1 /// -*- mode: asm; asm-comment-char: ?/ -*-
3 /// Fancy SIMD implementation of Salsa20 for ARM
5 /// (c) 2016 Straylight/Edgeware
8 ///----- Licensing notice ---------------------------------------------------
10 /// This file is part of Catacomb.
12 /// Catacomb is free software; you can redistribute it and/or modify
13 /// it under the terms of the GNU Library General Public License as
14 /// published by the Free Software Foundation; either version 2 of the
15 /// License, or (at your option) any later version.
17 /// Catacomb is distributed in the hope that it will be useful,
18 /// but WITHOUT ANY WARRANTY; without even the implied warranty of
19 /// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 /// GNU Library General Public License for more details.
22 /// You should have received a copy of the GNU Library General Public
23 /// License along with Catacomb; if not, write to the Free
24 /// Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
25 /// MA 02111-1307, USA.
27 ///--------------------------------------------------------------------------
28 /// External definitions.
31 #include "asm-common.h"
33 ///--------------------------------------------------------------------------
40 FUNC(salsa20_core_arm_neon)
42 // Arguments are in registers.
43 // r0 is the number of rounds to perform
44 // r1 points to the input matrix
45 // r2 points to the output matrix
47 // First job is to slurp the matrix into the SIMD registers. The
48 // words have already been permuted conveniently to make them line up
49 // better for SIMD processing.
51 // The textbook arrangement of the matrix is this.
58 // But we've rotated the columns up so that the main diagonal with
59 // the constants on it end up in the first row, giving something more
67 // so the transformation looks like this:
69 // [ 0 1 2 3] [ 0 5 10 15] (a, q8)
70 // [ 4 5 6 7] --> [ 4 9 14 3] (b, q9)
71 // [ 8 9 10 11] [ 8 13 2 7] (c, q10)
72 // [12 13 14 15] [12 1 6 11] (d, q11)
76 // [ 8 9 10 11] (c, q10)
77 // [12 13 14 15] (d, q11)
79 // We need a copy for later. Rather than waste time copying them by
80 // hand, we'll use the three-address nature of the instruction set.
81 // But this means that the main loop is offset by a bit.
84 // Apply a column quarterround to each of the columns simultaneously,
85 // moving the results to their working registers. Alas, there
86 // doesn't seem to be a packed word rotate, so we have to synthesize
103 // d ^= (c + b) <<< 13
105 vext.32 q9, q9, q9, #3
111 // a ^= (d + c) <<< 18
112 vadd.u32 q0, q11, q10
113 vext.32 q10, q10, q10, #2
114 vext.32 q11, q11, q11, #1
121 // The transpose conveniently only involves reordering elements of
122 // individual rows, which can be done quite easily, and reordering
123 // the rows themselves, which is a trivial renaming. It doesn't
124 // involve any movement of elements between rows.
126 // [ 0 5 10 15] [ 0 5 10 15] (a, q8)
127 // [ 4 9 14 3] --> [ 1 6 11 12] (b, q11)
128 // [ 8 13 2 7] [ 2 7 8 13] (c, q10)
129 // [12 1 6 11] [ 3 4 9 14] (d, q9)
131 // The reorderings have been pushed upwards to reduce delays.
133 // Apply the row quarterround to each of the columns (yes!)
136 // b ^= (a + d) <<< 7
143 // c ^= (b + a) <<< 9
150 // d ^= (c + b) <<< 13
151 vadd.u32 q0, q10, q11
152 vext.32 q11, q11, q11, #3
158 // a ^= (d + c) <<< 18
160 vext.32 q10, q10, q10, #2
161 vext.32 q9, q9, q9, #1
167 // We had to undo the transpose ready for the next loop. Again, push
168 // back the reorderings to reduce latency. Decrement the loop
169 // counter and see if we should go round again.
173 // Do the first half of the next round because this loop is offset.
175 // b ^= (a + d) <<< 7
182 // c ^= (b + a) <<< 9
189 // d ^= (c + b) <<< 13
191 vext.32 q9, q9, q9, #3
197 // a ^= (d + c) <<< 18
198 vadd.u32 q0, q11, q10
199 vext.32 q10, q10, q10, #2
200 vext.32 q11, q11, q11, #1
208 // Almost there. Firstly the feedfoward addition.
209 9: vadd.u32 q0, q8, q12 // 0, 5, 10, 15
210 vadd.u32 q9, q9, q13 // 4, 9, 14, 3
211 vadd.u32 q10, q10, q14 // 8, 13, 2, 7
212 vadd.u32 q11, q11, q15 // 12, 1, 6, 11
214 // Next we must undo the permutation which was already applied to the
215 // input. This can be done juggling values in registers, with the
216 // following fancy footwork: some row rotations, a transpose, and
217 // some more rotations.
218 vext.32 q9, q9, q9, #3 // 3, 4, 9, 14
219 vext.32 q10, q10, q10, #2 // 2, 7, 8, 13
220 vext.32 q11, q11, q11, #1 // 1, 6, 11, 12
222 vzip.32 q0, q10 // 0, 2, 5, 7
224 vzip.32 q11, q9 // 1, 3, 6, 4
227 vzip.32 q0, q11 // 0, 1, 2, 3
229 vzip.32 q10, q9 // 10, 11, 8, 9
232 vext.32 q1, q11, q11, #3 // 4, 5, 6, 7
233 vext.32 q2, q10, q10, #2 // 8, 9, 10, 11
234 vext.32 q3, q9, q9, #1 // 12, 13, 14, 15
236 // And with that, we're done.
242 ///----- That's all, folks --------------------------------------------------