/* Copyright lowRISC contributors.
 * Copyright 2016 The Chromium OS Authors. All rights reserved.
 * Use of this source code is governed by a BSD-style license that can be
 * found in the LICENSE.dcrypto file.
 */

/**
 * This library implements hash computation as specified in FIPS PUB 180-4
 * "Secure Hash Standard (SHS)".
 *
 * Terminology within the comments in this library is based (as much as
 * possible) on the terminology of FIPS 180-4.
 *
 * The functions named with the greek sigma have been renamed:
 *   - sigma_lowercase(x) -> s(x)
 *   - sigma_uppercase(x) -> S(x)
 *
 * Upercase W_i denotes the i-th word from the message schedule.
 * Uppercase M_i denotes the i_th message word of the current chunk.
 * Uppercase K_i denotes the i-th round constant.
 */


.section .text


/**
 * Compute SHA-512 hash
 *
 * Updates the SHA-512 state for n subsequent 1024-bit chunks of a
 * pre-formatted message.
 *
 * The message is expected in dmem in a pre-processed format:
 *  - The message has been padded according to the SHA-512 standard.
 *  - The padded message has been broken down into 64-bit sized big-endian
 *    words. I.e. for a message stored at dmem address a, the expected
 *    formating for the first 16 message bytes is as follows
 *    (where mn denotes the n-th message byte):
 *    |a+15|a+14|a+13|a+12|a+11|a+10|a+9|a+8|a+7|a+6|a+5|a+4|a+3|a+2|a+1|a+0|
 *    |  m8|  m9| m10| m11| m12| m13|m14|m15| m0| m1| m2| m3| m4| m5| m6| m7|
 *
 * The state variables H[0] to H[7] are expected in dmem in 8 subsequent
 * 256-bit memory cells, where each state variable occupies the lower 64 bit
 * of such a cell. For the state stored at dmem address a the expected format
 * is as follows:
 *  dmem[a +    ][63:0]: H[0]
 *  dmem[a +  32][63:0]: H[1]
 *  dmem[a +  64][63:0]: H[2]
 *  dmem[a +  96][63:0]: H[3]
 *  dmem[a + 128][63:0]: H[4]
 *  dmem[a + 160][63:0]: H[5]
 *  dmem[a + 192][63:0]: H[6]
 *  dmem[a + 224][63:0]: H[7]
 * The upper 192 bits of each cell are clobbered during the execution of the
 * algorithm but their contents are irrelevant.
 *
 * The routine makes use of a 640 byte sized scratchpad in dmem for the message
 * schedule.
 *
 * This routine runs in constant time.
 *
 * Flags: Flags have no meaning beyond the scope of this subroutine.
 *
 * @param[in]  dmem[n_chunks]: number of chunks to process in a single go
 * @param[in]  dmem[dptr_state]: dmem location with state      ][63:0]: H[0]
 * @param[in]  dmem[dptr_msg]: Pointer to memory location containing the pre-
 *                               formatted message chunks.
 *
 * clobbered registers: w0 to w7, w10, w11, w15 to w26, w30, w31
 *                      x1, x2, x10, x11 to x17, x20
 * clobbered flag groups: FG0
 */
.globl sha512
sha512:

  /* w31 = 0; w30 = 1111...1111 */
  bn.xor  w31, w31, w31
  bn.subi w30, w31, 1

  /* read number of 1024-bit chunks from dmem */
  la x20, n_chunks
  lw x20, 0(x20)

  /* read pointer to state variables from dmem */
  la x17, dptr_state
  lw x17, 0(x17)

  /* read pointer to message buffer from dmem */
  la x14, dptr_msg
  lw x14, 0(x14)

  /* init reg pointers */
  li x10, 10
  li x11, 11
  li x19, 22

  /* init pointer to scratchpad for message schedule */
  la x13, W

  /* init pointer to round constants */
  la x16, K

  /* one iteration per chunk */
  loop x20, 369

    /* reset pointer to message schedule */
    addi x12, x13, 0

    /* Expand 1024 bit data chunk to full message schedule (W_0 ... W_79)
       The 80 64-bit words of the message schedule are kept in dmem
       scatchpad (20 256-bit cells). */

    /* The message schedule's 16 lower words (W_0 to W_15) are set equal to the
       16 words of the message chunk (M_0 to M_15).

       The WDRs w19 to w22 are used as a sliding window over 16 words of the
       message schedule and are initialized as follows:
       w19 <=  W_3  | W_2  | W_1  | W_0
       w20 <=  W_7  | W_6  | W_5  | W_4
       w21 <=  W_11 | W_10 | W_9  | W_8
       w22 <=  W_15 | W_14 | W_13 | W_12 */
    addi    x2, x0, 19
    loopi   4, 3
      bn.lid  x2, 0(x14++)
      bn.sid  x2, 0(x12++)
      addi    x2, x2, 1

    /* The remaining 74 words are constructed from the lower 16 ones:
       W_t = s1(W_(t-2)) + W_(t-7) + s0(W_(t-15)) + W_(t-16)
       with:
       s0(x) = (x RROT 1) xor (x RROT 8) xor (x SHR 7)
       s1(x) = (x RROT 19) xor (x RROT 61) xor (x SHR 6) */

    /* In the loop body below, i denotes to the i-th cycle of this loop,
       t refers to the index t as used in the FIPS document. Each loop
       cycle computes 4 new words of the message schedule. Hence, i runs from
       0 to 15, and t runs from 16 to 79.
       Note that the assignments in comments only show the relevant 64 bit for
       each operation. The remaining bits are (usually) clobbered as well but
       are irrelevant for further processing. */
    loopi   16, 74

      /* t <= i*4 + 16 */

      /* Window register contents (w19 to w22) at start of cycle:
         w19 = W_(i*4+3)  | W_(i*4+2)  | W_(i*4+1)  | W_(i*4)
             = W_(t-13)   | W_(t-14)   | W_(t-15)   | W_(t-16)
         w20 = W_(i*4+7)  | W_(i*4+6)  | W_(i*4+5)  | W_(i*4+4)
             = W_(t-9)    | W_(t-10)   | W_(t-11)   | W_(t-12)
         w21 = W_(i*4+11) | W_(i*4+10) | W_(i*4+9)  | W_(i*4+8)
             = W_(t-5)    | W_(t-6)    | W_(t-7)    | W_(t-8)
         w22 = W_(i*4+15) | W_(i*4+14) | W_(i*4+13) | W_(i*4+12)
             = W_(t-1)    | W_(t-2)    | W_(t-3)    | W_(t-4) */

      /* w15[255:192] <= s0( W_(t-15) )
           = (W_(t-15) ROTR 1) XOR (W_(t-15) ROTR 8) XOR (W_(t-15) SHR 8) */
      bn.rshi  w18, w19, w30 >> 128
      bn.rshi  w17, w30, w19 >> 64
      bn.rshi  w15, w17, w18 >> 1
      bn.rshi  w16, w17, w18 >> 8
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w18 >> 7
      bn.xor   w15, w15, w16

      /* w23[63:0] <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) */
      bn.add   w23, w19, w15 >> 192
      bn.add   w23, w23, w21 >> 64

      /* w15[255:192] <= s1( W_(t-2) )
           = (W_(t-2) ROTR 19) XOR (W_(t-2) ROTR 61) XOR (W_(t-2) SHR 6) */
      bn.rshi  w18, w22, w30  >> 192
      bn.rshi  w17, w30, w22  >> 128
      bn.rshi  w15, w17, w18  >> 19
      bn.rshi  w16, w17, w18  >> 61
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w18  >> 6
      bn.xor   w15, w15, w16

      /* w23[63:0] = w_t
                   <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) + s1( W_(t-2) ) */
      bn.add   w23, w23, w15 >> 192


      /* t <= i*4 + 17
         w19       = W_(t-14) | W_(t-15) | W_(t-16) | W_(t-17)
         w20       = W_(t-10) | W_(t-11) | W_(t-12) | W_(t-13)
         w21       = W_(t-6)  | W_(t-7) |  W_(t-8)  | W_(t-9)
         w22       = W_(t-2)  | W_(t-3)  | W_(t-4)  | W_(t-5)
         w23[63:0] = W_(t-1) */

      /* w15[255:192] <= s0( W_(t-15) )
           = (W_(t-15) ROTR 1) XOR (W_(t-15) ROTR 8) XOR (W_(t-15) SHR 8) */
      bn.rshi  w18, w19, w30  >> 192
      bn.rshi  w17, w30, w19  >> 128
      bn.rshi  w15, w17, w18  >> 1
      bn.rshi  w16, w17, w18  >> 8
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w18  >> 7
      bn.xor   w15, w15, w16

      /* w24[63:0] <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) */
      bn.add   w24, w31, w19 >> 64
      bn.add   w24, w24, w15 >> 192
      bn.add   w24, w24, w21 >> 128

      /* w15[255:192] <= s1( W_(t-2) )
           = (W_(t-2) ROTR 19) XOR (W_(t-2) ROTR 61) XOR (W_(t-2) SHR 6) */
      bn.rshi  w17, w30, w22  >> 192
      bn.rshi  w15, w17, w22  >> 19
      bn.rshi  w16, w17, w22  >> 61
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w22  >> 6
      bn.xor   w15, w15, w16

      /* w24[63:0] = w_t
                   <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) + s1( W_(t-2) ) */
      bn.add   w24, w24, w15 >> 192


      /* t = i*4 + 18
         w19       = W_(t-15) | W_(t-16) | W_(t-17) | W_(t-18)
         w20       = W_(t-11) | W_(t-12) | W_(t-13) | W_(t-14)
         w21       = W_(t-7)  | W_(t-8) |  W_(t-9)  | W_(t-10)
         w22       = W_(t-3)  | W_(t-4)  | W_(t-5)  | W_(t-6)
         w23[63:0] = W_(t-2)
         w24[63:0] = W_(t-1) */

      /* w15[255:192] <= s0( W_(t-15) )
           = (W_(t-15) ROTR 1) XOR (W_(t-15) ROTR 8) XOR (W_(t-15) SHR 8) */
      bn.rshi  w17, w30, w19  >> 192
      bn.rshi  w15, w17, w19  >> 1
      bn.rshi  w16, w17, w19  >> 8
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w19  >> 7
      bn.xor   w15, w15, w16

      /* w25[63:0] <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) */
      bn.add   w25, w31, w19 >> 128
      bn.add   w25, w25, w15 >> 192
      bn.add   w25, w25, w21 >> 192

      /* w15[255:192] <= s1( W_(t-2) )
           = (W_(t-2) ROTR 19) XOR (W_(t-2) ROTR 61) XOR (W_(t-2) SHR 6) */
      bn.rshi  w18, w23, w30  >> 64
      bn.rshi  w15, w23, w18  >> 19
      bn.rshi  w16, w23, w18  >> 61
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w18  >> 6
      bn.xor   w15, w15, w16

      /* w25[63:0] = w_t
                   <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) + s1( W_(t-2) ) */
      bn.add   w25, w25, w15 >> 192


      /* t = i*4 + 19
         w19       = W_(t-16) | W_(t-17) | W_(t-18) | W_(t-19)
         w20       = W_(t-12) | W_(t-13) | W_(t-14) | W_(t-15)
         w21       = W_(t-8)  | W_(t-9) |  W_(t-10) | W_(t-11)
         w22       = W_(t-4)  | W_(t-5)  | W_(t-6)  | W_(t-7)
         w23[63:0] = W_(t-3)
         w24[63:0] = W_(t-2)
         w25[63:0] = W_(t-1) */

      /* w15[255:192] <= s0( W_(t-15) )
           = (W_(t-15) ROTR 1) XOR (W_(t-15) ROTR 8) XOR (W_(t-15) SHR 8) */
      bn.rshi  w18, w20, w30  >> 64
      bn.rshi  w15, w20, w18  >> 1
      bn.rshi  w16, w20, w18  >> 8
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w18  >> 7
      bn.xor   w15, w15, w16

      /* w26[63:0] <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) */
      bn.add   w26, w31, w19 >> 192
      bn.add   w26, w26, w15 >> 192
      bn.add   w26, w26, w22

      /* w15[255:192] <= s1( W_(t-2) )
           = (W_(t-2) ROTR 19) XOR (W_(t-2) ROTR 61) XOR (W_(t-2) SHR 6) */
      bn.rshi  w18, w24, w30  >> 64
      bn.rshi  w15, w24, w18  >> 19
      bn.rshi  w16, w24, w18  >> 61
      bn.xor   w15, w15, w16
      bn.rshi  w16, w31, w18  >> 6
      bn.xor   w15, w15, w16

      /* w26[63:0] = w_t
                   <= W_(t-16) + W_(t-7) + s0( W_(t-15) ) + s1( W_(t-2) ) */
      bn.add   w26, w26, w15 >> 192

      /* Forward window */
      bn.mov   w19, w20
      bn.mov   w20, w21
      bn.mov   w21, w22

      /* Assemble 256-bit cell from the 4 words computed above */
      /* w22 = w26[63:0] | w25[63:0] | w24[63:0] | w23[64:0]
             = W[i*4+19] | W[i*4+18] | W[i*4+17] | W[i*4+16] */
      bn.rshi  w22, w23, w22  >> 64
      bn.rshi  w22, w24, w22  >> 64
      bn.rshi  w22, w25, w22  >> 64
      bn.rshi  w22, w26, w22  >> 64


      /* Store the 4 words in dmem scratchpad */
      bn.sid   x19, 0(x12++)


    /* load state variables from dmem */
    addi     x2, x0, 0
    /* w0[63:0] = a <= H_0 */
    bn.lid   x2++, 0(x17)
    /* w1[63:0] = b <= H_1 */
    bn.lid   x2++, 32(x17)
    /* w2[63:0] = c <= H_2 */
    bn.lid   x2++, 64(x17)
    /* w3[63:0] = d <= H_3 */
    bn.lid   x2++, 96(x17)
    /* w4[63:0] = e <= H_4 */
    bn.lid   x2++, 128(x17)
    /* w5[63:0] = f <= H_5 */
    bn.lid   x2++, 160(x17)
    /* w6[63:0] = g <= H_6 */
    bn.lid   x2++, 192(x17)
    /* w7[63:0] = h <= H_7 */
    bn.lid   x2++, 224(x17)

    /* reset pointer to start of message schedule scratchpad in dmem */
    addi x12, x13, 0

    /* reset pointer to beginning of dmem section containing round constants */
    addi x15, x16, 0

    /* Main loop for SHA compression function. Processes 8 words of message
       schedule in one cycle.
       This saves copying the SHA working variables (a,b,...,h) after each
       word. If code size becomes an issue, the size of the loop body can
       be significantly reduced for the penalty 6 additional instructions after
       each word.
       Below,
         i denotes the current loop cycle, and
         t denotes the current word (hence t=i*8+(0,1,...,7) ). */
    loopi 10, 253

      /* Load four round constants from dmem */
      /* w10 <= [K_(i*8+3),K_(i*8+2),K_(i*8+1),K_(i*8)] = dmem[K + 2*i] */
      bn.lid   x10, 0(x15++)

      /* Load four message schedule words from dmem scratchpad */
      /* w11 <= [W_(i*8+3),W_(i*8+2),W_(i*8+1),W_(i*8)] = dmem[W + 2*i] */
      bn.lid   x11, 0(x12++)

      /* w6[63:0] = g */
      /* w5[63:0] = f */
      /* w4[63:0] = e */
      /* w3[63:0] = d */
      /* w2[63:0] = c */
      /* w1[63:0] = b */
      /* w0[63:0] = a */


      /* Process word 0 of loop cycle: t <= i*8. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w0, w30  >> 64
      bn.rshi  w15,  w0, w22  >> 28
      bn.rshi  w21,  w0, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w0, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w0,  w1
      bn.and   w21,  w0,  w2
      bn.xor   w16, w16, w21
      bn.and   w21,  w1,  w2
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16

      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w4, w30  >> 64
      bn.rshi  w18,  w4, w22  >> 14
      bn.rshi  w21,  w4, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w4, w22  >> 41
      bn.xor   w18, w18, w19

      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w4,  w5
      bn.not   w21,  w4
      bn.and   w21, w21,  w6
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20, w7
      bn.add   w20, w20, w10
      bn.add   w21, w11, w19
      bn.add   w20, w20, w21

      /* w6[63:0] = h <= g */
      /* w5[63:0] = g <= f */
      /* w4[63:0] = f <= e */
      /* w3[63:0] = e <= d + T1 = w3[63:0] + w20[63:0] */
      bn.add    w3,  w3, w20
      /* w2[63:0] = d <= c */
      /* w1[63:0] = c <= b */
      /* w0[63:0] = b <= a */
      /* w7[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add    w7, w20, w17


      /* Process word 1 of loop cycle: t <= i*8 + 1. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w7, w30  >> 64
      bn.rshi  w15,  w7, w22  >> 28
      bn.rshi  w21,  w7, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w7, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w7,  w0
      bn.and   w21,  w7,  w1
      bn.xor   w16, w16, w21
      bn.and   w21,  w0,  w1
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16

      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w3, w30  >> 64
      bn.rshi  w18,  w3, w22  >> 14
      bn.rshi  w21,  w3, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w3, w22  >> 41
      bn.xor   w18, w18, w19

      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w3,  w4
      bn.not   w21,  w3
      bn.and   w21, w21,  w5
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20,  w6
      bn.add   w20, w20, w10  >> 64
      bn.rshi  w21, w30, w11  >> 64
      bn.add   w21, w21, w19
      bn.add   w20, w20, w21

      /* w5[63:0] = h <= g */
      /* w4[63:0] = g <= f */
      /* w3[63:0] = f <= e */
      /* w2[63:0] = e <= d + T1 = w2[63:0] + w20[63:0] */
      bn.add w2, w2, w20
      /* w1[63:0] = d <= c */
      /* w0[63:0] = c <= b */
      /* w7[63:0] = b <= a */
      /* w6[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add w6, w20, w17


      /* Process word 2 of loop cycle: t <= i*8 + 2. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w6, w30  >> 64
      bn.rshi  w15,  w6, w22  >> 28
      bn.rshi  w21,  w6, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w6, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w6, w7
      bn.and   w21,  w6, w0
      bn.xor   w16, w16, w21
      bn.and   w21,  w7, w0
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16

      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w2, w30  >> 64
      bn.rshi  w18,  w2, w22  >> 14
      bn.rshi  w21,  w2, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w2, w22  >> 41
      bn.xor   w18, w18, w19

      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w2,  w3
      bn.not   w21,  w2
      bn.and   w21, w21,  w4
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20,  w5
      bn.add   w20, w20, w10  >> 128
      bn.rshi  w21, w30, w11  >> 128
      bn.add   w21, w21, w19
      bn.add   w20, w20, w21

      /* w4[63:0] = h <= g */
      /* w3[63:0] = g <= f */
      /* w2[63:0] = f <= e */
      /* w1[63:0] = e <= d + T1 = w2[63:0] + w20[63:0] */
      bn.add   w1,  w1, w20
      /* w0[63:0] = d <= c */
      /* w7[63:0] = c <= b */
      /* w6[63:0] = b <= a */
      /* w5[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add   w5, w20, w17


      /* Process word 3 of loop cycle: t <= i*8 + 3. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w5, w30  >> 64
      bn.rshi  w15,  w5, w22  >> 28
      bn.rshi  w21,  w5, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w5, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w5,  w6
      bn.and   w21,  w5,  w7
      bn.xor   w16, w16, w21
      bn.and   w21,  w6,  w7
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16

      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w1, w30  >> 64
      bn.rshi  w18,  w1, w22  >> 14
      bn.rshi  w21,  w1, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w1, w22  >> 41
      bn.xor   w18, w18, w19

      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w1,  w2
      bn.not   w21,  w1
      bn.and   w21, w21,  w3
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20,  w4
      bn.add   w20, w20, w10  >> 192
      bn.rshi  w21, w30, w11  >> 192
      bn.add   w21, w21, w19
      bn.add   w20, w20, w21

      /* w3[63:0] = h <= g */
      /* w2[63:0] = g <= f */
      /* w1[63:0] = f <= e */
      /* w0[63:0] = e <= d + T1 = w2[63:0] + w20[63:0] */
      bn.add    w0,  w0, w20
      /* w7[63:0] = d <= c */
      /* w6[63:0] = c <= b */
      /* w5[63:0] = b <= a */
      /* w4[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add    w4, w20, w17


      /* Load another four round constants from dmem */
      /* w10 <= [K_(i*8+7),K_(i*8+6),K_(i*8+5),K_(i*8+4)] = dmem[K + 2*i+1] */
      bn.lid x10, 0(x15++)

      /* Load another four message schedule words from dmem scratchpad */
      /* w11 <= [W_(i*8+7),W_(i*8+6),W_(i*8+5),W_(i*8+4)] = dmem[W + 2*i+1] */
      bn.lid x11, 0(x12++)


      /* Process word 4 of loop cycle: t <= i*8 + 3. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w4, w30  >> 64
      bn.rshi  w15,  w4, w22  >> 28
      bn.rshi  w21,  w4, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w4, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w4,  w5
      bn.and   w21,  w4,  w6
      bn.xor   w16, w16, w21
      bn.and   w21,  w5,  w6
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16

      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w0, w30  >> 64
      bn.rshi  w18,  w0, w22  >> 14
      bn.rshi  w21,  w0, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w0, w22  >> 41
      bn.xor   w18, w18, w19

      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w0,  w1
      bn.not   w21,  w0
      bn.and   w21, w21,  w2
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20,  w3
      bn.add   w20, w20, w10  >> 0
      bn.rshi  w21, w30, w11  >> 0
      bn.add   w21, w21, w19
      bn.add   w20, w20, w21

      /* w2[63:0] = h <= g */
      /* w1[63:0] = g <= f */
      /* w0[63:0] = f <= e */
      /* w7[63:0] = e <= d + T1 = w2[63:0] + w20[63:0] */
      bn.add    w7,  w7, w20
      /* w6[63:0] = d <= c */
      /* w5[63:0] = c <= b */
      /* w4[63:0] = b <= a */
      /* w3[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add    w3, w20, w17


      /* Process word 5 of loop cycle: t <= i*8 + 3. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w3, w30  >> 64
      bn.rshi  w15,  w3, w22  >> 28
      bn.rshi  w21,  w3, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w3, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w3,  w4
      bn.and   w21,  w3,  w5
      bn.xor   w16, w16, w21
      bn.and   w21,  w4,  w5
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16


      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w7, w30  >> 64
      bn.rshi  w18,  w7, w22  >> 14
      bn.rshi  w21,  w7, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w7, w22  >> 41
      bn.xor   w18, w18, w19


      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w7,  w0
      bn.not   w21,  w7
      bn.and   w21, w21,  w1
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20,  w2
      bn.add   w20, w20, w10  >> 64
      bn.rshi  w21, w30, w11  >> 64
      bn.add   w21, w21, w19
      bn.add   w20, w20, w21

      /* w1[63:0] = h <= g */
      /* w0[63:0] = g <= f */
      /* w7[63:0] = f <= e */
      /* w6[63:0] = e <= d + T1 = w2[63:0] + w20[63:0] */
      bn.add    w6,  w6, w20
      /* w5[63:0] = d <= c */
      /* w4[63:0] = c <= b */
      /* w3[63:0] = b <= a */
      /* w2[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add    w2, w20, w17

      /* Process word 6 of loop cycle: t <= i*8 + 3. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w2, w30  >> 64
      bn.rshi  w15,  w2, w22  >> 28
      bn.rshi  w21,  w2, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w2, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w2,  w3
      bn.and   w21,  w2,  w4
      bn.xor   w16, w16, w21
      bn.and   w21,  w3,  w4
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16

      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w6, w30  >> 64
      bn.rshi  w18,  w6, w22  >> 14
      bn.rshi  w21,  w6, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w6, w22  >> 41
      bn.xor   w18, w18, w19

      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w6,  w7
      bn.not   w21,  w6
      bn.and   w21, w21,  w0
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20,  w1
      bn.add   w20, w20, w10  >> 128
      bn.rshi  w21, w30, w11  >> 128
      bn.add   w21, w21, w19
      bn.add   w20, w20, w21

      /* w0[63:0] = h <= g */
      /* w7[63:0] = g <= f */
      /* w6[63:0] = f <= e */
      /* w5[63:0] = e <= d + T1 = w2[63:0] + w20[63:0] */
      bn.add    w5,  w5, w20
      /* w4[63:0] = d <= c */
      /* w3[63:0] = c <= b */
      /* w2[63:0] = b <= a */
      /* w1[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add    w1, w20, w17


      /* Process word 7 of loop cycle: t <= i*8 + 3. */

      /* w15[255:192] = S0(a) = (a ROTR 28) XOR (a ROTR 34) XOR (a ROTR 39) */
      bn.rshi  w22,  w1, w30  >> 64
      bn.rshi  w15,  w1, w22  >> 28
      bn.rshi  w21,  w1, w22  >> 34
      bn.xor   w15, w15, w21
      bn.rshi  w21,  w1, w22  >> 39
      bn.xor   w15, w15, w21

      /* w16[63:0] = Maj(a,b,c) = (a AND b) XOR (a AND c) XOR (b AND c) */
      bn.and   w16,  w1,  w2
      bn.and   w21,  w1,  w3
      bn.xor   w16, w16, w21
      bn.and   w21,  w2,  w3
      bn.xor   w16, w16, w21

      /* w17[63:0] <= T2 = S0(a) + Maj(a,b,c) = w15[255:192] + w16[63:0] */
      bn.rshi  w17, w30, w15  >> 192
      bn.add   w17, w17, w16

      /* w18[255:192] <= S1(e) = (e ROTR 14) XOR (e ROTR 18) XOR (e ROTR 41) */
      bn.rshi  w22,  w5, w30  >> 64
      bn.rshi  w18,  w5, w22  >> 14
      bn.rshi  w21,  w5, w22  >> 18
      bn.xor   w18, w18, w21
      bn.rshi  w19,  w5, w22  >> 41
      bn.xor   w18, w18, w19

      /* w19[63:0] <= Ch(e,f,g) = (e AND f) XOR ((NOT e) AND g) */
      bn.and   w19,  w5,  w6
      bn.not   w21,  w5
      bn.and   w21, w21,  w7
      bn.xor   w19, w19, w21

      /* w20[63:0] <= T1 = h + S1(e) + Ch(e,f,g) + K_t + W_t */
      bn.rshi  w20, w30, w18  >> 192
      bn.add   w20, w20,  w0
      bn.add   w20, w20, w10  >> 192
      bn.rshi  w21, w30, w11  >> 192
      bn.add   w21, w21, w19
      bn.add   w20, w20, w21

      /* w7[63:0] = h <= g */
      /* w6[63:0] = g <= f */
      /* w5[63:0] = f <= e */
      /* w4[63:0] = e <= d + T1 = w2[63:0] + w20[63:0] */
      bn.add w4, w4, w20
      /* w3[63:0] = d <= c */
      /* w2[63:0] = c <= b */
      /* w1[63:0] = b <= a */
      /* w0[63:0] = a = T_1 + T_2 = w20[63:0] + w17[63:0] */
      bn.add w0, w20, w17


    /* Add compressed chunk to current hash value */
    addi      x2, x0, 15

    /* H_0 <= H_0 + a */
    bn.lid    x2, 0(x17)
    bn.add   w15, w0, w15
    bn.sid    x2, 0(x17)

    /* H_1 <= H_1 + b */
    bn.lid    x2, 32(x17)
    bn.add   w15, w1, w15
    bn.sid    x2, 32(x17)

    /* H_2 <= H_2 + c */
    bn.lid    x2, 64(x17)
    bn.add   w15, w2, w15
    bn.sid    x2, 64(x17)

    /* H_3 <= H_3 + d */
    bn.lid    x2, 96(x17)
    bn.add   w15, w3, w15
    bn.sid    x2, 96(x17)

    /* H_4 <= H_4 + e */
    bn.lid    x2, 128(x17)
    bn.add   w15, w4, w15
    bn.sid    x2, 128(x17)

    /* H_5 <= H_5 + f */
    bn.lid    x2, 160(x17)
    bn.add   w15, w5, w15
    bn.sid    x2, 160(x17)

    /* H_6 <= H_6 + g */
    bn.lid    x2, 192(x17)
    bn.add   w15, w6, w15
    bn.sid    x2, 192(x17)

    /* H_7 <= H_7 + h */
    bn.lid    x2, 224(x17)
    bn.add   w15, w7, w15
    bn.sid    x2, 224(x17)

ret

.bss

/* number of chunks to process */
.globl n_chunks
.balign 4
n_chunks:
  .zero 4

/* pointer to state (dptr_state) */
.globl dptr_state
.balign 4
dptr_state:
  .zero 4

/* pointer to msg (dptr_msg) */
.globl dptr_msg
.balign 4
dptr_msg:
  .zero 4


/* 80*8=640 bytes scratchpad for message schedule */
.section .scratchpad
 .balign 32
W:
 .zero 640

 .data

/* SHA-512 round constants */
.balign 32
K:
.dword 0x428a2f98d728ae22
.dword 0x7137449123ef65cd
.dword 0xb5c0fbcfec4d3b2f
.dword 0xe9b5dba58189dbbc
.dword 0x3956c25bf348b538
.dword 0x59f111f1b605d019
.dword 0x923f82a4af194f9b
.dword 0xab1c5ed5da6d8118
.dword 0xd807aa98a3030242
.dword 0x12835b0145706fbe
.dword 0x243185be4ee4b28c
.dword 0x550c7dc3d5ffb4e2
.dword 0x72be5d74f27b896f
.dword 0x80deb1fe3b1696b1
.dword 0x9bdc06a725c71235
.dword 0xc19bf174cf692694
.dword 0xe49b69c19ef14ad2
.dword 0xefbe4786384f25e3
.dword 0x0fc19dc68b8cd5b5
.dword 0x240ca1cc77ac9c65
.dword 0x2de92c6f592b0275
.dword 0x4a7484aa6ea6e483
.dword 0x5cb0a9dcbd41fbd4
.dword 0x76f988da831153b5
.dword 0x983e5152ee66dfab
.dword 0xa831c66d2db43210
.dword 0xb00327c898fb213f
.dword 0xbf597fc7beef0ee4
.dword 0xc6e00bf33da88fc2
.dword 0xd5a79147930aa725
.dword 0x06ca6351e003826f
.dword 0x142929670a0e6e70
.dword 0x27b70a8546d22ffc
.dword 0x2e1b21385c26c926
.dword 0x4d2c6dfc5ac42aed
.dword 0x53380d139d95b3df
.dword 0x650a73548baf63de
.dword 0x766a0abb3c77b2a8
.dword 0x81c2c92e47edaee6
.dword 0x92722c851482353b
.dword 0xa2bfe8a14cf10364
.dword 0xa81a664bbc423001
.dword 0xc24b8b70d0f89791
.dword 0xc76c51a30654be30
.dword 0xd192e819d6ef5218
.dword 0xd69906245565a910
.dword 0xf40e35855771202a
.dword 0x106aa07032bbd1b8
.dword 0x19a4c116b8d2d0c8
.dword 0x1e376c085141ab53
.dword 0x2748774cdf8eeb99
.dword 0x34b0bcb5e19b48a8
.dword 0x391c0cb3c5c95a63
.dword 0x4ed8aa4ae3418acb
.dword 0x5b9cca4f7763e373
.dword 0x682e6ff3d6b2b8a3
.dword 0x748f82ee5defb2fc
.dword 0x78a5636f43172f60
.dword 0x84c87814a1f0ab72
.dword 0x8cc702081a6439ec
.dword 0x90befffa23631e28
.dword 0xa4506cebde82bde9
.dword 0xbef9a3f7b2c67915
.dword 0xc67178f2e372532b
.dword 0xca273eceea26619c
.dword 0xd186b8c721c0c207
.dword 0xeada7dd6cde0eb1e
.dword 0xf57d4f7fee6ed178
.dword 0x06f067aa72176fba
.dword 0x0a637dc5a2c898a6
.dword 0x113f9804bef90dae
.dword 0x1b710b35131c471b
.dword 0x28db77f523047d84
.dword 0x32caab7b40c72493
.dword 0x3c9ebe0a15c9bebc
.dword 0x431d67c49c100d4c
.dword 0x4cc5d4becb3e42b6
.dword 0x597f299cfc657e2a
.dword 0x5fcb6fab3ad6faec
.dword 0x6c44198c4a475817