powerpc/crypto/poly1305-p10le_64.S

1 /* SPDX-License-Identifier: GPL-2.0-or-later */
5 # Copyright 2023- IBM Corp. All rights reserved
10 # Poly1305 - this version mainly using vector/VSX/Scalar
11 #  - 26 bits limbs
12 #  - Handle multiple 64 byte blcok.
17 # p = 2^130 - 5
25 #  07/22/21 - this revison based on the above sum of products.  Setup r^4, r^3, r^2, r and s3, s2, …
49 # poly1305_p10le_4blocks( uint8_t *k, uint32_t mlen, uint8_t *m)
50 #  k = 32 bytes key
51 #  r3 = k (r, s)
56 #include <asm/asm-offsets.h>
57 #include <asm/asm-compat.h>
95 	stdu 1,-752(1)
104 	SAVE_GPR 21, 168, 1
118 	SAVE_VRS 21, 16, 9
137 	SAVE_VSX 21, 304, 9
153 	RESTORE_VRS 21, 16, 9
172 	RESTORE_VSX 21, 304, 9
191 	RESTORE_GPR 21, 168, 1
486 	lvx	25, 0, 10	# v25 - mask
522 # poly1305_p10le_4blocks( uint8_t *k, uint32_t mlen, uint8_t *m)
523 #  k = 32 bytes key
524 #  r3 = k (r, s)
537 	li	21, 0	# counter to message
562 	add	20, 4, 21
585 	vaddudm	21, 5, 10
613 	vmrgow	5, 10, 21
619 	addi	5, 5, -64	# len -= 64
620 	addi	21, 21, 64	# offset += 64
633 # h3 = (h1 + m3) * r^2,	h4 = (h2 + m4) * r^2  --> (h0 + m1) r*4 + (h3 + m3) r^2, (h0 + m2) r^4 + (h…
635 # h5 = (h3 + m5) * r^2,	h6 = (h4 + m6) * r^2  -->
636 # h7 = (h5 + m7) * r^2,	h8 = (h6 + m8) * r^1  --> m5 * r^4 + m6 * r^3 + m7 * r^2 + m8 * r
673 	add	20, 4, 21
690 	vsrd	21, 14, 31	# >> 26
691 	vsrd	22, 21, 31	# 12 bits left
695 	vand	21, 21, 25	# a1
716 	vaddudm	5, 5, 21
729 	addi	5, 5, -64	# len -= 64
730 	addi	21, 21, 64	# offset += 64
812 	vor	21, 7, 12
816 	vor	21, 21, 8
856         srdi    21, 10, 2
857         add     19, 21, 10      # s1: r19 - (r1 >> 2) *5
901 	mfvsrd	21, 32+10	# h1.h
904 	adde	29, 29, 21
923 #   - no highbit if final leftover block (highbit = 0)
931 	stdu 1,-400(1)
940 	SAVE_GPR 21, 168, 1
976 	ld	21, 8(11)
980 	adde	28, 28, 21
1006 	RESTORE_GPR 21, 168, 1
1039 	# h + 5 + (-p)