crypto/sha/asm/keccak1600-avx2.pl - third_party/openssl - Git at Google

 #!/usr/bin/env perl
 # Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the OpenSSL license (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
 #
 # ====================================================================
 # Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
 # project. The module is, however, dual licensed under OpenSSL and
 # CRYPTOGAMS licenses depending on where you obtain it. For further
 # details see http://www.openssl.org/~appro/cryptogams/.
 # ====================================================================
 #
 # Keccak-1600 for AVX2.
 #
 # July 2017.
 #
 # To paraphrase Gilles Van Assche, if you contemplate Fig. 2.3 on page
 # 20 of The Keccak reference [or Fig. 5 of FIPS PUB 202], and load data
 # other than A[0][0] in magic order into 6 [256-bit] registers, *each
 # dedicated to one axis*, Pi permutation is reduced to intra-register
 # shuffles...
 #
 # It makes other steps more intricate, but overall, is it a win? To be
 # more specific index permutations organized by quadruples are:
 #
 #       [4][4] [3][3] [2][2] [1][1]<-+
 #       [0][4] [0][3] [0][2] [0][1]<-+
 #       [3][0] [1][0] [4][0] [2][0]  |
 #       [4][3] [3][1] [2][4] [1][2]  |
 #       [3][4] [1][3] [4][2] [2][1]  |
 #       [2][3] [4][1] [1][4] [3][2]  |
 #       [2][2] [4][4] [1][1] [3][3] -+
 #
 # This however is highly impractical for Theta and Chi. What would help
 # Theta is if x indices were aligned column-wise, or in other words:
 #
 #       [0][4] [0][3] [0][2] [0][1]
 #       [3][0] [1][0] [4][0] [2][0]
 #vpermq([4][3] [3][1] [2][4] [1][2], 0b01110010)
 #       [2][4] [4][3] [1][2] [3][1]
 #vpermq([4][2] [3][4] [2][1] [1][3], 0b10001101)
 #       [3][4] [1][3] [4][2] [2][1]
 #vpermq([2][3] [4][1] [1][4] [3][2], 0b01110010)
 #       [1][4] [2][3] [3][2] [4][1]
 #vpermq([1][1] [2][2] [3][3] [4][4], 0b00011011)
 #       [4][4] [3][3] [2][2] [1][1]
 #
 # So here we have it, lines not marked with vpermq() represent the magic
 # order in which data is to be loaded and maintained. [And lines marked
 # with vpermq() represent Pi circular permutation in chosen layout. Note
 # that first step is permutation-free.] A[0][0] is loaded to register of
 # its own, to all lanes. [A[0][0] is not part of Pi permutation or Rho.]
 # Digits in variables' names denote right-most coordinates:

 my ($A00,	# [0][0] [0][0] [0][0] [0][0]		# %ymm0
     $A01,	# [0][4] [0][3] [0][2] [0][1]		# %ymm1
     $A20,	# [3][0] [1][0] [4][0] [2][0]		# %ymm2
     $A31,	# [2][4] [4][3] [1][2] [3][1]		# %ymm3
     $A21,	# [3][4] [1][3] [4][2] [2][1]		# %ymm4
     $A41,	# [1][4] [2][3] [3][2] [4][1]		# %ymm5
     $A11) =	# [4][4] [3][3] [2][2] [1][1]		# %ymm6
     map("%ymm$_",(0..6));

 # We also need to map the magic order into offsets within structure:

 my @A_jagged = ([0,0], [1,0], [1,1], [1,2], [1,3],	# [0][0..4]
 		[2,2], [6,0], [3,1], [4,2], [5,3],	# [1][0..4]
 		[2,0], [4,0], [6,1], [5,2], [3,3],	# [2][0..4]
 		[2,3], [3,0], [5,1], [6,2], [4,3],	# [3][0..4]
 		[2,1], [5,0], [4,1], [3,2], [6,3]);	# [4][0..4]
    @A_jagged = map(8*($$_[0]*4+$$_[1]), @A_jagged);	# ... and now linear

 # But on the other hand Chi is much better off if y indices were aligned
 # column-wise, not x. For this reason we have to shuffle data prior
 # Chi and revert it afterwards. Prior shuffle is naturally merged with
 # Pi itself:
 #
 #       [0][4] [0][3] [0][2] [0][1]
 #       [3][0] [1][0] [4][0] [2][0]
 #vpermq([4][3] [3][1] [2][4] [1][2], 0b01110010)
 #vpermq([2][4] [4][3] [1][2] [3][1], 0b00011011) = 0b10001101
 #       [3][1] [1][2] [4][3] [2][4]
 #vpermq([4][2] [3][4] [2][1] [1][3], 0b10001101)
 #vpermq([3][4] [1][3] [4][2] [2][1], 0b11100100) = 0b10001101
 #       [3][4] [1][3] [4][2] [2][1]
 #vpermq([2][3] [4][1] [1][4] [3][2], 0b01110010)
 #vpermq([1][4] [2][3] [3][2] [4][1], 0b01110010) = 0b00011011
 #       [3][2] [1][4] [4][1] [2][3]
 #vpermq([1][1] [2][2] [3][3] [4][4], 0b00011011)
 #vpermq([4][4] [3][3] [2][2] [1][1], 0b10001101) = 0b01110010
 #       [3][3] [1][1] [4][4] [2][2]
 #
 # And reverse post-Chi permutation:
 #
 #       [0][4] [0][3] [0][2] [0][1]
 #       [3][0] [1][0] [4][0] [2][0]
 #vpermq([3][1] [1][2] [4][3] [2][4], 0b00011011)
 #       [2][4] [4][3] [1][2] [3][1]
 #vpermq([3][4] [1][3] [4][2] [2][1], 0b11100100) = nop :-)
 #       [3][4] [1][3] [4][2] [2][1]
 #vpermq([3][2] [1][4] [4][1] [2][3], 0b10001101)
 #       [1][4] [2][3] [3][2] [4][1]
 #vpermq([3][3] [1][1] [4][4] [2][2], 0b01110010)
 #       [4][4] [3][3] [2][2] [1][1]
 #
 ########################################################################
 # Numbers are cycles per processed byte out of large message.
 #
 #			r=1088(*)
 #
 # Haswell		8.7/+10%
 # Skylake		7.8/+20%
 # Ryzen			17(**)
 #
 # (*)	Corresponds to SHA3-256. Percentage after slash is improvement
 #	coefficient in comparison to scalar keccak1600-x86_64.pl.
 # (**)	It's expected that Ryzen performs poorly, because instruction
 #	issue rate is limited to two AVX2 instructions per cycle and
 #	in addition vpblendd is reportedly bound to specific port.
 #	Obviously this code path should not be executed on Ryzen.

 my @T = map("%ymm$_",(7..15));
 my ($C14,$C00,$D00,$D14) = @T[5..8];

 $code.=<<___;
 .text

 .type	__KeccakF1600,\@function
 .align	32
 __KeccakF1600:
 	lea		rhotates_left+96(%rip),%r8
 	lea		rhotates_right+96(%rip),%r9
 	lea		iotas(%rip),%r10
 	mov		\$24,%eax
 	jmp		.Loop_avx2

 .align	32
 .Loop_avx2:
 	######################################### Theta
 	vpshufd		\$0b01001110,$A20,$C00
 	vpxor		$A31,$A41,$C14
 	vpxor		$A11,$A21,@T[2]
 	vpxor		$A01,$C14,$C14
 	vpxor		@T[2],$C14,$C14		# C[1..4]

 	vpermq		\$0b10010011,$C14,@T[4]
 	vpxor		$A20,$C00,$C00
 	vpermq		\$0b01001110,$C00,@T[0]

 	vpsrlq		\$63,$C14,@T[1]
 	vpaddq		$C14,$C14,@T[2]
 	vpor		@T[2],@T[1],@T[1]	# ROL64(C[1..4],1)

 	vpermq		\$0b00111001,@T[1],$D14
 	vpxor		@T[4],@T[1],$D00
 	vpermq		\$0b00000000,$D00,$D00	# D[0..0] = ROL64(C[1],1) ^ C[4]

 	vpxor		$A00,$C00,$C00
 	vpxor		@T[0],$C00,$C00		# C[0..0]

 	vpsrlq		\$63,$C00,@T[0]
 	vpaddq		$C00,$C00,@T[1]
 	vpor		@T[0],@T[1],@T[1]	# ROL64(C[0..0],1)

 	vpxor		$D00,$A20,$A20		# ^= D[0..0]
 	vpxor		$D00,$A00,$A00		# ^= D[0..0]

 	vpblendd	\$0b11000000,@T[1],$D14,$D14
 	vpblendd	\$0b00000011,$C00,@T[4],@T[4]
 	vpxor		@T[4],$D14,$D14		# D[1..4] = ROL64(C[2..4,0),1) ^ C[0..3]

 	######################################### Rho + Pi + pre-Chi shuffle
 	vpsllvq		0*32-96(%r8),$A20,@T[3]
 	vpsrlvq		0*32-96(%r9),$A20,$A20
 	vpor		@T[3],$A20,$A20

 	 vpxor		$D14,$A31,$A31		# ^= D[1..4] from Theta
 	vpsllvq		2*32-96(%r8),$A31,@T[4]
 	vpsrlvq		2*32-96(%r9),$A31,$A31
 	vpor		@T[4],$A31,$A31

 	 vpxor		$D14,$A21,$A21		# ^= D[1..4] from Theta
 	vpsllvq		3*32-96(%r8),$A21,@T[5]
 	vpsrlvq		3*32-96(%r9),$A21,$A21
 	vpor		@T[5],$A21,$A21

 	 vpxor		$D14,$A41,$A41		# ^= D[1..4] from Theta
 	vpsllvq		4*32-96(%r8),$A41,@T[6]
 	vpsrlvq		4*32-96(%r9),$A41,$A41
 	vpor		@T[6],$A41,$A41

 	 vpxor		$D14,$A11,$A11		# ^= D[1..4] from Theta
 	 vpermq		\$0b10001101,$A20,@T[3]	# $A20 -> future $A31
 	 vpermq		\$0b10001101,$A31,@T[4]	# $A31 -> future $A21
 	vpsllvq		5*32-96(%r8),$A11,@T[7]
 	vpsrlvq		5*32-96(%r9),$A11,@T[1]
 	vpor		@T[7],@T[1],@T[1]	# $A11 -> future $A01

 	 vpxor		$D14,$A01,$A01		# ^= D[1..4] from Theta
 	 vpermq		\$0b00011011,$A21,@T[5]	# $A21 -> future $A41
 	 vpermq		\$0b01110010,$A41,@T[6]	# $A41 -> future $A11
 	vpsllvq		1*32-96(%r8),$A01,@T[8]
 	vpsrlvq		1*32-96(%r9),$A01,@T[2]
 	vpor		@T[8],@T[2],@T[2]	# $A01 -> future $A20

 	######################################### Chi
 	vpsrldq		\$8,@T[1],@T[7]
 	vpandn		@T[7],@T[1],@T[0]	# tgting  [0][0] [0][0] [0][0] [0][0]

 	vpblendd	\$0b00001100,@T[6],@T[2],$A31	#               [4][4] [2][0]
 	vpblendd	\$0b00001100,@T[2],@T[4],@T[8]	#               [4][0] [2][1]
 	 vpblendd	\$0b00001100,@T[4],@T[3],$A41	#               [4][2] [2][4]
 	 vpblendd	\$0b00001100,@T[3],@T[2],@T[7]	#               [4][3] [2][0]
 	vpblendd	\$0b00110000,@T[4],$A31,$A31	#        [1][3] [4][4] [2][0]
 	vpblendd	\$0b00110000,@T[5],@T[8],@T[8]	#        [1][4] [4][0] [2][1]
 	 vpblendd	\$0b00110000,@T[2],$A41,$A41	#        [1][0] [4][2] [2][4]
 	 vpblendd	\$0b00110000,@T[6],@T[7],@T[7]	#        [1][1] [4][3] [2][0]
 	vpblendd	\$0b11000000,@T[5],$A31,$A31	# [3][2] [1][3] [4][4] [2][0]
 	vpblendd	\$0b11000000,@T[6],@T[8],@T[8]	# [3][3] [1][4] [4][0] [2][1]
 	 vpblendd	\$0b11000000,@T[6],$A41,$A41	# [3][3] [1][0] [4][2] [2][4]
 	 vpblendd	\$0b11000000,@T[4],@T[7],@T[7]	# [3][4] [1][1] [4][3] [2][0]
 	vpandn		@T[8],$A31,$A31		# tgting  [3][1] [1][2] [4][3] [2][4]
 	 vpandn		@T[7],$A41,$A41		# tgting  [3][2] [1][4] [4][1] [2][3]

 	vpblendd	\$0b00001100,@T[2],@T[5],$A11	#               [4][0] [2][3]
 	vpblendd	\$0b00001100,@T[5],@T[3],@T[8]	#               [4][1] [2][4]
 	 vpxor		@T[3],$A31,$A31
 	vpblendd	\$0b00110000,@T[3],$A11,$A11	#        [1][2] [4][0] [2][3]
 	vpblendd	\$0b00110000,@T[4],@T[8],@T[8]	#        [1][3] [4][1] [2][4]
 	 vpxor		@T[5],$A41,$A41
 	vpblendd	\$0b11000000,@T[4],$A11,$A11	# [3][4] [1][2] [4][0] [2][3]
 	vpblendd	\$0b11000000,@T[2],@T[8],@T[8]	# [3][0] [1][3] [4][1] [2][4]
 	vpandn		@T[8],$A11,$A11		# tgting  [3][3] [1][1] [4][4] [2][2]
 	vpxor		@T[6],$A11,$A11

 	  vpermq	\$0b00011110,@T[1],$A21		# [0][1] [0][2] [0][4] [0][3]
 	  vpblendd	\$0b00110000,$A00,$A21,@T[8]	# [0][1] [0][0] [0][4] [0][3]
 	  vpermq	\$0b00111001,@T[1],$A01		# [0][1] [0][4] [0][3] [0][2]
 	  vpblendd	\$0b11000000,$A00,$A01,$A01	# [0][0] [0][4] [0][3] [0][2]
 	  vpandn	@T[8],$A01,$A01		# tgting  [0][4] [0][3] [0][2] [0][1]

 	vpblendd	\$0b00001100,@T[5],@T[4],$A20	#               [4][1] [2][1]
 	vpblendd	\$0b00001100,@T[4],@T[6],@T[7]	#               [4][2] [2][2]
 	vpblendd	\$0b00110000,@T[6],$A20,$A20	#        [1][1] [4][1] [2][1]
 	vpblendd	\$0b00110000,@T[3],@T[7],@T[7]	#        [1][2] [4][2] [2][2]
 	vpblendd	\$0b11000000,@T[3],$A20,$A20	# [3][1] [1][1] [4][1] [2][1]
 	vpblendd	\$0b11000000,@T[5],@T[7],@T[7]	# [3][2] [1][2] [4][2] [2][2]
 	vpandn		@T[7],$A20,$A20		# tgting  [3][0] [1][0] [4][0] [2][0]
 	vpxor		@T[2],$A20,$A20

 	 vpermq		\$0b00000000,@T[0],@T[0]	# [0][0] [0][0] [0][0] [0][0]
 	 vpermq		\$0b00011011,$A31,$A31	# post-Chi shuffle
 	 vpermq		\$0b10001101,$A41,$A41
 	 vpermq		\$0b01110010,$A11,$A11

 	vpblendd	\$0b00001100,@T[3],@T[6],$A21	#               [4][3] [2][2]
 	vpblendd	\$0b00001100,@T[6],@T[5],@T[7]	#               [4][4] [2][3]
 	vpblendd	\$0b00110000,@T[5],$A21,$A21	#        [1][4] [4][3] [2][2]
 	vpblendd	\$0b00110000,@T[2],@T[7],@T[7]	#        [1][0] [4][4] [2][3]
 	vpblendd	\$0b11000000,@T[2],$A21,$A21	# [3][0] [1][4] [4][3] [2][2]
 	vpblendd	\$0b11000000,@T[3],@T[7],@T[7]	# [3][1] [1][0] [4][4] [2][3]
 	vpandn		@T[7],$A21,$A21		# tgting  [3][4] [1][3] [4][2] [2][1]

 	vpxor		@T[0],$A00,$A00
 	vpxor		@T[1],$A01,$A01
 	vpxor		@T[4],$A21,$A21

 	######################################### Iota
 	vpxor		(%r10),$A00,$A00
 	lea		32(%r10),%r10

 	dec		%eax
 	jnz		.Loop_avx2

 	ret
 .size	__KeccakF1600,.-__KeccakF1600
 ___
 my ($A_flat,$inp,$len,$bsz) = ("%rdi","%rsi","%rdx","%rcx");
 my  $out = $inp;	# in squeeze

 $code.=<<___;
 .globl	SHA3_absorb
 .type	SHA3_absorb,\@function
 .align	32
 SHA3_absorb:
 	mov	%rsp,%r11

 	lea	-240(%rsp),%rsp
 	and	\$-32,%rsp

 	lea	96($A_flat),$A_flat
 	lea	96($inp),$inp
 	lea	96(%rsp),%r10

 	vzeroupper

 	vpbroadcastq	-96($A_flat),$A00	# load A[5][5]
 	vmovdqu		8+32*0-96($A_flat),$A01
 	vmovdqu		8+32*1-96($A_flat),$A20
 	vmovdqu		8+32*2-96($A_flat),$A31
 	vmovdqu		8+32*3-96($A_flat),$A21
 	vmovdqu		8+32*4-96($A_flat),$A41
 	vmovdqu		8+32*5-96($A_flat),$A11

 	vpxor		@T[0],@T[0],@T[0]
 	vmovdqa		@T[0],32*2-96(%r10)	# zero transfer area on stack
 	vmovdqa		@T[0],32*3-96(%r10)
 	vmovdqa		@T[0],32*4-96(%r10)
 	vmovdqa		@T[0],32*5-96(%r10)
 	vmovdqa		@T[0],32*6-96(%r10)

 .Loop_absorb_avx2:
 	mov		$bsz,%rax
 	sub		$bsz,$len
 	jc		.Ldone_absorb_avx2

 	shr		\$3,%eax
 	vpbroadcastq	0-96($inp),@T[0]
 	vmovdqu		8-96($inp),@T[1]
 	sub		\$4,%eax
 ___
 for(my $i=5; $i<25; $i++) {
 $code.=<<___
 	dec	%eax
 	jz	.Labsorved_avx2
 	mov	8*$i-96($inp),%r8
 	mov	%r8,$A_jagged[$i]-96(%r10)
 ___
 }
 $code.=<<___;
 .Labsorved_avx2:
 	lea	($inp,$bsz),$inp

 	vpxor	@T[0],$A00,$A00
 	vpxor	@T[1],$A01,$A01
 	vpxor	32*2-96(%r10),$A20,$A20
 	vpxor	32*3-96(%r10),$A31,$A31
 	vpxor	32*4-96(%r10),$A21,$A21
 	vpxor	32*5-96(%r10),$A41,$A41
 	vpxor	32*6-96(%r10),$A11,$A11

 	call	__KeccakF1600

 	lea	96(%rsp),%r10
 	jmp	.Loop_absorb_avx2

 .Ldone_absorb_avx2:
 	vmovq	%xmm0,-96($A_flat)
 	vmovdqu	$A01,8+32*0-96($A_flat)
 	vmovdqu	$A20,8+32*1-96($A_flat)
 	vmovdqu	$A31,8+32*2-96($A_flat)
 	vmovdqu	$A21,8+32*3-96($A_flat)
 	vmovdqu	$A41,8+32*4-96($A_flat)
 	vmovdqu	$A11,8+32*5-96($A_flat)

 	vzeroupper

 	lea	(%r11),%rsp
 	lea	($len,$bsz),%rax		# return value
 	ret
 .size	SHA3_absorb,.-SHA3_absorb

 .globl	SHA3_squeeze
 .type	SHA3_squeeze,\@function
 .align	32
 SHA3_squeeze:
 	mov	%rsp,%r11

 	lea	96($A_flat),$A_flat
 	shr	\$3,$bsz

 	vzeroupper

 	vpbroadcastq	-96($A_flat),$A00
 	vpxor		@T[0],@T[0],@T[0]
 	vmovdqu		8+32*0-96($A_flat),$A01
 	vmovdqu		8+32*1-96($A_flat),$A20
 	vmovdqu		8+32*2-96($A_flat),$A31
 	vmovdqu		8+32*3-96($A_flat),$A21
 	vmovdqu		8+32*4-96($A_flat),$A41
 	vmovdqu		8+32*5-96($A_flat),$A11

 	mov	$bsz,%rax

 .Loop_squeeze_avx2:
 	mov	@A_jagged[$i]-96($A_flat),%r8
 ___
 for (my $i=0; $i<25; $i++) {
 $code.=<<___;
 	sub	\$8,$len
 	jc	.Ltail_squeeze_avx2
 	mov	%r8,($out)
 	lea	8($out),$out
 	je	.Ldone_squeeze_avx2
 	dec	%eax
 	je	.Lextend_output_avx2
 	mov	@A_jagged[$i+1]-120($A_flat),%r8
 ___
 }
 $code.=<<___;
 .Lextend_output_avx2:
 	call	__KeccakF1600

 	vmovq	%xmm0,-96($A_flat)
 	vmovdqu	$A01,8+32*0-96($A_flat)
 	vmovdqu	$A20,8+32*1-96($A_flat)
 	vmovdqu	$A31,8+32*2-96($A_flat)
 	vmovdqu	$A21,8+32*3-96($A_flat)
 	vmovdqu	$A41,8+32*4-96($A_flat)
 	vmovdqu	$A11,8+32*5-96($A_flat)

 	mov	$bsz,%rax
 	jmp	.Loop_squeeze_avx2


 .Ltail_squeeze_avx2:
 	add	\$8,$len
 .Loop_tail_avx2:
 	mov	%r8b,($out)
 	lea	1($out),$out
 	shr	\$8,%r8
 	dec	$len
 	jnz	.Loop_tail_avx2

 .Ldone_squeeze_avx2:
 	vzeroupper

 	lea	(%r11),%rsp
 	ret
 .size	SHA3_squeeze,.-SHA3_squeeze

 .align	64
 rhotates_left:
 	.quad	3,	18,	36,	41	# [2][0] [4][0] [1][0] [3][0]
 	.quad	1,	62,	28,	27	# [0][1] [0][2] [0][3] [0][4]
 	.quad	45,	6,	56,	39	# [3][1] [1][2] [4][3] [2][4]
 	.quad	10,	61,	55,	8	# [2][1] [4][2] [1][3] [3][4]
 	.quad	2,	15,	25,	20	# [4][1] [3][2] [2][3] [1][4]
 	.quad	44,	43,	21,	14	# [1][1] [2][2] [3][3] [4][4]
 rhotates_right:
 	.quad	64-3,	64-18,	64-36,	64-41
 	.quad	64-1,	64-62,	64-28,	64-27
 	.quad	64-45,	64-6,	64-56,	64-39
 	.quad	64-10,	64-61,	64-55,	64-8
 	.quad	64-2,	64-15,	64-25,	64-20
 	.quad	64-44,	64-43,	64-21,	64-14
 iotas:
 	.quad	0x0000000000000001, 0x0000000000000001, 0x0000000000000001, 0x0000000000000001
 	.quad	0x0000000000008082, 0x0000000000008082, 0x0000000000008082, 0x0000000000008082
 	.quad	0x800000000000808a, 0x800000000000808a, 0x800000000000808a, 0x800000000000808a
 	.quad	0x8000000080008000, 0x8000000080008000, 0x8000000080008000, 0x8000000080008000
 	.quad	0x000000000000808b, 0x000000000000808b, 0x000000000000808b, 0x000000000000808b
 	.quad	0x0000000080000001, 0x0000000080000001, 0x0000000080000001, 0x0000000080000001
 	.quad	0x8000000080008081, 0x8000000080008081, 0x8000000080008081, 0x8000000080008081
 	.quad	0x8000000000008009, 0x8000000000008009, 0x8000000000008009, 0x8000000000008009
 	.quad	0x000000000000008a, 0x000000000000008a, 0x000000000000008a, 0x000000000000008a
 	.quad	0x0000000000000088, 0x0000000000000088, 0x0000000000000088, 0x0000000000000088
 	.quad	0x0000000080008009, 0x0000000080008009, 0x0000000080008009, 0x0000000080008009
 	.quad	0x000000008000000a, 0x000000008000000a, 0x000000008000000a, 0x000000008000000a
 	.quad	0x000000008000808b, 0x000000008000808b, 0x000000008000808b, 0x000000008000808b
 	.quad	0x800000000000008b, 0x800000000000008b, 0x800000000000008b, 0x800000000000008b
 	.quad	0x8000000000008089, 0x8000000000008089, 0x8000000000008089, 0x8000000000008089
 	.quad	0x8000000000008003, 0x8000000000008003, 0x8000000000008003, 0x8000000000008003
 	.quad	0x8000000000008002, 0x8000000000008002, 0x8000000000008002, 0x8000000000008002
 	.quad	0x8000000000000080, 0x8000000000000080, 0x8000000000000080, 0x8000000000000080
 	.quad	0x000000000000800a, 0x000000000000800a, 0x000000000000800a, 0x000000000000800a
 	.quad	0x800000008000000a, 0x800000008000000a, 0x800000008000000a, 0x800000008000000a
 	.quad	0x8000000080008081, 0x8000000080008081, 0x8000000080008081, 0x8000000080008081
 	.quad	0x8000000000008080, 0x8000000000008080, 0x8000000000008080, 0x8000000000008080
 	.quad	0x0000000080000001, 0x0000000080000001, 0x0000000080000001, 0x0000000080000001
 	.quad	0x8000000080008008, 0x8000000080008008, 0x8000000080008008, 0x8000000080008008

 .asciz	"Keccak-1600 absorb and squeeze for AVX2, CRYPTOGAMS by <appro\@openssl.org>"
 ___

 $output=pop;
 open STDOUT,">$output";
 print $code;
 close STDOUT;
	#!/usr/bin/env perl
	# Copyright 2017-2018 The OpenSSL Project Authors. All Rights Reserved.
	#
	# Licensed under the OpenSSL license (the "License"). You may not use
	# this file except in compliance with the License. You can obtain a copy
	# in the file LICENSE in the source distribution or at
	# https://www.openssl.org/source/license.html
	#
	# ====================================================================
	# Written by Andy Polyakov <appro@openssl.org> for the OpenSSL
	# project. The module is, however, dual licensed under OpenSSL and
	# CRYPTOGAMS licenses depending on where you obtain it. For further
	# details see http://www.openssl.org/~appro/cryptogams/.
	# ====================================================================
	#
	# Keccak-1600 for AVX2.
	#
	# July 2017.
	#
	# To paraphrase Gilles Van Assche, if you contemplate Fig. 2.3 on page
	# 20 of The Keccak reference [or Fig. 5 of FIPS PUB 202], and load data
	# other than A[0][0] in magic order into 6 [256-bit] registers, *each
	# dedicated to one axis*, Pi permutation is reduced to intra-register
	# shuffles...
	#
	# It makes other steps more intricate, but overall, is it a win? To be
	# more specific index permutations organized by quadruples are:
	#
	# [4][4] [3][3] [2][2] [1][1]<-+
	# [0][4] [0][3] [0][2] [0][1]<-+
	# [3][0] [1][0] [4][0] [2][0] \|
	# [4][3] [3][1] [2][4] [1][2] \|
	# [3][4] [1][3] [4][2] [2][1] \|
	# [2][3] [4][1] [1][4] [3][2] \|
	# [2][2] [4][4] [1][1] [3][3] -+
	#
	# This however is highly impractical for Theta and Chi. What would help
	# Theta is if x indices were aligned column-wise, or in other words:
	#
	# [0][4] [0][3] [0][2] [0][1]
	# [3][0] [1][0] [4][0] [2][0]
	#vpermq([4][3] [3][1] [2][4] [1][2], 0b01110010)
	# [2][4] [4][3] [1][2] [3][1]
	#vpermq([4][2] [3][4] [2][1] [1][3], 0b10001101)
	# [3][4] [1][3] [4][2] [2][1]
	#vpermq([2][3] [4][1] [1][4] [3][2], 0b01110010)
	# [1][4] [2][3] [3][2] [4][1]
	#vpermq([1][1] [2][2] [3][3] [4][4], 0b00011011)
	# [4][4] [3][3] [2][2] [1][1]
	#
	# So here we have it, lines not marked with vpermq() represent the magic
	# order in which data is to be loaded and maintained. [And lines marked
	# with vpermq() represent Pi circular permutation in chosen layout. Note
	# that first step is permutation-free.] A[0][0] is loaded to register of
	# its own, to all lanes. [A[0][0] is not part of Pi permutation or Rho.]
	# Digits in variables' names denote right-most coordinates:

	my ($A00, # [0][0] [0][0] [0][0] [0][0] # %ymm0
	$A01, # [0][4] [0][3] [0][2] [0][1] # %ymm1
	$A20, # [3][0] [1][0] [4][0] [2][0] # %ymm2
	$A31, # [2][4] [4][3] [1][2] [3][1] # %ymm3
	$A21, # [3][4] [1][3] [4][2] [2][1] # %ymm4
	$A41, # [1][4] [2][3] [3][2] [4][1] # %ymm5
	$A11) = # [4][4] [3][3] [2][2] [1][1] # %ymm6
	map("%ymm$_",(0..6));

	# We also need to map the magic order into offsets within structure:

	my @A_jagged = ([0,0], [1,0], [1,1], [1,2], [1,3], # [0][0..4]
	[2,2], [6,0], [3,1], [4,2], [5,3], # [1][0..4]
	[2,0], [4,0], [6,1], [5,2], [3,3], # [2][0..4]
	[2,3], [3,0], [5,1], [6,2], [4,3], # [3][0..4]
	[2,1], [5,0], [4,1], [3,2], [6,3]); # [4][0..4]
	@A_jagged = map(8($$_[0]4+$$_[1]), @A_jagged); # ... and now linear

	# But on the other hand Chi is much better off if y indices were aligned
	# column-wise, not x. For this reason we have to shuffle data prior
	# Chi and revert it afterwards. Prior shuffle is naturally merged with
	# Pi itself:
	#
	# [0][4] [0][3] [0][2] [0][1]
	# [3][0] [1][0] [4][0] [2][0]
	#vpermq([4][3] [3][1] [2][4] [1][2], 0b01110010)
	#vpermq([2][4] [4][3] [1][2] [3][1], 0b00011011) = 0b10001101
	# [3][1] [1][2] [4][3] [2][4]
	#vpermq([4][2] [3][4] [2][1] [1][3], 0b10001101)
	#vpermq([3][4] [1][3] [4][2] [2][1], 0b11100100) = 0b10001101
	# [3][4] [1][3] [4][2] [2][1]
	#vpermq([2][3] [4][1] [1][4] [3][2], 0b01110010)
	#vpermq([1][4] [2][3] [3][2] [4][1], 0b01110010) = 0b00011011
	# [3][2] [1][4] [4][1] [2][3]
	#vpermq([1][1] [2][2] [3][3] [4][4], 0b00011011)
	#vpermq([4][4] [3][3] [2][2] [1][1], 0b10001101) = 0b01110010
	# [3][3] [1][1] [4][4] [2][2]
	#
	# And reverse post-Chi permutation:
	#
	# [0][4] [0][3] [0][2] [0][1]
	# [3][0] [1][0] [4][0] [2][0]
	#vpermq([3][1] [1][2] [4][3] [2][4], 0b00011011)
	# [2][4] [4][3] [1][2] [3][1]
	#vpermq([3][4] [1][3] [4][2] [2][1], 0b11100100) = nop :-)
	# [3][4] [1][3] [4][2] [2][1]
	#vpermq([3][2] [1][4] [4][1] [2][3], 0b10001101)
	# [1][4] [2][3] [3][2] [4][1]
	#vpermq([3][3] [1][1] [4][4] [2][2], 0b01110010)
	# [4][4] [3][3] [2][2] [1][1]
	#
	########################################################################
	# Numbers are cycles per processed byte out of large message.
	#
	# r=1088(*)
	#
	# Haswell 8.7/+10%
	# Skylake 7.8/+20%
	# Ryzen 17(**)
	#
	# (*) Corresponds to SHA3-256. Percentage after slash is improvement
	# coefficient in comparison to scalar keccak1600-x86_64.pl.
	# (**) It's expected that Ryzen performs poorly, because instruction
	# issue rate is limited to two AVX2 instructions per cycle and
	# in addition vpblendd is reportedly bound to specific port.
	# Obviously this code path should not be executed on Ryzen.

	my @T = map("%ymm$_",(7..15));
	my ($C14,$C00,$D00,$D14) = @T[5..8];

	$code.=<<___;
	.text

	.type __KeccakF1600,\@function
	.align 32
	__KeccakF1600:
	lea rhotates_left+96(%rip),%r8
	lea rhotates_right+96(%rip),%r9
	lea iotas(%rip),%r10
	mov \$24,%eax
	jmp .Loop_avx2

	.align 32
	.Loop_avx2:
	######################################### Theta
	vpshufd \$0b01001110,$A20,$C00
	vpxor $A31,$A41,$C14
	vpxor $A11,$A21,@T[2]
	vpxor $A01,$C14,$C14
	vpxor @T[2],$C14,$C14 # C[1..4]

	vpermq \$0b10010011,$C14,@T[4]
	vpxor $A20,$C00,$C00
	vpermq \$0b01001110,$C00,@T[0]

	vpsrlq \$63,$C14,@T[1]
	vpaddq $C14,$C14,@T[2]
	vpor @T[2],@T[1],@T[1] # ROL64(C[1..4],1)

	vpermq \$0b00111001,@T[1],$D14
	vpxor @T[4],@T[1],$D00
	vpermq \$0b00000000,$D00,$D00 # D[0..0] = ROL64(C[1],1) ^ C[4]

	vpxor $A00,$C00,$C00
	vpxor @T[0],$C00,$C00 # C[0..0]

	vpsrlq \$63,$C00,@T[0]
	vpaddq $C00,$C00,@T[1]
	vpor @T[0],@T[1],@T[1] # ROL64(C[0..0],1)

	vpxor $D00,$A20,$A20 # ^= D[0..0]
	vpxor $D00,$A00,$A00 # ^= D[0..0]

	vpblendd \$0b11000000,@T[1],$D14,$D14
	vpblendd \$0b00000011,$C00,@T[4],@T[4]
	vpxor @T[4],$D14,$D14 # D[1..4] = ROL64(C[2..4,0),1) ^ C[0..3]

	######################################### Rho + Pi + pre-Chi shuffle
	vpsllvq 0*32-96(%r8),$A20,@T[3]
	vpsrlvq 0*32-96(%r9),$A20,$A20
	vpor @T[3],$A20,$A20

	vpxor $D14,$A31,$A31 # ^= D[1..4] from Theta
	vpsllvq 2*32-96(%r8),$A31,@T[4]
	vpsrlvq 2*32-96(%r9),$A31,$A31
	vpor @T[4],$A31,$A31

	vpxor $D14,$A21,$A21 # ^= D[1..4] from Theta
	vpsllvq 3*32-96(%r8),$A21,@T[5]
	vpsrlvq 3*32-96(%r9),$A21,$A21
	vpor @T[5],$A21,$A21

	vpxor $D14,$A41,$A41 # ^= D[1..4] from Theta
	vpsllvq 4*32-96(%r8),$A41,@T[6]
	vpsrlvq 4*32-96(%r9),$A41,$A41
	vpor @T[6],$A41,$A41

	vpxor $D14,$A11,$A11 # ^= D[1..4] from Theta
	vpermq \$0b10001101,$A20,@T[3] # $A20 -> future $A31
	vpermq \$0b10001101,$A31,@T[4] # $A31 -> future $A21
	vpsllvq 5*32-96(%r8),$A11,@T[7]
	vpsrlvq 5*32-96(%r9),$A11,@T[1]
	vpor @T[7],@T[1],@T[1] # $A11 -> future $A01

	vpxor $D14,$A01,$A01 # ^= D[1..4] from Theta
	vpermq \$0b00011011,$A21,@T[5] # $A21 -> future $A41
	vpermq \$0b01110010,$A41,@T[6] # $A41 -> future $A11
	vpsllvq 1*32-96(%r8),$A01,@T[8]
	vpsrlvq 1*32-96(%r9),$A01,@T[2]
	vpor @T[8],@T[2],@T[2] # $A01 -> future $A20

	######################################### Chi
	vpsrldq \$8,@T[1],@T[7]
	vpandn @T[7],@T[1],@T[0] # tgting [0][0] [0][0] [0][0] [0][0]

	vpblendd \$0b00001100,@T[6],@T[2],$A31 # [4][4] [2][0]
	vpblendd \$0b00001100,@T[2],@T[4],@T[8] # [4][0] [2][1]
	vpblendd \$0b00001100,@T[4],@T[3],$A41 # [4][2] [2][4]
	vpblendd \$0b00001100,@T[3],@T[2],@T[7] # [4][3] [2][0]
	vpblendd \$0b00110000,@T[4],$A31,$A31 # [1][3] [4][4] [2][0]
	vpblendd \$0b00110000,@T[5],@T[8],@T[8] # [1][4] [4][0] [2][1]
	vpblendd \$0b00110000,@T[2],$A41,$A41 # [1][0] [4][2] [2][4]
	vpblendd \$0b00110000,@T[6],@T[7],@T[7] # [1][1] [4][3] [2][0]
	vpblendd \$0b11000000,@T[5],$A31,$A31 # [3][2] [1][3] [4][4] [2][0]
	vpblendd \$0b11000000,@T[6],@T[8],@T[8] # [3][3] [1][4] [4][0] [2][1]
	vpblendd \$0b11000000,@T[6],$A41,$A41 # [3][3] [1][0] [4][2] [2][4]
	vpblendd \$0b11000000,@T[4],@T[7],@T[7] # [3][4] [1][1] [4][3] [2][0]
	vpandn @T[8],$A31,$A31 # tgting [3][1] [1][2] [4][3] [2][4]
	vpandn @T[7],$A41,$A41 # tgting [3][2] [1][4] [4][1] [2][3]

	vpblendd \$0b00001100,@T[2],@T[5],$A11 # [4][0] [2][3]
	vpblendd \$0b00001100,@T[5],@T[3],@T[8] # [4][1] [2][4]
	vpxor @T[3],$A31,$A31
	vpblendd \$0b00110000,@T[3],$A11,$A11 # [1][2] [4][0] [2][3]
	vpblendd \$0b00110000,@T[4],@T[8],@T[8] # [1][3] [4][1] [2][4]
	vpxor @T[5],$A41,$A41
	vpblendd \$0b11000000,@T[4],$A11,$A11 # [3][4] [1][2] [4][0] [2][3]
	vpblendd \$0b11000000,@T[2],@T[8],@T[8] # [3][0] [1][3] [4][1] [2][4]
	vpandn @T[8],$A11,$A11 # tgting [3][3] [1][1] [4][4] [2][2]
	vpxor @T[6],$A11,$A11

	vpermq \$0b00011110,@T[1],$A21 # [0][1] [0][2] [0][4] [0][3]
	vpblendd \$0b00110000,$A00,$A21,@T[8] # [0][1] [0][0] [0][4] [0][3]
	vpermq \$0b00111001,@T[1],$A01 # [0][1] [0][4] [0][3] [0][2]
	vpblendd \$0b11000000,$A00,$A01,$A01 # [0][0] [0][4] [0][3] [0][2]
	vpandn @T[8],$A01,$A01 # tgting [0][4] [0][3] [0][2] [0][1]

	vpblendd \$0b00001100,@T[5],@T[4],$A20 # [4][1] [2][1]
	vpblendd \$0b00001100,@T[4],@T[6],@T[7] # [4][2] [2][2]
	vpblendd \$0b00110000,@T[6],$A20,$A20 # [1][1] [4][1] [2][1]
	vpblendd \$0b00110000,@T[3],@T[7],@T[7] # [1][2] [4][2] [2][2]
	vpblendd \$0b11000000,@T[3],$A20,$A20 # [3][1] [1][1] [4][1] [2][1]
	vpblendd \$0b11000000,@T[5],@T[7],@T[7] # [3][2] [1][2] [4][2] [2][2]
	vpandn @T[7],$A20,$A20 # tgting [3][0] [1][0] [4][0] [2][0]
	vpxor @T[2],$A20,$A20

	vpermq \$0b00000000,@T[0],@T[0] # [0][0] [0][0] [0][0] [0][0]
	vpermq \$0b00011011,$A31,$A31 # post-Chi shuffle
	vpermq \$0b10001101,$A41,$A41
	vpermq \$0b01110010,$A11,$A11

	vpblendd \$0b00001100,@T[3],@T[6],$A21 # [4][3] [2][2]
	vpblendd \$0b00001100,@T[6],@T[5],@T[7] # [4][4] [2][3]
	vpblendd \$0b00110000,@T[5],$A21,$A21 # [1][4] [4][3] [2][2]
	vpblendd \$0b00110000,@T[2],@T[7],@T[7] # [1][0] [4][4] [2][3]
	vpblendd \$0b11000000,@T[2],$A21,$A21 # [3][0] [1][4] [4][3] [2][2]
	vpblendd \$0b11000000,@T[3],@T[7],@T[7] # [3][1] [1][0] [4][4] [2][3]
	vpandn @T[7],$A21,$A21 # tgting [3][4] [1][3] [4][2] [2][1]

	vpxor @T[0],$A00,$A00
	vpxor @T[1],$A01,$A01
	vpxor @T[4],$A21,$A21

	######################################### Iota
	vpxor (%r10),$A00,$A00
	lea 32(%r10),%r10

	dec %eax
	jnz .Loop_avx2

	ret
	.size __KeccakF1600,.-__KeccakF1600
	___
	my ($A_flat,$inp,$len,$bsz) = ("%rdi","%rsi","%rdx","%rcx");
	my $out = $inp; # in squeeze

	$code.=<<___;
	.globl SHA3_absorb
	.type SHA3_absorb,\@function
	.align 32
	SHA3_absorb:
	mov %rsp,%r11

	lea -240(%rsp),%rsp
	and \$-32,%rsp

	lea 96($A_flat),$A_flat
	lea 96($inp),$inp
	lea 96(%rsp),%r10

	vzeroupper

	vpbroadcastq -96($A_flat),$A00 # load A[5][5]
	vmovdqu 8+32*0-96($A_flat),$A01
	vmovdqu 8+32*1-96($A_flat),$A20
	vmovdqu 8+32*2-96($A_flat),$A31
	vmovdqu 8+32*3-96($A_flat),$A21
	vmovdqu 8+32*4-96($A_flat),$A41
	vmovdqu 8+32*5-96($A_flat),$A11

	vpxor @T[0],@T[0],@T[0]
	vmovdqa @T[0],32*2-96(%r10) # zero transfer area on stack
	vmovdqa @T[0],32*3-96(%r10)
	vmovdqa @T[0],32*4-96(%r10)
	vmovdqa @T[0],32*5-96(%r10)
	vmovdqa @T[0],32*6-96(%r10)

	.Loop_absorb_avx2:
	mov $bsz,%rax
	sub $bsz,$len
	jc .Ldone_absorb_avx2

	shr \$3,%eax
	vpbroadcastq 0-96($inp),@T[0]
	vmovdqu 8-96($inp),@T[1]
	sub \$4,%eax
	___
	for(my $i=5; $i<25; $i++) {
	$code.=<<___
	dec %eax
	jz .Labsorved_avx2
	mov 8*$i-96($inp),%r8
	mov %r8,$A_jagged[$i]-96(%r10)
	___
	}
	$code.=<<___;
	.Labsorved_avx2:
	lea ($inp,$bsz),$inp

	vpxor @T[0],$A00,$A00
	vpxor @T[1],$A01,$A01
	vpxor 32*2-96(%r10),$A20,$A20
	vpxor 32*3-96(%r10),$A31,$A31
	vpxor 32*4-96(%r10),$A21,$A21
	vpxor 32*5-96(%r10),$A41,$A41
	vpxor 32*6-96(%r10),$A11,$A11

	call __KeccakF1600

	lea 96(%rsp),%r10
	jmp .Loop_absorb_avx2

	.Ldone_absorb_avx2:
	vmovq %xmm0,-96($A_flat)
	vmovdqu $A01,8+32*0-96($A_flat)
	vmovdqu $A20,8+32*1-96($A_flat)
	vmovdqu $A31,8+32*2-96($A_flat)
	vmovdqu $A21,8+32*3-96($A_flat)
	vmovdqu $A41,8+32*4-96($A_flat)
	vmovdqu $A11,8+32*5-96($A_flat)

	vzeroupper

	lea (%r11),%rsp
	lea ($len,$bsz),%rax # return value
	ret
	.size SHA3_absorb,.-SHA3_absorb

	.globl SHA3_squeeze
	.type SHA3_squeeze,\@function
	.align 32
	SHA3_squeeze:
	mov %rsp,%r11

	lea 96($A_flat),$A_flat
	shr \$3,$bsz

	vzeroupper

	vpbroadcastq -96($A_flat),$A00
	vpxor @T[0],@T[0],@T[0]
	vmovdqu 8+32*0-96($A_flat),$A01
	vmovdqu 8+32*1-96($A_flat),$A20
	vmovdqu 8+32*2-96($A_flat),$A31
	vmovdqu 8+32*3-96($A_flat),$A21
	vmovdqu 8+32*4-96($A_flat),$A41
	vmovdqu 8+32*5-96($A_flat),$A11

	mov $bsz,%rax

	.Loop_squeeze_avx2:
	mov @A_jagged[$i]-96($A_flat),%r8
	___
	for (my $i=0; $i<25; $i++) {
	$code.=<<___;
	sub \$8,$len
	jc .Ltail_squeeze_avx2
	mov %r8,($out)
	lea 8($out),$out
	je .Ldone_squeeze_avx2
	dec %eax
	je .Lextend_output_avx2
	mov @A_jagged[$i+1]-120($A_flat),%r8
	___
	}
	$code.=<<___;
	.Lextend_output_avx2:
	call __KeccakF1600

	vmovq %xmm0,-96($A_flat)
	vmovdqu $A01,8+32*0-96($A_flat)
	vmovdqu $A20,8+32*1-96($A_flat)
	vmovdqu $A31,8+32*2-96($A_flat)
	vmovdqu $A21,8+32*3-96($A_flat)
	vmovdqu $A41,8+32*4-96($A_flat)
	vmovdqu $A11,8+32*5-96($A_flat)

	mov $bsz,%rax
	jmp .Loop_squeeze_avx2


	.Ltail_squeeze_avx2:
	add \$8,$len
	.Loop_tail_avx2:
	mov %r8b,($out)
	lea 1($out),$out
	shr \$8,%r8
	dec $len
	jnz .Loop_tail_avx2

	.Ldone_squeeze_avx2:
	vzeroupper

	lea (%r11),%rsp
	ret
	.size SHA3_squeeze,.-SHA3_squeeze

	.align 64
	rhotates_left:
	.quad 3, 18, 36, 41 # [2][0] [4][0] [1][0] [3][0]
	.quad 1, 62, 28, 27 # [0][1] [0][2] [0][3] [0][4]
	.quad 45, 6, 56, 39 # [3][1] [1][2] [4][3] [2][4]
	.quad 10, 61, 55, 8 # [2][1] [4][2] [1][3] [3][4]
	.quad 2, 15, 25, 20 # [4][1] [3][2] [2][3] [1][4]
	.quad 44, 43, 21, 14 # [1][1] [2][2] [3][3] [4][4]
	rhotates_right:
	.quad 64-3, 64-18, 64-36, 64-41
	.quad 64-1, 64-62, 64-28, 64-27
	.quad 64-45, 64-6, 64-56, 64-39
	.quad 64-10, 64-61, 64-55, 64-8
	.quad 64-2, 64-15, 64-25, 64-20
	.quad 64-44, 64-43, 64-21, 64-14
	iotas:
	.quad 0x0000000000000001, 0x0000000000000001, 0x0000000000000001, 0x0000000000000001
	.quad 0x0000000000008082, 0x0000000000008082, 0x0000000000008082, 0x0000000000008082
	.quad 0x800000000000808a, 0x800000000000808a, 0x800000000000808a, 0x800000000000808a
	.quad 0x8000000080008000, 0x8000000080008000, 0x8000000080008000, 0x8000000080008000
	.quad 0x000000000000808b, 0x000000000000808b, 0x000000000000808b, 0x000000000000808b
	.quad 0x0000000080000001, 0x0000000080000001, 0x0000000080000001, 0x0000000080000001
	.quad 0x8000000080008081, 0x8000000080008081, 0x8000000080008081, 0x8000000080008081
	.quad 0x8000000000008009, 0x8000000000008009, 0x8000000000008009, 0x8000000000008009
	.quad 0x000000000000008a, 0x000000000000008a, 0x000000000000008a, 0x000000000000008a
	.quad 0x0000000000000088, 0x0000000000000088, 0x0000000000000088, 0x0000000000000088
	.quad 0x0000000080008009, 0x0000000080008009, 0x0000000080008009, 0x0000000080008009
	.quad 0x000000008000000a, 0x000000008000000a, 0x000000008000000a, 0x000000008000000a
	.quad 0x000000008000808b, 0x000000008000808b, 0x000000008000808b, 0x000000008000808b
	.quad 0x800000000000008b, 0x800000000000008b, 0x800000000000008b, 0x800000000000008b
	.quad 0x8000000000008089, 0x8000000000008089, 0x8000000000008089, 0x8000000000008089
	.quad 0x8000000000008003, 0x8000000000008003, 0x8000000000008003, 0x8000000000008003
	.quad 0x8000000000008002, 0x8000000000008002, 0x8000000000008002, 0x8000000000008002
	.quad 0x8000000000000080, 0x8000000000000080, 0x8000000000000080, 0x8000000000000080
	.quad 0x000000000000800a, 0x000000000000800a, 0x000000000000800a, 0x000000000000800a
	.quad 0x800000008000000a, 0x800000008000000a, 0x800000008000000a, 0x800000008000000a
	.quad 0x8000000080008081, 0x8000000080008081, 0x8000000080008081, 0x8000000080008081
	.quad 0x8000000000008080, 0x8000000000008080, 0x8000000000008080, 0x8000000000008080
	.quad 0x0000000080000001, 0x0000000080000001, 0x0000000080000001, 0x0000000080000001
	.quad 0x8000000080008008, 0x8000000080008008, 0x8000000080008008, 0x8000000080008008

	.asciz "Keccak-1600 absorb and squeeze for AVX2, CRYPTOGAMS by <appro\@openssl.org>"
	___

	$output=pop;
	open STDOUT,">$output";
	print $code;
	close STDOUT;