arm/crypto/blake2s-core.S

1 /* SPDX-License-Identifier: GPL-2.0-or-later */
13 	// Registers used to hold message words temporarily.  There aren't
14 	// enough ARM registers to hold the whole message block, so we have to
15 	// load the words on-demand.
59 // Execute a quarter-round of BLAKE2s by mixing two columns or two diagonals.
61 // columns/diagonals.  s0-s1 are the word offsets to the message words the first
62 // column/diagonal needs, and likewise s2-s3 for the second column/diagonal.
115 // spilling v[8..9], then to v[9..15], then to the message block.  r10-r12 and
116 // r14 are free to use.  The macro arguments s0-s15 give the order in which the
124 // when the values are used.  'brot' is the number of bits the values in row 'b'
126 // similarly for row 'd'.  (brot, drot) start out as (0, 0) but we make it such
180 	push		{r0-r2,r4-r11,lr}	// keep this an even number
200 	ldmia		r1!, {r2-r9}
202 	stmia		r12!, {r2-r9}
203 	ldmia		r1!, {r2-r9}
205 	stmia		r12, {r2-r9}
210 	// for spilling v[8..9].  Leave v[8..9] in r8-r9.
213 	ldmia		r12!, {r8-r9}		// load IV[0..1]
215 	ldm		r12, {r2-r7}		// load IV[3..7]
220 	push		{r2-r7}			// push v[9..15]
224 	ldm		r14, {r0-r7}
248 	pop		{r10-r11}		// load v[10..11]
253 	ldm		r14, {r8-r11}		// load h[0..3]
258 	stmia		r14!, {r0-r3}		// store new h[0..3]
259 	ldm		r14, {r0-r3}		// load old h[4..7]
260 	pop		{r8-r11}		// load v[12..15]
270 	stm		r14, {r0-r3}		// store new h[4..7]
274 	// 64.  So we can simply set it to 64 without re-loading it.
277 	subs		r2, r2, #1		// nblocks--
281 	pop		{r0-r2,r4-r11,pc}
283 	// The next message block (pointed to by r1) isn't 4-byte aligned, so it
285 	// by r12) using an alternative method.  r2-r9 are free to use.