x86/crypto/polyval-clmulni_asm.S

1 /* SPDX-License-Identifier: GPL-2.0 */
6  * This is an efficient implementation of POLYVAL using intel PCLMULQDQ-NI
20  * two-step process  only requires 1 finite field reduction for every 8
36 #define MI %xmm14  macro
54  * Performs schoolbook1_iteration on two lists of 128-bit polynomials of length
66  * Computes the product of two 128-bit polynomials at the memory locations
68  * the 256-bit product into LO, MI, HI.
76  *   MI += X_0 * Y_1 + X_1 * Y_0
79  * Later, the 256-bit result can be extracted as:
96 	vpxor %xmm2, MI, MI
99 	vpxor %xmm3, MI, MI
105  * registers LO, MI, and HI directly rather than XOR'ing into them.
108 	vpclmulqdq $0x01, %xmm0, %xmm1, MI
112 	vpxor %xmm2, MI, MI
116  * Computes the 256-bit polynomial represented by LO, HI, MI. Stores
121 	vpslldq $8, MI, PL
122 	vpsrldq $8, MI, PH
128  * Computes the 128-bit reduction of PH : PL. Stores the result in dest.
133  * We have a 256-bit polynomial PH : PL = P_3 : P_2 : P_1 : P_0 that is the
134  * product of two 128-bit polynomials in Montgomery form.  We need to reduce it
146  * x^64 * g*(x) * P_0 + P_0, where g*(x) is bits 64-127 of g(x).  Adding this to
148  * = T_1 : T_0 = g*(x) * P_0.  Thus, bits 0-63 got "folded" into bits 64-191.
150  * Repeating this same process on the next 64 bits "folds" bits 64-127 into bits
151  * 128-255, giving the answer in bits 128-255. This time, we need to cancel P_1
152  * + T_0 in bits 64-127. The multiple of g(x) required is (P_1 + T_0) * g(x) *
154  * P_2 + P_0 + T_1 + V_0 : 0 : 0, where V = V_1 : V_0 = g*(x) * (P_1 + T_0).
158  *   V = V_1 : V_0 = g*(x) * (P_1 + T_0)
163  * T_1 into dest.  This allows us to reuse P_1 + T_0 when computing V.
170 	pclmulqdq $0x11, GSTAR, TMP_XMM		# TMP_XMM = V_1 : V_0 = V = [(P_1 + T_0) * g*(x)]
186 	pxor MI, MI
266  * Computes op1*op2*x^{-128} mod x^128 + x^127 + x^126 + x^121 + 1
287  *	h^n * accumulator + h^n * m_0 + ... + h^1 * m_{n-1}
290  * rdi - pointer to precomputed key powers h^8 ... h^1
291  * rsi - pointer to message blocks
292  * rdx - number of blocks to hash
293  * rcx - pointer to the accumulator