/* SPDX-License-Identifier: GPL-2.0-or-later */
/*
 * AES modes (ECB/CBC/CTR/XTS) for PPC AES implementation
 *
 * Copyright (c) 2015 Markus Stockhausen <stockhausen@collogia.de>
 */

#include <asm/ppc_asm.h>
#include "aes-spe-regs.h"

#ifdef __BIG_ENDIAN__                   /* Macros for big endian builds */

#define LOAD_DATA(reg, off) \
        lwz             reg,off(rSP);   /* load with offset             */
#define SAVE_DATA(reg, off) \
        stw             reg,off(rDP);   /* save with offset             */
#define NEXT_BLOCK \
        addi            rSP,rSP,16;     /* increment pointers per bloc  */ \
        addi            rDP,rDP,16;
#define LOAD_IV(reg, off) \
        lwz             reg,off(rIP);   /* IV loading with offset       */
#define SAVE_IV(reg, off) \
        stw             reg,off(rIP);   /* IV saving with offset        */
#define START_IV                        /* nothing to reset             */
#define CBC_DEC 16                      /* CBC decrement per block      */
#define CTR_DEC 1                       /* CTR decrement one byte       */

#else                                   /* Macros for little endian     */

#define LOAD_DATA(reg, off) \
        lwbrx           reg,0,rSP;      /* load reversed                */ \
        addi            rSP,rSP,4;      /* and increment pointer        */
#define SAVE_DATA(reg, off) \
        stwbrx          reg,0,rDP;      /* save reversed                */ \
        addi            rDP,rDP,4;      /* and increment pointer        */
#define NEXT_BLOCK                      /* nothing todo                 */
#define LOAD_IV(reg, off) \
        lwbrx           reg,0,rIP;      /* load reversed                */ \
        addi            rIP,rIP,4;      /* and increment pointer        */
#define SAVE_IV(reg, off) \
        stwbrx          reg,0,rIP;      /* load reversed                */ \
        addi            rIP,rIP,4;      /* and increment pointer        */
#define START_IV \
        subi            rIP,rIP,16;     /* must reset pointer           */
#define CBC_DEC 32                      /* 2 blocks because of incs     */
#define CTR_DEC 17                      /* 1 block because of incs      */

#endif

#define SAVE_0_REGS
#define LOAD_0_REGS

#define SAVE_4_REGS \
        stw             rI0,96(r1);     /* save 32 bit registers        */ \
        stw             rI1,100(r1);                                       \
        stw             rI2,104(r1);                                       \
        stw             rI3,108(r1);

#define LOAD_4_REGS \
        lwz             rI0,96(r1);     /* restore 32 bit registers     */ \
        lwz             rI1,100(r1);                                       \
        lwz             rI2,104(r1);                                       \
        lwz             rI3,108(r1);

#define SAVE_8_REGS \
        SAVE_4_REGS                                                        \
        stw             rG0,112(r1);    /* save 32 bit registers        */ \
        stw             rG1,116(r1);                                       \
        stw             rG2,120(r1);                                       \
        stw             rG3,124(r1);

#define LOAD_8_REGS \
        LOAD_4_REGS                                                        \
        lwz             rG0,112(r1);    /* restore 32 bit registers     */ \
        lwz             rG1,116(r1);                                       \
        lwz             rG2,120(r1);                                       \
        lwz             rG3,124(r1);

#define INITIALIZE_CRYPT(tab,nr32bitregs) \
        mflr            r0;                                                \
        stwu            r1,-160(r1);    /* create stack frame           */ \
        lis             rT0,tab@h;      /* en-/decryption table pointer */ \
        stw             r0,8(r1);       /* save link register           */ \
        ori             rT0,rT0,tab@l;                                     \
        evstdw          r14,16(r1);                                        \
        mr              rKS,rKP;                                           \
        evstdw          r15,24(r1);     /* We must save non volatile    */ \
        evstdw          r16,32(r1);     /* registers. Take the chance   */ \
        evstdw          r17,40(r1);     /* and save the SPE part too    */ \
        evstdw          r18,48(r1);                                        \
        evstdw          r19,56(r1);                                        \
        evstdw          r20,64(r1);                                        \
        evstdw          r21,72(r1);                                        \
        evstdw          r22,80(r1);                                        \
        evstdw          r23,88(r1);                                        \
        SAVE_##nr32bitregs##_REGS

#define FINALIZE_CRYPT(nr32bitregs) \
        lwz             r0,8(r1);                                          \
        evldw           r14,16(r1);     /* restore SPE registers        */ \
        evldw           r15,24(r1);                                        \
        evldw           r16,32(r1);                                        \
        evldw           r17,40(r1);                                        \
        evldw           r18,48(r1);                                        \
        evldw           r19,56(r1);                                        \
        evldw           r20,64(r1);                                        \
        evldw           r21,72(r1);                                        \
        evldw           r22,80(r1);                                        \
        evldw           r23,88(r1);                                        \
        LOAD_##nr32bitregs##_REGS                                          \
        mtlr            r0;             /* restore link register        */ \
        xor             r0,r0,r0;                                          \
        stw             r0,16(r1);      /* delete sensitive data        */ \
        stw             r0,24(r1);      /* that we might have pushed    */ \
        stw             r0,32(r1);      /* from other context that runs */ \
        stw             r0,40(r1);      /* the same code                */ \
        stw             r0,48(r1);                                         \
        stw             r0,56(r1);                                         \
        stw             r0,64(r1);                                         \
        stw             r0,72(r1);                                         \
        stw             r0,80(r1);                                         \
        stw             r0,88(r1);                                         \
        addi            r1,r1,160;      /* cleanup stack frame          */

#define ENDIAN_SWAP(t0, t1, s0, s1) \
        rotrwi          t0,s0,8;        /* swap endianness for 2 GPRs   */ \
        rotrwi          t1,s1,8;                                           \
        rlwimi          t0,s0,8,8,15;                                      \
        rlwimi          t1,s1,8,8,15;                                      \
        rlwimi          t0,s0,8,24,31;                                     \
        rlwimi          t1,s1,8,24,31;

#define GF128_MUL(d0, d1, d2, d3, t0) \
        li              t0,0x87;        /* multiplication in GF128      */ \
        cmpwi           d3,-1;                                             \
        iselgt          t0,0,t0;                                           \
        rlwimi          d3,d2,0,0,0;    /* propagate "carry" bits       */ \
        rotlwi          d3,d3,1;                                           \
        rlwimi          d2,d1,0,0,0;                                       \
        rotlwi          d2,d2,1;                                           \
        rlwimi          d1,d0,0,0,0;                                       \
        slwi            d0,d0,1;        /* shift left 128 bit           */ \
        rotlwi          d1,d1,1;                                           \
        xor             d0,d0,t0;

#define START_KEY(d0, d1, d2, d3) \
        lwz             rW0,0(rKP);                                        \
        mtctr           rRR;                                               \
        lwz             rW1,4(rKP);                                        \
        lwz             rW2,8(rKP);                                        \
        lwz             rW3,12(rKP);                                       \
        xor             rD0,d0,rW0;                                        \
        xor             rD1,d1,rW1;                                        \
        xor             rD2,d2,rW2;                                        \
        xor             rD3,d3,rW3;

/*
 * ppc_encrypt_aes(u8 *out, const u8 *in, u32 *key_enc,
 *                 u32 rounds)
 *
 * called from glue layer to encrypt a single 16 byte block
 * round values are AES128 = 4, AES192 = 5, AES256 = 6
 *
 */
_GLOBAL(ppc_encrypt_aes)
        INITIALIZE_CRYPT(PPC_AES_4K_ENCTAB, 0)
        LOAD_DATA(rD0, 0)
        LOAD_DATA(rD1, 4)
        LOAD_DATA(rD2, 8)
        LOAD_DATA(rD3, 12)
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_encrypt_block
        xor             rD0,rD0,rW0
        SAVE_DATA(rD0, 0)
        xor             rD1,rD1,rW1
        SAVE_DATA(rD1, 4)
        xor             rD2,rD2,rW2
        SAVE_DATA(rD2, 8)
        xor             rD3,rD3,rW3
        SAVE_DATA(rD3, 12)
        FINALIZE_CRYPT(0)
        blr

/*
 * ppc_decrypt_aes(u8 *out, const u8 *in, u32 *key_dec,
 *                 u32 rounds)
 *
 * called from glue layer to decrypt a single 16 byte block
 * round values are AES128 = 4, AES192 = 5, AES256 = 6
 *
 */
_GLOBAL(ppc_decrypt_aes)
        INITIALIZE_CRYPT(PPC_AES_4K_DECTAB,0)
        LOAD_DATA(rD0, 0)
        addi            rT1,rT0,4096
        LOAD_DATA(rD1, 4)
        LOAD_DATA(rD2, 8)
        LOAD_DATA(rD3, 12)
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_decrypt_block
        xor             rD0,rD0,rW0
        SAVE_DATA(rD0, 0)
        xor             rD1,rD1,rW1
        SAVE_DATA(rD1, 4)
        xor             rD2,rD2,rW2
        SAVE_DATA(rD2, 8)
        xor             rD3,rD3,rW3
        SAVE_DATA(rD3, 12)
        FINALIZE_CRYPT(0)
        blr

/*
 * ppc_encrypt_ecb(u8 *out, const u8 *in, u32 *key_enc,
 *                 u32 rounds, u32 bytes);
 *
 * called from glue layer to encrypt multiple blocks via ECB
 * Bytes must be larger or equal 16 and only whole blocks are
 * processed. round values are AES128 = 4, AES192 = 5 and
 * AES256 = 6
 *
 */
_GLOBAL(ppc_encrypt_ecb)
        INITIALIZE_CRYPT(PPC_AES_4K_ENCTAB, 0)
ppc_encrypt_ecb_loop:
        LOAD_DATA(rD0, 0)
        mr              rKP,rKS
        LOAD_DATA(rD1, 4)
        subi            rLN,rLN,16
        LOAD_DATA(rD2, 8)
        cmpwi           rLN,15
        LOAD_DATA(rD3, 12)
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_encrypt_block
        xor             rD0,rD0,rW0
        SAVE_DATA(rD0, 0)
        xor             rD1,rD1,rW1
        SAVE_DATA(rD1, 4)
        xor             rD2,rD2,rW2
        SAVE_DATA(rD2, 8)
        xor             rD3,rD3,rW3
        SAVE_DATA(rD3, 12)
        NEXT_BLOCK
        bt              gt,ppc_encrypt_ecb_loop
        FINALIZE_CRYPT(0)
        blr

/*
 * ppc_decrypt_ecb(u8 *out, const u8 *in, u32 *key_dec,
 *                 u32 rounds, u32 bytes);
 *
 * called from glue layer to decrypt multiple blocks via ECB
 * Bytes must be larger or equal 16 and only whole blocks are
 * processed. round values are AES128 = 4, AES192 = 5 and
 * AES256 = 6
 *
 */
_GLOBAL(ppc_decrypt_ecb)
        INITIALIZE_CRYPT(PPC_AES_4K_DECTAB, 0)
        addi            rT1,rT0,4096
ppc_decrypt_ecb_loop:
        LOAD_DATA(rD0, 0)
        mr              rKP,rKS
        LOAD_DATA(rD1, 4)
        subi            rLN,rLN,16
        LOAD_DATA(rD2, 8)
        cmpwi           rLN,15
        LOAD_DATA(rD3, 12)
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_decrypt_block
        xor             rD0,rD0,rW0
        SAVE_DATA(rD0, 0)
        xor             rD1,rD1,rW1
        SAVE_DATA(rD1, 4)
        xor             rD2,rD2,rW2
        SAVE_DATA(rD2, 8)
        xor             rD3,rD3,rW3
        SAVE_DATA(rD3, 12)
        NEXT_BLOCK
        bt              gt,ppc_decrypt_ecb_loop
        FINALIZE_CRYPT(0)
        blr

/*
 * ppc_encrypt_cbc(u8 *out, const u8 *in, u32 *key_enc,
 *                 32 rounds, u32 bytes, u8 *iv);
 *
 * called from glue layer to encrypt multiple blocks via CBC
 * Bytes must be larger or equal 16 and only whole blocks are
 * processed. round values are AES128 = 4, AES192 = 5 and
 * AES256 = 6
 *
 */
_GLOBAL(ppc_encrypt_cbc)
        INITIALIZE_CRYPT(PPC_AES_4K_ENCTAB, 4)
        LOAD_IV(rI0, 0)
        LOAD_IV(rI1, 4)
        LOAD_IV(rI2, 8)
        LOAD_IV(rI3, 12)
ppc_encrypt_cbc_loop:
        LOAD_DATA(rD0, 0)
        mr              rKP,rKS
        LOAD_DATA(rD1, 4)
        subi            rLN,rLN,16
        LOAD_DATA(rD2, 8)
        cmpwi           rLN,15
        LOAD_DATA(rD3, 12)
        xor             rD0,rD0,rI0
        xor             rD1,rD1,rI1
        xor             rD2,rD2,rI2
        xor             rD3,rD3,rI3
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_encrypt_block
        xor             rI0,rD0,rW0
        SAVE_DATA(rI0, 0)
        xor             rI1,rD1,rW1
        SAVE_DATA(rI1, 4)
        xor             rI2,rD2,rW2
        SAVE_DATA(rI2, 8)
        xor             rI3,rD3,rW3
        SAVE_DATA(rI3, 12)
        NEXT_BLOCK
        bt              gt,ppc_encrypt_cbc_loop
        START_IV
        SAVE_IV(rI0, 0)
        SAVE_IV(rI1, 4)
        SAVE_IV(rI2, 8)
        SAVE_IV(rI3, 12)
        FINALIZE_CRYPT(4)
        blr

/*
 * ppc_decrypt_cbc(u8 *out, const u8 *in, u32 *key_dec,
 *                 u32 rounds, u32 bytes, u8 *iv);
 *
 * called from glue layer to decrypt multiple blocks via CBC
 * round values are AES128 = 4, AES192 = 5, AES256 = 6
 *
 */
_GLOBAL(ppc_decrypt_cbc)
        INITIALIZE_CRYPT(PPC_AES_4K_DECTAB, 4)
        li              rT1,15
        LOAD_IV(rI0, 0)
        andc            rLN,rLN,rT1
        LOAD_IV(rI1, 4)
        subi            rLN,rLN,16
        LOAD_IV(rI2, 8)
        add             rSP,rSP,rLN     /* reverse processing           */
        LOAD_IV(rI3, 12)
        add             rDP,rDP,rLN
        LOAD_DATA(rD0, 0)
        addi            rT1,rT0,4096
        LOAD_DATA(rD1, 4)
        LOAD_DATA(rD2, 8)
        LOAD_DATA(rD3, 12)
        START_IV
        SAVE_IV(rD0, 0)
        SAVE_IV(rD1, 4)
        SAVE_IV(rD2, 8)
        cmpwi           rLN,16
        SAVE_IV(rD3, 12)
        bt              lt,ppc_decrypt_cbc_end
ppc_decrypt_cbc_loop:
        mr              rKP,rKS
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_decrypt_block
        subi            rLN,rLN,16
        subi            rSP,rSP,CBC_DEC
        xor             rW0,rD0,rW0
        LOAD_DATA(rD0, 0)
        xor             rW1,rD1,rW1
        LOAD_DATA(rD1, 4)
        xor             rW2,rD2,rW2
        LOAD_DATA(rD2, 8)
        xor             rW3,rD3,rW3
        LOAD_DATA(rD3, 12)
        xor             rW0,rW0,rD0
        SAVE_DATA(rW0, 0)
        xor             rW1,rW1,rD1
        SAVE_DATA(rW1, 4)
        xor             rW2,rW2,rD2
        SAVE_DATA(rW2, 8)
        xor             rW3,rW3,rD3
        SAVE_DATA(rW3, 12)
        cmpwi           rLN,15
        subi            rDP,rDP,CBC_DEC
        bt              gt,ppc_decrypt_cbc_loop
ppc_decrypt_cbc_end:
        mr              rKP,rKS
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_decrypt_block
        xor             rW0,rW0,rD0
        xor             rW1,rW1,rD1
        xor             rW2,rW2,rD2
        xor             rW3,rW3,rD3
        xor             rW0,rW0,rI0     /* decrypt with initial IV      */
        SAVE_DATA(rW0, 0)
        xor             rW1,rW1,rI1
        SAVE_DATA(rW1, 4)
        xor             rW2,rW2,rI2
        SAVE_DATA(rW2, 8)
        xor             rW3,rW3,rI3
        SAVE_DATA(rW3, 12)
        FINALIZE_CRYPT(4)
        blr

/*
 * ppc_crypt_ctr(u8 *out, const u8 *in, u32 *key_enc,
 *               u32 rounds, u32 bytes, u8 *iv);
 *
 * called from glue layer to encrypt/decrypt multiple blocks
 * via CTR. Number of bytes does not need to be a multiple of
 * 16. Round values are AES128 = 4, AES192 = 5, AES256 = 6
 *
 */
_GLOBAL(ppc_crypt_ctr)
        INITIALIZE_CRYPT(PPC_AES_4K_ENCTAB, 4)
        LOAD_IV(rI0, 0)
        LOAD_IV(rI1, 4)
        LOAD_IV(rI2, 8)
        cmpwi           rLN,16
        LOAD_IV(rI3, 12)
        START_IV
        bt              lt,ppc_crypt_ctr_partial
ppc_crypt_ctr_loop:
        mr              rKP,rKS
        START_KEY(rI0, rI1, rI2, rI3)
        bl              ppc_encrypt_block
        xor             rW0,rD0,rW0
        xor             rW1,rD1,rW1
        xor             rW2,rD2,rW2
        xor             rW3,rD3,rW3
        LOAD_DATA(rD0, 0)
        subi            rLN,rLN,16
        LOAD_DATA(rD1, 4)
        LOAD_DATA(rD2, 8)
        LOAD_DATA(rD3, 12)
        xor             rD0,rD0,rW0
        SAVE_DATA(rD0, 0)
        xor             rD1,rD1,rW1
        SAVE_DATA(rD1, 4)
        xor             rD2,rD2,rW2
        SAVE_DATA(rD2, 8)
        xor             rD3,rD3,rW3
        SAVE_DATA(rD3, 12)
        addic           rI3,rI3,1       /* increase counter                     */
        addze           rI2,rI2
        addze           rI1,rI1
        addze           rI0,rI0
        NEXT_BLOCK
        cmpwi           rLN,15
        bt              gt,ppc_crypt_ctr_loop
ppc_crypt_ctr_partial:
        cmpwi           rLN,0
        bt              eq,ppc_crypt_ctr_end
        mr              rKP,rKS
        START_KEY(rI0, rI1, rI2, rI3)
        bl              ppc_encrypt_block
        xor             rW0,rD0,rW0
        SAVE_IV(rW0, 0)
        xor             rW1,rD1,rW1
        SAVE_IV(rW1, 4)
        xor             rW2,rD2,rW2
        SAVE_IV(rW2, 8)
        xor             rW3,rD3,rW3
        SAVE_IV(rW3, 12)
        mtctr           rLN
        subi            rIP,rIP,CTR_DEC
        subi            rSP,rSP,1
        subi            rDP,rDP,1
ppc_crypt_ctr_xorbyte:
        lbzu            rW4,1(rIP)      /* bytewise xor for partial block       */
        lbzu            rW5,1(rSP)
        xor             rW4,rW4,rW5
        stbu            rW4,1(rDP)
        bdnz            ppc_crypt_ctr_xorbyte
        subf            rIP,rLN,rIP
        addi            rIP,rIP,1
        addic           rI3,rI3,1
        addze           rI2,rI2
        addze           rI1,rI1
        addze           rI0,rI0
ppc_crypt_ctr_end:
        SAVE_IV(rI0, 0)
        SAVE_IV(rI1, 4)
        SAVE_IV(rI2, 8)
        SAVE_IV(rI3, 12)
        FINALIZE_CRYPT(4)
        blr

/*
 * ppc_encrypt_xts(u8 *out, const u8 *in, u32 *key_enc,
 *                 u32 rounds, u32 bytes, u8 *iv, u32 *key_twk);
 *
 * called from glue layer to encrypt multiple blocks via XTS
 * If key_twk is given, the initial IV encryption will be
 * processed too. Round values are AES128 = 4, AES192 = 5,
 * AES256 = 6
 *
 */
_GLOBAL(ppc_encrypt_xts)
        INITIALIZE_CRYPT(PPC_AES_4K_ENCTAB, 8)
        LOAD_IV(rI0, 0)
        LOAD_IV(rI1, 4)
        LOAD_IV(rI2, 8)
        cmpwi           rKT,0
        LOAD_IV(rI3, 12)
        bt              eq,ppc_encrypt_xts_notweak
        mr              rKP,rKT
        START_KEY(rI0, rI1, rI2, rI3)
        bl              ppc_encrypt_block
        xor             rI0,rD0,rW0
        xor             rI1,rD1,rW1
        xor             rI2,rD2,rW2
        xor             rI3,rD3,rW3
ppc_encrypt_xts_notweak:
        ENDIAN_SWAP(rG0, rG1, rI0, rI1)
        ENDIAN_SWAP(rG2, rG3, rI2, rI3)
ppc_encrypt_xts_loop:
        LOAD_DATA(rD0, 0)
        mr              rKP,rKS
        LOAD_DATA(rD1, 4)
        subi            rLN,rLN,16
        LOAD_DATA(rD2, 8)
        LOAD_DATA(rD3, 12)
        xor             rD0,rD0,rI0
        xor             rD1,rD1,rI1
        xor             rD2,rD2,rI2
        xor             rD3,rD3,rI3
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_encrypt_block
        xor             rD0,rD0,rW0
        xor             rD1,rD1,rW1
        xor             rD2,rD2,rW2
        xor             rD3,rD3,rW3
        xor             rD0,rD0,rI0
        SAVE_DATA(rD0, 0)
        xor             rD1,rD1,rI1
        SAVE_DATA(rD1, 4)
        xor             rD2,rD2,rI2
        SAVE_DATA(rD2, 8)
        xor             rD3,rD3,rI3
        SAVE_DATA(rD3, 12)
        GF128_MUL(rG0, rG1, rG2, rG3, rW0)
        ENDIAN_SWAP(rI0, rI1, rG0, rG1)
        ENDIAN_SWAP(rI2, rI3, rG2, rG3)
        cmpwi           rLN,0
        NEXT_BLOCK
        bt              gt,ppc_encrypt_xts_loop
        START_IV
        SAVE_IV(rI0, 0)
        SAVE_IV(rI1, 4)
        SAVE_IV(rI2, 8)
        SAVE_IV(rI3, 12)
        FINALIZE_CRYPT(8)
        blr

/*
 * ppc_decrypt_xts(u8 *out, const u8 *in, u32 *key_dec,
 *                 u32 rounds, u32 blocks, u8 *iv, u32 *key_twk);
 *
 * called from glue layer to decrypt multiple blocks via XTS
 * If key_twk is given, the initial IV encryption will be
 * processed too. Round values are AES128 = 4, AES192 = 5,
 * AES256 = 6
 *
 */
_GLOBAL(ppc_decrypt_xts)
        INITIALIZE_CRYPT(PPC_AES_4K_DECTAB, 8)
        LOAD_IV(rI0, 0)
        addi            rT1,rT0,4096
        LOAD_IV(rI1, 4)
        LOAD_IV(rI2, 8)
        cmpwi           rKT,0
        LOAD_IV(rI3, 12)
        bt              eq,ppc_decrypt_xts_notweak
        subi            rT0,rT0,4096
        mr              rKP,rKT
        START_KEY(rI0, rI1, rI2, rI3)
        bl              ppc_encrypt_block
        xor             rI0,rD0,rW0
        xor             rI1,rD1,rW1
        xor             rI2,rD2,rW2
        xor             rI3,rD3,rW3
        addi            rT0,rT0,4096
ppc_decrypt_xts_notweak:
        ENDIAN_SWAP(rG0, rG1, rI0, rI1)
        ENDIAN_SWAP(rG2, rG3, rI2, rI3)
ppc_decrypt_xts_loop:
        LOAD_DATA(rD0, 0)
        mr              rKP,rKS
        LOAD_DATA(rD1, 4)
        subi            rLN,rLN,16
        LOAD_DATA(rD2, 8)
        LOAD_DATA(rD3, 12)
        xor             rD0,rD0,rI0
        xor             rD1,rD1,rI1
        xor             rD2,rD2,rI2
        xor             rD3,rD3,rI3
        START_KEY(rD0, rD1, rD2, rD3)
        bl              ppc_decrypt_block
        xor             rD0,rD0,rW0
        xor             rD1,rD1,rW1
        xor             rD2,rD2,rW2
        xor             rD3,rD3,rW3
        xor             rD0,rD0,rI0
        SAVE_DATA(rD0, 0)
        xor             rD1,rD1,rI1
        SAVE_DATA(rD1, 4)
        xor             rD2,rD2,rI2
        SAVE_DATA(rD2, 8)
        xor             rD3,rD3,rI3
        SAVE_DATA(rD3, 12)
        GF128_MUL(rG0, rG1, rG2, rG3, rW0)
        ENDIAN_SWAP(rI0, rI1, rG0, rG1)
        ENDIAN_SWAP(rI2, rI3, rG2, rG3)
        cmpwi           rLN,0
        NEXT_BLOCK
        bt              gt,ppc_decrypt_xts_loop
        START_IV
        SAVE_IV(rI0, 0)
        SAVE_IV(rI1, 4)
        SAVE_IV(rI2, 8)
        SAVE_IV(rI3, 12)
        FINALIZE_CRYPT(8)
        blr