Add sha/asm/keccak1600-armv4.pl.

Reviewed-by: Rich Salz <rsalz@openssl.org>

1 files changed, 532 insertions, 0 deletions

diff --git a/crypto/sha/asm/keccak1600-armv4.pl b/crypto/sha/asm/keccak1600-armv4.pl
new file mode 100644
index 0000000000..21395733a6
--- /dev/null
+++ b/crypto/sha/asm/keccak1600-armv4.pl
@@ -0,0 +1,532 @@
+my @C = map("r$_",(0..9));
+my @E = map("r$_",(10..12,14));
+
+my @A = map([ 8*$_, 8*($_+1), 8*($_+2), 8*($_+3), 8*($_+4) ], (0,5,10,15,20));
+my @D = map(8*$_, (25..29));
+my @T = map([ 8*$_, 8*($_+1), 8*($_+2), 8*($_+3), 8*($_+4) ], (30,35));
+
+$code.=<<___;
+.text
+
+.type	iotas,%object
+.align	5
+iotas:
+	.long	0x00000001, 0x00000000
+	.long	0x00000000, 0x00000089
+	.long	0x00000000, 0x8000008b
+	.long	0x00000000, 0x80008080
+	.long	0x00000001, 0x0000008b
+	.long	0x00000001, 0x00008000
+	.long	0x00000001, 0x80008088
+	.long	0x00000001, 0x80000082
+	.long	0x00000000, 0x0000000b
+	.long	0x00000000, 0x0000000a
+	.long	0x00000001, 0x00008082
+	.long	0x00000000, 0x00008003
+	.long	0x00000001, 0x0000808b
+	.long	0x00000001, 0x8000000b
+	.long	0x00000001, 0x8000008a
+	.long	0x00000001, 0x80000081
+	.long	0x00000000, 0x80000081
+	.long	0x00000000, 0x80000008
+	.long	0x00000000, 0x00000083
+	.long	0x00000000, 0x80008003
+	.long	0x00000001, 0x80008088
+	.long	0x00000000, 0x80000088
+	.long	0x00000001, 0x00008000
+	.long	0x00000000, 0x80008082
+.size	iostas,.-iotas
+
+.global	KeccakF1600
+.type	KeccakF1600, %function
+.align	5
+KeccakF1600:
+	eor	r1,r1,r1
+	stmdb	sp!,{r0,r1,r4-r12,lr}
+	sub	sp,sp,#320			@ space for A[5][5],D[5],T[2][5]
+
+	add	@E[0],r0,#$A[1][0]
+	add	@E[1],sp,#$A[1][0]
+	mov	@E[2],r0
+	ldmia	@E[0]!,{@C[0]-@C[9]}		@ copy A[5][5] to stack
+	stmia	@E[1]!,{@C[0]-@C[9]}
+	ldmia	@E[0]!,{@C[0]-@C[9]}
+	stmia	@E[1]!,{@C[0]-@C[9]}
+	ldmia	@E[0]!,{@C[0]-@C[9]}
+	stmia	@E[1]!,{@C[0]-@C[9]}
+	ldmia	@E[0],{@C[0]-@C[9]}
+	stmia	@E[1],{@C[0]-@C[9]}
+	ldmia	@E[2],{@C[0]-@C[9]}
+	stmia	sp,{@C[0]-@C[9]}
+	add	@E[0],sp,#$A[1][0]
+	b	.Lround
+
+.align	4
+.Lround:
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[1][0..1]
+	eor	@C[0],@C[0],@E[0]
+	 add	@E[0],sp,#$A[1][2]
+	eor	@C[1],@C[1],@E[1]
+	eor	@C[2],@C[2],@E[2]
+	eor	@C[3],@C[3],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[1][2..3]
+	eor	@C[4],@C[4],@E[0]
+	 add	@E[0],sp,#$A[1][4]
+	eor	@C[5],@C[5],@E[1]
+	eor	@C[6],@C[6],@E[2]
+	eor	@C[7],@C[7],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[1][4]..A[2][0]
+	eor	@C[8],@C[8],@E[0]
+	 add	@E[0],sp,#$A[2][1]
+	eor	@C[9],@C[9],@E[1]
+	eor	@C[0],@C[0],@E[2]
+	eor	@C[1],@C[1],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[2][1..2]
+	eor	@C[2],@C[2],@E[0]
+	 add	@E[0],sp,#$A[2][3]
+	eor	@C[3],@C[3],@E[1]
+	eor	@C[4],@C[4],@E[2]
+	eor	@C[5],@C[5],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[2][3..4]
+	eor	@C[6],@C[6],@E[0]
+	 add	@E[0],sp,#$A[3][0]
+	eor	@C[7],@C[7],@E[1]
+	eor	@C[8],@C[8],@E[2]
+	eor	@C[9],@C[9],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[3][0..1]
+	eor	@C[0],@C[0],@E[0]
+	 add	@E[0],sp,#$A[3][2]
+	eor	@C[1],@C[1],@E[1]
+	eor	@C[2],@C[2],@E[2]
+	eor	@C[3],@C[3],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[3][2..3]
+	eor	@C[4],@C[4],@E[0]
+	 add	@E[0],sp,#$A[3][4]
+	eor	@C[5],@C[5],@E[1]
+	eor	@C[6],@C[6],@E[2]
+	eor	@C[7],@C[7],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[3][4]..A[4][0]
+	eor	@C[8],@C[8],@E[0]
+	 add	@E[0],sp,#$A[4][1]
+	eor	@C[9],@C[9],@E[1]
+	eor	@C[0],@C[0],@E[2]
+	eor	@C[1],@C[1],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[4][1..2]
+	eor	@C[2],@C[2],@E[0]
+	 add	@E[0],sp,#$A[4][3]
+	eor	@C[3],@C[3],@E[1]
+	eor	@C[4],@C[4],@E[2]
+	eor	@C[5],@C[5],@E[3]
+	ldmia	@E[0],{@E[0]-@E[2],@E[3]}	@ A[4][3..4]
+	eor	@C[6],@C[6],@E[0]
+	eor	@C[7],@C[7],@E[1]
+	eor	@C[8],@C[8],@E[2]
+	eor	@C[9],@C[9],@E[3]
+
+	eor	@E[0],@C[0],@C[5],ror#32-1	@ E[0] = ROL64(C[2], 1) ^ C[0];
+	eor	@E[1],@C[1],@C[4]
+	str	@E[0],[sp,#$D[1]]		@ D[1] = E[0]
+	eor	@E[2],@C[6],@C[1],ror#32-1	@ E[1] = ROL64(C[0], 1) ^ C[3];
+	str	@E[1],[sp,#$D[1]+4]
+	eor	@E[3],@C[7],@C[0]
+	str	@E[2],[sp,#$D[4]]		@ D[4] = E[1]
+	eor	@C[0],@C[8],@C[3],ror#32-1	@ C[0] = ROL64(C[1], 1) ^ C[4];
+	str	@E[3],[sp,#$D[4]+4]
+	eor	@C[1],@C[9],@C[2]
+	str	@C[0],[sp,#$D[0]]		@ D[0] = C[0]
+	eor	@C[2],@C[2],@C[7],ror#32-1	@ C[1] = ROL64(C[3], 1) ^ C[1];
+	str	@C[1],[sp,#$D[0]+4]
+	eor	@C[3],@C[3],@C[6]
+	str	@C[2],[sp,#$D[2]]		@ D[2] = C[1]
+	eor	@C[4],@C[4],@C[9],ror#32-1	@ C[2] = ROL64(C[4], 1) ^ C[2];
+	str	@C[3],[sp,#$D[2]+4]
+	eor	@C[5],@C[5],@C[8]
+	str	@C[4],[sp,#$D[3]]		@ D[3] = C[2]
+	str	@C[5],[sp,#$D[3]+4]
+
+	ldr	@C[8],[sp,#$A[3][0]]
+	ldr	@C[9],[sp,#$A[3][0]+4]
+	eor	@C[8],@C[8],@C[0]
+	eor	@C[9],@C[9],@C[1]
+	str	@C[8],[sp,#$T[0][0]]		@ T[0][0] = A[3][0] ^ C[0]; /* borrow T[0][0] */
+	str	@C[9],[sp,#$T[0][0]+4]
+	ldr	@C[6],[sp,#$A[0][1]]
+	ldr	@C[7],[sp,#$A[0][1]+4]
+	eor	@C[6],@C[6],@E[0]
+	eor	@C[7],@C[7],@E[1]
+	str	@C[6],[sp,#$T[0][1]]		@ T[0][1] = A[0][1] ^ E[0]; /* D[1] */
+	str	@C[7],[sp,#$T[0][1]+4]
+	ldr	@C[8],[sp,#$A[0][2]]
+	ldr	@C[9],[sp,#$A[0][2]+4]
+	eor	@C[8],@C[8],@C[2]
+	eor	@C[9],@C[9],@C[3]
+	str	@C[8],[sp,#$T[0][2]]		@ T[0][2] = A[0][2] ^ C[1]; /* D[2] */
+	str	@C[9],[sp,#$T[0][2]+4]
+	ldr	@C[6],[sp,#$A[0][3]]
+	ldr	@C[7],[sp,#$A[0][3]+4]
+	eor	@C[6],@C[6],@C[4]
+	eor	@C[7],@C[7],@C[5]
+	str	@C[6],[sp,#$T[0][3]]		@ T[0][3] = A[0][3] ^ C[2]; /* D[3] */
+	str	@C[7],[sp,#$T[0][3]+4]
+	ldr	@C[8],[sp,#$A[0][4]]
+	ldr	@C[9],[sp,#$A[0][4]+4]
+	eor	@C[8],@C[8],@E[2]
+	eor	@C[9],@C[9],@E[3]
+	str	@C[8],[sp,#$T[0][4]]		@ T[0][4] = A[0][4] ^ E[1]; /* D[4] */
+	str	@C[9],[sp,#$T[0][4]+4]
+
+	ldr	@C[6],[sp,#$A[3][3]]
+	ldr	@C[7],[sp,#$A[3][3]+4]
+	eor	@C[4],@C[4],@C[6]
+	eor	@C[5],@C[5],@C[7]
+	ror	@C[7],@C[4],#32-10		@ C[3] = ROL64(A[3][3] ^ C[2], rhotates[3][3]);   /* D[3] */
+	ror	@C[6],@C[5],#32-11
+	ldr	@C[8],[sp,#$A[4][4]]
+	ldr	@C[9],[sp,#$A[4][4]+4]
+	eor	@C[8],@C[8],@E[2]
+	eor	@C[9],@C[9],@E[3]
+	ror	@C[8],@C[8],#32-7		@ C[4] = ROL64(A[4][4] ^ E[1], rhotates[4][4]);   /* D[4] */
+	ror	@C[9],@C[9],#32-7
+	ldr	@C[4],[sp,#$A[0][0]]
+	ldr	@C[5],[sp,#$A[0][0]+4]
+	eor	@C[0],@C[0],@C[4]
+	eor	@C[1],@C[1],@C[5]		@ C[0] =       A[0][0] ^ C[0]; /* rotate by 0 */  /* D[0] */
+	ldr	@E[2],[sp,#$A[2][2]]
+	ldr	@E[3],[sp,#$A[2][2]+4]
+	eor	@E[2],@E[2],@C[2]
+	eor	@E[3],@E[3],@C[3]
+	ror	@C[5],@E[2],#32-21		@ C[2] = ROL64(A[2][2] ^ C[1], rhotates[2][2]);   /* D[2] */
+	ror	@C[4],@E[3],#32-22
+	ldr	@C[2],[sp,#$A[1][1]]
+	ldr	@C[3],[sp,#$A[1][1]+4]
+	eor	@C[2],@C[2],@E[0]
+	eor	@C[3],@C[3],@E[1]
+	ror	@C[2],@C[2],#32-22		@ C[1] = ROL64(A[1][1] ^ E[0], rhotates[1][1]);   /* D[1] */
+	ror	@C[3],@C[3],#32-22
+
+	adr	@E[0],iotas
+	ldr	@E[1],[sp,#320+4]		@ load counter
+	add	@E[0],@E[0],@E[1]
+	ldr	@E[2],[@E[0],#0]
+	ldr	@E[3],[@E[0],#4]
+	add	@E[1],@E[1],#8
+	str	@E[1],[sp,#320+4]		@ store counter
+	cmp	@E[1],#192
+
+	bic	@E[0],@C[4],@C[2]
+	bic	@E[1],@C[5],@C[3]
+	eor	@E[0],@E[0],@C[0]
+	eor	@E[1],@E[1],@C[1]
+	eor	@E[0],@E[0],@E[2]
+	eor	@E[1],@E[1],@E[3]
+	str	@E[0],[sp,#$A[0][0]]		@ A[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i];
+	bic	@E[2],@C[6],@C[4]
+	str	@E[1],[sp,#$A[0][0]+4]
+	bic	@E[3],@C[7],@C[5]
+	eor	@E[2],@E[2],@C[2]
+	eor	@E[3],@E[3],@C[3]
+	str	@E[2],[sp,#$A[0][1]]		@ A[0][1] = C[1] ^ (~C[2] & C[3]);
+	bic	@E[0],@C[8],@C[6]
+	str	@E[3],[sp,#$A[0][1]+4]
+	bic	@E[1],@C[9],@C[7]
+	eor	@E[0],@E[0],@C[4]
+	eor	@E[1],@E[1],@C[5]
+	str	@E[0],[sp,#$A[0][2]]		@ A[0][2] = C[2] ^ (~C[3] & C[4]);
+	bic	@E[2],@C[0],@C[8]
+	str	@E[1],[sp,#$A[0][2]+4]
+	bic	@E[3],@C[1],@C[9]
+	eor	@E[2],@E[2],@C[6]
+	eor	@E[3],@E[3],@C[7]
+	str	@E[2],[sp,#$A[0][3]]		@ A[0][3] = C[3] ^ (~C[4] & C[0]);
+	bic	@E[0],@C[2],@C[0]
+	str	@E[3],[sp,#$A[0][3]+4]
+	bic	@E[1],@C[3],@C[1]
+	eor	@E[0],@E[0],@C[8]
+	eor	@E[1],@E[1],@C[9]
+	str	@E[0],[sp,#$A[0][4]]		@ A[0][4] = C[4] ^ (~C[0] & C[1]);
+	str	@E[1],[sp,#$A[0][4]+4]
+
+	add	@E[3],sp,#$D[0]
+	ldmia	@E[3],{@C[6]-@C[9],@E[0],@E[1],@E[2],@E[3]}	@ D[0..3]
+	ldr	@C[4],[sp,#$D[4]]
+	ldr	@C[5],[sp,#$D[4]+4]
+	ldr	@C[0],[sp,#$A[1][0]]
+	ldr	@C[1],[sp,#$A[1][0]+4]
+	eor	@C[0],@C[0],@C[6]
+	eor	@C[1],@C[1],@C[7]
+	str	@C[0],[sp,#$T[1][0]]		@ T[1][0] = A[1][0] ^ (C[3] = D[0]);
+	str	@C[1],[sp,#$T[1][0]+4]
+	ldr	@C[2],[sp,#$A[2][1]]
+	ldr	@C[3],[sp,#$A[2][1]+4]
+	eor	@C[2],@C[2],@C[8]
+	eor	@C[3],@C[3],@C[9]
+	str	@C[2],[sp,#$T[1][1]]		@ T[1][1] = A[2][1] ^ (C[4] = D[1]); /* borrow T[1][1] */
+	str	@C[3],[sp,#$T[1][1]+4]
+	add	@C[0],sp,#$A[1][2]
+	ldmia	@C[0],{@C[0]-@C[3]}		@ A[1][2..3]
+	eor	@C[0],@C[0],@E[0]
+	eor	@C[1],@C[1],@E[1]
+	str	@C[0],[sp,#$T[1][2]]		@ T[1][2] = A[1][2] ^ (E[0] = D[2]);
+	str	@C[1],[sp,#$T[1][2]+4]
+	eor	@C[2],@C[2],@E[2]
+	eor	@C[3],@C[3],@E[3]
+	str	@C[2],[sp,#$T[1][3]]		@ T[1][3] = A[1][3] ^ (E[1] = D[3]);
+	str	@C[3],[sp,#$T[1][3]+4]
+	ldr	@C[0],[sp,#$A[2][4]]
+	ldr	@C[1],[sp,#$A[2][4]+4]
+	eor	@C[0],@C[0],@C[4]
+	eor	@C[1],@C[1],@C[5]
+	str	@C[0],[sp,#$T[1][4]]		@ T[1][4] = A[2][4] ^ (C[2] = D[4]); /* borrow T[1][4] */
+	str	@C[1],[sp,#$T[1][4]+4]
+
+	ldr	@C[2],[sp,#$T[0][3]]
+	ldr	@C[3],[sp,#$T[0][3]+4]
+	ror	@C[0],@C[2],#32-14		@ C[0] = ROL64(T[0][3],        rhotates[0][3]);
+	ror	@C[1],@C[3],#32-14
+	ldr	@E[2],[sp,#$A[1][4]]
+	ldr	@E[3],[sp,#$A[1][4]+4]
+	eor	@C[2],@E[2],@C[4]
+	eor	@C[3],@E[3],@C[5]
+	ror	@C[2],@C[2],#32-10		@ C[1] = ROL64(A[1][4] ^ C[2], rhotates[1][4]);   /* D[4] */
+	ror	@C[3],@C[3],#32-10
+	ldr	@C[4],[sp,#$A[2][0]]
+	ldr	@C[5],[sp,#$A[2][0]+4]
+	eor	@C[6],@C[6],@C[4]
+	eor	@C[7],@C[7],@C[5]
+	ror	@C[5],@C[6],#32-1		@ C[2] = ROL64(A[2][0] ^ C[3], rhotates[2][0]);   /* D[0] */
+	ror	@C[4],@C[7],#32-2
+	ldr	@E[2],[sp,#$A[3][1]]
+	ldr	@E[3],[sp,#$A[3][1]+4]
+	eor	@E[2],@E[2],@C[8]
+	eor	@E[3],@E[3],@C[9]
+	ror	@C[7],@E[2],#32-22		@ C[3] = ROL64(A[3][1] ^ C[4], rhotates[3][1]);   /* D[1] */
+	ror	@C[6],@E[3],#32-23
+	ldr	@C[8],[sp,#$A[4][2]]
+	ldr	@C[9],[sp,#$A[4][2]+4]
+	eor	@E[0],@E[0],@C[8]
+	eor	@E[1],@E[1],@C[9]
+	ror	@C[9],@E[0],#32-30		@ C[4] = ROL64(A[4][2] ^ E[0], rhotates[4][2]);   /* D[2] */
+	ror	@C[8],@E[1],#32-31
+
+	bic	@E[0],@C[4],@C[2]
+	bic	@E[1],@C[5],@C[3]
+	eor	@E[0],@E[0],@C[0]
+	eor	@E[1],@E[1],@C[1]
+	str	@E[0],[sp,#$A[1][0]]		@ A[1][0] = C[0] ^ (~C[1] & C[2])
+	bic	@E[2],@C[6],@C[4]
+	str	@E[1],[sp,#$A[1][0]+4]
+	bic	@E[3],@C[7],@C[5]
+	eor	@E[2],@E[2],@C[2]
+	eor	@E[3],@E[3],@C[3]
+	str	@E[2],[sp,#$A[1][1]]		@ A[1][1] = C[1] ^ (~C[2] & C[3]);
+	bic	@E[0],@C[8],@C[6]
+	str	@E[3],[sp,#$A[1][1]+4]
+	bic	@E[1],@C[9],@C[7]
+	eor	@E[0],@E[0],@C[4]
+	eor	@E[1],@E[1],@C[5]
+	str	@E[0],[sp,#$A[1][2]]		@ A[1][2] = C[2] ^ (~C[3] & C[4]);
+	bic	@E[2],@C[0],@C[8]
+	str	@E[1],[sp,#$A[1][2]+4]
+	bic	@E[3],@C[1],@C[9]
+	eor	@E[2],@E[2],@C[6]
+	eor	@E[3],@E[3],@C[7]
+	str	@E[2],[sp,#$A[1][3]]		@ A[1][3] = C[3] ^ (~C[4] & C[0]);
+	bic	@E[0],@C[2],@C[0]
+	str	@E[3],[sp,#$A[1][3]+4]
+	bic	@E[1],@C[3],@C[1]
+	eor	@E[0],@E[0],@C[8]
+	eor	@E[1],@E[1],@C[9]
+	str	@E[0],[sp,#$A[1][4]]		@ A[1][4] = C[4] ^ (~C[0] & C[1]);
+	str	@E[1],[sp,#$A[1][4]+4]
+
+	ldr	@C[1],[sp,#$T[0][1]]
+	ldr	@C[0],[sp,#$T[0][1]+4]
+	ror	@C[0],@C[0],#32-1		@ C[0] = ROL64(T[0][1],        rhotates[0][1]);
+	ldr	@C[2],[sp,#$T[1][2]]
+	ldr	@C[3],[sp,#$T[1][2]+4]
+	ror	@C[2],@C[2],#32-3		@ C[1] = ROL64(T[1][2],        rhotates[1][2]);
+	ror	@C[3],@C[3],#32-3
+	add	@E[3],sp,#$D[3]
+	ldmia	@E[3],{@E[0]-@E[2],@E[3]}	@ D[3..4]
+	ldr	@C[4],[sp,#$A[2][3]]
+	ldr	@C[5],[sp,#$A[2][3]+4]
+	eor	@E[0],@E[0],@C[4]
+	eor	@E[1],@E[1],@C[5]
+	ror	@C[5],@E[0],#32-12		@ C[2] = ROL64(A[2][3] ^ D[3], rhotates[2][3]);
+	ror	@C[4],@E[1],#32-13
+	ldr	@C[6],[sp,#$A[3][4]]
+	ldr	@C[7],[sp,#$A[3][4]+4]
+	eor	@C[6],@C[6],@E[2]
+	eor	@C[7],@C[7],@E[3]
+	ror	@C[6],@C[6],#32-4		@ C[3] = ROL64(A[3][4] ^ D[4], rhotates[3][4]);
+	ror	@C[7],@C[7],#32-4
+	ldr	@C[8],[sp,#$A[4][0]]
+	ldr	@C[9],[sp,#$A[4][0]+4]
+	ldr	@E[0],[sp,#$D[0]]
+	ldr	@E[1],[sp,#$D[0]+4]
+	eor	@C[8],@C[8],@E[0]
+	eor	@C[9],@C[9],@E[1]
+	ror	@C[8],@C[8],#32-9		@ C[4] = ROL64(A[4][0] ^ D[0], rhotates[4][0]);
+	ror	@C[9],@C[9],#32-9
+
+	bic	@E[0],@C[4],@C[2]
+	bic	@E[1],@C[5],@C[3]
+	eor	@E[0],@E[0],@C[0]
+	eor	@E[1],@E[1],@C[1]
+	str	@E[0],[sp,#$A[2][0]]		@ A[2][0] = C[0] ^ (~C[1] & C[2])
+	bic	@E[2],@C[6],@C[4]
+	str	@E[1],[sp,#$A[2][0]+4]
+	bic	@E[3],@C[7],@C[5]
+	eor	@E[2],@E[2],@C[2]
+	eor	@E[3],@E[3],@C[3]
+	str	@E[2],[sp,#$A[2][1]]		@ A[2][1] = C[1] ^ (~C[2] & C[3]);
+	bic	@E[0],@C[8],@C[6]
+	str	@E[3],[sp,#$A[2][1]+4]
+	bic	@E[1],@C[9],@C[7]
+	eor	@E[0],@E[0],@C[4]
+	eor	@E[1],@E[1],@C[5]
+	str	@E[0],[sp,#$A[2][2]]		@ A[2][2] = C[2] ^ (~C[3] & C[4]);
+	bic	@E[2],@C[0],@C[8]
+	str	@E[1],[sp,#$A[2][2]+4]
+	bic	@E[3],@C[1],@C[9]
+	eor	@E[2],@E[2],@C[6]
+	eor	@E[3],@E[3],@C[7]
+	str	@E[2],[sp,#$A[2][3]]		@ A[2][3] = C[3] ^ (~C[4] & C[0]);
+	bic	@E[0],@C[2],@C[0]
+	str	@E[3],[sp,#$A[2][3]+4]
+	bic	@E[1],@C[3],@C[1]
+	eor	@E[0],@E[0],@C[8]
+	eor	@E[1],@E[1],@C[9]
+	str	@E[0],[sp,#$A[2][4]]		@ A[2][4] = C[4] ^ (~C[0] & C[1]);
+	str	@E[1],[sp,#$A[2][4]+4]
+
+	ldr	@C[1],[sp,#$T[0][4]]
+	ldr	@C[0],[sp,#$T[0][4]+4]
+	ror	@C[1],@C[1],#32-13		@ C[0] = ROL64(T[0][4],        rhotates[0][4]);
+	ror	@C[0],@C[0],#32-14
+	add	@C[2],sp,#$T[1][0]
+	ldmia	@C[2],{@C[2]-@C[5]}		@ T[1][0..1]
+	ror	@C[2],@C[2],#32-18		@ C[1] = ROL64(T[1][0],        rhotates[1][0]);
+	ror	@C[3],@C[3],#32-18
+	ror	@C[4],@C[4],#32-5		@ C[2] = ROL64(T[1][1],        rhotates[2][1]); /* originally A[2][1] */
+	ror	@C[5],@C[5],#32-5
+	add	@E[3],sp,#$D[2]
+	ldmia	@E[3],{@E[0]-@E[2],@E[3]}	@ D[2..3]
+	ldr	@C[6],[sp,#$A[3][2]]
+	ldr	@C[7],[sp,#$A[3][2]+4]
+	eor	@E[0],@E[0],@C[6]
+	eor	@E[1],@E[1],@C[7]
+	ror	@C[7],@E[0],#32-7		@ C[3] = ROL64(A[3][2] ^ D[2], rhotates[3][2]);
+	ror	@C[6],@E[1],#32-8
+	ldr	@C[8],[sp,#$A[4][3]]
+	ldr	@C[9],[sp,#$A[4][3]+4]
+	eor	@C[8],@C[8],@E[2]
+	eor	@C[9],@C[9],@E[3]
+	ror	@C[8],@C[8],#32-28		@ C[4] = ROL64(A[4][3] ^ D[3], rhotates[4][3]);
+	ror	@C[9],@C[9],#32-28
+
+	bic	@E[0],@C[4],@C[2]
+	bic	@E[1],@C[5],@C[3]
+	eor	@E[0],@E[0],@C[0]
+	eor	@E[1],@E[1],@C[1]
+	str	@E[0],[sp,#$A[3][0]]		@ A[3][0] = C[0] ^ (~C[1] & C[2])
+	bic	@E[2],@C[6],@C[4]
+	str	@E[1],[sp,#$A[3][0]+4]
+	bic	@E[3],@C[7],@C[5]
+	eor	@E[2],@E[2],@C[2]
+	eor	@E[3],@E[3],@C[3]
+	str	@E[2],[sp,#$A[3][1]]		@ A[3][1] = C[1] ^ (~C[2] & C[3]);
+	bic	@E[0],@C[8],@C[6]
+	str	@E[3],[sp,#$A[3][1]+4]
+	bic	@E[1],@C[9],@C[7]
+	eor	@E[0],@E[0],@C[4]
+	eor	@E[1],@E[1],@C[5]
+	str	@E[0],[sp,#$A[3][2]]		@ A[3][2] = C[2] ^ (~C[3] & C[4]);
+	bic	@E[2],@C[0],@C[8]
+	str	@E[1],[sp,#$A[3][2]+4]
+	bic	@E[3],@C[1],@C[9]
+	eor	@E[2],@E[2],@C[6]
+	eor	@E[3],@E[3],@C[7]
+	str	@E[2],[sp,#$A[3][3]]		@ A[3][3] = C[3] ^ (~C[4] & C[0]);
+	bic	@E[0],@C[2],@C[0]
+	str	@E[3],[sp,#$A[3][3]+4]
+	bic	@E[1],@C[3],@C[1]
+	eor	@E[0],@E[0],@C[8]
+	eor	@E[1],@E[1],@C[9]
+	str	@E[0],[sp,#$A[3][4]]		@ A[3][4] = C[4] ^ (~C[0] & C[1]);
+	str	@E[1],[sp,#$A[3][4]+4]
+
+	ldr	@C[0],[sp,#$T[0][2]]
+	ldr	@C[1],[sp,#$T[0][2]+4]
+	ror	@C[0],@C[0],#32-31		@ C[0] = ROL64(T[0][2],        rhotates[0][2]);
+	ror	@C[1],@C[1],#32-31
+	add	@E[3],sp,#$T[1][3]
+	ldmia	@E[3],{@E[0]-@E[2],@E[3]}	@ T[1][3..4]
+	ror	@C[3],@E[0],#32-27		@ C[1] = ROL64(T[1][3],        rhotates[1][3]);
+	ror	@C[2],@E[1],#32-28
+	ror	@C[5],@E[2],#32-19		@ C[2] = ROL64(T[1][4],        rhotates[2][4]); /* originally A[2][4] */
+	ror	@C[4],@E[3],#32-20
+	ldr	@C[7],[sp,#$T[0][0]]
+	ldr	@C[6],[sp,#$T[0][0]+4]
+	ror	@C[7],@C[7],#32-20		@ C[3] = ROL64(T[0][0],        rhotates[3][0]); /* originally A[3][0] */
+	ror	@C[6],@C[6],#32-21
+	ldr	@C[8],[sp,#$A[4][1]]
+	ldr	@C[9],[sp,#$A[4][1]+4]
+	ldr	@E[0],[sp,#$D[1]]
+	ldr	@E[1],[sp,#$D[1]+4]
+	eor	@C[8],@C[8],@E[0]
+	eor	@C[9],@C[9],@E[1]
+	ror	@C[8],@C[8],#32-1		@ C[4] = ROL64(A[4][1] ^ D[1], rhotates[4][1]);
+	ror	@C[9],@C[9],#32-1
+
+	bic	@E[0],@C[4],@C[2]
+	bic	@E[1],@C[5],@C[3]
+	eor	@E[0],@E[0],@C[0]
+	eor	@E[1],@E[1],@C[1]
+	str	@E[0],[sp,#$A[4][0]]		@ A[4][0] = C[0] ^ (~C[1] & C[2])
+	bic	@E[2],@C[6],@C[4]
+	str	@E[1],[sp,#$A[4][0]+4]
+	bic	@E[3],@C[7],@C[5]
+	eor	@E[2],@E[2],@C[2]
+	eor	@E[3],@E[3],@C[3]
+	str	@E[2],[sp,#$A[4][1]]		@ A[4][1] = C[1] ^ (~C[2] & C[3]);
+	bic	@E[0],@C[8],@C[6]
+	str	@E[3],[sp,#$A[4][1]+4]
+	bic	@E[1],@C[9],@C[7]
+	eor	@E[0],@E[0],@C[4]
+	eor	@E[1],@E[1],@C[5]
+	str	@E[0],[sp,#$A[4][2]]		@ A[4][2] = C[2] ^ (~C[3] & C[4]);
+	bic	@E[2],@C[0],@C[8]
+	str	@E[1],[sp,#$A[4][2]+4]
+	bic	@E[3],@C[1],@C[9]
+	eor	@E[2],@E[2],@C[6]
+	eor	@E[3],@E[3],@C[7]
+	str	@E[2],[sp,#$A[4][3]]		@ A[4][3] = C[3] ^ (~C[4] & C[0]);
+	str	@E[3],[sp,#$A[4][3]+4]
+	bic	@E[0],@C[2],@C[0]
+	bic	@E[1],@C[3],@C[1]
+	eor	@E[2],@E[0],@C[8]
+	 add	@E[0],sp,#$A[1][0]
+	eor	@E[3],@E[1],@C[9]
+	 ldmia	sp,{@C[0]-@C[9]}		@ A[0][0..5]
+	str	@E[2],[sp,#$A[4][4]]		@ A[4][4] = C[4] ^ (~C[0] & C[1]);
+	str	@E[3],[sp,#$A[4][4]+4]
+
+	blo	.Lround
+
+	ldr	@E[1],[sp,#320]			@ restore pointer to A
+	stmia	@E[1]!,{@C[0]-@C[9]}		@ copy A[5][5] from stack
+	ldmia	@E[0]!,{@C[0]-@C[9]}
+	stmia	@E[1]!,{@C[0]-@C[9]}
+	ldmia	@E[0]!,{@C[0]-@C[9]}
+	stmia	@E[1]!,{@C[0]-@C[9]}
+	ldmia	@E[0]!,{@C[0]-@C[9]}
+	stmia	@E[1]!,{@C[0]-@C[9]}
+	ldmia	@E[0],{@C[0]-@C[9]}
+	stmia	@E[1],{@C[0]-@C[9]}
+
+	add	sp,sp,#320+8
+	ldmia	sp!,{r4-r12,pc}
+.size	KeccakF1600,.-KeccakF1600
+___
+print $code;