152 #define xor_block(x, y) _mm_xor_si128(x, y)  macro
190 #define xor_block(x, y) vec_xor(x, y)  macro
244 #define xor_block(x, y) veorq_s8(x, y)  macro
278 static inline block xor_block(block x, block y) {  in xor_block()  function
821             oa[0] = xor_block(ad_offset, ctx->L[0]);  in process_ad()
822             ta[0] = xor_block(oa[0], adp[0]);  in process_ad()
823             oa[1] = xor_block(oa[0], ctx->L[1]);  in process_ad()
824             ta[1] = xor_block(oa[1], adp[1]);  in process_ad()
825             oa[2] = xor_block(ad_offset, ctx->L[1]);  in process_ad()
826             ta[2] = xor_block(oa[2], adp[2]);  in process_ad()
828             ad_offset = xor_block(oa[2], getL(ctx, tz));  in process_ad()
829             ta[3] = xor_block(ad_offset, adp[3]);  in process_ad()
831             oa[3] = xor_block(oa[2], ctx->L[2]);  in process_ad()
832             ta[3] = xor_block(oa[3], adp[3]);  in process_ad()
833             oa[4] = xor_block(oa[1], ctx->L[2]);  in process_ad()
834             ta[4] = xor_block(oa[4], adp[4]);  in process_ad()
835             oa[5] = xor_block(oa[0], ctx->L[2]);  in process_ad()
836             ta[5] = xor_block(oa[5], adp[5]);  in process_ad()
837             oa[6] = xor_block(ad_offset, ctx->L[2]);  in process_ad()
838             ta[6] = xor_block(oa[6], adp[6]);  in process_ad()
839             ad_offset = xor_block(oa[6], getL(ctx, tz));  in process_ad()
840             ta[7] = xor_block(ad_offset, adp[7]);  in process_ad()
843             ad_checksum = xor_block(ad_checksum, ta[0]);  in process_ad()
844             ad_checksum = xor_block(ad_checksum, ta[1]);  in process_ad()
845             ad_checksum = xor_block(ad_checksum, ta[2]);  in process_ad()
846             ad_checksum = xor_block(ad_checksum, ta[3]);  in process_ad()
848             ad_checksum = xor_block(ad_checksum, ta[4]);  in process_ad()
849             ad_checksum = xor_block(ad_checksum, ta[5]);  in process_ad()
850             ad_checksum = xor_block(ad_checksum, ta[6]);  in process_ad()
851             ad_checksum = xor_block(ad_checksum, ta[7]);  in process_ad()
869                 tmp.bl = xor_block(ad_offset, ctx->L[0]);  in process_ad()
870                 ta[0] = xor_block(tmp.bl, adp[0]);  in process_ad()
871                 tmp.bl = xor_block(tmp.bl, ctx->L[1]);  in process_ad()
872                 ta[1] = xor_block(tmp.bl, adp[1]);  in process_ad()
873                 ad_offset = xor_block(ad_offset, ctx->L[1]);  in process_ad()
874                 ta[2] = xor_block(ad_offset, adp[2]);  in process_ad()
875                 ad_offset = xor_block(ad_offset, ctx->L[2]);  in process_ad()
876                 ta[3] = xor_block(ad_offset, adp[3]);  in process_ad()
882                 ad_offset = xor_block(ad_offset, ctx->L[0]);  in process_ad()
883                 ta[k] = xor_block(ad_offset, adp[k]);  in process_ad()
884                 ad_offset = xor_block(ad_offset, getL(ctx, ntz(k + 2)));  in process_ad()
885                 ta[k + 1] = xor_block(ad_offset, adp[k + 1]);  in process_ad()
890                 ad_offset = xor_block(ad_offset, ctx->L[0]);  in process_ad()
891                 ta[k] = xor_block(ad_offset, adp[k]);  in process_ad()
896                 ad_offset = xor_block(ad_offset, ctx->Lstar);  in process_ad()
900                 ta[k] = xor_block(ad_offset, tmp.bl);  in process_ad()
907                 ad_checksum = xor_block(ad_checksum, ta[7]);  in process_ad()
910                 ad_checksum = xor_block(ad_checksum, ta[6]);  in process_ad()
913                 ad_checksum = xor_block(ad_checksum, ta[5]);  in process_ad()
916                 ad_checksum = xor_block(ad_checksum, ta[4]);  in process_ad()
920                 ad_checksum = xor_block(ad_checksum, ta[3]);  in process_ad()
923                 ad_checksum = xor_block(ad_checksum, ta[2]);  in process_ad()
926                 ad_checksum = xor_block(ad_checksum, ta[1]);  in process_ad()
929                 ad_checksum = xor_block(ad_checksum, ta[0]);  in process_ad()
974             oa[0] = xor_block(oa[BPI - 1], ctx->L[0]);  in ae_encrypt()
975             ta[0] = xor_block(oa[0], ptp[0]);  in ae_encrypt()
976             checksum = xor_block(checksum, ptp[0]);  in ae_encrypt()
977             oa[1] = xor_block(oa[0], ctx->L[1]);  in ae_encrypt()
978             ta[1] = xor_block(oa[1], ptp[1]);  in ae_encrypt()
979             checksum = xor_block(checksum, ptp[1]);  in ae_encrypt()
980             oa[2] = xor_block(oa[1], ctx->L[0]);  in ae_encrypt()
981             ta[2] = xor_block(oa[2], ptp[2]);  in ae_encrypt()
982             checksum = xor_block(checksum, ptp[2]);  in ae_encrypt()
984             oa[3] = xor_block(oa[2], getL(ctx, ntz(block_num)));  in ae_encrypt()
985             ta[3] = xor_block(oa[3], ptp[3]);  in ae_encrypt()
986             checksum = xor_block(checksum, ptp[3]);  in ae_encrypt()
988             oa[3] = xor_block(oa[2], ctx->L[2]);  in ae_encrypt()
989             ta[3] = xor_block(oa[3], ptp[3]);  in ae_encrypt()
990             checksum = xor_block(checksum, ptp[3]);  in ae_encrypt()
991             oa[4] = xor_block(oa[1], ctx->L[2]);  in ae_encrypt()
992             ta[4] = xor_block(oa[4], ptp[4]);  in ae_encrypt()
993             checksum = xor_block(checksum, ptp[4]);  in ae_encrypt()
994             oa[5] = xor_block(oa[0], ctx->L[2]);  in ae_encrypt()
995             ta[5] = xor_block(oa[5], ptp[5]);  in ae_encrypt()
996             checksum = xor_block(checksum, ptp[5]);  in ae_encrypt()
997             oa[6] = xor_block(oa[7], ctx->L[2]);  in ae_encrypt()
998             ta[6] = xor_block(oa[6], ptp[6]);  in ae_encrypt()
999             checksum = xor_block(checksum, ptp[6]);  in ae_encrypt()
1000             oa[7] = xor_block(oa[6], getL(ctx, ntz(block_num)));  in ae_encrypt()
1001             ta[7] = xor_block(oa[7], ptp[7]);  in ae_encrypt()
1002             checksum = xor_block(checksum, ptp[7]);  in ae_encrypt()
1005             ctp[0] = xor_block(ta[0], oa[0]);  in ae_encrypt()
1006             ctp[1] = xor_block(ta[1], oa[1]);  in ae_encrypt()
1007             ctp[2] = xor_block(ta[2], oa[2]);  in ae_encrypt()
1008             ctp[3] = xor_block(ta[3], oa[3]);  in ae_encrypt()
1010             ctp[4] = xor_block(ta[4], oa[4]);  in ae_encrypt()
1011             ctp[5] = xor_block(ta[5], oa[5]);  in ae_encrypt()
1012             ctp[6] = xor_block(ta[6], oa[6]);  in ae_encrypt()
1013             ctp[7] = xor_block(ta[7], oa[7]);  in ae_encrypt()
1032                 oa[0] = xor_block(offset, ctx->L[0]);  in ae_encrypt()
1033                 ta[0] = xor_block(oa[0], ptp[0]);  in ae_encrypt()
1034                 checksum = xor_block(checksum, ptp[0]);  in ae_encrypt()
1035                 oa[1] = xor_block(oa[0], ctx->L[1]);  in ae_encrypt()
1036                 ta[1] = xor_block(oa[1], ptp[1]);  in ae_encrypt()
1037                 checksum = xor_block(checksum, ptp[1]);  in ae_encrypt()
1038                 oa[2] = xor_block(oa[1], ctx->L[0]);  in ae_encrypt()
1039                 ta[2] = xor_block(oa[2], ptp[2]);  in ae_encrypt()
1040                 checksum = xor_block(checksum, ptp[2]);  in ae_encrypt()
1041                 offset = oa[3] = xor_block(oa[2], ctx->L[2]);  in ae_encrypt()
1042                 ta[3] = xor_block(offset, ptp[3]);  in ae_encrypt()
1043                 checksum = xor_block(checksum, ptp[3]);  in ae_encrypt()
1049                 oa[k] = xor_block(offset, ctx->L[0]);  in ae_encrypt()
1050                 ta[k] = xor_block(oa[k], ptp[k]);  in ae_encrypt()
1051                 checksum = xor_block(checksum, ptp[k]);  in ae_encrypt()
1052                 offset = oa[k + 1] = xor_block(oa[k], ctx->L[1]);  in ae_encrypt()
1053                 ta[k + 1] = xor_block(offset, ptp[k + 1]);  in ae_encrypt()
1054                 checksum = xor_block(checksum, ptp[k + 1]);  in ae_encrypt()
1059                 offset = oa[k] = xor_block(offset, ctx->L[0]);  in ae_encrypt()
1060                 ta[k] = xor_block(offset, ptp[k]);  in ae_encrypt()
1061                 checksum = xor_block(checksum, ptp[k]);  in ae_encrypt()
1069                 checksum = xor_block(checksum, tmp.bl);  in ae_encrypt()
1070                 ta[k] = offset = xor_block(offset, ctx->Lstar);  in ae_encrypt()
1074         offset = xor_block(offset, ctx->Ldollar); /* Part of tag gen */  in ae_encrypt()
1075         ta[k] = xor_block(offset, checksum);      /* Part of tag gen */  in ae_encrypt()
1077         offset = xor_block(ta[k], ctx->ad_checksum); /* Part of tag gen */  in ae_encrypt()
1080             tmp.bl = xor_block(tmp.bl, ta[k]);  in ae_encrypt()
1086             ctp[6] = xor_block(ta[6], oa[6]);  in ae_encrypt()
1089             ctp[5] = xor_block(ta[5], oa[5]);  in ae_encrypt()
1092             ctp[4] = xor_block(ta[4], oa[4]);  in ae_encrypt()
1095             ctp[3] = xor_block(ta[3], oa[3]);  in ae_encrypt()
1099             ctp[2] = xor_block(ta[2], oa[2]);  in ae_encrypt()
1102             ctp[1] = xor_block(ta[1], oa[1]);  in ae_encrypt()
1105             ctp[0] = xor_block(ta[0], oa[0]);  in ae_encrypt()
1199             oa[0] = xor_block(oa[BPI - 1], ctx->L[0]);  in ae_decrypt()
1200             ta[0] = xor_block(oa[0], ctp[0]);  in ae_decrypt()
1201             oa[1] = xor_block(oa[0], ctx->L[1]);  in ae_decrypt()
1202             ta[1] = xor_block(oa[1], ctp[1]);  in ae_decrypt()
1203             oa[2] = xor_block(oa[1], ctx->L[0]);  in ae_decrypt()
1204             ta[2] = xor_block(oa[2], ctp[2]);  in ae_decrypt()
1206             oa[3] = xor_block(oa[2], getL(ctx, ntz(block_num)));  in ae_decrypt()
1207             ta[3] = xor_block(oa[3], ctp[3]);  in ae_decrypt()
1209             oa[3] = xor_block(oa[2], ctx->L[2]);  in ae_decrypt()
1210             ta[3] = xor_block(oa[3], ctp[3]);  in ae_decrypt()
1211             oa[4] = xor_block(oa[1], ctx->L[2]);  in ae_decrypt()
1212             ta[4] = xor_block(oa[4], ctp[4]);  in ae_decrypt()
1213             oa[5] = xor_block(oa[0], ctx->L[2]);  in ae_decrypt()
1214             ta[5] = xor_block(oa[5], ctp[5]);  in ae_decrypt()
1215             oa[6] = xor_block(oa[7], ctx->L[2]);  in ae_decrypt()
1216             ta[6] = xor_block(oa[6], ctp[6]);  in ae_decrypt()
1217             oa[7] = xor_block(oa[6], getL(ctx, ntz(block_num)));  in ae_decrypt()
1218             ta[7] = xor_block(oa[7], ctp[7]);  in ae_decrypt()
1221             ptp[0] = xor_block(ta[0], oa[0]);  in ae_decrypt()
1222             checksum = xor_block(checksum, ptp[0]);  in ae_decrypt()
1223             ptp[1] = xor_block(ta[1], oa[1]);  in ae_decrypt()
1224             checksum = xor_block(checksum, ptp[1]);  in ae_decrypt()
1225             ptp[2] = xor_block(ta[2], oa[2]);  in ae_decrypt()
1226             checksum = xor_block(checksum, ptp[2]);  in ae_decrypt()
1227             ptp[3] = xor_block(ta[3], oa[3]);  in ae_decrypt()
1228             checksum = xor_block(checksum, ptp[3]);  in ae_decrypt()
1230             ptp[4] = xor_block(ta[4], oa[4]);  in ae_decrypt()
1231             checksum = xor_block(checksum, ptp[4]);  in ae_decrypt()
1232             ptp[5] = xor_block(ta[5], oa[5]);  in ae_decrypt()
1233             checksum = xor_block(checksum, ptp[5]);  in ae_decrypt()
1234             ptp[6] = xor_block(ta[6], oa[6]);  in ae_decrypt()
1235             checksum = xor_block(checksum, ptp[6]);  in ae_decrypt()
1236             ptp[7] = xor_block(ta[7], oa[7]);  in ae_decrypt()
1237             checksum = xor_block(checksum, ptp[7]);  in ae_decrypt()
1256                 oa[0] = xor_block(offset, ctx->L[0]);  in ae_decrypt()
1257                 ta[0] = xor_block(oa[0], ctp[0]);  in ae_decrypt()
1258                 oa[1] = xor_block(oa[0], ctx->L[1]);  in ae_decrypt()
1259                 ta[1] = xor_block(oa[1], ctp[1]);  in ae_decrypt()
1260                 oa[2] = xor_block(oa[1], ctx->L[0]);  in ae_decrypt()
1261                 ta[2] = xor_block(oa[2], ctp[2]);  in ae_decrypt()
1262                 offset = oa[3] = xor_block(oa[2], ctx->L[2]);  in ae_decrypt()
1263                 ta[3] = xor_block(offset, ctp[3]);  in ae_decrypt()
1269                 oa[k] = xor_block(offset, ctx->L[0]);  in ae_decrypt()
1270                 ta[k] = xor_block(oa[k], ctp[k]);  in ae_decrypt()
1271                 offset = oa[k + 1] = xor_block(oa[k], ctx->L[1]);  in ae_decrypt()
1272                 ta[k + 1] = xor_block(offset, ctp[k + 1]);  in ae_decrypt()
1277                 offset = oa[k] = xor_block(offset, ctx->L[0]);  in ae_decrypt()
1278                 ta[k] = xor_block(offset, ctp[k]);  in ae_decrypt()
1284                 offset = xor_block(offset, ctx->Lstar);  in ae_decrypt()
1288                 tmp.bl = xor_block(tmp.bl, pad);  in ae_decrypt()
1291                 checksum = xor_block(checksum, tmp.bl);  in ae_decrypt()
1298             ptp[6] = xor_block(ta[6], oa[6]);  in ae_decrypt()
1299             checksum = xor_block(checksum, ptp[6]);  in ae_decrypt()
1302             ptp[5] = xor_block(ta[5], oa[5]);  in ae_decrypt()
1303             checksum = xor_block(checksum, ptp[5]);  in ae_decrypt()
1306             ptp[4] = xor_block(ta[4], oa[4]);  in ae_decrypt()
1307             checksum = xor_block(checksum, ptp[4]);  in ae_decrypt()
1310             ptp[3] = xor_block(ta[3], oa[3]);  in ae_decrypt()
1311             checksum = xor_block(checksum, ptp[3]);  in ae_decrypt()
1315             ptp[2] = xor_block(ta[2], oa[2]);  in ae_decrypt()
1316             checksum = xor_block(checksum, ptp[2]);  in ae_decrypt()
1319             ptp[1] = xor_block(ta[1], oa[1]);  in ae_decrypt()
1320             checksum = xor_block(checksum, ptp[1]);  in ae_decrypt()
1323             ptp[0] = xor_block(ta[0], oa[0]);  in ae_decrypt()
1324             checksum = xor_block(checksum, ptp[0]);  in ae_decrypt()
1328         offset = xor_block(offset, ctx->Ldollar);  in ae_decrypt()
1329         tmp.bl = xor_block(offset, checksum);  in ae_decrypt()
1331         tmp.bl = xor_block(tmp.bl, ctx->ad_checksum); /* Full tag */  in ae_decrypt()