mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-28 11:18:45 +07:00
6dcc5627f6
These are all functions which are invoked from elsewhere, so annotate them as global using the new SYM_FUNC_START and their ENDPROC's by SYM_FUNC_END. Make sure ENTRY/ENDPROC is not defined on X86_64, given these were the last users. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Borislav Petkov <bp@suse.de> Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> [hibernate] Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com> [xen bits] Acked-by: Herbert Xu <herbert@gondor.apana.org.au> [crypto] Cc: Allison Randal <allison@lohutok.net> Cc: Andrey Ryabinin <aryabinin@virtuozzo.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Andy Shevchenko <andy@infradead.org> Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org> Cc: Armijn Hemel <armijn@tjaldur.nl> Cc: Cao jin <caoj.fnst@cn.fujitsu.com> Cc: Darren Hart <dvhart@infradead.org> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: "David S. Miller" <davem@davemloft.net> Cc: Enrico Weigelt <info@metux.net> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Herbert Xu <herbert@gondor.apana.org.au> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jim Mattson <jmattson@google.com> Cc: Joerg Roedel <joro@8bytes.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Juergen Gross <jgross@suse.com> Cc: Kate Stewart <kstewart@linuxfoundation.org> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> Cc: kvm ML <kvm@vger.kernel.org> Cc: Len Brown <len.brown@intel.com> Cc: linux-arch@vger.kernel.org Cc: linux-crypto@vger.kernel.org Cc: linux-efi <linux-efi@vger.kernel.org> Cc: linux-efi@vger.kernel.org Cc: linux-pm@vger.kernel.org Cc: Mark Rutland <mark.rutland@arm.com> Cc: Matt Fleming <matt@codeblueprint.co.uk> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Pavel Machek <pavel@ucw.cz> Cc: Peter Zijlstra <peterz@infradead.org> Cc: platform-driver-x86@vger.kernel.org Cc: "Radim Krčmář" <rkrcmar@redhat.com> Cc: Sean Christopherson <sean.j.christopherson@intel.com> Cc: Stefano Stabellini <sstabellini@kernel.org> Cc: "Steven Rostedt (VMware)" <rostedt@goodmis.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vitaly Kuznetsov <vkuznets@redhat.com> Cc: Wanpeng Li <wanpengli@tencent.com> Cc: Wei Huang <wei@redhat.com> Cc: x86-ml <x86@kernel.org> Cc: xen-devel@lists.xenproject.org Cc: Xiaoyao Li <xiaoyao.li@linux.intel.com> Link: https://lkml.kernel.org/r/20191011115108.12392-25-jslaby@suse.cz
591 lines
11 KiB
ArmAsm
591 lines
11 KiB
ArmAsm
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Poly1305 authenticator algorithm, RFC7539, x64 SSE2 functions
|
|
*
|
|
* Copyright (C) 2015 Martin Willi
|
|
*/
|
|
|
|
#include <linux/linkage.h>
|
|
|
|
.section .rodata.cst16.ANMASK, "aM", @progbits, 16
|
|
.align 16
|
|
ANMASK: .octa 0x0000000003ffffff0000000003ffffff
|
|
|
|
.section .rodata.cst16.ORMASK, "aM", @progbits, 16
|
|
.align 16
|
|
ORMASK: .octa 0x00000000010000000000000001000000
|
|
|
|
.text
|
|
|
|
#define h0 0x00(%rdi)
|
|
#define h1 0x04(%rdi)
|
|
#define h2 0x08(%rdi)
|
|
#define h3 0x0c(%rdi)
|
|
#define h4 0x10(%rdi)
|
|
#define r0 0x00(%rdx)
|
|
#define r1 0x04(%rdx)
|
|
#define r2 0x08(%rdx)
|
|
#define r3 0x0c(%rdx)
|
|
#define r4 0x10(%rdx)
|
|
#define s1 0x00(%rsp)
|
|
#define s2 0x04(%rsp)
|
|
#define s3 0x08(%rsp)
|
|
#define s4 0x0c(%rsp)
|
|
#define m %rsi
|
|
#define h01 %xmm0
|
|
#define h23 %xmm1
|
|
#define h44 %xmm2
|
|
#define t1 %xmm3
|
|
#define t2 %xmm4
|
|
#define t3 %xmm5
|
|
#define t4 %xmm6
|
|
#define mask %xmm7
|
|
#define d0 %r8
|
|
#define d1 %r9
|
|
#define d2 %r10
|
|
#define d3 %r11
|
|
#define d4 %r12
|
|
|
|
SYM_FUNC_START(poly1305_block_sse2)
|
|
# %rdi: Accumulator h[5]
|
|
# %rsi: 16 byte input block m
|
|
# %rdx: Poly1305 key r[5]
|
|
# %rcx: Block count
|
|
|
|
# This single block variant tries to improve performance by doing two
|
|
# multiplications in parallel using SSE instructions. There is quite
|
|
# some quardword packing involved, hence the speedup is marginal.
|
|
|
|
push %rbx
|
|
push %r12
|
|
sub $0x10,%rsp
|
|
|
|
# s1..s4 = r1..r4 * 5
|
|
mov r1,%eax
|
|
lea (%eax,%eax,4),%eax
|
|
mov %eax,s1
|
|
mov r2,%eax
|
|
lea (%eax,%eax,4),%eax
|
|
mov %eax,s2
|
|
mov r3,%eax
|
|
lea (%eax,%eax,4),%eax
|
|
mov %eax,s3
|
|
mov r4,%eax
|
|
lea (%eax,%eax,4),%eax
|
|
mov %eax,s4
|
|
|
|
movdqa ANMASK(%rip),mask
|
|
|
|
.Ldoblock:
|
|
# h01 = [0, h1, 0, h0]
|
|
# h23 = [0, h3, 0, h2]
|
|
# h44 = [0, h4, 0, h4]
|
|
movd h0,h01
|
|
movd h1,t1
|
|
movd h2,h23
|
|
movd h3,t2
|
|
movd h4,h44
|
|
punpcklqdq t1,h01
|
|
punpcklqdq t2,h23
|
|
punpcklqdq h44,h44
|
|
|
|
# h01 += [ (m[3-6] >> 2) & 0x3ffffff, m[0-3] & 0x3ffffff ]
|
|
movd 0x00(m),t1
|
|
movd 0x03(m),t2
|
|
psrld $2,t2
|
|
punpcklqdq t2,t1
|
|
pand mask,t1
|
|
paddd t1,h01
|
|
# h23 += [ (m[9-12] >> 6) & 0x3ffffff, (m[6-9] >> 4) & 0x3ffffff ]
|
|
movd 0x06(m),t1
|
|
movd 0x09(m),t2
|
|
psrld $4,t1
|
|
psrld $6,t2
|
|
punpcklqdq t2,t1
|
|
pand mask,t1
|
|
paddd t1,h23
|
|
# h44 += [ (m[12-15] >> 8) | (1 << 24), (m[12-15] >> 8) | (1 << 24) ]
|
|
mov 0x0c(m),%eax
|
|
shr $8,%eax
|
|
or $0x01000000,%eax
|
|
movd %eax,t1
|
|
pshufd $0xc4,t1,t1
|
|
paddd t1,h44
|
|
|
|
# t1[0] = h0 * r0 + h2 * s3
|
|
# t1[1] = h1 * s4 + h3 * s2
|
|
movd r0,t1
|
|
movd s4,t2
|
|
punpcklqdq t2,t1
|
|
pmuludq h01,t1
|
|
movd s3,t2
|
|
movd s2,t3
|
|
punpcklqdq t3,t2
|
|
pmuludq h23,t2
|
|
paddq t2,t1
|
|
# t2[0] = h0 * r1 + h2 * s4
|
|
# t2[1] = h1 * r0 + h3 * s3
|
|
movd r1,t2
|
|
movd r0,t3
|
|
punpcklqdq t3,t2
|
|
pmuludq h01,t2
|
|
movd s4,t3
|
|
movd s3,t4
|
|
punpcklqdq t4,t3
|
|
pmuludq h23,t3
|
|
paddq t3,t2
|
|
# t3[0] = h4 * s1
|
|
# t3[1] = h4 * s2
|
|
movd s1,t3
|
|
movd s2,t4
|
|
punpcklqdq t4,t3
|
|
pmuludq h44,t3
|
|
# d0 = t1[0] + t1[1] + t3[0]
|
|
# d1 = t2[0] + t2[1] + t3[1]
|
|
movdqa t1,t4
|
|
punpcklqdq t2,t4
|
|
punpckhqdq t2,t1
|
|
paddq t4,t1
|
|
paddq t3,t1
|
|
movq t1,d0
|
|
psrldq $8,t1
|
|
movq t1,d1
|
|
|
|
# t1[0] = h0 * r2 + h2 * r0
|
|
# t1[1] = h1 * r1 + h3 * s4
|
|
movd r2,t1
|
|
movd r1,t2
|
|
punpcklqdq t2,t1
|
|
pmuludq h01,t1
|
|
movd r0,t2
|
|
movd s4,t3
|
|
punpcklqdq t3,t2
|
|
pmuludq h23,t2
|
|
paddq t2,t1
|
|
# t2[0] = h0 * r3 + h2 * r1
|
|
# t2[1] = h1 * r2 + h3 * r0
|
|
movd r3,t2
|
|
movd r2,t3
|
|
punpcklqdq t3,t2
|
|
pmuludq h01,t2
|
|
movd r1,t3
|
|
movd r0,t4
|
|
punpcklqdq t4,t3
|
|
pmuludq h23,t3
|
|
paddq t3,t2
|
|
# t3[0] = h4 * s3
|
|
# t3[1] = h4 * s4
|
|
movd s3,t3
|
|
movd s4,t4
|
|
punpcklqdq t4,t3
|
|
pmuludq h44,t3
|
|
# d2 = t1[0] + t1[1] + t3[0]
|
|
# d3 = t2[0] + t2[1] + t3[1]
|
|
movdqa t1,t4
|
|
punpcklqdq t2,t4
|
|
punpckhqdq t2,t1
|
|
paddq t4,t1
|
|
paddq t3,t1
|
|
movq t1,d2
|
|
psrldq $8,t1
|
|
movq t1,d3
|
|
|
|
# t1[0] = h0 * r4 + h2 * r2
|
|
# t1[1] = h1 * r3 + h3 * r1
|
|
movd r4,t1
|
|
movd r3,t2
|
|
punpcklqdq t2,t1
|
|
pmuludq h01,t1
|
|
movd r2,t2
|
|
movd r1,t3
|
|
punpcklqdq t3,t2
|
|
pmuludq h23,t2
|
|
paddq t2,t1
|
|
# t3[0] = h4 * r0
|
|
movd r0,t3
|
|
pmuludq h44,t3
|
|
# d4 = t1[0] + t1[1] + t3[0]
|
|
movdqa t1,t4
|
|
psrldq $8,t4
|
|
paddq t4,t1
|
|
paddq t3,t1
|
|
movq t1,d4
|
|
|
|
# d1 += d0 >> 26
|
|
mov d0,%rax
|
|
shr $26,%rax
|
|
add %rax,d1
|
|
# h0 = d0 & 0x3ffffff
|
|
mov d0,%rbx
|
|
and $0x3ffffff,%ebx
|
|
|
|
# d2 += d1 >> 26
|
|
mov d1,%rax
|
|
shr $26,%rax
|
|
add %rax,d2
|
|
# h1 = d1 & 0x3ffffff
|
|
mov d1,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h1
|
|
|
|
# d3 += d2 >> 26
|
|
mov d2,%rax
|
|
shr $26,%rax
|
|
add %rax,d3
|
|
# h2 = d2 & 0x3ffffff
|
|
mov d2,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h2
|
|
|
|
# d4 += d3 >> 26
|
|
mov d3,%rax
|
|
shr $26,%rax
|
|
add %rax,d4
|
|
# h3 = d3 & 0x3ffffff
|
|
mov d3,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h3
|
|
|
|
# h0 += (d4 >> 26) * 5
|
|
mov d4,%rax
|
|
shr $26,%rax
|
|
lea (%rax,%rax,4),%rax
|
|
add %rax,%rbx
|
|
# h4 = d4 & 0x3ffffff
|
|
mov d4,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h4
|
|
|
|
# h1 += h0 >> 26
|
|
mov %rbx,%rax
|
|
shr $26,%rax
|
|
add %eax,h1
|
|
# h0 = h0 & 0x3ffffff
|
|
andl $0x3ffffff,%ebx
|
|
mov %ebx,h0
|
|
|
|
add $0x10,m
|
|
dec %rcx
|
|
jnz .Ldoblock
|
|
|
|
# Zeroing of key material
|
|
mov %rcx,0x00(%rsp)
|
|
mov %rcx,0x08(%rsp)
|
|
|
|
add $0x10,%rsp
|
|
pop %r12
|
|
pop %rbx
|
|
ret
|
|
SYM_FUNC_END(poly1305_block_sse2)
|
|
|
|
|
|
#define u0 0x00(%r8)
|
|
#define u1 0x04(%r8)
|
|
#define u2 0x08(%r8)
|
|
#define u3 0x0c(%r8)
|
|
#define u4 0x10(%r8)
|
|
#define hc0 %xmm0
|
|
#define hc1 %xmm1
|
|
#define hc2 %xmm2
|
|
#define hc3 %xmm5
|
|
#define hc4 %xmm6
|
|
#define ru0 %xmm7
|
|
#define ru1 %xmm8
|
|
#define ru2 %xmm9
|
|
#define ru3 %xmm10
|
|
#define ru4 %xmm11
|
|
#define sv1 %xmm12
|
|
#define sv2 %xmm13
|
|
#define sv3 %xmm14
|
|
#define sv4 %xmm15
|
|
#undef d0
|
|
#define d0 %r13
|
|
|
|
SYM_FUNC_START(poly1305_2block_sse2)
|
|
# %rdi: Accumulator h[5]
|
|
# %rsi: 16 byte input block m
|
|
# %rdx: Poly1305 key r[5]
|
|
# %rcx: Doubleblock count
|
|
# %r8: Poly1305 derived key r^2 u[5]
|
|
|
|
# This two-block variant further improves performance by using loop
|
|
# unrolled block processing. This is more straight forward and does
|
|
# less byte shuffling, but requires a second Poly1305 key r^2:
|
|
# h = (h + m) * r => h = (h + m1) * r^2 + m2 * r
|
|
|
|
push %rbx
|
|
push %r12
|
|
push %r13
|
|
|
|
# combine r0,u0
|
|
movd u0,ru0
|
|
movd r0,t1
|
|
punpcklqdq t1,ru0
|
|
|
|
# combine r1,u1 and s1=r1*5,v1=u1*5
|
|
movd u1,ru1
|
|
movd r1,t1
|
|
punpcklqdq t1,ru1
|
|
movdqa ru1,sv1
|
|
pslld $2,sv1
|
|
paddd ru1,sv1
|
|
|
|
# combine r2,u2 and s2=r2*5,v2=u2*5
|
|
movd u2,ru2
|
|
movd r2,t1
|
|
punpcklqdq t1,ru2
|
|
movdqa ru2,sv2
|
|
pslld $2,sv2
|
|
paddd ru2,sv2
|
|
|
|
# combine r3,u3 and s3=r3*5,v3=u3*5
|
|
movd u3,ru3
|
|
movd r3,t1
|
|
punpcklqdq t1,ru3
|
|
movdqa ru3,sv3
|
|
pslld $2,sv3
|
|
paddd ru3,sv3
|
|
|
|
# combine r4,u4 and s4=r4*5,v4=u4*5
|
|
movd u4,ru4
|
|
movd r4,t1
|
|
punpcklqdq t1,ru4
|
|
movdqa ru4,sv4
|
|
pslld $2,sv4
|
|
paddd ru4,sv4
|
|
|
|
.Ldoblock2:
|
|
# hc0 = [ m[16-19] & 0x3ffffff, h0 + m[0-3] & 0x3ffffff ]
|
|
movd 0x00(m),hc0
|
|
movd 0x10(m),t1
|
|
punpcklqdq t1,hc0
|
|
pand ANMASK(%rip),hc0
|
|
movd h0,t1
|
|
paddd t1,hc0
|
|
# hc1 = [ (m[19-22] >> 2) & 0x3ffffff, h1 + (m[3-6] >> 2) & 0x3ffffff ]
|
|
movd 0x03(m),hc1
|
|
movd 0x13(m),t1
|
|
punpcklqdq t1,hc1
|
|
psrld $2,hc1
|
|
pand ANMASK(%rip),hc1
|
|
movd h1,t1
|
|
paddd t1,hc1
|
|
# hc2 = [ (m[22-25] >> 4) & 0x3ffffff, h2 + (m[6-9] >> 4) & 0x3ffffff ]
|
|
movd 0x06(m),hc2
|
|
movd 0x16(m),t1
|
|
punpcklqdq t1,hc2
|
|
psrld $4,hc2
|
|
pand ANMASK(%rip),hc2
|
|
movd h2,t1
|
|
paddd t1,hc2
|
|
# hc3 = [ (m[25-28] >> 6) & 0x3ffffff, h3 + (m[9-12] >> 6) & 0x3ffffff ]
|
|
movd 0x09(m),hc3
|
|
movd 0x19(m),t1
|
|
punpcklqdq t1,hc3
|
|
psrld $6,hc3
|
|
pand ANMASK(%rip),hc3
|
|
movd h3,t1
|
|
paddd t1,hc3
|
|
# hc4 = [ (m[28-31] >> 8) | (1<<24), h4 + (m[12-15] >> 8) | (1<<24) ]
|
|
movd 0x0c(m),hc4
|
|
movd 0x1c(m),t1
|
|
punpcklqdq t1,hc4
|
|
psrld $8,hc4
|
|
por ORMASK(%rip),hc4
|
|
movd h4,t1
|
|
paddd t1,hc4
|
|
|
|
# t1 = [ hc0[1] * r0, hc0[0] * u0 ]
|
|
movdqa ru0,t1
|
|
pmuludq hc0,t1
|
|
# t1 += [ hc1[1] * s4, hc1[0] * v4 ]
|
|
movdqa sv4,t2
|
|
pmuludq hc1,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc2[1] * s3, hc2[0] * v3 ]
|
|
movdqa sv3,t2
|
|
pmuludq hc2,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc3[1] * s2, hc3[0] * v2 ]
|
|
movdqa sv2,t2
|
|
pmuludq hc3,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc4[1] * s1, hc4[0] * v1 ]
|
|
movdqa sv1,t2
|
|
pmuludq hc4,t2
|
|
paddq t2,t1
|
|
# d0 = t1[0] + t1[1]
|
|
movdqa t1,t2
|
|
psrldq $8,t2
|
|
paddq t2,t1
|
|
movq t1,d0
|
|
|
|
# t1 = [ hc0[1] * r1, hc0[0] * u1 ]
|
|
movdqa ru1,t1
|
|
pmuludq hc0,t1
|
|
# t1 += [ hc1[1] * r0, hc1[0] * u0 ]
|
|
movdqa ru0,t2
|
|
pmuludq hc1,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc2[1] * s4, hc2[0] * v4 ]
|
|
movdqa sv4,t2
|
|
pmuludq hc2,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc3[1] * s3, hc3[0] * v3 ]
|
|
movdqa sv3,t2
|
|
pmuludq hc3,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc4[1] * s2, hc4[0] * v2 ]
|
|
movdqa sv2,t2
|
|
pmuludq hc4,t2
|
|
paddq t2,t1
|
|
# d1 = t1[0] + t1[1]
|
|
movdqa t1,t2
|
|
psrldq $8,t2
|
|
paddq t2,t1
|
|
movq t1,d1
|
|
|
|
# t1 = [ hc0[1] * r2, hc0[0] * u2 ]
|
|
movdqa ru2,t1
|
|
pmuludq hc0,t1
|
|
# t1 += [ hc1[1] * r1, hc1[0] * u1 ]
|
|
movdqa ru1,t2
|
|
pmuludq hc1,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc2[1] * r0, hc2[0] * u0 ]
|
|
movdqa ru0,t2
|
|
pmuludq hc2,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc3[1] * s4, hc3[0] * v4 ]
|
|
movdqa sv4,t2
|
|
pmuludq hc3,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc4[1] * s3, hc4[0] * v3 ]
|
|
movdqa sv3,t2
|
|
pmuludq hc4,t2
|
|
paddq t2,t1
|
|
# d2 = t1[0] + t1[1]
|
|
movdqa t1,t2
|
|
psrldq $8,t2
|
|
paddq t2,t1
|
|
movq t1,d2
|
|
|
|
# t1 = [ hc0[1] * r3, hc0[0] * u3 ]
|
|
movdqa ru3,t1
|
|
pmuludq hc0,t1
|
|
# t1 += [ hc1[1] * r2, hc1[0] * u2 ]
|
|
movdqa ru2,t2
|
|
pmuludq hc1,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc2[1] * r1, hc2[0] * u1 ]
|
|
movdqa ru1,t2
|
|
pmuludq hc2,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc3[1] * r0, hc3[0] * u0 ]
|
|
movdqa ru0,t2
|
|
pmuludq hc3,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc4[1] * s4, hc4[0] * v4 ]
|
|
movdqa sv4,t2
|
|
pmuludq hc4,t2
|
|
paddq t2,t1
|
|
# d3 = t1[0] + t1[1]
|
|
movdqa t1,t2
|
|
psrldq $8,t2
|
|
paddq t2,t1
|
|
movq t1,d3
|
|
|
|
# t1 = [ hc0[1] * r4, hc0[0] * u4 ]
|
|
movdqa ru4,t1
|
|
pmuludq hc0,t1
|
|
# t1 += [ hc1[1] * r3, hc1[0] * u3 ]
|
|
movdqa ru3,t2
|
|
pmuludq hc1,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc2[1] * r2, hc2[0] * u2 ]
|
|
movdqa ru2,t2
|
|
pmuludq hc2,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc3[1] * r1, hc3[0] * u1 ]
|
|
movdqa ru1,t2
|
|
pmuludq hc3,t2
|
|
paddq t2,t1
|
|
# t1 += [ hc4[1] * r0, hc4[0] * u0 ]
|
|
movdqa ru0,t2
|
|
pmuludq hc4,t2
|
|
paddq t2,t1
|
|
# d4 = t1[0] + t1[1]
|
|
movdqa t1,t2
|
|
psrldq $8,t2
|
|
paddq t2,t1
|
|
movq t1,d4
|
|
|
|
# Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
|
|
# h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
|
|
# amount. Careful: we must not assume the carry bits 'd0 >> 26',
|
|
# 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
|
|
# integers. It's true in a single-block implementation, but not here.
|
|
|
|
# d1 += d0 >> 26
|
|
mov d0,%rax
|
|
shr $26,%rax
|
|
add %rax,d1
|
|
# h0 = d0 & 0x3ffffff
|
|
mov d0,%rbx
|
|
and $0x3ffffff,%ebx
|
|
|
|
# d2 += d1 >> 26
|
|
mov d1,%rax
|
|
shr $26,%rax
|
|
add %rax,d2
|
|
# h1 = d1 & 0x3ffffff
|
|
mov d1,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h1
|
|
|
|
# d3 += d2 >> 26
|
|
mov d2,%rax
|
|
shr $26,%rax
|
|
add %rax,d3
|
|
# h2 = d2 & 0x3ffffff
|
|
mov d2,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h2
|
|
|
|
# d4 += d3 >> 26
|
|
mov d3,%rax
|
|
shr $26,%rax
|
|
add %rax,d4
|
|
# h3 = d3 & 0x3ffffff
|
|
mov d3,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h3
|
|
|
|
# h0 += (d4 >> 26) * 5
|
|
mov d4,%rax
|
|
shr $26,%rax
|
|
lea (%rax,%rax,4),%rax
|
|
add %rax,%rbx
|
|
# h4 = d4 & 0x3ffffff
|
|
mov d4,%rax
|
|
and $0x3ffffff,%eax
|
|
mov %eax,h4
|
|
|
|
# h1 += h0 >> 26
|
|
mov %rbx,%rax
|
|
shr $26,%rax
|
|
add %eax,h1
|
|
# h0 = h0 & 0x3ffffff
|
|
andl $0x3ffffff,%ebx
|
|
mov %ebx,h0
|
|
|
|
add $0x20,m
|
|
dec %rcx
|
|
jnz .Ldoblock2
|
|
|
|
pop %r13
|
|
pop %r12
|
|
pop %rbx
|
|
ret
|
|
SYM_FUNC_END(poly1305_2block_sse2)
|