/* $OpenBSD: sha256_aarch64_ce.S,v 1.6 2026/01/25 08:22:17 jsing Exp $ */
/*
 * Copyright (c) 2023,2025 Joel Sing <jsing@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

/*
 * SHA-256 implementation using the ARM Cryptographic Extension (CE).
 *
 * There are four instructions that enable hardware acceleration of SHA-256,
 * however the documentation for these is woefully inadequate:
 *
 *  sha256h:   hash update - part 1 (without a number to be inconsistent)
 *  sha256h2:  hash update - part 2
 *  sha256su0: message schedule update with sigma0 for four rounds
 *  sha256su1: message schedule update with sigma1 for four rounds
 */

#define ctx             x0
#define in              x1
#define num             x2

#define k256_base       x9
#define k256            x10

/* Note: the lower 64 bits of v8 through v15 are callee save. */

#define hc0             v16
#define hc1             v17

#define hs0             v18
#define hs1             v19

#define w0              v20
#define w1              v21
#define w2              v22
#define w3              v23

#define k0              v24
#define k1              v25
#define k2              v26
#define k3              v27

#define tmp0            v28
#define tmp1            v29
#define tmp1q           q29

#define v18q            q18
#define v19q            q19

/*
 * Update message schedule for m0 (W0:W1:W2:W3), using m1 (W4:W5:W6:W7),
 * m2 (W8:W9:W10:11) and m3 (W12:W13:W14:W15). The sha256su0 instruction
 * computes the sigma0 component of the message schedule update as:
 *   W0:W1:W2:W3 = sigma0(W1:W2:W3:W4) + W0:W1:W2:W3
 * while sha256su1 computes the sigma1 component and adds in W9 as:
 *   W0:W1:W2:W3 = sigma1(W14:W15:W0:W1) + W9:W10:W12:W13 + W0:W1:W2:W3
 */
#define sha256_message_schedule_update(m0, m1, m2, m3) \
        sha256su0 m0.4s, m1.4s;                                         \
        sha256su1 m0.4s, m2.4s, m3.4s

/*
 * Compute four SHA-256 rounds by adding W0:W1:W2:W3 + K0:K1:K2:K3, then
 * computing the remainder of each round (including the shuffle) via
 * sha256h/sha256h2.
 */
#define sha256_round(h0, h1, w, k) \
        add     tmp0.4s, w.4s, k.4s;            /* Tt = Wt + Kt */      \
        mov     tmp1.16b, h0.16b;                                       \
        sha256h h0##q, h1##q, tmp0.4s;                                  \
        sha256h2 h1##q, tmp1##q, tmp0.4s

#define sha256_round_initial(h0, h1, w, k) \
        sha256_round(h0, h1, w, k)

#define sha256_round_update(h0, h1, m0, m1, m2, m3, k) \
        sha256_message_schedule_update(m0, m1, m2, m3);                 \
        sha256_round(h0, h1, m0, k)

.arch   armv8-a+sha2

.section .text

/*
 * void sha256_block_ce(SHA256_CTX *ctx, const void *in, size_t num);
 *
 * Standard ARM ABI: x0 = ctx, x1 = in, x2 = num
 */
.globl  sha256_block_ce
.type   sha256_block_ce,@function
sha256_block_ce:

        /* Address of SHA-256 constants. */
        adrp    k256_base, K256
        add     k256_base, k256_base, :lo12:K256

        /*
         * Load current hash state from context.
         * hc0 = a:b:c:d, hc1 = e:f:g:h
         */
        ld1     {hc0.4s, hc1.4s}, [ctx]

.Lblock_loop:
        mov     k256, k256_base

        /* Copy current hash state. */
        mov     hs0.16b, hc0.16b
        mov     hs1.16b, hc1.16b

        /* Load and byte swap message schedule. */
        ld1     {w0.16b, w1.16b, w2.16b, w3.16b}, [in], #64
        rev32   w0.16b, w0.16b
        rev32   w1.16b, w1.16b
        rev32   w2.16b, w2.16b
        rev32   w3.16b, w3.16b

        /* Rounds 0 through 15 (four rounds at a time). */
        ld1     {k0.4s, k1.4s, k2.4s, k3.4s}, [k256], #64

        sha256_round_initial(hs0, hs1, w0, k0)
        sha256_round_initial(hs0, hs1, w1, k1)
        sha256_round_initial(hs0, hs1, w2, k2)
        sha256_round_initial(hs0, hs1, w3, k3)

        /* Rounds 16 through 31 (four rounds at a time). */
        ld1     {k0.4s, k1.4s, k2.4s, k3.4s}, [k256], #64

        sha256_round_update(hs0, hs1, w0, w1, w2, w3, k0)
        sha256_round_update(hs0, hs1, w1, w2, w3, w0, k1)
        sha256_round_update(hs0, hs1, w2, w3, w0, w1, k2)
        sha256_round_update(hs0, hs1, w3, w0, w1, w2, k3)

        /* Rounds 32 through 47 (four rounds at a time). */
        ld1     {k0.4s, k1.4s, k2.4s, k3.4s}, [k256], #64

        sha256_round_update(hs0, hs1, w0, w1, w2, w3, k0)
        sha256_round_update(hs0, hs1, w1, w2, w3, w0, k1)
        sha256_round_update(hs0, hs1, w2, w3, w0, w1, k2)
        sha256_round_update(hs0, hs1, w3, w0, w1, w2, k3)

        /* Rounds 48 through 63 (four rounds at a time). */
        ld1     {k0.4s, k1.4s, k2.4s, k3.4s}, [k256], #64

        sha256_round_update(hs0, hs1, w0, w1, w2, w3, k0)
        sha256_round_update(hs0, hs1, w1, w2, w3, w0, k1)
        sha256_round_update(hs0, hs1, w2, w3, w0, w1, k2)
        sha256_round_update(hs0, hs1, w3, w0, w1, w2, k3)

        /* Add intermediate state to hash state. */
        add     hc0.4s, hc0.4s, hs0.4s
        add     hc1.4s, hc1.4s, hs1.4s

        sub     num, num, #1
        cbnz    num, .Lblock_loop

        /* Store hash state to context. */
        st1     {hc0.4s, hc1.4s}, [ctx]

        ret

.section .rodata

/*
 * SHA-256 constants - see FIPS 180-4 section 4.2.3.
 */
.align  4
.type   K256,@object
K256:
.long   0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
.long   0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
.long   0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
.long   0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174
.long   0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc
.long   0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da
.long   0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7
.long   0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967
.long   0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13
.long   0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85
.long   0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3
.long   0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070
.long   0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5
.long   0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
.long   0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
.long   0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
.size   K256,.-K256