1 /* SPDX-License-Identifier: GPL-2.0-only */
3 * Accelerated GHASH implementation with Intel PCLMULQDQ-NI
4 * instructions. This file contains accelerated part of ghash
5 * implementation. More information about PCLMULQDQ can be found at:
7 * http://software.intel.com/en-us/articles/carry-less-multiplication-and-its-usage-for-computing-the-gcm-mode/
9 * Copyright (c) 2009 Intel Corp.
10 * Author: Huang Ying <ying.huang@intel.com>
16 #include <linux/linkage.h>
17 #include <asm/frame.h>
19 .section .rodata.cst16.bswap_mask, "aM", @progbits, 16
22 .octa 0x000102030405060708090a0b0c0d0e0f
35 * __clmul_gf128mul_ble: internal ABI
38 * SHASH: operand2, hash_key << 1 mod poly
40 * DATA: operand1 * operand2 mod poly
46 SYM_FUNC_START_LOCAL(__clmul_gf128mul_ble)
48 pshufd $0b01001110, DATA, T2
49 pshufd $0b01001110, SHASH, T3
53 pclmulqdq $0x00, SHASH, DATA # DATA = a0 * b0
54 pclmulqdq $0x11, SHASH, T1 # T1 = a1 * b1
55 pclmulqdq $0x00, T3, T2 # T2 = (a1 + a0) * (b1 + b0)
57 pxor T1, T2 # T2 = a0 * b1 + a1 * b0
63 pxor T2, T1 # <T1:DATA> is result of
64 # carry-less multiplication
66 # first phase of the reduction
79 # second phase of the reduction
89 SYM_FUNC_END(__clmul_gf128mul_ble)
91 /* void clmul_ghash_mul(char *dst, const u128 *shash) */
92 SYM_FUNC_START(clmul_ghash_mul)
96 movaps .Lbswap_mask, BSWAP
98 call __clmul_gf128mul_ble
103 SYM_FUNC_END(clmul_ghash_mul)
106 * void clmul_ghash_update(char *dst, const char *src, unsigned int srclen,
107 * const u128 *shash);
109 SYM_FUNC_START(clmul_ghash_update)
112 jb .Lupdate_just_ret # check length
113 movaps .Lbswap_mask, BSWAP
122 call __clmul_gf128mul_ble
132 SYM_FUNC_END(clmul_ghash_update)