/* SPDX-License-Identifier: GPL-2.0-only */
/*
* Accelerated GHASH implementation with Intel PCLMULQDQ-NI
* instructions. This file contains accelerated part of ghash
* implementation. More information about PCLMULQDQ can be found at:
*
* https://www.intel.com/content/dam/develop/external/us/en/documents/clmul-wp-rev-2-02-2014-04-20.pdf
*
* Copyright (c) 2009 Intel Corp.
* Author: Huang Ying <ying.huang@intel.com>
* Vinodh Gopal
* Erdinc Ozturk
* Deniz Karakoyunlu
*/
#include <linux/linkage.h>
#include <asm/frame.h>
.section .rodata.cst16.bswap_mask, "aM", @progbits, 16
.align 16
.Lbswap_mask:
.octa 0x000102030405060708090a0b0c0d0e0f
#define ACC %xmm0
#define KEY %xmm1
#define T1 %xmm2
#define T2 %xmm3
#define T3 %xmm4
#define BSWAP %xmm5
#define IN1 %xmm6
.text
/*
* __clmul_gf128mul_ble: internal ABI
* input:
* ACC: operand1
* KEY: operand2, hash_key << 1 mod poly
* output:
* ACC: operand1 * operand2 mod poly
* changed:
* T1
* T2
* T3
*/
SYM_FUNC_START_LOCAL(__clmul_gf128mul_ble)
movaps ACC, T1
pshufd $0b01001110, ACC, T2
pshufd $0b01001110, KEY, T3
pxor ACC, T2
pxor KEY, T3
pclmulqdq $0x00, KEY, ACC # ACC = a0 * b0
pclmulqdq $0x11, KEY, T1 # T1 = a1 * b1
pclmulqdq $0x00, T3, T2 # T2 = (a1 + a0) * (b1 + b0)
pxor ACC, T2
pxor T1, T2 # T2 = a0 * b1 + a1 * b0
movaps T2, T3
pslldq $8, T3
psrldq $8, T2
pxor T3, ACC
pxor T2, T1 # <T1:ACC> is result of
# carry-less multiplication
# first phase of the reduction
movaps ACC, T3
psllq $1, T3
pxor ACC, T3
psllq $5, T3
pxor ACC, T3
psllq $57, T3
movaps T3, T2
pslldq $8, T2
psrldq $8, T3
pxor T2, ACC
pxor T3, T1
# second phase of the reduction
movaps ACC, T2
psrlq $5, T2
pxor ACC, T2
psrlq $1, T2
pxor ACC, T2
psrlq $1, T2
pxor T2, T1
pxor T1, ACC
RET
SYM_FUNC_END(__clmul_gf128mul_ble)
/*
* void polyval_mul_pclmul(struct polyval_elem *a,
* const struct polyval_elem *b)
*/
SYM_FUNC_START(polyval_mul_pclmul)
FRAME_BEGIN
movups (%rdi), ACC
movups (%rsi), KEY
call __clmul_gf128mul_ble
movups ACC, (%rdi)
FRAME_END
RET
SYM_FUNC_END(polyval_mul_pclmul)
/*
* void ghash_blocks_pclmul(struct polyval_elem *acc,
* const struct polyval_elem *key,
* const u8 *data, size_t nblocks)
*/
SYM_FUNC_START(ghash_blocks_pclmul)
FRAME_BEGIN
movaps .Lbswap_mask(%rip), BSWAP
movups (%rdi), ACC
movups (%rsi), KEY
.align 4
.Lnext_block:
movups (%rdx), IN1
pshufb BSWAP, IN1
pxor IN1, ACC
call __clmul_gf128mul_ble
add $16, %rdx
dec %rcx
jnz .Lnext_block
movups ACC, (%rdi)
FRAME_END
RET
SYM_FUNC_END(ghash_blocks_pclmul)
