51 	 * With 64-bit multiplicands and one term every 4 bits, there would be  in clmul64()
52 	 * up to 64 / 4 = 16 one bits per column when each multiplication is  in clmul64()
55 	 * fit in 4 bits.  Carries would sometimes overflow into the next term.  in clmul64()
58 	 * 5 x 5 = 25 multiplications instead of 4 x 4 = 16.  in clmul64()
60 	 * Instead, mask off 4 bits from one multiplicand, giving a max of 15  in clmul64()
61 	 * one bits per column.  Then handle those 4 bits separately.  in clmul64()
74 	u128 c0 = (a0 * (u128)b0) ^ (a1 * (u128)b3) ^  in clmul64()  local
83 	/* Multiply the low 4 bits of @a by @b. */  in clmul64()
92 	*out_lo = (((u64)c0) & 0x1111111111111111) ^  in clmul64()
96 	*out_hi = (((u64)(c0 >> 64)) & 0x1111111111111111) ^  in clmul64()
108 	 * With 32-bit multiplicands and one term every 4 bits, there are up to  in clmul32()
109 	 * 32 / 4 = 8 one bits per column when each multiplication is written  in clmul32()
111 	 * fits in 4 bits, so the carries don't overflow into the next term.  in clmul32()
123 	u64 c0 = (a0 * (u64)b0) ^ (a1 * (u64)b3) ^  in clmul32()  local
133 	return (c0 & 0x1111111111111111) ^  in clmul32()
161 	u64 c0, c1, c2, c3, mi0, mi1;  in polyval_mul_generic()  local
165 	 * the 256-bit product in @c0 (low) through @c3 (high).  in polyval_mul_generic()
167 	clmul64(le64_to_cpu(a->lo), le64_to_cpu(b->lo), &c0, &c1);  in polyval_mul_generic()
171 	mi0 ^= c0 ^ c2;  in polyval_mul_generic()
184 	 * First, add G(x) times c0 as follows:  in polyval_mul_generic()
186 	 * (c0, c1, c2) = (0,  in polyval_mul_generic()
187 	 *                 c1 + (c0 * (x^63 + x^62 + x^57) mod x^64),  in polyval_mul_generic()
188 	 *		   c2 + c0 + floor((c0 * (x^63 + x^62 + x^57)) / x^64))  in polyval_mul_generic()
190 	c1 ^= (c0 << 63) ^ (c0 << 62) ^ (c0 << 57);  in polyval_mul_generic()
191 	c2 ^= c0 ^ (c0 >> 1) ^ (c0 >> 2) ^ (c0 >> 7);  in polyval_mul_generic()