1 /* gf128mul.c - GF(2^128) multiplication functions
17  ---------------------------------------------------------------------------
44  ---------------------------------------------------------------------------
92  * Given a value i in 0..255 as the byte overflow when a field element
94  * 16-bit value that must be XOR-ed into the low-degree end of the
98  * the "be" convention where the highest-order bit is the coefficient of
99  * the highest-degree polynomial term, and one for the "le" convention
100  * where the highest-order bit is the coefficient of the lowest-degree
101  * polynomial term.  In both cases the values are stored in CPU byte
107  * Therefore, provided that the appropriate byte endianness conversions
129 static const u16 gf128mul_table_le[256] = gf128mul_dat(xda_le);
130 static const u16 gf128mul_table_be[256] = gf128mul_dat(xda_be);
134  * the polynomial field representation.  They use 64-bit word operations
141 	u64 a = be64_to_cpu(x->a);  in gf128mul_x8_lle()
142 	u64 b = be64_to_cpu(x->b);  in gf128mul_x8_lle()
145 	x->b = cpu_to_be64((b >> 8) | (a << 56));  in gf128mul_x8_lle()
146 	x->a = cpu_to_be64((a >> 8) ^ (_tt << 48));  in gf128mul_x8_lle()
152 	u64 a = be64_to_cpu(x->a);  in gf128mul_x8_lle_ti()
153 	u64 b = be64_to_cpu(x->b);  in gf128mul_x8_lle_ti()
156 	x->b = cpu_to_be64((b >> 8) | (a << 56));  in gf128mul_x8_lle_ti()
157 	x->a = cpu_to_be64((a >> 8) ^ (_tt << 48));  in gf128mul_x8_lle_ti()
162 	u64 a = be64_to_cpu(x->a);  in gf128mul_x8_bbe()
163 	u64 b = be64_to_cpu(x->b);  in gf128mul_x8_bbe()
166 	x->a = cpu_to_be64((a << 8) | (b >> 56));  in gf128mul_x8_bbe()
167 	x->b = cpu_to_be64((b << 8) ^ _tt);  in gf128mul_x8_bbe()
172 	u64 a = le64_to_cpu(x->a);  in gf128mul_x8_ble()
173 	u64 b = le64_to_cpu(x->b);  in gf128mul_x8_ble()
176 	r->a = cpu_to_le64((a << 8) | (b >> 56));  in gf128mul_x8_ble()
177 	r->b = cpu_to_le64((b << 8) ^ _tt);  in gf128mul_x8_ble()
209 		u8 ch = ((u8 *)b)[15 - i];  in gf128mul_lle()
267     A 16 byte buffer has to be multiplied by a 16 byte key
269     the buffer's lowest byte, we can construct a table of
270     the 256 16 byte values that result from the 256 values
271     of this byte.  This requires 4096 bytes. But we also
276  * t[0][BYTE] contains g*BYTE
277  * t[1][BYTE] contains g*x^8*BYTE
279  * t[15][BYTE] contains g*x^120*BYTE */
290 		t->t[i] = kzalloc(sizeof(*t->t[i]), GFP_KERNEL);  in gf128mul_init_64k_bbe()
291 		if (!t->t[i]) {  in gf128mul_init_64k_bbe()
298 	t->t[0]->t[1] = *g;  in gf128mul_init_64k_bbe()
300 		gf128mul_x_bbe(&t->t[0]->t[j + j], &t->t[0]->t[j]);  in gf128mul_init_64k_bbe()
303 		for (j = 2; j < 256; j += j)  in gf128mul_init_64k_bbe()
305 				be128_xor(&t->t[i]->t[j + k],  in gf128mul_init_64k_bbe()
306 					  &t->t[i]->t[j], &t->t[i]->t[k]);  in gf128mul_init_64k_bbe()
312 			t->t[i]->t[j] = t->t[i - 1]->t[j];  in gf128mul_init_64k_bbe()
313 			gf128mul_x8_bbe(&t->t[i]->t[j]);  in gf128mul_init_64k_bbe()
327 		kfree_sensitive(t->t[i]);  in gf128mul_free_64k()
338 	*r = t->t[0]->t[ap[15]];  in gf128mul_64k_bbe()
340 		be128_xor(r, r, &t->t[i]->t[ap[15 - i]]);  in gf128mul_64k_bbe()
346     A 16 byte buffer has to be multiplied by a 16 byte key
348     single byte, we can construct a table of the 256 16 byte
349     values that result from the 256 values of this byte.
350     This requires 4096 bytes. If we take the highest byte in
353     next highest byte the result has to be multiplied by x^112
356     byte.  We repeatedly multiply the accumulator value by
358     lower byte in the buffer, stopping when we reach the
359     lowest byte. This requires a 4096 byte table.
370 	t->t[128] = *g;  in gf128mul_init_4k_lle()
372 		gf128mul_x_lle(&t->t[j], &t->t[j+j]);  in gf128mul_init_4k_lle()
374 	for (j = 2; j < 256; j += j)  in gf128mul_init_4k_lle()
376 			be128_xor(&t->t[j + k], &t->t[j], &t->t[k]);  in gf128mul_init_4k_lle()
392 	t->t[1] = *g;  in gf128mul_init_4k_bbe()
394 		gf128mul_x_bbe(&t->t[j + j], &t->t[j]);  in gf128mul_init_4k_bbe()
396 	for (j = 2; j < 256; j += j)  in gf128mul_init_4k_bbe()
398 			be128_xor(&t->t[j + k], &t->t[j], &t->t[k]);  in gf128mul_init_4k_bbe()
411 	*r = t->t[ap[15]];  in gf128mul_4k_lle()
412 	while (i--) {  in gf128mul_4k_lle()
414 		be128_xor(r, r, &t->t[ap[i]]);  in gf128mul_4k_lle()
426 	*r = t->t[ap[0]];  in gf128mul_4k_bbe()
429 		be128_xor(r, r, &t->t[ap[i]]);  in gf128mul_4k_bbe()