54 	 * Unfortunately, that doesn't work since the value 16 is 1 too large to  in clmul64()
74 	u128 c0 = (a0 * (u128)b0) ^ (a1 * (u128)b3) ^  in clmul64()  local
84 	u64 e0 = -(a & 1) & b;  in clmul64()
85 	u64 e1 = -((a >> 1) & 1) & b;  in clmul64()
86 	u64 e2 = -((a >> 2) & 1) & b;  in clmul64()
87 	u64 e3 = -((a >> 3) & 1) & b;  in clmul64()
88 	u64 extra_lo = e0 ^ (e1 << 1) ^ (e2 << 2) ^ (e3 << 3);  in clmul64()
92 	*out_lo = (((u64)c0) & 0x1111111111111111) ^  in clmul64()
96 	*out_hi = (((u64)(c0 >> 64)) & 0x1111111111111111) ^  in clmul64()
123 	u64 c0 = (a0 * (u64)b0) ^ (a1 * (u64)b3) ^  in clmul32()  local
133 	return (c0 & 0x1111111111111111) ^  in clmul32()
161 	u64 c0, c1, c2, c3, mi0, mi1;  in polyval_mul_generic()  local
165 	 * the 256-bit product in @c0 (low) through @c3 (high).  in polyval_mul_generic()
167 	clmul64(le64_to_cpu(a->lo), le64_to_cpu(b->lo), &c0, &c1);  in polyval_mul_generic()
171 	mi0 ^= c0 ^ c2;  in polyval_mul_generic()
178 	 * G(x) = x^128 + x^127 + x^126 + x^121 + 1.  Do this in two steps, each  in polyval_mul_generic()
180 	 * parts: 1, x^64 * (x^63 + x^62 + x^57), and x^128 * 1.  in polyval_mul_generic()
184 	 * First, add G(x) times c0 as follows:  in polyval_mul_generic()
186 	 * (c0, c1, c2) = (0,  in polyval_mul_generic()
187 	 *                 c1 + (c0 * (x^63 + x^62 + x^57) mod x^64),  in polyval_mul_generic()
188 	 *		   c2 + c0 + floor((c0 * (x^63 + x^62 + x^57)) / x^64))  in polyval_mul_generic()
190 	c1 ^= (c0 << 63) ^ (c0 << 62) ^ (c0 << 57);  in polyval_mul_generic()
191 	c2 ^= c0 ^ (c0 >> 1) ^ (c0 >> 2) ^ (c0 >> 7);  in polyval_mul_generic()
201 	c3 ^= c1 ^ (c1 >> 1) ^ (c1 >> 2) ^ (c1 >> 7);  in polyval_mul_generic()
235  * have H^1 stored somewhere in their struct).  Thus, the following dispatch
274 		data += len & ~(POLYVAL_BLOCK_SIZE - 1);  in polyval_update()
275 		len &= POLYVAL_BLOCK_SIZE - 1;  in polyval_update()