19 	( (((a0) & 1) << 0) |				\
29 	( ((l7) << (0 * 8)) |				\
172 		     x4, x5, x6, x7,			\  argument
176 	vmovdqu (0 * 16)(rio), x0;			\
183 	vmovdqu (7 * 16)(rio), x7;			\
195 		      x4, x5, x6, x7,			\  argument
200 			 x4, x5, x6, x7,		\
205 	vmovdqu x0, 0 * 16(mem_ab);			\
212 	vmovdqu x7, 7 * 16(mem_ab);			\
213 	vmovdqu y0, 0 * 16(mem_cd);			\
223 		     x4, x5, x6, x7,			\  argument
227 	vmovdqu x0, 0 * 16(mem);			\
234 	vmovdqu x7, 7 * 16(mem);			\
245 			      x4, x5, x6, x7,		\  argument
247 	vmovdqu x0, ((idx + 0) * 16)(mem_tmp);		\
254 	vmovdqu x7, ((idx + 7) * 16)(mem_tmp);
257 			     x4, x5, x6, x7,		\  argument
259 	vmovdqu ((idx + 0) * 16)(mem_tmp), x0;		\
266 	vmovdqu ((idx + 7) * 16)(mem_tmp), x7;
269 		      x4, x5, x6, x7,			\  argument
273 	vbroadcastss ((round * 16) + idx + 0)(rk), t0;	\
296 	vpxor t2, x7, x7;
300 			    x4, x5, x6, x7,		\  argument
312 	vgf2p8affineinvqb $0, t2, x2, x2;		\
313 	vgf2p8affineinvqb $0, t2, x6, x6;		\
317 	vgf2p8affineqb $(tf_x2_const), t4, x7, x7;	\
318 	vgf2p8affineinvqb $0, t2, x3, x3;		\
319 	vgf2p8affineinvqb $0, t2, x7, x7
324 		       x4, x5, x6, x7,			\  argument
348 	vpshufb t1, x7, x7;				\
360 	filter_8bit(x7, t4, t5, t6, t0);		\
362 	vaesdeclast t7, x7, x7;
380 		       x4, x5, x6, x7,			\  argument
387 	vpxor y3, x7, x7;				\
399 	vpxor x7, x3, x3;				\
405 	vpxor x7, y7, y7;				\
417 	vpxor y3, x7, x7;
420 		x4, x5, x6, x7,				\  argument
425 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
428 	aria_sbox_8way(x2, x3, x0, x1, x6, x7, x4, x5,	\
432 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
434 			      x4, x5, x6, x7,		\
438 			     x4, x5, x6, x7,		\
439 			     mem_tmp, 0);		\
440 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
441 		      y0, y7, y2, rk, 0, round);	\
443 	aria_sbox_8way(x2, x3, x0, x1, x6, x7, x4, x5,	\
447 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
449 			      x4, x5, x6, x7,		\
450 			      mem_tmp, 0);		\
455 		       x4, x5, x6, x7,			\
464 	 * T1 = x4, x5, x6, x7 -> x7, x6, x5, x4	\
467 		       x7, x6, x5, x4,			\
471 			      x6, x7, x4, x5,		\
472 			      mem_tmp, 0);
475 		x4, x5, x6, x7,				\  argument
480 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
483 	aria_sbox_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
487 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
489 			      x4, x5, x6, x7,		\
493 			     x4, x5, x6, x7,		\
494 			     mem_tmp, 0);		\
495 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
496 		      y0, y7, y2, rk, 0, round);	\
498 	aria_sbox_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
502 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
504 			      x4, x5, x6, x7,		\
505 			      mem_tmp, 0);		\
510 		       x4, x5, x6, x7,			\
515 	 * T1 = x4, x5, x6, x7 -> x5, x4, x7, x6	\
522 		       x5, x4, x7, x6,			\
526 			      x6, x7, x4, x5,		\
527 			      mem_tmp, 0);
530 		x4, x5, x6, x7,				\  argument
535 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
538 	aria_sbox_8way(x2, x3, x0, x1, x6, x7, x4, x5,	\
541 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
545 			      x4, x5, x6, x7,		\
549 			     x4, x5, x6, x7,		\
550 			     mem_tmp, 0);		\
551 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
552 		      y0, y7, y2, rk, 0, round);	\
554 	aria_sbox_8way(x2, x3, x0, x1, x6, x7, x4, x5,	\
557 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
558 		      y0, y7, y2, rk, 0, last_round);	\
566 		     x4, x5, x6, x7,			\  argument
571 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
575 			    x6, x7, x4, x5,		\
580 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
582 			      x4, x5, x6, x7,		\
586 			     x4, x5, x6, x7,		\
587 			     mem_tmp, 0);		\
588 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
589 		      y0, y7, y2, rk, 0, round);	\
592 			    x6, x7, x4, x5,		\
597 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
599 			      x4, x5, x6, x7,		\
600 			      mem_tmp, 0);		\
605 		       x4, x5, x6, x7,			\
614 	 * T1 = x4, x5, x6, x7 -> x7, x6, x5, x4	\
617 		       x7, x6, x5, x4,			\
621 			      x6, x7, x4, x5,		\
622 			      mem_tmp, 0);
625 		     x4, x5, x6, x7,			\  argument
630 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
634 			    x4, x5, x6, x7,		\
639 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
641 			      x4, x5, x6, x7,		\
645 			     x4, x5, x6, x7,		\
646 			     mem_tmp, 0);		\
647 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
648 		      y0, y7, y2, rk, 0, round);	\
651 			    x4, x5, x6, x7,		\
656 	aria_diff_m(x4, x5, x6, x7, y0, y1, y2, y3);	\
658 			      x4, x5, x6, x7,		\
659 			      mem_tmp, 0);		\
664 		       x4, x5, x6, x7,			\
669 	 * T1 = x4, x5, x6, x7 -> x5, x4, x7, x6	\
676 		       x5, x4, x7, x6,			\
680 			      x6, x7, x4, x5,		\
681 			      mem_tmp, 0);
684 		x4, x5, x6, x7,				\  argument
689 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
693 			    x6, x7, x4, x5,		\
697 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
701 			      x4, x5, x6, x7,		\
705 			     x4, x5, x6, x7,		\
706 			     mem_tmp, 0);		\
707 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
708 		      y0, y7, y2, rk, 0, round);	\
711 			    x6, x7, x4, x5,		\
715 	aria_ark_8way(x0, x1, x2, x3, x4, x5, x6, x7,	\
716 		      y0, y7, y2, rk, 0, last_round);	\
729 	0 + (idx), 4 + (idx), 8 + (idx), 12 + (idx)
732 	.byte SHUFB_BYTES(0), SHUFB_BYTES(1), SHUFB_BYTES(2), SHUFB_BYTES(3);
735 	.byte 0x00, 0x0d, 0x0a, 0x07, 0x04, 0x01, 0x0e, 0x0b
736 	.byte 0x08, 0x05, 0x02, 0x0f, 0x0c, 0x09, 0x06, 0x03
738 	.byte 0x00, 0x05, 0x0a, 0x0f, 0x04, 0x09, 0x0e, 0x03
739 	.byte 0x08, 0x0d, 0x02, 0x07, 0x0c, 0x01, 0x06, 0x0b
742 	.byte 0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08
743 	.byte 0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00
746  *      1 1 0 0 0 0 0 1     x0     0
747  *      0 1 0 0 1 0 0 0     x1     0
748  *      1 1 0 0 1 1 1 1     x2     0
749  *      0 1 1 0 1 0 0 1     x3     1
750  *      0 1 0 0 1 1 0 0  *  x4  +  0
751  *      0 1 0 1 1 0 0 0     x5     0
752  *      0 0 0 0 0 1 0 1     x6     0
753  *      1 1 1 0 0 1 1 1     x7     1
756 	.octa 0x92172DA81A9FA520B2370D883ABF8500
758 	.octa 0x2B15FFC1AF917B45E6D8320C625CB688
761  *      1 0 1 1 0 0 0 1     x0     0
762  *      0 1 1 1 1 0 1 1     x1     0
763  *      0 0 0 1 1 0 1 0     x2     1
764  *      0 1 0 0 0 1 0 0     x3     0
765  *      0 0 1 1 1 0 1 1  *  x4  +  0
766  *      0 1 0 0 1 0 0 0     x5     0
767  *      1 1 0 1 0 0 1 1     x6     0
768  *      0 1 0 0 1 0 1 0     x7     0
771 	.octa 0xEFAE0544FCBD1657B8F95213ABEA4100
773 	.octa 0x3F893781E95FE1576CDA64D2BA0CB204
777 #define tf_aff_const BV8(1, 1, 0, 0, 0, 1, 1, 0)
779 	.quad BM8X8(BV8(1, 0, 0, 0, 1, 1, 1, 1),
780 		    BV8(1, 1, 0, 0, 0, 1, 1, 1),
781 		    BV8(1, 1, 1, 0, 0, 0, 1, 1),
782 		    BV8(1, 1, 1, 1, 0, 0, 0, 1),
783 		    BV8(1, 1, 1, 1, 1, 0, 0, 0),
784 		    BV8(0, 1, 1, 1, 1, 1, 0, 0),
785 		    BV8(0, 0, 1, 1, 1, 1, 1, 0),
786 		    BV8(0, 0, 0, 1, 1, 1, 1, 1))
787 	.quad BM8X8(BV8(1, 0, 0, 0, 1, 1, 1, 1),
788 		    BV8(1, 1, 0, 0, 0, 1, 1, 1),
789 		    BV8(1, 1, 1, 0, 0, 0, 1, 1),
790 		    BV8(1, 1, 1, 1, 0, 0, 0, 1),
791 		    BV8(1, 1, 1, 1, 1, 0, 0, 0),
792 		    BV8(0, 1, 1, 1, 1, 1, 0, 0),
793 		    BV8(0, 0, 1, 1, 1, 1, 1, 0),
794 		    BV8(0, 0, 0, 1, 1, 1, 1, 1))
797 #define tf_inv_const BV8(1, 0, 1, 0, 0, 0, 0, 0)
799 	.quad BM8X8(BV8(0, 0, 1, 0, 0, 1, 0, 1),
800 		    BV8(1, 0, 0, 1, 0, 0, 1, 0),
801 		    BV8(0, 1, 0, 0, 1, 0, 0, 1),
802 		    BV8(1, 0, 1, 0, 0, 1, 0, 0),
803 		    BV8(0, 1, 0, 1, 0, 0, 1, 0),
804 		    BV8(0, 0, 1, 0, 1, 0, 0, 1),
805 		    BV8(1, 0, 0, 1, 0, 1, 0, 0),
806 		    BV8(0, 1, 0, 0, 1, 0, 1, 0))
807 	.quad BM8X8(BV8(0, 0, 1, 0, 0, 1, 0, 1),
808 		    BV8(1, 0, 0, 1, 0, 0, 1, 0),
809 		    BV8(0, 1, 0, 0, 1, 0, 0, 1),
810 		    BV8(1, 0, 1, 0, 0, 1, 0, 0),
811 		    BV8(0, 1, 0, 1, 0, 0, 1, 0),
812 		    BV8(0, 0, 1, 0, 1, 0, 0, 1),
813 		    BV8(1, 0, 0, 1, 0, 1, 0, 0),
814 		    BV8(0, 1, 0, 0, 1, 0, 1, 0))
817 #define tf_s2_const BV8(0, 1, 0, 0, 0, 1, 1, 1)
819 	.quad BM8X8(BV8(0, 1, 0, 1, 0, 1, 1, 1),
820 		    BV8(0, 0, 1, 1, 1, 1, 1, 1),
821 		    BV8(1, 1, 1, 0, 1, 1, 0, 1),
822 		    BV8(1, 1, 0, 0, 0, 0, 1, 1),
823 		    BV8(0, 1, 0, 0, 0, 0, 1, 1),
824 		    BV8(1, 1, 0, 0, 1, 1, 1, 0),
825 		    BV8(0, 1, 1, 0, 0, 0, 1, 1),
826 		    BV8(1, 1, 1, 1, 0, 1, 1, 0))
827 	.quad BM8X8(BV8(0, 1, 0, 1, 0, 1, 1, 1),
828 		    BV8(0, 0, 1, 1, 1, 1, 1, 1),
829 		    BV8(1, 1, 1, 0, 1, 1, 0, 1),
830 		    BV8(1, 1, 0, 0, 0, 0, 1, 1),
831 		    BV8(0, 1, 0, 0, 0, 0, 1, 1),
832 		    BV8(1, 1, 0, 0, 1, 1, 1, 0),
833 		    BV8(0, 1, 1, 0, 0, 0, 1, 1),
834 		    BV8(1, 1, 1, 1, 0, 1, 1, 0))
837 #define tf_x2_const BV8(0, 0, 1, 1, 0, 1, 0, 0)
839 	.quad BM8X8(BV8(0, 0, 0, 1, 1, 0, 0, 0),
840 		    BV8(0, 0, 1, 0, 0, 1, 1, 0),
841 		    BV8(0, 0, 0, 0, 1, 0, 1, 0),
842 		    BV8(1, 1, 1, 0, 0, 0, 1, 1),
843 		    BV8(1, 1, 1, 0, 1, 1, 0, 0),
844 		    BV8(0, 1, 1, 0, 1, 0, 1, 1),
845 		    BV8(1, 0, 1, 1, 1, 1, 0, 1),
846 		    BV8(1, 0, 0, 1, 0, 0, 1, 1))
847 	.quad BM8X8(BV8(0, 0, 0, 1, 1, 0, 0, 0),
848 		    BV8(0, 0, 1, 0, 0, 1, 1, 0),
849 		    BV8(0, 0, 0, 0, 1, 0, 1, 0),
850 		    BV8(1, 1, 1, 0, 0, 0, 1, 1),
851 		    BV8(1, 1, 1, 0, 1, 1, 0, 0),
852 		    BV8(0, 1, 1, 0, 1, 0, 1, 1),
853 		    BV8(1, 0, 1, 1, 1, 1, 0, 1),
854 		    BV8(1, 0, 0, 1, 0, 0, 1, 1))
858 	.quad BM8X8(BV8(1, 0, 0, 0, 0, 0, 0, 0),
859 		    BV8(0, 1, 0, 0, 0, 0, 0, 0),
860 		    BV8(0, 0, 1, 0, 0, 0, 0, 0),
861 		    BV8(0, 0, 0, 1, 0, 0, 0, 0),
862 		    BV8(0, 0, 0, 0, 1, 0, 0, 0),
863 		    BV8(0, 0, 0, 0, 0, 1, 0, 0),
864 		    BV8(0, 0, 0, 0, 0, 0, 1, 0),
865 		    BV8(0, 0, 0, 0, 0, 0, 0, 1))
866 	.quad BM8X8(BV8(1, 0, 0, 0, 0, 0, 0, 0),
867 		    BV8(0, 1, 0, 0, 0, 0, 0, 0),
868 		    BV8(0, 0, 1, 0, 0, 0, 0, 0),
869 		    BV8(0, 0, 0, 1, 0, 0, 0, 0),
870 		    BV8(0, 0, 0, 0, 1, 0, 0, 0),
871 		    BV8(0, 0, 0, 0, 0, 1, 0, 0),
872 		    BV8(0, 0, 0, 0, 0, 0, 1, 0),
873 		    BV8(0, 0, 0, 0, 0, 0, 0, 1))
880 	.long 0x0f0f0f0f
902 		%rax, %r9, 0);
1040 	vpsrldq $8, %xmm0, %xmm0; /* low: -1, high: 0 */
1057 	vmovdqu %xmm8, (0 * 16)(%rcx);
1086 	vmovdqu (0 * 16)(%rcx), %xmm0;
1119 	vpxor (0 * 16)(%r11), %xmm1, %xmm1;
1166 		     %rax, %r9, 0);
1339 	vpxor (0 * 16)(%r11), %xmm1, %xmm1;