1 /// -*- mode: asm; asm-comment-char: ?/ -*-
3 /// Fancy SIMD implementation of ChaCha for ARM
5 /// (c) 2016 Straylight/Edgeware
8 ///----- Licensing notice ---------------------------------------------------
10 /// This file is part of Catacomb.
12 /// Catacomb is free software; you can redistribute it and/or modify
13 /// it under the terms of the GNU Library General Public License as
14 /// published by the Free Software Foundation; either version 2 of the
15 /// License, or (at your option) any later version.
17 /// Catacomb is distributed in the hope that it will be useful,
18 /// but WITHOUT ANY WARRANTY; without even the implied warranty of
19 /// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 /// GNU Library General Public License for more details.
22 /// You should have received a copy of the GNU Library General Public
23 /// License along with Catacomb; if not, write to the Free
24 /// Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
25 /// MA 02111-1307, USA.
27 ///--------------------------------------------------------------------------
28 /// External definitions.
31 #include "asm-common.h"
33 ///--------------------------------------------------------------------------
40 FUNC(chacha_core_arm_neon)
42 // Arguments are in registers.
43 // r0 is the number of rounds to perform
44 // r1 points to the input matrix
45 // r2 points to the output matrix
47 // First job is to slurp the matrix into the SIMD registers. vldm
48 // and vstm work on word-aligned data, so this is fine.
52 // [ 8 9 10 11] (c, q10)
53 // [12 13 14 15] (d, q11)
55 // We need a copy for later. Rather than waste time copying them by
56 // hand, we'll use the three-address nature of the instruction set.
57 // But this means that the main loop is offset by a bit.
58 vldmia r1, {QQ(q12, q15)}
60 // a += b; d ^= a; d <<<= 16
64 vshr.u32 q11, q11, #16
67 // c += d; b ^= c; b <<<= 12
68 vadd.u32 q10, q14, q11
75 // Apply (the rest of) a column quarterround to each of the columns
76 // simultaneously. Alas, there doesn't seem to be a packed word
77 // rotate, so we have to synthesize it.
79 // a += b; d ^= a; d <<<= 8
83 vshr.u32 q11, q11, #24
86 // c += d; b ^= c; b <<<= 7
87 vadd.u32 q10, q10, q11
88 vext.32 q11, q11, q11, #3
90 vext.32 q10, q10, q10, #2
95 // The not-quite-transpose conveniently only involves reordering
96 // elements of individual rows, which can be done quite easily. It
97 // doesn't involve any movement of elements between rows, or even
98 // renaming of the rows.
100 // [ 0 1 2 3] [ 0 1 2 3] (a, q8)
101 // [ 4 5 6 7] --> [ 5 6 7 4] (b, q9)
102 // [ 8 9 10 11] [10 11 8 9] (c, q10)
103 // [12 13 14 15] [15 12 13 14] (d, q11)
105 // The reorderings have for the most part been pushed upwards to
107 vext.32 q9, q9, q9, #1
109 // Apply the diagonal quarterround to each of the columns
112 // a += b; d ^= a; d <<<= 16
115 vshl.u32 q0, q11, #16
116 vshr.u32 q11, q11, #16
119 // c += d; b ^= c; b <<<= 12
120 vadd.u32 q10, q10, q11
126 // a += b; d ^= a; d <<<= 8
130 vshr.u32 q11, q11, #24
133 // c += d; b ^= c; b <<<= 7
134 vadd.u32 q10, q10, q11
135 vext.32 q11, q11, q11, #1
137 vext.32 q10, q10, q10, #2
142 // Finally finish off undoing the transpose, and we're done for this
143 // doubleround. Again, most of this was done above so we don't have
144 // to wait for the reorderings.
145 vext.32 q9, q9, q9, #3
147 // Decrement the loop counter and see if we should go round again.
151 // Do the first part of the next round because this loop is offset.
153 // a += b; d ^= a; d <<<= 16
156 vshl.u32 q0, q11, #16
157 vshr.u32 q11, q11, #16
160 // c += d; b ^= c; b <<<= 12
161 vadd.u32 q10, q10, q11
169 // Almost there. Firstly the feedfoward addition.
170 9: vadd.u32 q8, q8, q12
172 vadd.u32 q10, q10, q14
173 vadd.u32 q11, q11, q15
175 // And now we write out the result.
176 vstmia r2, {QQ(q8, q11)}
178 // And with that, we're done.
183 ///----- That's all, folks --------------------------------------------------