Argon2 neon fix

Author: Xor-el

HashLib/src/Include/Simd/Argon2/Argon2FillBlockNeon_aarch64.inc

@@ -1,54 +1,58 @@
 // AArch64 NEON implementation of Argon2 FillBlock (BlaMka round function).
 //
-// Reference: HashLib Argon2FillBlockSse2_x86_64.inc (FillBlock semantics);
-//   libsodium blamka-round-neon.h (fBlaMka, vext diagonalize on AArch64).
+// Reference: jedisct1/libsodium crypto_pwhash/argon2/argon2-fill-block-neon.c,
+//   crypto_pwhash/argon2/blamka-round-neon.h; HashLib Argon2FillBlockSse2_x86_64.inc.
 //
 // Expects AAPCS64: x0 = Left ptr, x1 = Right ptr, x2 = Current ptr, w3 = WithXor.
 // Each pointer addresses 128 UInt64 (1024 bytes).
 // Uses v0-v7 (A/B/C/D pairs), v16-v18 temps; caller-saved only, leaf nostackframe.
-// Stack: 2128 bytes (R_buf + Z_buf + AAPCS64 16-byte SP alignment padding).
+// Stack: 2128 bytes — R_buf at [sp+64], Z_buf at [sp+1088], plus 16-byte SP pad.
 // x9 = R_buf, x11 = Z_buf during rounds; x2/w3 survive all loops.
 //
-// Steps (match SSE2):
+// Steps (same semantics as SSE2):
 //   1. R_buf = Left XOR Right
 //   2. Z_buf = copy(R_buf)
 //   3. Eight column rounds on Z_buf (128-byte slices)
 //   4. Eight row rounds on Z_buf (stride-16 qword access)
 //   5. Current = R_buf XOR Z_buf [XOR Current if WithXor <> 0]
+// Indexed loads/stores in steps 1/2/5: ldr/str qN, [xBase, x10].
+// Column/row slices: x12 = x11 + x10, then ldr/str qN, [x12, #imm].
+// Diagonalize uses vext #8 (blamka-round-neon.h), not SSE2 shufpd.
 //
 // Instruction encodings (for assembler compatibility):
 //   FPC 3.2.2's inline assembler cannot encode AArch64 vector mnemonics
 //   (subscripted vector regs require FPC 3.3+, and ldr/str/ldp with qN crash the
 //   3.2.2 assembler). Each such instruction is therefore emitted as its raw 32-bit
 //   '.long' opcode, with the equivalent mnemonic in the trailing comment; only
-//   stack/loop/branch/ret mnemonics stay as text.
+//   add/mov/cmp/sub/cbz/b.lo/b/ret stay as text (never ldr/str/ldp with qN).
 //
-// Register map during G rounds:
+// Register map:
 //   v0-v1    = A0, A1
 //   v2-v3    = B0, B1
 //   v4-v5    = C0, C1
 //   v6-v7    = D0, D1
 //   v16-v18  = fBlaMka / rotr temps
-//   x9       = R_buf base
-//   x11      = Z_buf base
-//   x10      = loop offset
+//   x9       = R_buf base ([sp+64])
+//   x10      = loop byte offset (steps 1-5)
+//   x11      = Z_buf base ([sp+1088])
+//   x12      = Z slice pointer (column/row load/store)
 //   w3       = WithXor (0 or 1)
   sub sp, sp, #2128
   add x9, sp, #64
   mov x10, #0
 .Largon2_xor_loop:
-  ldr q0, [x0, x10]
-  ldr q1, [x1, x10]
+  .long 0x3cea6800                    // ldr q0, [x0, x10]
+  .long 0x3cea6821                    // ldr q1, [x1, x10]
   .long 0x6e211c00                    // eor v0.16b, v0.16b, v1.16b
-  str q0, [x9, x10]
+  .long 0x3caa6920                    // str q0, [x9, x10]
   add x10, x10, #16
   cmp x10, #1024
   b.lo .Largon2_xor_loop
   add x11, sp, #1088
   mov x10, #0
 .Largon2_copy_loop:
-  ldr q0, [x9, x10]
-  str q0, [x11, x10]
+  .long 0x3cea6920                    // ldr q0, [x9, x10]
+  .long 0x3caa6960                    // str q0, [x11, x10]
   add x10, x10, #16
   cmp x10, #1024
   b.lo .Largon2_copy_loop
@@ -449,23 +453,23 @@
   cbz w3, .Largon2_final_noxor
   mov x10, #0
 .Largon2_final_xor_loop:
-  ldr q0, [x9, x10]
-  ldr q1, [x11, x10]
-  ldr q2, [x2, x10]
+  .long 0x3cea6920                    // ldr q0, [x9, x10]
+  .long 0x3cea6961                    // ldr q1, [x11, x10]
+  .long 0x3cea6842                    // ldr q2, [x2, x10]
   .long 0x6e211c00                    // eor v0.16b, v0.16b, v1.16b
   .long 0x6e221c00                    // eor v0.16b, v0.16b, v2.16b
-  str q0, [x2, x10]
+  .long 0x3caa6840                    // str q0, [x2, x10]
   add x10, x10, #16
   cmp x10, #1024
   b.lo .Largon2_final_xor_loop
   b .Largon2_epilogue
 .Largon2_final_noxor:
   mov x10, #0
 .Largon2_final_noxor_loop:
-  ldr q0, [x9, x10]
-  ldr q1, [x11, x10]
+  .long 0x3cea6920                    // ldr q0, [x9, x10]
+  .long 0x3cea6961                    // ldr q1, [x11, x10]
   .long 0x6e211c00                    // eor v0.16b, v0.16b, v1.16b
-  str q0, [x2, x10]
+  .long 0x3caa6840                    // str q0, [x2, x10]
   add x10, x10, #16
   cmp x10, #1024
   b.lo .Largon2_final_noxor_loop

HashLib/src/Include/Simd/Scrypt/ScryptSalsa8Neon_aarch64.inc

@@ -1,8 +1,8 @@
 // AArch64 NEON implementation of fused XOR + Salsa20/8 on Percival-permuted data.
 //
 // Reference: Colin Percival, "Stronger Key Derivation via Sequential
-// Memory-Hard Functions" (2009), and the Tarsnap scrypt reference
-// implementation (crypto_scrypt_smix_sse2.c). The (i*5 mod 16) data permutation
+// Memory-Hard Functions" (2009); Tarsnap scrypt crypto_scrypt_smix_sse2.c;
+// HashLib ScryptSalsa8Sse2_x86_64.inc. The (i*5 mod 16) data permutation
 // arranges each 16-word Salsa20 state into role-based diagonal order,
 // enabling lane-parallel SIMD processing of column and row quarter-rounds
 // with pshufd-based diagonalize/undiagonalize between them.
@@ -22,9 +22,6 @@
 //   D ^= rotl(A+B,7); C ^= rotl(D+A,9); B ^= rotl(C+D,13); A ^= rotl(B+C,18)
 // Undiag: ins/pshufd B,$39; C,$4E; D,$93
 //
-// Reference (golden): HashLib ScryptSalsa8Sse2_x86_64.inc;
-//   scripts/ref/scrypt-sse.c (Tarsnap excerpt).
-//
 // Instruction encodings (for assembler compatibility):
 //   FPC 3.2.2's inline assembler cannot encode AArch64 vector mnemonics
 //   (subscripted vector regs require FPC 3.3+, and ldr/str/ldp with qN crash the