1 #include "s390x_arch.h" 2 3 .text 4 5 .globl gcm_gmult_4bit 6 .align 32 7 gcm_gmult_4bit: 8 stm %r6,%r14,6*4(%r15) 9 10 aghi %r2,-1 11 lghi %r5,1 12 lghi %r13,120 13 larl %r14,rem_4bit 14 15 lg %r1,8+1(%r2) # Xi 16 j .Lgmult_shortcut 17 .type gcm_gmult_4bit,@function 18 .size gcm_gmult_4bit,(.-gcm_gmult_4bit) 19 20 .globl gcm_ghash_4bit 21 .align 32 22 gcm_ghash_4bit: 23 larl %r1,OPENSSL_s390xcap_P 24 lg %r0,S390X_KIMD+8(%r1) # load second word of kimd capabilities 25 # vector 26 tmhh %r0,0x4000 # check for function 65 27 jz .Lsoft_ghash 28 lghi %r0,S390X_GHASH # function 65 29 la %r1,0(%r2) # H lies right after Xi in gcm128_context 30 .long 0xb93e0004 # kimd %r0,%r4 31 brc 1,.-4 # pay attention to "partial completion" 32 br %r14 33 .align 32 34 .Lsoft_ghash: 35 llgfr %r5,%r5 36 stm %r6,%r14,6*4(%r15) 37 38 aghi %r2,-1 39 srlg %r5,%r5,4 40 lghi %r13,120 41 larl %r14,rem_4bit 42 43 lg %r1,8+1(%r2) # Xi 44 lg %r0,0+1(%r2) 45 lghi %r12,0 46 .Louter: 47 xg %r0,0(%r4) # Xi ^= inp 48 xg %r1,8(%r4) 49 xgr %r0,%r12 50 stg %r1,8+1(%r2) 51 stg %r0,0+1(%r2) 52 53 .Lgmult_shortcut: 54 lghi %r12,0xf0 55 sllg %r8,%r1,4 56 srlg %r10,%r1,8 # extract second byte 57 ngr %r8,%r12 58 lgr %r9,%r1 59 lghi %r11,14 60 ngr %r9,%r12 61 62 lg %r1,8(%r8,%r3) 63 lg %r0,0(%r8,%r3) 64 65 sllg %r8,%r10,4 66 sllg %r6,%r1,3 67 ngr %r8,%r12 68 ngr %r6,%r13 69 ngr %r10,%r12 70 71 sllg %r12,%r0,60 72 srlg %r1,%r1,4 73 srlg %r0,%r0,4 74 xg %r1,8(%r9,%r3) 75 xg %r0,0(%r9,%r3) 76 lgr %r9,%r10 77 sllg %r7,%r1,3 78 xgr %r1,%r12 79 ngr %r7,%r13 80 sllg %r12,%r0,60 81 j .Lghash_inner 82 .align 16 83 .Lghash_inner: 84 srlg %r1,%r1,4 85 srlg %r0,%r0,4 86 xg %r1,8(%r8,%r3) 87 llgc %r10,0(%r11,%r2) 88 xg %r0,0(%r8,%r3) 89 sllg %r8,%r10,4 90 xg %r0,0(%r6,%r14) 91 nill %r8,0xf0 92 sllg %r6,%r1,3 93 xgr %r1,%r12 94 ngr %r6,%r13 95 nill %r10,0xf0 96 97 sllg %r12,%r0,60 98 srlg %r1,%r1,4 99 srlg %r0,%r0,4 100 xg %r1,8(%r9,%r3) 101 xg %r0,0(%r9,%r3) 102 lgr %r9,%r10 103 xg %r0,0(%r7,%r14) 104 sllg %r7,%r1,3 105 xgr %r1,%r12 106 ngr %r7,%r13 107 sllg %r12,%r0,60 108 brct %r11,.Lghash_inner 109 110 srlg %r1,%r1,4 111 srlg %r0,%r0,4 112 xg %r1,8(%r8,%r3) 113 xg %r0,0(%r8,%r3) 114 sllg %r10,%r1,3 115 xg %r0,0(%r6,%r14) 116 xgr %r1,%r12 117 ngr %r10,%r13 118 119 sllg %r12,%r0,60 120 srlg %r1,%r1,4 121 srlg %r0,%r0,4 122 xg %r1,8(%r9,%r3) 123 xg %r0,0(%r9,%r3) 124 xgr %r1,%r12 125 xg %r0,0(%r7,%r14) 126 127 lg %r12,0(%r10,%r14) 128 la %r4,16(%r4) 129 sllg %r12,%r12,4 # correct last rem_4bit[rem] 130 brctg %r5,.Louter 131 132 xgr %r0,%r12 133 stg %r1,8+1(%r2) 134 stg %r0,0+1(%r2) 135 lm %r6,%r14,6*4(%r15) 136 br %r14 137 .type gcm_ghash_4bit,@function 138 .size gcm_ghash_4bit,(.-gcm_ghash_4bit) 139 140 .align 64 141 rem_4bit: 142 .long 0,0,29491200,0,58982400,0,38141952,0 143 .long 117964800,0,113901568,0,76283904,0,88997888,0 144 .long 235929600,0,265420800,0,227803136,0,206962688,0 145 .long 152567808,0,148504576,0,177995776,0,190709760,0 146 .type rem_4bit,@object 147 .size rem_4bit,(.-rem_4bit) 148 .string "GHASH for s390x, CRYPTOGAMS by <appro@openssl.org>" 149