arm64/crypto/ghash-ce-core.S

1 /* SPDX-License-Identifier: GPL-2.0-only */
5  * Copyright (C) 2014 - 2018 Linaro Ltd. <ard.biesheuvel@linaro.org>
61 	.arch		armv8-a+crypto
149 	ld1		{HH.2d-HH4.2d}, [x8]
197 	// PMULL (64x64->128) based reduction for CPUs that can do
214 	// 64x64->128 PMULL instruction
253 	tbnz		w0, #0, 2f		// skip until #blocks is a
256 1:	ld1		{XM3.16b-TT4.16b}, [x2], #64
258 	sub		w0, w0, #4
320 	sub		w0, w0, #1
351 	 * void pmull_ghash_update(int blocks, u64 dg[], const char *src,
388 	ld1		{K0.4s-K3.4s}, [\rk]
389 	ld1		{K4.4s-K5.4s}, [\tmp]
391 	sub		\tmp, \tmp, #32
392 	ld1		{KK.4s-KM.4s}, [\tmp]
409 	ld1		{K6.4s-K7.4s}, [\tmp], #32
426 	ld1		{K8.4s-K9.4s}, [\tmp], #32
429 	ld1		{K6.4s-K7.4s}, [\tmp]
444 	ld1		{HH.2d-HH4.2d}, [x3]
461 0:	mov		w9, #4				// max blocks per round
463 	lsr		x10, x10, #4			// remaining blocks
470 	ld1		{INP0.16b-INP3.16b}, [x2], #64
493 	sub		x11, x15, x19
495 	sub		x17, x17, x11
497 	sub		x10, x1, x11
498 	sub		x11, x2, x11
500 	cmp		x0, #-16
502 	cmp		x0, #-32
504 	cmp		x0, #-48
524 	st1		{INP0.16b-INP3.16b}, [x1], #64
557 	mvn		XL.16b, XL.16b			// -1 for fail, 0 for pass
572 6:	ld1		{T1.16b-T2.16b}, [x17], #32	// permute vectors
573 	sub		x17, x17, x19, lsl #1
593 	tbl		INP3.16b, {INP3.16b}, T1.16b	// clear non-data bits
600 	 * void pmull_gcm_encrypt(int blocks, u8 dst[], const u8 src[],
609 	 * void pmull_gcm_decrypt(int blocks, u8 dst[], const u8 src[],
628 	tbz		w9, #2, 0f			// <4 blocks?
634 	tbz		w9, #0, 1f			// 2 blocks?
702 	sub		w10, w8, #4
703 	sub		w11, w8, #3
704 	sub		w12, w8, #2
705 	sub		w13, w8, #1
719 	ld1		{K6.4s-K7.4s}, [x10], #32
727 	ld1		{K8.4s-K9.4s}, [x10], #32
731 	ld1		{K6.4s-K7.4s}, [x10]