https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107167
--- Comment #2 from cqwrteur <unlvsur at live dot com> ---
(In reply to Andrew Pinski from comment #1)
> This is a reassociation, scheduling issue and register allocation issue.
>
> Plus your example might be slower due to dependencies.
>
> Without a full example of where gcc ra goes wrong, gcc actually produces
> much better code for this example due to register renaming in hw.
> Note many x86_64 also does register renaming for the stack too
The problem I do things like sha512_round:
sha512_round(x[0]=big_endian(W[0]),a,b,d,e,f,g,h,bpc,0x428a2f98d728ae22);
sha512_round(x[1]=big_endian(W[1]),h,a,c,d,e,f,g,bpc,0x7137449123ef65cd);
sha512_round(x[2]=big_endian(W[2]),g,h,b,c,d,e,f,bpc,0xb5c0fbcfec4d3b2f);
sha512_round(x[3]=big_endian(W[3]),f,g,a,b,c,d,e,bpc,0xe9b5dba58189dbbc);
sha512_round(x[4]=big_endian(W[4]),e,f,h,a,b,c,d,bpc,0x3956c25bf348b538);
They use tons of registers. If GCC wastes registers, tons of time would waste
on stack push/load.
My implementation by GCC on x86_64 is slower than openssl's asm version
particularly due to this reason. GCC just pushes/stores too many values on the
stack.
https://github.com/openssl/openssl/blob/master/crypto/sha/asm/sha512-x86_64.pl#L192
OpenSSL does exactly what I do here.
