Lines Matching +full:- +full:16 +full:g
1 /* SPDX-License-Identifier: GPL-2.0 */
6 * This is an efficient implementation of POLYVAL using intel PCLMULQDQ-NI
16 * modulus g(x) = x^128 + x^127 + x^126 + x^121 + 1.
20 * two-step process only requires 1 finite field reduction for every 8
45 .section .rodata.cst16.gstar, "aM", @progbits, 16
46 .align 16
54 * Performs schoolbook1_iteration on two lists of 128-bit polynomials of length
66 * Computes the product of two 128-bit polynomials at the memory locations
67 * specified by (MSG + 16*i) and (KEY_POWERS + 16*i) and XORs the components of
68 * the 256-bit product into LO, MI, HI.
79 * Later, the 256-bit result can be extracted as:
88 movups (16*\i)(MSG), %xmm0
92 vpclmulqdq $0x01, (16*\i)(KEY_POWERS), %xmm0, %xmm2
93 vpclmulqdq $0x00, (16*\i)(KEY_POWERS), %xmm0, %xmm1
94 vpclmulqdq $0x10, (16*\i)(KEY_POWERS), %xmm0, %xmm3
95 vpclmulqdq $0x11, (16*\i)(KEY_POWERS), %xmm0, %xmm4
116 * Computes the 256-bit polynomial represented by LO, HI, MI. Stores
128 * Computes the 128-bit reduction of PH : PL. Stores the result in dest.
130 * This macro computes p(x) mod g(x) where p(x) is in montgomery form and g(x) =
133 * We have a 256-bit polynomial PH : PL = P_3 : P_2 : P_1 : P_0 that is the
134 * product of two 128-bit polynomials in Montgomery form. We need to reduce it
135 * mod g(x). Also, since polynomials in Montgomery form have an "extra" factor
139 * To accomplish both of these goals, we add multiples of g(x) that cancel out
143 * Since the only nonzero term in the low 64 bits of g(x) is the constant term,
144 * the multiple of g(x) needed to cancel out P_0 is P_0 * g(x). The CPU can
145 * only do 64x64 bit multiplications, so split P_0 * g(x) into x^128 * P_0 +
146 * x^64 * g*(x) * P_0 + P_0, where g*(x) is bits 64-127 of g(x). Adding this to
148 * = T_1 : T_0 = g*(x) * P_0. Thus, bits 0-63 got "folded" into bits 64-191.
150 * Repeating this same process on the next 64 bits "folds" bits 64-127 into bits
151 * 128-255, giving the answer in bits 128-255. This time, we need to cancel P_1
152 * + T_0 in bits 64-127. The multiple of g(x) required is (P_1 + T_0) * g(x) *
154 * P_2 + P_0 + T_1 + V_0 : 0 : 0, where V = V_1 : V_0 = g*(x) * (P_1 + T_0).
157 * T = T_1 : T_0 = g*(x) * P_0
158 * V = V_1 : V_0 = g*(x) * (P_1 + T_0)
159 * p(x) / x^{128} mod g(x) = P_3 + P_1 + T_0 + V_1 : P_2 + P_0 + T_1 + V_0
166 vpclmulqdq $0x00, PL, GSTAR, TMP_XMM # TMP_XMM = T_1 : T_0 = P_0 * g*(x)
170 pclmulqdq $0x11, GSTAR, TMP_XMM # TMP_XMM = V_1 : V_0 = V = [(P_1 + T_0) * g*(x)]
222 addq $(8*16), MSG
232 addq $(16*STRIDE_BLOCKS), KEY_POWERS
240 addq $16, MSG
241 addq $16, KEY_POWERS
246 addq $(4*16), MSG
247 addq $(4*16), KEY_POWERS
252 addq $(2*16), MSG
253 addq $(2*16), KEY_POWERS
266 * Computes op1*op2*x^{-128} mod x^128 + x^127 + x^126 + x^121 + 1
287 * h^n * accumulator + h^n * m_0 + ... + h^1 * m_{n-1}
290 * rdi - pointer to precomputed key powers h^8 ... h^1
291 * rsi - pointer to message blocks
292 * rdx - number of blocks to hash
293 * rcx - pointer to the accumulator