RISC-V: shorten the SHA-512 round chain

Apply the same round restructuring as for SHA-256.

Signed-off-by: Julian Zhu <[email protected]>
Reviewed-by: Paul Dale <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Fri Oct  2 08:26:49 2026
Merged-from: https://github.com/openssl/openssl/pull/33008
(cherry picked from commit 0855b7fb7ea06bcbc29e0445461d295a4497ac58)

1 files changed, 79 insertions, 148 deletions

diff --git a/crypto/sha/asm/sha512-riscv64-zbb.pl b/crypto/sha/asm/sha512-riscv64-zbb.pl
index 6c86e1d0685..142c32b3a6e 100644
--- a/crypto/sha/asm/sha512-riscv64-zbb.pl
+++ b/crypto/sha/asm/sha512-riscv64-zbb.pl
@@ -2,7 +2,7 @@
 # This file is dual-licensed, meaning that you can use it under your
 # choice of either of the following two licenses:
 #
-# Copyright 2025 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2025-2026 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License"). You can obtain
 # a copy in the file LICENSE in the source distribution or at
@@ -10,7 +10,7 @@
 #
 # or
 #
-# Copyright (c) 2025, Julian Zhu <[email protected]>
+# Copyright (c) 2025-2026, Julian Zhu <[email protected]>
 # All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -62,102 +62,101 @@ my $K512 = "K512";
 # Function arguments
 my ($INP, $LEN, $ADDR) = ("a1", "a2", "sp");
 my ($KT, $T1, $T2, $T3, $T4, $T5, $T6) = ("t0", "t1", "t2", "t3", "t4", "t5", "t6");
+# Parity-indexed pairs: W = W[i], U = W[i-15], X = a ^ b
+my ($W0, $W1, $U0, $U1, $X0, $X1) = ("a5", "a6", "a7", "s0", "s1", "s10");
 my ($A, $B, $C, $D ,$E ,$F ,$G ,$H) = ("s2", "s3", "s4", "s5", "s6", "s7", "s8", "s9");
 
 sub MSGSCHEDULE0 {
-    my (
-        $index,
-    ) = @_;
+    my ($index) = @_;
+    my $Wi = ($index & 1) ? $W1 : $W0;
     my $code=<<___;
-    ld $T1, (8*$index+0)($INP)
-    @{[rev8 $T1, $T1]}
-    sd $T1, 8*$index($ADDR)
+    ld $Wi, 8*$index($INP)
+    @{[rev8 $Wi, $Wi]}
+    sd $Wi, 8*$index($ADDR)
 ___
 
     return $code;
 }
 
+# W[i-2] and W[i-16] are already in registers
 sub MSGSCHEDULE1 {
-    my (
-        $INDEX,
-    ) = @_;
+    my ($INDEX) = @_;
+    my $Wi2 = ($INDEX & 1) ? $W1 : $W0;
+    # W[i] overwrites W[i-2], so it is written last
+    my $Wi = $Wi2;
+    my $Wi15 = ($INDEX & 1) ? $U1 : $U0;
+    my $Wi16 = ($INDEX & 1) ? $U0 : $U1;
     my $code=<<___;
-    ld $T1, (($INDEX-2)&0x0f)*8($ADDR)
-    ld $T2, (($INDEX-15)&0x0f)*8($ADDR)
     ld $T3, (($INDEX-7)&0x0f)*8($ADDR)
-    ld $T4, ($INDEX&0x0f)*8($ADDR)
-    @{[rori $T5, $T1, 19]}
-    @{[rori $T6, $T1, 61]}
-    srli $T1, $T1, 6
+    ld $Wi15, (($INDEX-15)&0x0f)*8($ADDR)
+    @{[rori $T5, $Wi2, 19]}
+    @{[rori $T6, $Wi2, 61]}
+    srli $T1, $Wi2, 6
     xor $T1, $T1, $T5
     xor $T1, $T1, $T6
     add $T1, $T1, $T3
-    @{[rori $T5, $T2, 1]}
-    @{[rori $T6, $T2, 8]}
-    srli $T2, $T2, 7
+    @{[rori $T5, $Wi15, 1]}
+    @{[rori $T6, $Wi15, 8]}
+    srli $T2, $Wi15, 7
     xor $T2, $T2, $T5
     xor $T2, $T2, $T6
-    add $T1, $T1, $T2
-    add $T1, $T1, $T4
-    sd $T1, 8*($INDEX&0x0f)($ADDR)
+    add $T2, $T2, $Wi16
+    add $Wi, $T1, $T2
+    sd $Wi, 8*($INDEX&0x0f)($ADDR)
 ___
 
     return $code;
 }
 
 sub sha512_T1 {
-    my (
-        $INDEX, $e, $f, $g, $h,
-    ) = @_;
+    my ($INDEX, $e, $f, $g, $h) = @_;
+    my $Wi = ($INDEX & 1) ? $W1 : $W0;
     my $code=<<___;
     ld $T4, 8*$INDEX($KT)
-    add $h, $h, $T1
-    add $h, $h, $T4
     @{[rori $T2, $e, 14]}
     @{[rori $T3, $e, 18]}
-    @{[rori $T4, $e, 41]}
-    xor $T2, $T2, $T3
+    @{[rori $T5, $e, 41]}
+    add $h, $h, $Wi
     xor $T1, $f, $g
-    xor $T2, $T2, $T4
+    add $h, $h, $T4
+    xor $T2, $T2, $T3
     and $T1, $T1, $e
-    add $h, $h, $T2
+    xor $T2, $T2, $T5
     xor $T1, $T1, $g
-    add $T1, $T1, $h
+    add $T2, $T2, $h
+    add $T1, $T1, $T2
 ___
 
     return $code;
 }
 
 sub sha512_T2 {
-    my (
-        $a, $b, $c,
-    ) = @_;
+    my ($INDEX, $a, $b, $c) = @_;
+    my $Xab = ($INDEX & 1) ? $X1 : $X0;
+    my $Xbc = ($INDEX & 1) ? $X0 : $X1;
     my $code=<<___;
     # Sigma0
     @{[rori $T2, $a, 28]}
     @{[rori $T3, $a, 34]}
     @{[rori $T4, $a, 39]}
-    xor $T2, $T2, $T3
     # Maj
-    xor $T5, $b, $c
-    and $T3, $b, $c
-    and $T5, $T5, $a
+    xor $Xab, $a, $b
+    xor $T2, $T2, $T3
+    and $T5, $Xab, $Xbc
     xor $T2, $T2, $T4
-    xor $T3, $T3, $T5
+    xor $T5, $T5, $b
     # T2
-    add $T2, $T2, $T3
+    add $T2, $T2, $T5
 ___
 
     return $code;
 }
 
 sub SHA512ROUND {
-    my (
-        $INDEX, $a, $b, $c, $d, $e, $f, $g, $h
-    ) = @_;
+    my ($INDEX, $a, $b, $c, $d, $e, $f, $g, $h) = @_;
     my $code=<<___;
     @{[sha512_T1 $INDEX, $e, $f, $g, $h]}
-    @{[sha512_T2 $a, $b, $c]}
+    @{[sha512_T2 $INDEX, $a, $b, $c]}
     add $d, $d, $T1
     add $h, $T2, $T1
 ___
@@ -166,9 +165,7 @@ ___
 }
 
 sub SHA512ROUND0 {
-    my (
-        $INDEX, $a, $b, $c, $d, $e, $f, $g, $h
-    ) = @_;
+    my ($INDEX, $a, $b, $c, $d, $e, $f, $g, $h) = @_;
     my $code=<<___;
     @{[MSGSCHEDULE0 $INDEX]}
     @{[SHA512ROUND $INDEX, $a, $b, $c, $d, $e, $f, $g, $h]}
@@ -178,9 +175,7 @@ ___
 }
 
 sub SHA512ROUND1 {
-    my (
-        $INDEX, $a, $b, $c, $d, $e, $f, $g, $h
-    ) = @_;
+    my ($INDEX, $a, $b, $c, $d, $e, $f, $g, $h) = @_;
     my $code=<<___;
     @{[MSGSCHEDULE1 $INDEX]}
     @{[SHA512ROUND $INDEX, $a, $b, $c, $d, $e, $f, $g, $h]}
@@ -230,106 +225,42 @@ L_round_loop:
     # Decrement length by 1
     addi $LEN, $LEN, -1
 
-    @{[SHA512ROUND0 0, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND0 1, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND0 2, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND0 3, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND0 4, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND0 5, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND0 6, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND0 7, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND0 8, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND0 9, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND0 10, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND0 11, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND0 12, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND0 13, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND0 14, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND0 15, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND1 16, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 17, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 18, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 19, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND1 20, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 21, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 22, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 23, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND1 24, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 25, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 26, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 27, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND1 28, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 29, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 30, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 31, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND1 32, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 33, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 34, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 35, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND1 36, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 37, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 38, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 39, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND1 40, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 41, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 42, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 43, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND1 44, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 45, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 46, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 47, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND1 48, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 49, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 50, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 51, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND1 52, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 53, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 54, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 55, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND1 56, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 57, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 58, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 59, $F, $G, $H, $A, $B, $C, $D, $E]}
-
-    @{[SHA512ROUND1 60, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 61, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 62, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 63, $B, $C, $D, $E, $F, $G, $H, $A]}
-
-    @{[SHA512ROUND1 64, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 65, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 66, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 67, $F, $G, $H, $A, $B, $C, $D, $E]}
+    # b ^ c for round 0's Maj; later rounds reuse the previous a ^ b
+    xor $X1, $B, $C
+___
 
-    @{[SHA512ROUND1 68, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 69, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 70, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 71, $B, $C, $D, $E, $F, $G, $H, $A]}
+for (my $i = 0; $i < 16; $i += 8) {
+    $code .= <<___;
+    @{[SHA512ROUND0 $i, $A, $B, $C, $D, $E, $F, $G, $H]}
+    @{[SHA512ROUND0 $i+1, $H, $A, $B, $C, $D, $E, $F, $G]}
+    @{[SHA512ROUND0 $i+2, $G, $H, $A, $B, $C, $D, $E, $F]}
+    @{[SHA512ROUND0 $i+3, $F, $G, $H, $A, $B, $C, $D, $E]}
+    @{[SHA512ROUND0 $i+4, $E, $F, $G, $H, $A, $B, $C, $D]}
+    @{[SHA512ROUND0 $i+5, $D, $E, $F, $G, $H, $A, $B, $C]}
+    @{[SHA512ROUND0 $i+6, $C, $D, $E, $F, $G, $H, $A, $B]}
+    @{[SHA512ROUND0 $i+7, $B, $C, $D, $E, $F, $G, $H, $A]}
+___
+}
 
-    @{[SHA512ROUND1 72, $A, $B, $C, $D, $E, $F, $G, $H]}
-    @{[SHA512ROUND1 73, $H, $A, $B, $C, $D, $E, $F, $G]}
-    @{[SHA512ROUND1 74, $G, $H, $A, $B, $C, $D, $E, $F]}
-    @{[SHA512ROUND1 75, $F, $G, $H, $A, $B, $C, $D, $E]}
+$code .= <<___;
+    # Round 16's W[i-16] is W[0]; later rounds reuse the previous W[i-15]
+    ld $U1, 0($ADDR)
+___
 
-    @{[SHA512ROUND1 76, $E, $F, $G, $H, $A, $B, $C, $D]}
-    @{[SHA512ROUND1 77, $D, $E, $F, $G, $H, $A, $B, $C]}
-    @{[SHA512ROUND1 78, $C, $D, $E, $F, $G, $H, $A, $B]}
-    @{[SHA512ROUND1 79, $B, $C, $D, $E, $F, $G, $H, $A]}
+for (my $i = 16; $i < 80; $i += 8) {
+    $code .= <<___;
+    @{[SHA512ROUND1 $i, $A, $B, $C, $D, $E, $F, $G, $H]}
+    @{[SHA512ROUND1 $i+1, $H, $A, $B, $C, $D, $E, $F, $G]}
+    @{[SHA512ROUND1 $i+2, $G, $H, $A, $B, $C, $D, $E, $F]}
+    @{[SHA512ROUND1 $i+3, $F, $G, $H, $A, $B, $C, $D, $E]}
+    @{[SHA512ROUND1 $i+4, $E, $F, $G, $H, $A, $B, $C, $D]}
+    @{[SHA512ROUND1 $i+5, $D, $E, $F, $G, $H, $A, $B, $C]}
+    @{[SHA512ROUND1 $i+6, $C, $D, $E, $F, $G, $H, $A, $B]}
+    @{[SHA512ROUND1 $i+7, $B, $C, $D, $E, $F, $G, $H, $A]}
+___
+}
 
+$code .= <<___;
     ld $T1, 0(a0)
     ld $T2, 8(a0)
     ld $T3, 16(a0)