1*0957b409SSimon J. Gerraty /*
2*0957b409SSimon J. Gerraty * Copyright (c) 2017 Thomas Pornin <pornin@bolet.org>
3*0957b409SSimon J. Gerraty *
4*0957b409SSimon J. Gerraty * Permission is hereby granted, free of charge, to any person obtaining
5*0957b409SSimon J. Gerraty * a copy of this software and associated documentation files (the
6*0957b409SSimon J. Gerraty * "Software"), to deal in the Software without restriction, including
7*0957b409SSimon J. Gerraty * without limitation the rights to use, copy, modify, merge, publish,
8*0957b409SSimon J. Gerraty * distribute, sublicense, and/or sell copies of the Software, and to
9*0957b409SSimon J. Gerraty * permit persons to whom the Software is furnished to do so, subject to
10*0957b409SSimon J. Gerraty * the following conditions:
11*0957b409SSimon J. Gerraty *
12*0957b409SSimon J. Gerraty * The above copyright notice and this permission notice shall be
13*0957b409SSimon J. Gerraty * included in all copies or substantial portions of the Software.
14*0957b409SSimon J. Gerraty *
15*0957b409SSimon J. Gerraty * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
16*0957b409SSimon J. Gerraty * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
17*0957b409SSimon J. Gerraty * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
18*0957b409SSimon J. Gerraty * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS
19*0957b409SSimon J. Gerraty * BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
20*0957b409SSimon J. Gerraty * ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
21*0957b409SSimon J. Gerraty * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
22*0957b409SSimon J. Gerraty * SOFTWARE.
23*0957b409SSimon J. Gerraty */
24*0957b409SSimon J. Gerraty
25*0957b409SSimon J. Gerraty #define BR_POWER_ASM_MACROS 1
26*0957b409SSimon J. Gerraty #include "inner.h"
27*0957b409SSimon J. Gerraty
28*0957b409SSimon J. Gerraty #if BR_POWER8
29*0957b409SSimon J. Gerraty
30*0957b409SSimon J. Gerraty /* see bearssl_block.h */
31*0957b409SSimon J. Gerraty void
br_aes_pwr8_ctr_init(br_aes_pwr8_ctr_keys * ctx,const void * key,size_t len)32*0957b409SSimon J. Gerraty br_aes_pwr8_ctr_init(br_aes_pwr8_ctr_keys *ctx,
33*0957b409SSimon J. Gerraty const void *key, size_t len)
34*0957b409SSimon J. Gerraty {
35*0957b409SSimon J. Gerraty ctx->vtable = &br_aes_pwr8_ctr_vtable;
36*0957b409SSimon J. Gerraty ctx->num_rounds = br_aes_pwr8_keysched(ctx->skey.skni, key, len);
37*0957b409SSimon J. Gerraty }
38*0957b409SSimon J. Gerraty
39*0957b409SSimon J. Gerraty static void
ctr_128(const unsigned char * sk,const unsigned char * ivbuf,unsigned char * buf,size_t num_blocks)40*0957b409SSimon J. Gerraty ctr_128(const unsigned char *sk, const unsigned char *ivbuf,
41*0957b409SSimon J. Gerraty unsigned char *buf, size_t num_blocks)
42*0957b409SSimon J. Gerraty {
43*0957b409SSimon J. Gerraty long cc0, cc1, cc2, cc3;
44*0957b409SSimon J. Gerraty
45*0957b409SSimon J. Gerraty #if BR_POWER8_LE
46*0957b409SSimon J. Gerraty static const uint32_t idx2be[] = {
47*0957b409SSimon J. Gerraty 0x03020100, 0x07060504, 0x0B0A0908, 0x0F0E0D0C
48*0957b409SSimon J. Gerraty };
49*0957b409SSimon J. Gerraty #endif
50*0957b409SSimon J. Gerraty static const uint32_t ctrinc[] = {
51*0957b409SSimon J. Gerraty 0, 0, 0, 4
52*0957b409SSimon J. Gerraty };
53*0957b409SSimon J. Gerraty
54*0957b409SSimon J. Gerraty cc0 = 0;
55*0957b409SSimon J. Gerraty cc1 = 16;
56*0957b409SSimon J. Gerraty cc2 = 32;
57*0957b409SSimon J. Gerraty cc3 = 48;
58*0957b409SSimon J. Gerraty asm volatile (
59*0957b409SSimon J. Gerraty
60*0957b409SSimon J. Gerraty /*
61*0957b409SSimon J. Gerraty * Load subkeys into v0..v10
62*0957b409SSimon J. Gerraty */
63*0957b409SSimon J. Gerraty lxvw4x(32, %[cc0], %[sk])
64*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
65*0957b409SSimon J. Gerraty lxvw4x(33, %[cc0], %[sk])
66*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
67*0957b409SSimon J. Gerraty lxvw4x(34, %[cc0], %[sk])
68*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
69*0957b409SSimon J. Gerraty lxvw4x(35, %[cc0], %[sk])
70*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
71*0957b409SSimon J. Gerraty lxvw4x(36, %[cc0], %[sk])
72*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
73*0957b409SSimon J. Gerraty lxvw4x(37, %[cc0], %[sk])
74*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
75*0957b409SSimon J. Gerraty lxvw4x(38, %[cc0], %[sk])
76*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
77*0957b409SSimon J. Gerraty lxvw4x(39, %[cc0], %[sk])
78*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
79*0957b409SSimon J. Gerraty lxvw4x(40, %[cc0], %[sk])
80*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
81*0957b409SSimon J. Gerraty lxvw4x(41, %[cc0], %[sk])
82*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
83*0957b409SSimon J. Gerraty lxvw4x(42, %[cc0], %[sk])
84*0957b409SSimon J. Gerraty li(%[cc0], 0)
85*0957b409SSimon J. Gerraty
86*0957b409SSimon J. Gerraty #if BR_POWER8_LE
87*0957b409SSimon J. Gerraty /*
88*0957b409SSimon J. Gerraty * v15 = constant for byteswapping words
89*0957b409SSimon J. Gerraty */
90*0957b409SSimon J. Gerraty lxvw4x(47, 0, %[idx2be])
91*0957b409SSimon J. Gerraty #endif
92*0957b409SSimon J. Gerraty /*
93*0957b409SSimon J. Gerraty * v28 = increment for IV counter.
94*0957b409SSimon J. Gerraty */
95*0957b409SSimon J. Gerraty lxvw4x(60, 0, %[ctrinc])
96*0957b409SSimon J. Gerraty
97*0957b409SSimon J. Gerraty /*
98*0957b409SSimon J. Gerraty * Load IV into v16..v19
99*0957b409SSimon J. Gerraty */
100*0957b409SSimon J. Gerraty lxvw4x(48, %[cc0], %[ivbuf])
101*0957b409SSimon J. Gerraty lxvw4x(49, %[cc1], %[ivbuf])
102*0957b409SSimon J. Gerraty lxvw4x(50, %[cc2], %[ivbuf])
103*0957b409SSimon J. Gerraty lxvw4x(51, %[cc3], %[ivbuf])
104*0957b409SSimon J. Gerraty #if BR_POWER8_LE
105*0957b409SSimon J. Gerraty vperm(16, 16, 16, 15)
106*0957b409SSimon J. Gerraty vperm(17, 17, 17, 15)
107*0957b409SSimon J. Gerraty vperm(18, 18, 18, 15)
108*0957b409SSimon J. Gerraty vperm(19, 19, 19, 15)
109*0957b409SSimon J. Gerraty #endif
110*0957b409SSimon J. Gerraty
111*0957b409SSimon J. Gerraty mtctr(%[num_blocks])
112*0957b409SSimon J. Gerraty label(loop)
113*0957b409SSimon J. Gerraty /*
114*0957b409SSimon J. Gerraty * Compute next IV into v24..v27
115*0957b409SSimon J. Gerraty */
116*0957b409SSimon J. Gerraty vadduwm(24, 16, 28)
117*0957b409SSimon J. Gerraty vadduwm(25, 17, 28)
118*0957b409SSimon J. Gerraty vadduwm(26, 18, 28)
119*0957b409SSimon J. Gerraty vadduwm(27, 19, 28)
120*0957b409SSimon J. Gerraty
121*0957b409SSimon J. Gerraty /*
122*0957b409SSimon J. Gerraty * Load next data blocks. We do this early on but we
123*0957b409SSimon J. Gerraty * won't need them until IV encryption is done.
124*0957b409SSimon J. Gerraty */
125*0957b409SSimon J. Gerraty lxvw4x(52, %[cc0], %[buf])
126*0957b409SSimon J. Gerraty lxvw4x(53, %[cc1], %[buf])
127*0957b409SSimon J. Gerraty lxvw4x(54, %[cc2], %[buf])
128*0957b409SSimon J. Gerraty lxvw4x(55, %[cc3], %[buf])
129*0957b409SSimon J. Gerraty
130*0957b409SSimon J. Gerraty /*
131*0957b409SSimon J. Gerraty * Encrypt the current IV.
132*0957b409SSimon J. Gerraty */
133*0957b409SSimon J. Gerraty vxor(16, 16, 0)
134*0957b409SSimon J. Gerraty vxor(17, 17, 0)
135*0957b409SSimon J. Gerraty vxor(18, 18, 0)
136*0957b409SSimon J. Gerraty vxor(19, 19, 0)
137*0957b409SSimon J. Gerraty vcipher(16, 16, 1)
138*0957b409SSimon J. Gerraty vcipher(17, 17, 1)
139*0957b409SSimon J. Gerraty vcipher(18, 18, 1)
140*0957b409SSimon J. Gerraty vcipher(19, 19, 1)
141*0957b409SSimon J. Gerraty vcipher(16, 16, 2)
142*0957b409SSimon J. Gerraty vcipher(17, 17, 2)
143*0957b409SSimon J. Gerraty vcipher(18, 18, 2)
144*0957b409SSimon J. Gerraty vcipher(19, 19, 2)
145*0957b409SSimon J. Gerraty vcipher(16, 16, 3)
146*0957b409SSimon J. Gerraty vcipher(17, 17, 3)
147*0957b409SSimon J. Gerraty vcipher(18, 18, 3)
148*0957b409SSimon J. Gerraty vcipher(19, 19, 3)
149*0957b409SSimon J. Gerraty vcipher(16, 16, 4)
150*0957b409SSimon J. Gerraty vcipher(17, 17, 4)
151*0957b409SSimon J. Gerraty vcipher(18, 18, 4)
152*0957b409SSimon J. Gerraty vcipher(19, 19, 4)
153*0957b409SSimon J. Gerraty vcipher(16, 16, 5)
154*0957b409SSimon J. Gerraty vcipher(17, 17, 5)
155*0957b409SSimon J. Gerraty vcipher(18, 18, 5)
156*0957b409SSimon J. Gerraty vcipher(19, 19, 5)
157*0957b409SSimon J. Gerraty vcipher(16, 16, 6)
158*0957b409SSimon J. Gerraty vcipher(17, 17, 6)
159*0957b409SSimon J. Gerraty vcipher(18, 18, 6)
160*0957b409SSimon J. Gerraty vcipher(19, 19, 6)
161*0957b409SSimon J. Gerraty vcipher(16, 16, 7)
162*0957b409SSimon J. Gerraty vcipher(17, 17, 7)
163*0957b409SSimon J. Gerraty vcipher(18, 18, 7)
164*0957b409SSimon J. Gerraty vcipher(19, 19, 7)
165*0957b409SSimon J. Gerraty vcipher(16, 16, 8)
166*0957b409SSimon J. Gerraty vcipher(17, 17, 8)
167*0957b409SSimon J. Gerraty vcipher(18, 18, 8)
168*0957b409SSimon J. Gerraty vcipher(19, 19, 8)
169*0957b409SSimon J. Gerraty vcipher(16, 16, 9)
170*0957b409SSimon J. Gerraty vcipher(17, 17, 9)
171*0957b409SSimon J. Gerraty vcipher(18, 18, 9)
172*0957b409SSimon J. Gerraty vcipher(19, 19, 9)
173*0957b409SSimon J. Gerraty vcipherlast(16, 16, 10)
174*0957b409SSimon J. Gerraty vcipherlast(17, 17, 10)
175*0957b409SSimon J. Gerraty vcipherlast(18, 18, 10)
176*0957b409SSimon J. Gerraty vcipherlast(19, 19, 10)
177*0957b409SSimon J. Gerraty
178*0957b409SSimon J. Gerraty #if BR_POWER8_LE
179*0957b409SSimon J. Gerraty vperm(16, 16, 16, 15)
180*0957b409SSimon J. Gerraty vperm(17, 17, 17, 15)
181*0957b409SSimon J. Gerraty vperm(18, 18, 18, 15)
182*0957b409SSimon J. Gerraty vperm(19, 19, 19, 15)
183*0957b409SSimon J. Gerraty #endif
184*0957b409SSimon J. Gerraty
185*0957b409SSimon J. Gerraty /*
186*0957b409SSimon J. Gerraty * Load next plaintext word and XOR with encrypted IV.
187*0957b409SSimon J. Gerraty */
188*0957b409SSimon J. Gerraty vxor(16, 20, 16)
189*0957b409SSimon J. Gerraty vxor(17, 21, 17)
190*0957b409SSimon J. Gerraty vxor(18, 22, 18)
191*0957b409SSimon J. Gerraty vxor(19, 23, 19)
192*0957b409SSimon J. Gerraty stxvw4x(48, %[cc0], %[buf])
193*0957b409SSimon J. Gerraty stxvw4x(49, %[cc1], %[buf])
194*0957b409SSimon J. Gerraty stxvw4x(50, %[cc2], %[buf])
195*0957b409SSimon J. Gerraty stxvw4x(51, %[cc3], %[buf])
196*0957b409SSimon J. Gerraty
197*0957b409SSimon J. Gerraty addi(%[buf], %[buf], 64)
198*0957b409SSimon J. Gerraty
199*0957b409SSimon J. Gerraty /*
200*0957b409SSimon J. Gerraty * Update IV.
201*0957b409SSimon J. Gerraty */
202*0957b409SSimon J. Gerraty vand(16, 24, 24)
203*0957b409SSimon J. Gerraty vand(17, 25, 25)
204*0957b409SSimon J. Gerraty vand(18, 26, 26)
205*0957b409SSimon J. Gerraty vand(19, 27, 27)
206*0957b409SSimon J. Gerraty
207*0957b409SSimon J. Gerraty bdnz(loop)
208*0957b409SSimon J. Gerraty
209*0957b409SSimon J. Gerraty : [cc0] "+b" (cc0), [cc1] "+b" (cc1), [cc2] "+b" (cc2), [cc3] "+b" (cc3),
210*0957b409SSimon J. Gerraty [buf] "+b" (buf)
211*0957b409SSimon J. Gerraty : [sk] "b" (sk), [ivbuf] "b" (ivbuf), [num_blocks] "b" (num_blocks >> 2),
212*0957b409SSimon J. Gerraty [ctrinc] "b" (ctrinc)
213*0957b409SSimon J. Gerraty #if BR_POWER8_LE
214*0957b409SSimon J. Gerraty , [idx2be] "b" (idx2be)
215*0957b409SSimon J. Gerraty #endif
216*0957b409SSimon J. Gerraty : "v0", "v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8", "v9",
217*0957b409SSimon J. Gerraty "v10", "v11", "v12", "v13", "v14", "v15", "v16", "v17", "v18", "v19",
218*0957b409SSimon J. Gerraty "v20", "v21", "v22", "v23", "v24", "v25", "v26", "v27", "v28", "v29",
219*0957b409SSimon J. Gerraty "ctr", "memory"
220*0957b409SSimon J. Gerraty );
221*0957b409SSimon J. Gerraty }
222*0957b409SSimon J. Gerraty
223*0957b409SSimon J. Gerraty static void
ctr_192(const unsigned char * sk,const unsigned char * ivbuf,unsigned char * buf,size_t num_blocks)224*0957b409SSimon J. Gerraty ctr_192(const unsigned char *sk, const unsigned char *ivbuf,
225*0957b409SSimon J. Gerraty unsigned char *buf, size_t num_blocks)
226*0957b409SSimon J. Gerraty {
227*0957b409SSimon J. Gerraty long cc0, cc1, cc2, cc3;
228*0957b409SSimon J. Gerraty
229*0957b409SSimon J. Gerraty #if BR_POWER8_LE
230*0957b409SSimon J. Gerraty static const uint32_t idx2be[] = {
231*0957b409SSimon J. Gerraty 0x03020100, 0x07060504, 0x0B0A0908, 0x0F0E0D0C
232*0957b409SSimon J. Gerraty };
233*0957b409SSimon J. Gerraty #endif
234*0957b409SSimon J. Gerraty static const uint32_t ctrinc[] = {
235*0957b409SSimon J. Gerraty 0, 0, 0, 4
236*0957b409SSimon J. Gerraty };
237*0957b409SSimon J. Gerraty
238*0957b409SSimon J. Gerraty cc0 = 0;
239*0957b409SSimon J. Gerraty cc1 = 16;
240*0957b409SSimon J. Gerraty cc2 = 32;
241*0957b409SSimon J. Gerraty cc3 = 48;
242*0957b409SSimon J. Gerraty asm volatile (
243*0957b409SSimon J. Gerraty
244*0957b409SSimon J. Gerraty /*
245*0957b409SSimon J. Gerraty * Load subkeys into v0..v12
246*0957b409SSimon J. Gerraty */
247*0957b409SSimon J. Gerraty lxvw4x(32, %[cc0], %[sk])
248*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
249*0957b409SSimon J. Gerraty lxvw4x(33, %[cc0], %[sk])
250*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
251*0957b409SSimon J. Gerraty lxvw4x(34, %[cc0], %[sk])
252*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
253*0957b409SSimon J. Gerraty lxvw4x(35, %[cc0], %[sk])
254*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
255*0957b409SSimon J. Gerraty lxvw4x(36, %[cc0], %[sk])
256*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
257*0957b409SSimon J. Gerraty lxvw4x(37, %[cc0], %[sk])
258*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
259*0957b409SSimon J. Gerraty lxvw4x(38, %[cc0], %[sk])
260*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
261*0957b409SSimon J. Gerraty lxvw4x(39, %[cc0], %[sk])
262*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
263*0957b409SSimon J. Gerraty lxvw4x(40, %[cc0], %[sk])
264*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
265*0957b409SSimon J. Gerraty lxvw4x(41, %[cc0], %[sk])
266*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
267*0957b409SSimon J. Gerraty lxvw4x(42, %[cc0], %[sk])
268*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
269*0957b409SSimon J. Gerraty lxvw4x(43, %[cc0], %[sk])
270*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
271*0957b409SSimon J. Gerraty lxvw4x(44, %[cc0], %[sk])
272*0957b409SSimon J. Gerraty li(%[cc0], 0)
273*0957b409SSimon J. Gerraty
274*0957b409SSimon J. Gerraty #if BR_POWER8_LE
275*0957b409SSimon J. Gerraty /*
276*0957b409SSimon J. Gerraty * v15 = constant for byteswapping words
277*0957b409SSimon J. Gerraty */
278*0957b409SSimon J. Gerraty lxvw4x(47, 0, %[idx2be])
279*0957b409SSimon J. Gerraty #endif
280*0957b409SSimon J. Gerraty /*
281*0957b409SSimon J. Gerraty * v28 = increment for IV counter.
282*0957b409SSimon J. Gerraty */
283*0957b409SSimon J. Gerraty lxvw4x(60, 0, %[ctrinc])
284*0957b409SSimon J. Gerraty
285*0957b409SSimon J. Gerraty /*
286*0957b409SSimon J. Gerraty * Load IV into v16..v19
287*0957b409SSimon J. Gerraty */
288*0957b409SSimon J. Gerraty lxvw4x(48, %[cc0], %[ivbuf])
289*0957b409SSimon J. Gerraty lxvw4x(49, %[cc1], %[ivbuf])
290*0957b409SSimon J. Gerraty lxvw4x(50, %[cc2], %[ivbuf])
291*0957b409SSimon J. Gerraty lxvw4x(51, %[cc3], %[ivbuf])
292*0957b409SSimon J. Gerraty #if BR_POWER8_LE
293*0957b409SSimon J. Gerraty vperm(16, 16, 16, 15)
294*0957b409SSimon J. Gerraty vperm(17, 17, 17, 15)
295*0957b409SSimon J. Gerraty vperm(18, 18, 18, 15)
296*0957b409SSimon J. Gerraty vperm(19, 19, 19, 15)
297*0957b409SSimon J. Gerraty #endif
298*0957b409SSimon J. Gerraty
299*0957b409SSimon J. Gerraty mtctr(%[num_blocks])
300*0957b409SSimon J. Gerraty label(loop)
301*0957b409SSimon J. Gerraty /*
302*0957b409SSimon J. Gerraty * Compute next IV into v24..v27
303*0957b409SSimon J. Gerraty */
304*0957b409SSimon J. Gerraty vadduwm(24, 16, 28)
305*0957b409SSimon J. Gerraty vadduwm(25, 17, 28)
306*0957b409SSimon J. Gerraty vadduwm(26, 18, 28)
307*0957b409SSimon J. Gerraty vadduwm(27, 19, 28)
308*0957b409SSimon J. Gerraty
309*0957b409SSimon J. Gerraty /*
310*0957b409SSimon J. Gerraty * Load next data blocks. We do this early on but we
311*0957b409SSimon J. Gerraty * won't need them until IV encryption is done.
312*0957b409SSimon J. Gerraty */
313*0957b409SSimon J. Gerraty lxvw4x(52, %[cc0], %[buf])
314*0957b409SSimon J. Gerraty lxvw4x(53, %[cc1], %[buf])
315*0957b409SSimon J. Gerraty lxvw4x(54, %[cc2], %[buf])
316*0957b409SSimon J. Gerraty lxvw4x(55, %[cc3], %[buf])
317*0957b409SSimon J. Gerraty
318*0957b409SSimon J. Gerraty /*
319*0957b409SSimon J. Gerraty * Encrypt the current IV.
320*0957b409SSimon J. Gerraty */
321*0957b409SSimon J. Gerraty vxor(16, 16, 0)
322*0957b409SSimon J. Gerraty vxor(17, 17, 0)
323*0957b409SSimon J. Gerraty vxor(18, 18, 0)
324*0957b409SSimon J. Gerraty vxor(19, 19, 0)
325*0957b409SSimon J. Gerraty vcipher(16, 16, 1)
326*0957b409SSimon J. Gerraty vcipher(17, 17, 1)
327*0957b409SSimon J. Gerraty vcipher(18, 18, 1)
328*0957b409SSimon J. Gerraty vcipher(19, 19, 1)
329*0957b409SSimon J. Gerraty vcipher(16, 16, 2)
330*0957b409SSimon J. Gerraty vcipher(17, 17, 2)
331*0957b409SSimon J. Gerraty vcipher(18, 18, 2)
332*0957b409SSimon J. Gerraty vcipher(19, 19, 2)
333*0957b409SSimon J. Gerraty vcipher(16, 16, 3)
334*0957b409SSimon J. Gerraty vcipher(17, 17, 3)
335*0957b409SSimon J. Gerraty vcipher(18, 18, 3)
336*0957b409SSimon J. Gerraty vcipher(19, 19, 3)
337*0957b409SSimon J. Gerraty vcipher(16, 16, 4)
338*0957b409SSimon J. Gerraty vcipher(17, 17, 4)
339*0957b409SSimon J. Gerraty vcipher(18, 18, 4)
340*0957b409SSimon J. Gerraty vcipher(19, 19, 4)
341*0957b409SSimon J. Gerraty vcipher(16, 16, 5)
342*0957b409SSimon J. Gerraty vcipher(17, 17, 5)
343*0957b409SSimon J. Gerraty vcipher(18, 18, 5)
344*0957b409SSimon J. Gerraty vcipher(19, 19, 5)
345*0957b409SSimon J. Gerraty vcipher(16, 16, 6)
346*0957b409SSimon J. Gerraty vcipher(17, 17, 6)
347*0957b409SSimon J. Gerraty vcipher(18, 18, 6)
348*0957b409SSimon J. Gerraty vcipher(19, 19, 6)
349*0957b409SSimon J. Gerraty vcipher(16, 16, 7)
350*0957b409SSimon J. Gerraty vcipher(17, 17, 7)
351*0957b409SSimon J. Gerraty vcipher(18, 18, 7)
352*0957b409SSimon J. Gerraty vcipher(19, 19, 7)
353*0957b409SSimon J. Gerraty vcipher(16, 16, 8)
354*0957b409SSimon J. Gerraty vcipher(17, 17, 8)
355*0957b409SSimon J. Gerraty vcipher(18, 18, 8)
356*0957b409SSimon J. Gerraty vcipher(19, 19, 8)
357*0957b409SSimon J. Gerraty vcipher(16, 16, 9)
358*0957b409SSimon J. Gerraty vcipher(17, 17, 9)
359*0957b409SSimon J. Gerraty vcipher(18, 18, 9)
360*0957b409SSimon J. Gerraty vcipher(19, 19, 9)
361*0957b409SSimon J. Gerraty vcipher(16, 16, 10)
362*0957b409SSimon J. Gerraty vcipher(17, 17, 10)
363*0957b409SSimon J. Gerraty vcipher(18, 18, 10)
364*0957b409SSimon J. Gerraty vcipher(19, 19, 10)
365*0957b409SSimon J. Gerraty vcipher(16, 16, 11)
366*0957b409SSimon J. Gerraty vcipher(17, 17, 11)
367*0957b409SSimon J. Gerraty vcipher(18, 18, 11)
368*0957b409SSimon J. Gerraty vcipher(19, 19, 11)
369*0957b409SSimon J. Gerraty vcipherlast(16, 16, 12)
370*0957b409SSimon J. Gerraty vcipherlast(17, 17, 12)
371*0957b409SSimon J. Gerraty vcipherlast(18, 18, 12)
372*0957b409SSimon J. Gerraty vcipherlast(19, 19, 12)
373*0957b409SSimon J. Gerraty
374*0957b409SSimon J. Gerraty #if BR_POWER8_LE
375*0957b409SSimon J. Gerraty vperm(16, 16, 16, 15)
376*0957b409SSimon J. Gerraty vperm(17, 17, 17, 15)
377*0957b409SSimon J. Gerraty vperm(18, 18, 18, 15)
378*0957b409SSimon J. Gerraty vperm(19, 19, 19, 15)
379*0957b409SSimon J. Gerraty #endif
380*0957b409SSimon J. Gerraty
381*0957b409SSimon J. Gerraty /*
382*0957b409SSimon J. Gerraty * Load next plaintext word and XOR with encrypted IV.
383*0957b409SSimon J. Gerraty */
384*0957b409SSimon J. Gerraty vxor(16, 20, 16)
385*0957b409SSimon J. Gerraty vxor(17, 21, 17)
386*0957b409SSimon J. Gerraty vxor(18, 22, 18)
387*0957b409SSimon J. Gerraty vxor(19, 23, 19)
388*0957b409SSimon J. Gerraty stxvw4x(48, %[cc0], %[buf])
389*0957b409SSimon J. Gerraty stxvw4x(49, %[cc1], %[buf])
390*0957b409SSimon J. Gerraty stxvw4x(50, %[cc2], %[buf])
391*0957b409SSimon J. Gerraty stxvw4x(51, %[cc3], %[buf])
392*0957b409SSimon J. Gerraty
393*0957b409SSimon J. Gerraty addi(%[buf], %[buf], 64)
394*0957b409SSimon J. Gerraty
395*0957b409SSimon J. Gerraty /*
396*0957b409SSimon J. Gerraty * Update IV.
397*0957b409SSimon J. Gerraty */
398*0957b409SSimon J. Gerraty vand(16, 24, 24)
399*0957b409SSimon J. Gerraty vand(17, 25, 25)
400*0957b409SSimon J. Gerraty vand(18, 26, 26)
401*0957b409SSimon J. Gerraty vand(19, 27, 27)
402*0957b409SSimon J. Gerraty
403*0957b409SSimon J. Gerraty bdnz(loop)
404*0957b409SSimon J. Gerraty
405*0957b409SSimon J. Gerraty : [cc0] "+b" (cc0), [cc1] "+b" (cc1), [cc2] "+b" (cc2), [cc3] "+b" (cc3),
406*0957b409SSimon J. Gerraty [buf] "+b" (buf)
407*0957b409SSimon J. Gerraty : [sk] "b" (sk), [ivbuf] "b" (ivbuf), [num_blocks] "b" (num_blocks >> 2),
408*0957b409SSimon J. Gerraty [ctrinc] "b" (ctrinc)
409*0957b409SSimon J. Gerraty #if BR_POWER8_LE
410*0957b409SSimon J. Gerraty , [idx2be] "b" (idx2be)
411*0957b409SSimon J. Gerraty #endif
412*0957b409SSimon J. Gerraty : "v0", "v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8", "v9",
413*0957b409SSimon J. Gerraty "v10", "v11", "v12", "v13", "v14", "v15", "v16", "v17", "v18", "v19",
414*0957b409SSimon J. Gerraty "v20", "v21", "v22", "v23", "v24", "v25", "v26", "v27", "v28", "v29",
415*0957b409SSimon J. Gerraty "ctr", "memory"
416*0957b409SSimon J. Gerraty );
417*0957b409SSimon J. Gerraty }
418*0957b409SSimon J. Gerraty
419*0957b409SSimon J. Gerraty static void
ctr_256(const unsigned char * sk,const unsigned char * ivbuf,unsigned char * buf,size_t num_blocks)420*0957b409SSimon J. Gerraty ctr_256(const unsigned char *sk, const unsigned char *ivbuf,
421*0957b409SSimon J. Gerraty unsigned char *buf, size_t num_blocks)
422*0957b409SSimon J. Gerraty {
423*0957b409SSimon J. Gerraty long cc0, cc1, cc2, cc3;
424*0957b409SSimon J. Gerraty
425*0957b409SSimon J. Gerraty #if BR_POWER8_LE
426*0957b409SSimon J. Gerraty static const uint32_t idx2be[] = {
427*0957b409SSimon J. Gerraty 0x03020100, 0x07060504, 0x0B0A0908, 0x0F0E0D0C
428*0957b409SSimon J. Gerraty };
429*0957b409SSimon J. Gerraty #endif
430*0957b409SSimon J. Gerraty static const uint32_t ctrinc[] = {
431*0957b409SSimon J. Gerraty 0, 0, 0, 4
432*0957b409SSimon J. Gerraty };
433*0957b409SSimon J. Gerraty
434*0957b409SSimon J. Gerraty cc0 = 0;
435*0957b409SSimon J. Gerraty cc1 = 16;
436*0957b409SSimon J. Gerraty cc2 = 32;
437*0957b409SSimon J. Gerraty cc3 = 48;
438*0957b409SSimon J. Gerraty asm volatile (
439*0957b409SSimon J. Gerraty
440*0957b409SSimon J. Gerraty /*
441*0957b409SSimon J. Gerraty * Load subkeys into v0..v14
442*0957b409SSimon J. Gerraty */
443*0957b409SSimon J. Gerraty lxvw4x(32, %[cc0], %[sk])
444*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
445*0957b409SSimon J. Gerraty lxvw4x(33, %[cc0], %[sk])
446*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
447*0957b409SSimon J. Gerraty lxvw4x(34, %[cc0], %[sk])
448*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
449*0957b409SSimon J. Gerraty lxvw4x(35, %[cc0], %[sk])
450*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
451*0957b409SSimon J. Gerraty lxvw4x(36, %[cc0], %[sk])
452*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
453*0957b409SSimon J. Gerraty lxvw4x(37, %[cc0], %[sk])
454*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
455*0957b409SSimon J. Gerraty lxvw4x(38, %[cc0], %[sk])
456*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
457*0957b409SSimon J. Gerraty lxvw4x(39, %[cc0], %[sk])
458*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
459*0957b409SSimon J. Gerraty lxvw4x(40, %[cc0], %[sk])
460*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
461*0957b409SSimon J. Gerraty lxvw4x(41, %[cc0], %[sk])
462*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
463*0957b409SSimon J. Gerraty lxvw4x(42, %[cc0], %[sk])
464*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
465*0957b409SSimon J. Gerraty lxvw4x(43, %[cc0], %[sk])
466*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
467*0957b409SSimon J. Gerraty lxvw4x(44, %[cc0], %[sk])
468*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
469*0957b409SSimon J. Gerraty lxvw4x(45, %[cc0], %[sk])
470*0957b409SSimon J. Gerraty addi(%[cc0], %[cc0], 16)
471*0957b409SSimon J. Gerraty lxvw4x(46, %[cc0], %[sk])
472*0957b409SSimon J. Gerraty li(%[cc0], 0)
473*0957b409SSimon J. Gerraty
474*0957b409SSimon J. Gerraty #if BR_POWER8_LE
475*0957b409SSimon J. Gerraty /*
476*0957b409SSimon J. Gerraty * v15 = constant for byteswapping words
477*0957b409SSimon J. Gerraty */
478*0957b409SSimon J. Gerraty lxvw4x(47, 0, %[idx2be])
479*0957b409SSimon J. Gerraty #endif
480*0957b409SSimon J. Gerraty /*
481*0957b409SSimon J. Gerraty * v28 = increment for IV counter.
482*0957b409SSimon J. Gerraty */
483*0957b409SSimon J. Gerraty lxvw4x(60, 0, %[ctrinc])
484*0957b409SSimon J. Gerraty
485*0957b409SSimon J. Gerraty /*
486*0957b409SSimon J. Gerraty * Load IV into v16..v19
487*0957b409SSimon J. Gerraty */
488*0957b409SSimon J. Gerraty lxvw4x(48, %[cc0], %[ivbuf])
489*0957b409SSimon J. Gerraty lxvw4x(49, %[cc1], %[ivbuf])
490*0957b409SSimon J. Gerraty lxvw4x(50, %[cc2], %[ivbuf])
491*0957b409SSimon J. Gerraty lxvw4x(51, %[cc3], %[ivbuf])
492*0957b409SSimon J. Gerraty #if BR_POWER8_LE
493*0957b409SSimon J. Gerraty vperm(16, 16, 16, 15)
494*0957b409SSimon J. Gerraty vperm(17, 17, 17, 15)
495*0957b409SSimon J. Gerraty vperm(18, 18, 18, 15)
496*0957b409SSimon J. Gerraty vperm(19, 19, 19, 15)
497*0957b409SSimon J. Gerraty #endif
498*0957b409SSimon J. Gerraty
499*0957b409SSimon J. Gerraty mtctr(%[num_blocks])
500*0957b409SSimon J. Gerraty label(loop)
501*0957b409SSimon J. Gerraty /*
502*0957b409SSimon J. Gerraty * Compute next IV into v24..v27
503*0957b409SSimon J. Gerraty */
504*0957b409SSimon J. Gerraty vadduwm(24, 16, 28)
505*0957b409SSimon J. Gerraty vadduwm(25, 17, 28)
506*0957b409SSimon J. Gerraty vadduwm(26, 18, 28)
507*0957b409SSimon J. Gerraty vadduwm(27, 19, 28)
508*0957b409SSimon J. Gerraty
509*0957b409SSimon J. Gerraty /*
510*0957b409SSimon J. Gerraty * Load next data blocks. We do this early on but we
511*0957b409SSimon J. Gerraty * won't need them until IV encryption is done.
512*0957b409SSimon J. Gerraty */
513*0957b409SSimon J. Gerraty lxvw4x(52, %[cc0], %[buf])
514*0957b409SSimon J. Gerraty lxvw4x(53, %[cc1], %[buf])
515*0957b409SSimon J. Gerraty lxvw4x(54, %[cc2], %[buf])
516*0957b409SSimon J. Gerraty lxvw4x(55, %[cc3], %[buf])
517*0957b409SSimon J. Gerraty
518*0957b409SSimon J. Gerraty /*
519*0957b409SSimon J. Gerraty * Encrypt the current IV.
520*0957b409SSimon J. Gerraty */
521*0957b409SSimon J. Gerraty vxor(16, 16, 0)
522*0957b409SSimon J. Gerraty vxor(17, 17, 0)
523*0957b409SSimon J. Gerraty vxor(18, 18, 0)
524*0957b409SSimon J. Gerraty vxor(19, 19, 0)
525*0957b409SSimon J. Gerraty vcipher(16, 16, 1)
526*0957b409SSimon J. Gerraty vcipher(17, 17, 1)
527*0957b409SSimon J. Gerraty vcipher(18, 18, 1)
528*0957b409SSimon J. Gerraty vcipher(19, 19, 1)
529*0957b409SSimon J. Gerraty vcipher(16, 16, 2)
530*0957b409SSimon J. Gerraty vcipher(17, 17, 2)
531*0957b409SSimon J. Gerraty vcipher(18, 18, 2)
532*0957b409SSimon J. Gerraty vcipher(19, 19, 2)
533*0957b409SSimon J. Gerraty vcipher(16, 16, 3)
534*0957b409SSimon J. Gerraty vcipher(17, 17, 3)
535*0957b409SSimon J. Gerraty vcipher(18, 18, 3)
536*0957b409SSimon J. Gerraty vcipher(19, 19, 3)
537*0957b409SSimon J. Gerraty vcipher(16, 16, 4)
538*0957b409SSimon J. Gerraty vcipher(17, 17, 4)
539*0957b409SSimon J. Gerraty vcipher(18, 18, 4)
540*0957b409SSimon J. Gerraty vcipher(19, 19, 4)
541*0957b409SSimon J. Gerraty vcipher(16, 16, 5)
542*0957b409SSimon J. Gerraty vcipher(17, 17, 5)
543*0957b409SSimon J. Gerraty vcipher(18, 18, 5)
544*0957b409SSimon J. Gerraty vcipher(19, 19, 5)
545*0957b409SSimon J. Gerraty vcipher(16, 16, 6)
546*0957b409SSimon J. Gerraty vcipher(17, 17, 6)
547*0957b409SSimon J. Gerraty vcipher(18, 18, 6)
548*0957b409SSimon J. Gerraty vcipher(19, 19, 6)
549*0957b409SSimon J. Gerraty vcipher(16, 16, 7)
550*0957b409SSimon J. Gerraty vcipher(17, 17, 7)
551*0957b409SSimon J. Gerraty vcipher(18, 18, 7)
552*0957b409SSimon J. Gerraty vcipher(19, 19, 7)
553*0957b409SSimon J. Gerraty vcipher(16, 16, 8)
554*0957b409SSimon J. Gerraty vcipher(17, 17, 8)
555*0957b409SSimon J. Gerraty vcipher(18, 18, 8)
556*0957b409SSimon J. Gerraty vcipher(19, 19, 8)
557*0957b409SSimon J. Gerraty vcipher(16, 16, 9)
558*0957b409SSimon J. Gerraty vcipher(17, 17, 9)
559*0957b409SSimon J. Gerraty vcipher(18, 18, 9)
560*0957b409SSimon J. Gerraty vcipher(19, 19, 9)
561*0957b409SSimon J. Gerraty vcipher(16, 16, 10)
562*0957b409SSimon J. Gerraty vcipher(17, 17, 10)
563*0957b409SSimon J. Gerraty vcipher(18, 18, 10)
564*0957b409SSimon J. Gerraty vcipher(19, 19, 10)
565*0957b409SSimon J. Gerraty vcipher(16, 16, 11)
566*0957b409SSimon J. Gerraty vcipher(17, 17, 11)
567*0957b409SSimon J. Gerraty vcipher(18, 18, 11)
568*0957b409SSimon J. Gerraty vcipher(19, 19, 11)
569*0957b409SSimon J. Gerraty vcipher(16, 16, 12)
570*0957b409SSimon J. Gerraty vcipher(17, 17, 12)
571*0957b409SSimon J. Gerraty vcipher(18, 18, 12)
572*0957b409SSimon J. Gerraty vcipher(19, 19, 12)
573*0957b409SSimon J. Gerraty vcipher(16, 16, 13)
574*0957b409SSimon J. Gerraty vcipher(17, 17, 13)
575*0957b409SSimon J. Gerraty vcipher(18, 18, 13)
576*0957b409SSimon J. Gerraty vcipher(19, 19, 13)
577*0957b409SSimon J. Gerraty vcipherlast(16, 16, 14)
578*0957b409SSimon J. Gerraty vcipherlast(17, 17, 14)
579*0957b409SSimon J. Gerraty vcipherlast(18, 18, 14)
580*0957b409SSimon J. Gerraty vcipherlast(19, 19, 14)
581*0957b409SSimon J. Gerraty
582*0957b409SSimon J. Gerraty #if BR_POWER8_LE
583*0957b409SSimon J. Gerraty vperm(16, 16, 16, 15)
584*0957b409SSimon J. Gerraty vperm(17, 17, 17, 15)
585*0957b409SSimon J. Gerraty vperm(18, 18, 18, 15)
586*0957b409SSimon J. Gerraty vperm(19, 19, 19, 15)
587*0957b409SSimon J. Gerraty #endif
588*0957b409SSimon J. Gerraty
589*0957b409SSimon J. Gerraty /*
590*0957b409SSimon J. Gerraty * Load next plaintext word and XOR with encrypted IV.
591*0957b409SSimon J. Gerraty */
592*0957b409SSimon J. Gerraty vxor(16, 20, 16)
593*0957b409SSimon J. Gerraty vxor(17, 21, 17)
594*0957b409SSimon J. Gerraty vxor(18, 22, 18)
595*0957b409SSimon J. Gerraty vxor(19, 23, 19)
596*0957b409SSimon J. Gerraty stxvw4x(48, %[cc0], %[buf])
597*0957b409SSimon J. Gerraty stxvw4x(49, %[cc1], %[buf])
598*0957b409SSimon J. Gerraty stxvw4x(50, %[cc2], %[buf])
599*0957b409SSimon J. Gerraty stxvw4x(51, %[cc3], %[buf])
600*0957b409SSimon J. Gerraty
601*0957b409SSimon J. Gerraty addi(%[buf], %[buf], 64)
602*0957b409SSimon J. Gerraty
603*0957b409SSimon J. Gerraty /*
604*0957b409SSimon J. Gerraty * Update IV.
605*0957b409SSimon J. Gerraty */
606*0957b409SSimon J. Gerraty vand(16, 24, 24)
607*0957b409SSimon J. Gerraty vand(17, 25, 25)
608*0957b409SSimon J. Gerraty vand(18, 26, 26)
609*0957b409SSimon J. Gerraty vand(19, 27, 27)
610*0957b409SSimon J. Gerraty
611*0957b409SSimon J. Gerraty bdnz(loop)
612*0957b409SSimon J. Gerraty
613*0957b409SSimon J. Gerraty : [cc0] "+b" (cc0), [cc1] "+b" (cc1), [cc2] "+b" (cc2), [cc3] "+b" (cc3),
614*0957b409SSimon J. Gerraty [buf] "+b" (buf)
615*0957b409SSimon J. Gerraty : [sk] "b" (sk), [ivbuf] "b" (ivbuf), [num_blocks] "b" (num_blocks >> 2),
616*0957b409SSimon J. Gerraty [ctrinc] "b" (ctrinc)
617*0957b409SSimon J. Gerraty #if BR_POWER8_LE
618*0957b409SSimon J. Gerraty , [idx2be] "b" (idx2be)
619*0957b409SSimon J. Gerraty #endif
620*0957b409SSimon J. Gerraty : "v0", "v1", "v2", "v3", "v4", "v5", "v6", "v7", "v8", "v9",
621*0957b409SSimon J. Gerraty "v10", "v11", "v12", "v13", "v14", "v15", "v16", "v17", "v18", "v19",
622*0957b409SSimon J. Gerraty "v20", "v21", "v22", "v23", "v24", "v25", "v26", "v27", "v28", "v29",
623*0957b409SSimon J. Gerraty "ctr", "memory"
624*0957b409SSimon J. Gerraty );
625*0957b409SSimon J. Gerraty }
626*0957b409SSimon J. Gerraty
627*0957b409SSimon J. Gerraty /* see bearssl_block.h */
628*0957b409SSimon J. Gerraty uint32_t
br_aes_pwr8_ctr_run(const br_aes_pwr8_ctr_keys * ctx,const void * iv,uint32_t cc,void * data,size_t len)629*0957b409SSimon J. Gerraty br_aes_pwr8_ctr_run(const br_aes_pwr8_ctr_keys *ctx,
630*0957b409SSimon J. Gerraty const void *iv, uint32_t cc, void *data, size_t len)
631*0957b409SSimon J. Gerraty {
632*0957b409SSimon J. Gerraty unsigned char *buf;
633*0957b409SSimon J. Gerraty unsigned char ivbuf[64];
634*0957b409SSimon J. Gerraty
635*0957b409SSimon J. Gerraty buf = data;
636*0957b409SSimon J. Gerraty memcpy(ivbuf + 0, iv, 12);
637*0957b409SSimon J. Gerraty memcpy(ivbuf + 16, iv, 12);
638*0957b409SSimon J. Gerraty memcpy(ivbuf + 32, iv, 12);
639*0957b409SSimon J. Gerraty memcpy(ivbuf + 48, iv, 12);
640*0957b409SSimon J. Gerraty if (len >= 64) {
641*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 12, cc + 0);
642*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 28, cc + 1);
643*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 44, cc + 2);
644*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 60, cc + 3);
645*0957b409SSimon J. Gerraty switch (ctx->num_rounds) {
646*0957b409SSimon J. Gerraty case 10:
647*0957b409SSimon J. Gerraty ctr_128(ctx->skey.skni, ivbuf, buf,
648*0957b409SSimon J. Gerraty (len >> 4) & ~(size_t)3);
649*0957b409SSimon J. Gerraty break;
650*0957b409SSimon J. Gerraty case 12:
651*0957b409SSimon J. Gerraty ctr_192(ctx->skey.skni, ivbuf, buf,
652*0957b409SSimon J. Gerraty (len >> 4) & ~(size_t)3);
653*0957b409SSimon J. Gerraty break;
654*0957b409SSimon J. Gerraty default:
655*0957b409SSimon J. Gerraty ctr_256(ctx->skey.skni, ivbuf, buf,
656*0957b409SSimon J. Gerraty (len >> 4) & ~(size_t)3);
657*0957b409SSimon J. Gerraty break;
658*0957b409SSimon J. Gerraty }
659*0957b409SSimon J. Gerraty cc += (len >> 4) & ~(size_t)3;
660*0957b409SSimon J. Gerraty buf += len & ~(size_t)63;
661*0957b409SSimon J. Gerraty len &= 63;
662*0957b409SSimon J. Gerraty }
663*0957b409SSimon J. Gerraty if (len > 0) {
664*0957b409SSimon J. Gerraty unsigned char tmp[64];
665*0957b409SSimon J. Gerraty
666*0957b409SSimon J. Gerraty memcpy(tmp, buf, len);
667*0957b409SSimon J. Gerraty memset(tmp + len, 0, (sizeof tmp) - len);
668*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 12, cc + 0);
669*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 28, cc + 1);
670*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 44, cc + 2);
671*0957b409SSimon J. Gerraty br_enc32be(ivbuf + 60, cc + 3);
672*0957b409SSimon J. Gerraty switch (ctx->num_rounds) {
673*0957b409SSimon J. Gerraty case 10:
674*0957b409SSimon J. Gerraty ctr_128(ctx->skey.skni, ivbuf, tmp, 4);
675*0957b409SSimon J. Gerraty break;
676*0957b409SSimon J. Gerraty case 12:
677*0957b409SSimon J. Gerraty ctr_192(ctx->skey.skni, ivbuf, tmp, 4);
678*0957b409SSimon J. Gerraty break;
679*0957b409SSimon J. Gerraty default:
680*0957b409SSimon J. Gerraty ctr_256(ctx->skey.skni, ivbuf, tmp, 4);
681*0957b409SSimon J. Gerraty break;
682*0957b409SSimon J. Gerraty }
683*0957b409SSimon J. Gerraty memcpy(buf, tmp, len);
684*0957b409SSimon J. Gerraty cc += (len + 15) >> 4;
685*0957b409SSimon J. Gerraty }
686*0957b409SSimon J. Gerraty return cc;
687*0957b409SSimon J. Gerraty }
688*0957b409SSimon J. Gerraty
689*0957b409SSimon J. Gerraty /* see bearssl_block.h */
690*0957b409SSimon J. Gerraty const br_block_ctr_class br_aes_pwr8_ctr_vtable = {
691*0957b409SSimon J. Gerraty sizeof(br_aes_pwr8_ctr_keys),
692*0957b409SSimon J. Gerraty 16,
693*0957b409SSimon J. Gerraty 4,
694*0957b409SSimon J. Gerraty (void (*)(const br_block_ctr_class **, const void *, size_t))
695*0957b409SSimon J. Gerraty &br_aes_pwr8_ctr_init,
696*0957b409SSimon J. Gerraty (uint32_t (*)(const br_block_ctr_class *const *,
697*0957b409SSimon J. Gerraty const void *, uint32_t, void *, size_t))
698*0957b409SSimon J. Gerraty &br_aes_pwr8_ctr_run
699*0957b409SSimon J. Gerraty };
700*0957b409SSimon J. Gerraty
701*0957b409SSimon J. Gerraty /* see bearssl_block.h */
702*0957b409SSimon J. Gerraty const br_block_ctr_class *
br_aes_pwr8_ctr_get_vtable(void)703*0957b409SSimon J. Gerraty br_aes_pwr8_ctr_get_vtable(void)
704*0957b409SSimon J. Gerraty {
705*0957b409SSimon J. Gerraty return br_aes_pwr8_supported() ? &br_aes_pwr8_ctr_vtable : NULL;
706*0957b409SSimon J. Gerraty }
707*0957b409SSimon J. Gerraty
708*0957b409SSimon J. Gerraty #else
709*0957b409SSimon J. Gerraty
710*0957b409SSimon J. Gerraty /* see bearssl_block.h */
711*0957b409SSimon J. Gerraty const br_block_ctr_class *
br_aes_pwr8_ctr_get_vtable(void)712*0957b409SSimon J. Gerraty br_aes_pwr8_ctr_get_vtable(void)
713*0957b409SSimon J. Gerraty {
714*0957b409SSimon J. Gerraty return NULL;
715*0957b409SSimon J. Gerraty }
716*0957b409SSimon J. Gerraty
717*0957b409SSimon J. Gerraty #endif
718