arm/crypto/aes-cipher-core.S

1 /* SPDX-License-Identifier: GPL-2.0-only */
36 	ldr\op		\out, [ttab, \in, lsr #(8 * \idx) - \sz]
42 	.macro		__hround, out0, out1, in0, in1, in2, in3, t3, t4, enc, sz, op, oldcpsr
43 	__select	\out0, \in0, 0
44 	__select	t0, \in1, 1
49 	__select	\out1, \in1, 0
53 	__select	t1, \in0, 1
65 	__select	\t4, \in0, 3
67 	__select	\t3, \in1, 2
76 	 * This is the final round and we're done with all data-dependent table
77 	 * lookups, so we can safely re-enable interrupts.
92 	.macro		fround, out0, out1, out2, out3, in0, in1, in2, in3, sz=2, op, oldcpsr
93 	__hround	\out0, \out1, \in0, \in1, \in2, \in3, \out2, \out3, 1, \sz, \op
94 	__hround	\out2, \out3, \in2, \in3, \in0, \in1, \in1, \in2, 1, \sz, \op, \oldcpsr
97 	.macro		iround, out0, out1, out2, out3, in0, in1, in2, in3, sz=2, op, oldcpsr
98 	__hround	\out0, \out1, \in0, \in3, \in2, \in1, \out2, \out3, 0, \sz, \op
99 	__hround	\out2, \out3, \in2, \in1, \in0, \in3, \in1, \in0, 0, \sz, \op, \oldcpsr
103 	push		{r3-r11, lr}
106 	ldm		rk!, {r8-r11}
127 	 * Disable interrupts and prefetch the 1024-byte 'ft' or 'it' table into
129 	 * intended to make cache-timing attacks more difficult.  They may not
131 	 * https://cr.yp.to/antiforgery/cachetiming-20050414.pdf
132 	 * ("Cache-timing attacks on AES") for a discussion of the many
133 	 * difficulties involved in writing truly constant-time AES software.
162 	// Prefetch inverse S-box for final round; see explanation above
188 	pop		{r3-r11, pc}