arm/crypto/chacha-scalar-core.S

1 /* SPDX-License-Identifier: GPL-2.0 */
12  * 16 registers would be needed to hold the state matrix, but only 14 are
22  * when the values are used.  'brot' is the number of bits the values in row 'b'
24  * similarly for row 'd'.  (brot, drot) start out as (0, 0) but we make it such
78 	// drot == 32 - 16 == 16
85 	// brot == 32 - 12 == 20
92 	// drot == 32 - 8 == 24
99 	// brot == 32 - 7 == 25
143 	// Stack: unused0-unused1 x10-x11 x0-x15 OUT IN LEN
144 	// Registers contain x0-x9,x12-x15.
146 	// Do the core ChaCha permutation to update x0-x15.
150 	// Stack: x10-x11 orig_x0-orig_x15 OUT IN LEN
151 	// Registers contain x0-x9,x12-x15.
152 	// x4-x7 are rotated by 'brot'; x12-x15 are rotated by 'drot'.
154 	// Free up some registers (r8-r12,r14) by pushing (x8-x9,x12-x15).
168 	// Use slow path if IN and/or OUT isn't 4-byte aligned.  Needed even on
175 	// Stack: x8-x9 x12-x15 x10-x11 orig_x0-orig_x15 OUT IN LEN
176 	// Registers: r0-r7 are x0-x7; r8-r11 are free; r12 is IN; r14 is OUT.
177 	// x4-x7 are rotated by 'brot'; x12-x15 are rotated by 'drot'.
179 	// x0-x3
187 	ldmia		r12!, {r8-r11}
192 	stmia		r14!, {X0-X3}
194 	// x4-x7
199 	ldmia		r12!, {X0-X3}
207 	stmia		r14!, {X4-X7}
209 	// x8-x15
210 	pop		{r0-r7}			// (x8-x9,x12-x15,x10-x11)
218 	ldmia		r12!, {r8-r11}
238 	stmia		r14!, {r2-r5}
244 	// Stack: x0-x15 OUT IN LEN
262 	ldmia		r14!, {r0-r11}		// load x0-x11
263 	__strd		r10, r11, sp, 8		// store x10-x11 before state
264 	ldmia		r14, {r10-r12,r14}	// load x12-x15
270 	// XOR-ing the needed portion with the data.
276 	// Stack: ks0-ks15 x8-x9 x12-x15 x10-x11 orig_x0-orig_x15 OUT IN LEN
277 	// Registers: r0-r7 are x0-x7; r8-r11 are free; r12 is IN; r14 is &ks0.
278 	// x4-x7 are rotated by 'brot'; x12-x15 are rotated by 'drot'.
280 	// Save keystream for x0-x3
288 	stmia		r14!, {X0-X3}
290 	// Save keystream for x4-x7
299 	stmia		r14!, {X4-X7}
301 	// Save keystream for x8-x15
302 	ldm		r8, {r0-r7}		// (x8-x9,x12-x15,x10-x11)
318 	stmia		r14, {r2-r5}
320 	// Stack: ks0-ks15 unused0-unused7 x0-x15 OUT IN LEN
379 	push		{r0-r2,r4-r11,lr}
381 	// Push state x0-x15 onto stack.
382 	// Also store an extra copy of x10-x11 just before the state.
392 	ldm		r3, {X0-X9_X11}
403 	pop		{r4-r11, pc}
413 	push		{r1,r4-r11,lr}
418 	ldmia		r14!, {r0-r11}		// load x0-x11
419 	push		{r10-r11}		// store x10-x11 to stack
420 	ldm		r14, {r10-r12,r14}	// load x12-x15
426 	// Skip over (unused0-unused1, x10-x11)
429 	// Fix up rotations of x12-x15
436 	// Store (x0-x3,x12-x15) to 'out'
439 	pop		{r4-r11,pc}