aes-s390x.pl

	ltgr	$len,$len
	jz	.Lxts_dec_km_short
	bras	$ra,_s390x_xts_km
	jz	.Lxts_dec_km_done

	lrvgr	$s2,$s0			# make copy in reverse byte order
	lrvgr	$s3,$s1
	j	.Lxts_dec_km_2ndtweak

.Lxts_dec_km_short:
	llgc	$len,`2*$SIZE_T-1`($sp)
	nill	$len,0x0f		# $len%=16
	lrvg	$s0,$tweak+0($sp)	# load the tweak
	lrvg	$s1,$tweak+8($sp)
	lrvgr	$s2,$s0			# make copy in reverse byte order
	lrvgr	$s3,$s1

.Lxts_dec_km_2ndtweak:
	lghi	$i1,0x87
	srag	$i2,$s1,63		# broadcast upper bit
	ngr	$i1,$i2			# rem
	algr	$s0,$s0
	alcgr	$s1,$s1
	xgr	$s0,$i1
	lrvgr	$i1,$s0			# flip byte order
	lrvgr	$i2,$s1

	xg	$i1,0($inp)
	xg	$i2,8($inp)
	stg	$i1,0($out,$inp)
	stg	$i2,8($out,$inp)
	la	$i2,0($out,$inp)
	lghi	$i3,16
	.long	0xb92e0066		# km $i2,$i2
	brc	1,.-4			# can this happen?
	lrvgr	$i1,$s0
	lrvgr	$i2,$s1
	xg	$i1,0($out,$inp)
	xg	$i2,8($out,$inp)
	stg	$i1,0($out,$inp)
	stg	$i2,8($out,$inp)

	la	$i3,0($out,$inp)	# put aside real $out
.Lxts_dec_km_steal:
	llgc	$i1,16($inp)
	llgc	$i2,0($out,$inp)
	stc	$i1,0($out,$inp)
	stc	$i2,16($out,$inp)
	la	$inp,1($inp)
	brct	$len,.Lxts_dec_km_steal

	lgr	$s0,$s2
	lgr	$s1,$s3
	xg	$s0,0($i3)
	xg	$s1,8($i3)
	stg	$s0,0($i3)
	stg	$s1,8($i3)
	la	$s0,0($i3)
	lghi	$s1,16
	.long	0xb92e0088		# km $s0,$s0
	brc	1,.-4			# can this happen?
	xg	$s2,0($i3)
	xg	$s3,8($i3)
	stg	$s2,0($i3)
	stg	$s3,8($i3)
.Lxts_dec_km_done:
	stg	$sp,$tweak+0($sp)	# wipe tweak
	stg	$sp,$tweak+8($sp)
	l${g}	$ra,5*$SIZE_T($sp)
	lm${g}	%r6,$s3,6*$SIZE_T($sp)
	br	$ra
.align	16
.Lxts_dec_software:
___
$code.=<<___;
	stm${g}	%r6,$ra,6*$SIZE_T($sp)

	srlg	$len,$len,4
	slgr	$out,$inp

	l${g}	$s3,$stdframe($sp)	# ivp
	llgf	$s0,0($s3)		# load iv
	llgf	$s1,4($s3)
	llgf	$s2,8($s3)
	llgf	$s3,12($s3)
	stm${g}	%r2,%r5,2*$SIZE_T($sp)
	la	$key,0($key2)
	larl	$tbl,AES_Te
	bras	$ra,_s390x_AES_encrypt	# generate the tweak
	lm${g}	%r2,%r5,2*$SIZE_T($sp)
	larl	$tbl,AES_Td
	lt${g}r	$len,$len
	stm	$s0,$s3,$tweak($sp)	# save the tweak
	jz	.Lxts_dec_short
	j	.Lxts_dec_enter

.align	16
.Lxts_dec_loop:
	lrvg	$s1,$tweak+0($sp)	# load the tweak in little-endian
	lrvg	$s3,$tweak+8($sp)
	lghi	%r1,0x87
	srag	%r0,$s3,63		# broadcast upper bit
	ngr	%r1,%r0			# rem
	algr	$s1,$s1
	alcgr	$s3,$s3
	xgr	$s1,%r1
	lrvgr	$s1,$s1			# flip byte order
	lrvgr	$s3,$s3
	srlg	$s0,$s1,32		# smash the tweak to 4x32-bits 
	stg	$s1,$tweak+0($sp)	# save the tweak
	llgfr	$s1,$s1
	srlg	$s2,$s3,32
	stg	$s3,$tweak+8($sp)
	llgfr	$s3,$s3
.Lxts_dec_enter:
	x	$s0,0($inp)		# tweak^=*(inp)
	x	$s1,4($inp)
	x	$s2,8($inp)
	x	$s3,12($inp)
	stm${g}	%r2,%r3,2*$SIZE_T($sp)	# only two registers are changing
	la	$key,0($key1)
	bras	$ra,_s390x_AES_decrypt
	lm${g}	%r2,%r5,2*$SIZE_T($sp)
	x	$s0,$tweak+0($sp)	# ^=tweak
	x	$s1,$tweak+4($sp)
	x	$s2,$tweak+8($sp)
	x	$s3,$tweak+12($sp)
	st	$s0,0($out,$inp)
	st	$s1,4($out,$inp)
	st	$s2,8($out,$inp)
	st	$s3,12($out,$inp)
	la	$inp,16($inp)
	brct${g}	$len,.Lxts_dec_loop

	llgc	$len,`2*$SIZE_T-1`($sp)
	nill	$len,0x0f		# $len%16
	jz	.Lxts_dec_done

	# generate pair of tweaks...
	lrvg	$s1,$tweak+0($sp)	# load the tweak in little-endian
	lrvg	$s3,$tweak+8($sp)
	lghi	%r1,0x87
	srag	%r0,$s3,63		# broadcast upper bit
	ngr	%r1,%r0			# rem
	algr	$s1,$s1
	alcgr	$s3,$s3
	xgr	$s1,%r1
	lrvgr	$i2,$s1			# flip byte order
	lrvgr	$i3,$s3
	stmg	$i2,$i3,$tweak($sp)	# save the 1st tweak
	j	.Lxts_dec_2ndtweak

.align	16
.Lxts_dec_short:
	llgc	$len,`2*$SIZE_T-1`($sp)
	nill	$len,0x0f		# $len%16
	lrvg	$s1,$tweak+0($sp)	# load the tweak in little-endian
	lrvg	$s3,$tweak+8($sp)
.Lxts_dec_2ndtweak:
	lghi	%r1,0x87
	srag	%r0,$s3,63		# broadcast upper bit
	ngr	%r1,%r0			# rem
	algr	$s1,$s1
	alcgr	$s3,$s3
	xgr	$s1,%r1
	lrvgr	$s1,$s1			# flip byte order
	lrvgr	$s3,$s3
	srlg	$s0,$s1,32		# smash the tweak to 4x32-bits
	stg	$s1,$tweak-16+0($sp)	# save the 2nd tweak
	llgfr	$s1,$s1
	srlg	$s2,$s3,32
	stg	$s3,$tweak-16+8($sp)
	llgfr	$s3,$s3

	x	$s0,0($inp)		# tweak_the_2nd^=*(inp)
	x	$s1,4($inp)
	x	$s2,8($inp)
	x	$s3,12($inp)
	stm${g}	%r2,%r3,2*$SIZE_T($sp)
	la	$key,0($key1)
	bras	$ra,_s390x_AES_decrypt
	lm${g}	%r2,%r5,2*$SIZE_T($sp)
	x	$s0,$tweak-16+0($sp)	# ^=tweak_the_2nd
	x	$s1,$tweak-16+4($sp)
	x	$s2,$tweak-16+8($sp)
	x	$s3,$tweak-16+12($sp)
	st	$s0,0($out,$inp)
	st	$s1,4($out,$inp)
	st	$s2,8($out,$inp)
	st	$s3,12($out,$inp)

	la	$i3,0($out,$inp)	# put aside real $out
.Lxts_dec_steal:
	llgc	%r0,16($inp)
	llgc	%r1,0($out,$inp)
	stc	%r0,0($out,$inp)
	stc	%r1,16($out,$inp)
	la	$inp,1($inp)
	brct	$len,.Lxts_dec_steal
	la	$out,0($i3)		# restore real $out

	lm	$s0,$s3,$tweak($sp)	# load the 1st tweak
	x	$s0,0($out)		# tweak^=*(inp)|stolen cipher-text
	x	$s1,4($out)
	x	$s2,8($out)
	x	$s3,12($out)
	st${g}	$out,4*$SIZE_T($sp)
	la	$key,0($key1)
	bras	$ra,_s390x_AES_decrypt
	l${g}	$out,4*$SIZE_T($sp)
	x	$s0,$tweak+0($sp)	# ^=tweak
	x	$s1,$tweak+4($sp)
	x	$s2,$tweak+8($sp)
	x	$s3,$tweak+12($sp)
	st	$s0,0($out)
	st	$s1,4($out)
	st	$s2,8($out)
	st	$s3,12($out)
	stg	$sp,$tweak-16+0($sp)	# wipe 2nd tweak
	stg	$sp,$tweak-16+8($sp)
.Lxts_dec_done:
	stg	$sp,$tweak+0($sp)	# wipe tweak
	stg	$sp,$twesk+8($sp)
	lm${g}	%r6,$ra,6*$SIZE_T($sp)
	br	$ra
.size	AES_xts_decrypt,.-AES_xts_decrypt
___
}
$code.=<<___;
.string	"AES for s390x, CRYPTOGAMS by <appro\@openssl.org>"
.comm	OPENSSL_s390xcap_P,16,8
___

$code =~ s/\`([^\`]*)\`/eval $1/gem;
print $code;
close STDOUT;	# force flush