } 192 for(;$i<80;$i++) { &BODY_20_39($i,@V); unshift(@V,pop(@V)); } 193 194 (($V[5] eq $D) and ($V[0] eq $E)) or die; # double-check 195 196 &mov($tmp1,&wparam(0)); # re-load SHA_CTX* 197 &mov($D,&wparam(1)); # D is last "T" and is discarded 198 199 &add($E,&DWP(0,$tmp1)); # E is last "A"... 200 &add($T,&DWP(4,$tmp1)); 201 &add($A,&DWP(8,$tmp1)); 202 &add($B,&DWP(12,$tmp1)); 203 &add($C,&DWP(16,$tmp1)); 204 205 &mov(&DWP(0,$tmp1),$E); # update SHA_CTX 206 &add($D,64); # advance input pointer 207 &mov(&DWP(4,$tmp1),$T); 208 &cmp($D,&wparam(2)); # have we reached the end yet? 209 &mov(&DWP(8,$tmp1),$A); 210 &mov($E,$C); # C is last "E" which needs to be "pre-loaded" 211 &mov(&DWP(12,$tmp1),$B); 212 &mov($T,$D); # input pointer 213 &mov(&DWP(16,$tmp1),$C); 214 &jb(&label("loop")); 215 216 &stack_pop(16); 217&function_end("sha1_block_data_order"); 218 219&asm_finish(); 220