xref: /titanic_41/usr/src/common/crypto/aes/amd64/aesopt.h (revision 4b56a00321e0ce508e55cc5e43e3ad7b00005a39)
1 /*
2  * ---------------------------------------------------------------------------
3  * Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.
4  *
5  * LICENSE TERMS
6  *
7  * The free distribution and use of this software is allowed (with or without
8  * changes) provided that:
9  *
10  *  1. source code distributions include the above copyright notice, this
11  *	list of conditions and the following disclaimer;
12  *
13  *  2. binary distributions include the above copyright notice, this list
14  *	of conditions and the following disclaimer in their documentation;
15  *
16  *  3. the name of the copyright holder is not used to endorse products
17  *	built using this software without specific written permission.
18  *
19  * DISCLAIMER
20  *
21  * This software is provided 'as is' with no explicit or implied warranties
22  * in respect of its properties, including, but not limited to, correctness
23  * and/or fitness for purpose.
24  * ---------------------------------------------------------------------------
25  * Issue Date: 20/12/2007
26  *
27  * This file contains the compilation options for AES (Rijndael) and code
28  * that is common across encryption, key scheduling and table generation.
29  *
30  * OPERATION
31  *
32  * These source code files implement the AES algorithm Rijndael designed by
33  * Joan Daemen and Vincent Rijmen. This version is designed for the standard
34  * block size of 16 bytes and for key sizes of 128, 192 and 256 bits (16, 24
35  * and 32 bytes).
36  *
37  * This version is designed for flexibility and speed using operations on
38  * 32-bit words rather than operations on bytes.  It can be compiled with
39  * either big or little endian internal byte order but is faster when the
40  * native byte order for the processor is used.
41  *
42  * THE CIPHER INTERFACE
43  *
44  * The cipher interface is implemented as an array of bytes in which lower
45  * AES bit sequence indexes map to higher numeric significance within bytes.
46  */
47 
48 /*
49  * OpenSolaris changes
50  * 1. Added __cplusplus and _AESTAB_H header guards
51  * 2. Added header files sys/types.h and aes_impl.h
52  * 3. Added defines for AES_ENCRYPT, AES_DECRYPT, AES_REV_DKS, and ASM_AMD64_C
53  * 4. Moved defines for IS_BIG_ENDIAN, IS_LITTLE_ENDIAN, PLATFORM_BYTE_ORDER
54  *    from brg_endian.h
55  * 5. Undefined VIA_ACE_POSSIBLE and ASSUME_VIA_ACE_PRESENT
56  * 6. Changed uint_8t and uint_32t to uint8_t and uint32_t
57  * 7. Defined aes_sw32 as htonl() for byte swapping
58  * 8. Cstyled and hdrchk code
59  *
60  */
61 
62 #ifndef _AESOPT_H
63 #define	_AESOPT_H
64 
65 #ifdef	__cplusplus
66 extern "C" {
67 #endif
68 
69 #include <sys/types.h>
70 #include <sys/byteorder.h>
71 #include <aes_impl.h>
72 
73 /*  SUPPORT FEATURES */
74 #define	AES_ENCRYPT /* if support for encryption is needed */
75 #define	AES_DECRYPT /* if support for decryption is needed */
76 
77 /*  PLATFORM-SPECIFIC FEATURES */
78 #define	IS_BIG_ENDIAN		4321 /* byte 0 is most significant (mc68k) */
79 #define	IS_LITTLE_ENDIAN	1234 /* byte 0 is least significant (i386) */
80 #define	PLATFORM_BYTE_ORDER	IS_LITTLE_ENDIAN
81 #define	AES_REV_DKS /* define to reverse decryption key schedule */
82 
83 
84 /*
85  *  CONFIGURATION - THE USE OF DEFINES
86  *	Later in this section there are a number of defines that control the
87  *	operation of the code.  In each section, the purpose of each define is
88  *	explained so that the relevant form can be included or excluded by
89  *	setting either 1's or 0's respectively on the branches of the related
90  *	#if clauses.  The following local defines should not be changed.
91  */
92 
93 #define	ENCRYPTION_IN_C	1
94 #define	DECRYPTION_IN_C	2
95 #define	ENC_KEYING_IN_C	4
96 #define	DEC_KEYING_IN_C	8
97 
98 #define	NO_TABLES	0
99 #define	ONE_TABLE	1
100 #define	FOUR_TABLES	4
101 #define	NONE		0
102 #define	PARTIAL		1
103 #define	FULL		2
104 
105 /*  --- START OF USER CONFIGURED OPTIONS --- */
106 
107 /*
108  *  1. BYTE ORDER WITHIN 32 BIT WORDS
109  *
110  *	The fundamental data processing units in Rijndael are 8-bit bytes. The
111  *	input, output and key input are all enumerated arrays of bytes in which
112  *	bytes are numbered starting at zero and increasing to one less than the
113  *	number of bytes in the array in question. This enumeration is only used
114  *	for naming bytes and does not imply any adjacency or order relationship
115  *	from one byte to another. When these inputs and outputs are considered
116  *	as bit sequences, bits 8*n to 8*n+7 of the bit sequence are mapped to
117  *	byte[n] with bit 8n+i in the sequence mapped to bit 7-i within the byte.
118  *	In this implementation bits are numbered from 0 to 7 starting at the
119  *	numerically least significant end of each byte.  Bit n represents 2^n.
120  *
121  *	However, Rijndael can be implemented more efficiently using 32-bit
122  *	words by packing bytes into words so that bytes 4*n to 4*n+3 are placed
123  *	into word[n]. While in principle these bytes can be assembled into words
124  *	in any positions, this implementation only supports the two formats in
125  *	which bytes in adjacent positions within words also have adjacent byte
126  *	numbers. This order is called big-endian if the lowest numbered bytes
127  *	in words have the highest numeric significance and little-endian if the
128  *	opposite applies.
129  *
130  *	This code can work in either order irrespective of the order used by the
131  *	machine on which it runs. Normally the internal byte order will be set
132  *	to the order of the processor on which the code is to be run but this
133  *	define	can be used to reverse this in special situations
134  *
135  *	WARNING: Assembler code versions rely on PLATFORM_BYTE_ORDER being set.
136  *	This define will hence be redefined later (in section 4) if necessary
137  */
138 
139 #if 1
140 #define	ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
141 #elif 0
142 #define	ALGORITHM_BYTE_ORDER IS_LITTLE_ENDIAN
143 #elif 0
144 #define	ALGORITHM_BYTE_ORDER IS_BIG_ENDIAN
145 #else
146 #error The algorithm byte order is not defined
147 #endif
148 
149 /*  2. VIA ACE SUPPORT */
150 
151 #if defined(__GNUC__) && defined(__i386__) || \
152 	defined(_WIN32) && defined(_M_IX86) && \
153 	!(defined(_WIN64) || defined(_WIN32_WCE) || \
154 	defined(_MSC_VER) && (_MSC_VER <= 800))
155 #define	VIA_ACE_POSSIBLE
156 #endif
157 
158 /*
159  *  Define this option if support for the VIA ACE is required. This uses
160  *  inline assembler instructions and is only implemented for the Microsoft,
161  *  Intel and GCC compilers.  If VIA ACE is known to be present, then defining
162  *  ASSUME_VIA_ACE_PRESENT will remove the ordinary encryption/decryption
163  *  code.  If USE_VIA_ACE_IF_PRESENT is defined then VIA ACE will be used if
164  *  it is detected (both present and enabled) but the normal AES code will
165  *  also be present.
166  *
167  *  When VIA ACE is to be used, all AES encryption contexts MUST be 16 byte
168  *  aligned; other input/output buffers do not need to be 16 byte aligned
169  *  but there are very large performance gains if this can be arranged.
170  *  VIA ACE also requires the decryption key schedule to be in reverse
171  *  order (which later checks below ensure).
172  */
173 
174 /*  VIA ACE is not used here for OpenSolaris: */
175 #undef	VIA_ACE_POSSIBLE
176 #undef	ASSUME_VIA_ACE_PRESENT
177 
178 #if 0 && defined(VIA_ACE_POSSIBLE) && !defined(USE_VIA_ACE_IF_PRESENT)
179 #define	USE_VIA_ACE_IF_PRESENT
180 #endif
181 
182 #if 0 && defined(VIA_ACE_POSSIBLE) && !defined(ASSUME_VIA_ACE_PRESENT)
183 #define	ASSUME_VIA_ACE_PRESENT
184 #endif
185 
186 
187 /*
188  *  3. ASSEMBLER SUPPORT
189  *
190  *	This define (which can be on the command line) enables the use of the
191  *	assembler code routines for encryption, decryption and key scheduling
192  *	as follows:
193  *
194  *	ASM_X86_V1C uses the assembler (aes_x86_v1.asm) with large tables for
195  *		encryption and decryption and but with key scheduling in C
196  *	ASM_X86_V2  uses assembler (aes_x86_v2.asm) with compressed tables for
197  *		encryption, decryption and key scheduling
198  *	ASM_X86_V2C uses assembler (aes_x86_v2.asm) with compressed tables for
199  *		encryption and decryption and but with key scheduling in C
200  *	ASM_AMD64_C uses assembler (aes_amd64.asm) with compressed tables for
201  *		encryption and decryption and but with key scheduling in C
202  *
203  *	Change one 'if 0' below to 'if 1' to select the version or define
204  *	as a compilation option.
205  */
206 
207 #if 0 && !defined(ASM_X86_V1C)
208 #define	ASM_X86_V1C
209 #elif 0 && !defined(ASM_X86_V2)
210 #define	ASM_X86_V2
211 #elif 0 && !defined(ASM_X86_V2C)
212 #define	ASM_X86_V2C
213 #elif 1 && !defined(ASM_AMD64_C)
214 #define	ASM_AMD64_C
215 #endif
216 
217 #if (defined(ASM_X86_V1C) || defined(ASM_X86_V2) || defined(ASM_X86_V2C)) && \
218 	!defined(_M_IX86) || defined(ASM_AMD64_C) && !defined(_M_X64) && \
219 	!defined(__amd64)
220 #error Assembler code is only available for x86 and AMD64 systems
221 #endif
222 
223 /*
224  *  4. FAST INPUT/OUTPUT OPERATIONS.
225  *
226  *	On some machines it is possible to improve speed by transferring the
227  *	bytes in the input and output arrays to and from the internal 32-bit
228  *	variables by addressing these arrays as if they are arrays of 32-bit
229  *	words.  On some machines this will always be possible but there may
230  *	be a large performance penalty if the byte arrays are not aligned on
231  *	the normal word boundaries. On other machines this technique will
232  *	lead to memory access errors when such 32-bit word accesses are not
233  *	properly aligned. The option SAFE_IO avoids such problems but will
234  *	often be slower on those machines that support misaligned access
235  *	(especially so if care is taken to align the input  and output byte
236  *	arrays on 32-bit word boundaries). If SAFE_IO is not defined it is
237  *	assumed that access to byte arrays as if they are arrays of 32-bit
238  *	words will not cause problems when such accesses are misaligned.
239  */
240 #if 1 && !defined(_MSC_VER)
241 #define	SAFE_IO
242 #endif
243 
244 /*
245  *  5. LOOP UNROLLING
246  *
247  *	The code for encryption and decryption cycles through a number of rounds
248  *	that can be implemented either in a loop or by expanding the code into a
249  *	long sequence of instructions, the latter producing a larger program but
250  *	one that will often be much faster. The latter is called loop unrolling.
251  *	There are also potential speed advantages in expanding two iterations in
252  *	a loop with half the number of iterations, which is called partial loop
253  *	unrolling.  The following options allow partial or full loop unrolling
254  *	to be set independently for encryption and decryption
255  */
256 #if 1
257 #define	ENC_UNROLL  FULL
258 #elif 0
259 #define	ENC_UNROLL  PARTIAL
260 #else
261 #define	ENC_UNROLL  NONE
262 #endif
263 
264 #if 1
265 #define	DEC_UNROLL  FULL
266 #elif 0
267 #define	DEC_UNROLL  PARTIAL
268 #else
269 #define	DEC_UNROLL  NONE
270 #endif
271 
272 #if 1
273 #define	ENC_KS_UNROLL
274 #endif
275 
276 #if 1
277 #define	DEC_KS_UNROLL
278 #endif
279 
280 /*
281  *  6. FAST FINITE FIELD OPERATIONS
282  *
283  *	If this section is included, tables are used to provide faster finite
284  *	field arithmetic.  This has no effect if FIXED_TABLES is defined.
285  */
286 #if 1
287 #define	FF_TABLES
288 #endif
289 
290 /*
291  *  7. INTERNAL STATE VARIABLE FORMAT
292  *
293  *	The internal state of Rijndael is stored in a number of local 32-bit
294  *	word variables which can be defined either as an array or as individual
295  *	names variables. Include this section if you want to store these local
296  *	variables in arrays. Otherwise individual local variables will be used.
297  */
298 #if 1
299 #define	ARRAYS
300 #endif
301 
302 /*
303  *  8. FIXED OR DYNAMIC TABLES
304  *
305  *	When this section is included the tables used by the code are compiled
306  *	statically into the binary file.  Otherwise the subroutine aes_init()
307  *	must be called to compute them before the code is first used.
308  */
309 #if 1 && !(defined(_MSC_VER) && (_MSC_VER <= 800))
310 #define	FIXED_TABLES
311 #endif
312 
313 /*
314  *  9. MASKING OR CASTING FROM LONGER VALUES TO BYTES
315  *
316  *	In some systems it is better to mask longer values to extract bytes
317  *	rather than using a cast. This option allows this choice.
318  */
319 #if 0
320 #define	to_byte(x)  ((uint8_t)(x))
321 #else
322 #define	to_byte(x)  ((x) & 0xff)
323 #endif
324 
325 /*
326  *  10. TABLE ALIGNMENT
327  *
328  *	On some systems speed will be improved by aligning the AES large lookup
329  *	tables on particular boundaries. This define should be set to a power of
330  *	two giving the desired alignment. It can be left undefined if alignment
331  *	is not needed.  This option is specific to the Micrsoft VC++ compiler -
332  *	it seems to sometimes cause trouble for the VC++ version 6 compiler.
333  */
334 
335 #if 1 && defined(_MSC_VER) && (_MSC_VER >= 1300)
336 #define	TABLE_ALIGN 32
337 #endif
338 
339 /*
340  *  11.  REDUCE CODE AND TABLE SIZE
341  *
342  *	This replaces some expanded macros with function calls if AES_ASM_V2 or
343  *	AES_ASM_V2C are defined
344  */
345 
346 #if 1 && (defined(ASM_X86_V2) || defined(ASM_X86_V2C))
347 #define	REDUCE_CODE_SIZE
348 #endif
349 
350 /*
351  *  12. TABLE OPTIONS
352  *
353  *	This cipher proceeds by repeating in a number of cycles known as rounds
354  *	which are implemented by a round function which is optionally be speeded
355  *	up using tables.  The basic tables are 256 32-bit words, with either
356  *	one or four tables being required for each round function depending on
357  *	how much speed is required. Encryption and decryption round functions
358  *	are different and the last encryption and decryption round functions are
359  *	different again making four different round functions in all.
360  *
361  *	This means that:
362  *	1. Normal encryption and decryption rounds can each use either 0, 1
363  *		or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
364  *	2. The last encryption and decryption rounds can also use either 0, 1
365  *		or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
366  *
367  *	Include or exclude the appropriate definitions below to set the number
368  *	of tables used by this implementation.
369  */
370 
371 #if 1   /* set tables for the normal encryption round */
372 #define	ENC_ROUND   FOUR_TABLES
373 #elif 0
374 #define	ENC_ROUND   ONE_TABLE
375 #else
376 #define	ENC_ROUND   NO_TABLES
377 #endif
378 
379 #if 1   /* set tables for the last encryption round */
380 #define	LAST_ENC_ROUND  FOUR_TABLES
381 #elif 0
382 #define	LAST_ENC_ROUND  ONE_TABLE
383 #else
384 #define	LAST_ENC_ROUND  NO_TABLES
385 #endif
386 
387 #if 1   /* set tables for the normal decryption round */
388 #define	DEC_ROUND   FOUR_TABLES
389 #elif 0
390 #define	DEC_ROUND   ONE_TABLE
391 #else
392 #define	DEC_ROUND   NO_TABLES
393 #endif
394 
395 #if 1   /* set tables for the last decryption round */
396 #define	LAST_DEC_ROUND  FOUR_TABLES
397 #elif 0
398 #define	LAST_DEC_ROUND  ONE_TABLE
399 #else
400 #define	LAST_DEC_ROUND  NO_TABLES
401 #endif
402 
403 /*
404  *  The decryption key schedule can be speeded up with tables in the same
405  *	way that the round functions can.  Include or exclude the following
406  *	defines to set this requirement.
407  */
408 #if 1
409 #define	KEY_SCHED   FOUR_TABLES
410 #elif 0
411 #define	KEY_SCHED   ONE_TABLE
412 #else
413 #define	KEY_SCHED   NO_TABLES
414 #endif
415 
416 /*  ---- END OF USER CONFIGURED OPTIONS ---- */
417 
418 /* VIA ACE support is only available for VC++ and GCC */
419 
420 #if !defined(_MSC_VER) && !defined(__GNUC__)
421 #if defined(ASSUME_VIA_ACE_PRESENT)
422 #undef ASSUME_VIA_ACE_PRESENT
423 #endif
424 #if defined(USE_VIA_ACE_IF_PRESENT)
425 #undef USE_VIA_ACE_IF_PRESENT
426 #endif
427 #endif
428 
429 #if defined(ASSUME_VIA_ACE_PRESENT) && !defined(USE_VIA_ACE_IF_PRESENT)
430 #define	USE_VIA_ACE_IF_PRESENT
431 #endif
432 
433 #if defined(USE_VIA_ACE_IF_PRESENT) && !defined(AES_REV_DKS)
434 #define	AES_REV_DKS
435 #endif
436 
437 /* Assembler support requires the use of platform byte order */
438 
439 #if (defined(ASM_X86_V1C) || defined(ASM_X86_V2C) || defined(ASM_AMD64_C)) && \
440 	(ALGORITHM_BYTE_ORDER != PLATFORM_BYTE_ORDER)
441 #undef  ALGORITHM_BYTE_ORDER
442 #define	ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
443 #endif
444 
445 /*
446  * In this implementation the columns of the state array are each held in
447  *	32-bit words. The state array can be held in various ways: in an array
448  *	of words, in a number of individual word variables or in a number of
449  *	processor registers. The following define maps a variable name x and
450  *	a column number c to the way the state array variable is to be held.
451  *	The first define below maps the state into an array x[c] whereas the
452  *	second form maps the state into a number of individual variables x0,
453  *	x1, etc.  Another form could map individual state columns to machine
454  *	register names.
455  */
456 
457 #if defined(ARRAYS)
458 #define	s(x, c) x[c]
459 #else
460 #define	s(x, c) x##c
461 #endif
462 
463 /*
464  *  This implementation provides subroutines for encryption, decryption
465  *	and for setting the three key lengths (separately) for encryption
466  *	and decryption. Since not all functions are needed, masks are set
467  *	up here to determine which will be implemented in C
468  */
469 
470 #if !defined(AES_ENCRYPT)
471 #define	EFUNCS_IN_C   0
472 #elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
473 	defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
474 #define	EFUNCS_IN_C   ENC_KEYING_IN_C
475 #elif !defined(ASM_X86_V2)
476 #define	EFUNCS_IN_C   (ENCRYPTION_IN_C | ENC_KEYING_IN_C)
477 #else
478 #define	EFUNCS_IN_C   0
479 #endif
480 
481 #if !defined(AES_DECRYPT)
482 #define	DFUNCS_IN_C   0
483 #elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
484 	defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
485 #define	DFUNCS_IN_C   DEC_KEYING_IN_C
486 #elif !defined(ASM_X86_V2)
487 #define	DFUNCS_IN_C   (DECRYPTION_IN_C | DEC_KEYING_IN_C)
488 #else
489 #define	DFUNCS_IN_C   0
490 #endif
491 
492 #define	FUNCS_IN_C  (EFUNCS_IN_C | DFUNCS_IN_C)
493 
494 /* END OF CONFIGURATION OPTIONS */
495 
496 /* Disable or report errors on some combinations of options */
497 
498 #if ENC_ROUND == NO_TABLES && LAST_ENC_ROUND != NO_TABLES
499 #undef  LAST_ENC_ROUND
500 #define	LAST_ENC_ROUND  NO_TABLES
501 #elif ENC_ROUND == ONE_TABLE && LAST_ENC_ROUND == FOUR_TABLES
502 #undef  LAST_ENC_ROUND
503 #define	LAST_ENC_ROUND  ONE_TABLE
504 #endif
505 
506 #if ENC_ROUND == NO_TABLES && ENC_UNROLL != NONE
507 #undef  ENC_UNROLL
508 #define	ENC_UNROLL  NONE
509 #endif
510 
511 #if DEC_ROUND == NO_TABLES && LAST_DEC_ROUND != NO_TABLES
512 #undef  LAST_DEC_ROUND
513 #define	LAST_DEC_ROUND  NO_TABLES
514 #elif DEC_ROUND == ONE_TABLE && LAST_DEC_ROUND == FOUR_TABLES
515 #undef  LAST_DEC_ROUND
516 #define	LAST_DEC_ROUND  ONE_TABLE
517 #endif
518 
519 #if DEC_ROUND == NO_TABLES && DEC_UNROLL != NONE
520 #undef  DEC_UNROLL
521 #define	DEC_UNROLL  NONE
522 #endif
523 
524 #if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
525 #define	aes_sw32	htonl
526 #elif defined(bswap32)
527 #define	aes_sw32	bswap32
528 #elif defined(bswap_32)
529 #define	aes_sw32	bswap_32
530 #else
531 #define	brot(x, n)  (((uint32_t)(x) << (n)) | ((uint32_t)(x) >> (32 - (n))))
532 #define	aes_sw32(x) ((brot((x), 8) & 0x00ff00ff) | (brot((x), 24) & 0xff00ff00))
533 #endif
534 
535 
536 /*
537  *	upr(x, n):  rotates bytes within words by n positions, moving bytes to
538  *		higher index positions with wrap around into low positions
539  *	ups(x, n):  moves bytes by n positions to higher index positions in
540  *		words but without wrap around
541  *	bval(x, n): extracts a byte from a word
542  *
543  *	WARNING:   The definitions given here are intended only for use with
544  *		unsigned variables and with shift counts that are compile
545  *		time constants
546  */
547 
548 #if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
549 #define	upr(x, n)	(((uint32_t)(x) << (8 * (n))) | \
550 			((uint32_t)(x) >> (32 - 8 * (n))))
551 #define	ups(x, n)	((uint32_t)(x) << (8 * (n)))
552 #define	bval(x, n)	to_byte((x) >> (8 * (n)))
553 #define	bytes2word(b0, b1, b2, b3)  \
554 		(((uint32_t)(b3) << 24) | ((uint32_t)(b2) << 16) | \
555 		((uint32_t)(b1) << 8) | (b0))
556 #endif
557 
558 #if (ALGORITHM_BYTE_ORDER == IS_BIG_ENDIAN)
559 #define	upr(x, n)	(((uint32_t)(x) >> (8 * (n))) | \
560 			((uint32_t)(x) << (32 - 8 * (n))))
561 #define	ups(x, n)	((uint32_t)(x) >> (8 * (n)))
562 #define	bval(x, n)	to_byte((x) >> (24 - 8 * (n)))
563 #define	bytes2word(b0, b1, b2, b3)  \
564 		(((uint32_t)(b0) << 24) | ((uint32_t)(b1) << 16) | \
565 		((uint32_t)(b2) << 8) | (b3))
566 #endif
567 
568 #if defined(SAFE_IO)
569 #define	word_in(x, c)	bytes2word(((const uint8_t *)(x) + 4 * c)[0], \
570 				((const uint8_t *)(x) + 4 * c)[1], \
571 				((const uint8_t *)(x) + 4 * c)[2], \
572 				((const uint8_t *)(x) + 4 * c)[3])
573 #define	word_out(x, c, v) { ((uint8_t *)(x) + 4 * c)[0] = bval(v, 0); \
574 			((uint8_t *)(x) + 4 * c)[1] = bval(v, 1); \
575 			((uint8_t *)(x) + 4 * c)[2] = bval(v, 2); \
576 			((uint8_t *)(x) + 4 * c)[3] = bval(v, 3); }
577 #elif (ALGORITHM_BYTE_ORDER == PLATFORM_BYTE_ORDER)
578 #define	word_in(x, c)	(*((uint32_t *)(x) + (c)))
579 #define	word_out(x, c, v) (*((uint32_t *)(x) + (c)) = (v))
580 #else
581 #define	word_in(x, c)	aes_sw32(*((uint32_t *)(x) + (c)))
582 #define	word_out(x, c, v) (*((uint32_t *)(x) + (c)) = aes_sw32(v))
583 #endif
584 
585 /* the finite field modular polynomial and elements */
586 
587 #define	WPOLY   0x011b
588 #define	BPOLY	0x1b
589 
590 /* multiply four bytes in GF(2^8) by 'x' {02} in parallel */
591 
592 #define	m1  0x80808080
593 #define	m2  0x7f7f7f7f
594 #define	gf_mulx(x)  ((((x) & m2) << 1) ^ ((((x) & m1) >> 7) * BPOLY))
595 
596 /*
597  * The following defines provide alternative definitions of gf_mulx that might
598  * give improved performance if a fast 32-bit multiply is not available. Note
599  * that a temporary variable u needs to be defined where gf_mulx is used.
600  *
601  * #define	gf_mulx(x) (u = (x) & m1, u |= (u >> 1), ((x) & m2) << 1) ^ \
602  *			((u >> 3) | (u >> 6))
603  * #define	m4  (0x01010101 * BPOLY)
604  * #define	gf_mulx(x) (u = (x) & m1, ((x) & m2) << 1) ^ ((u - (u >> 7)) \
605  *			& m4)
606  */
607 
608 /* Work out which tables are needed for the different options   */
609 
610 #if defined(ASM_X86_V1C)
611 #if defined(ENC_ROUND)
612 #undef  ENC_ROUND
613 #endif
614 #define	ENC_ROUND   FOUR_TABLES
615 #if defined(LAST_ENC_ROUND)
616 #undef  LAST_ENC_ROUND
617 #endif
618 #define	LAST_ENC_ROUND  FOUR_TABLES
619 #if defined(DEC_ROUND)
620 #undef  DEC_ROUND
621 #endif
622 #define	DEC_ROUND   FOUR_TABLES
623 #if defined(LAST_DEC_ROUND)
624 #undef  LAST_DEC_ROUND
625 #endif
626 #define	LAST_DEC_ROUND  FOUR_TABLES
627 #if defined(KEY_SCHED)
628 #undef  KEY_SCHED
629 #define	KEY_SCHED   FOUR_TABLES
630 #endif
631 #endif
632 
633 #if (FUNCS_IN_C & ENCRYPTION_IN_C) || defined(ASM_X86_V1C)
634 #if ENC_ROUND == ONE_TABLE
635 #define	FT1_SET
636 #elif ENC_ROUND == FOUR_TABLES
637 #define	FT4_SET
638 #else
639 #define	SBX_SET
640 #endif
641 #if LAST_ENC_ROUND == ONE_TABLE
642 #define	FL1_SET
643 #elif LAST_ENC_ROUND == FOUR_TABLES
644 #define	FL4_SET
645 #elif !defined(SBX_SET)
646 #define	SBX_SET
647 #endif
648 #endif
649 
650 #if (FUNCS_IN_C & DECRYPTION_IN_C) || defined(ASM_X86_V1C)
651 #if DEC_ROUND == ONE_TABLE
652 #define	IT1_SET
653 #elif DEC_ROUND == FOUR_TABLES
654 #define	IT4_SET
655 #else
656 #define	ISB_SET
657 #endif
658 #if LAST_DEC_ROUND == ONE_TABLE
659 #define	IL1_SET
660 #elif LAST_DEC_ROUND == FOUR_TABLES
661 #define	IL4_SET
662 #elif !defined(ISB_SET)
663 #define	ISB_SET
664 #endif
665 #endif
666 
667 
668 #if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
669 	defined(ASM_X86_V2C)))
670 #if ((FUNCS_IN_C & ENC_KEYING_IN_C) || (FUNCS_IN_C & DEC_KEYING_IN_C))
671 #if KEY_SCHED == ONE_TABLE
672 #if !defined(FL1_SET) && !defined(FL4_SET)
673 #define	LS1_SET
674 #endif
675 #elif KEY_SCHED == FOUR_TABLES
676 #if !defined(FL4_SET)
677 #define	LS4_SET
678 #endif
679 #elif !defined(SBX_SET)
680 #define	SBX_SET
681 #endif
682 #endif
683 #if (FUNCS_IN_C & DEC_KEYING_IN_C)
684 #if KEY_SCHED == ONE_TABLE
685 #define	IM1_SET
686 #elif KEY_SCHED == FOUR_TABLES
687 #define	IM4_SET
688 #elif !defined(SBX_SET)
689 #define	SBX_SET
690 #endif
691 #endif
692 #endif
693 
694 /* generic definitions of Rijndael macros that use tables */
695 
696 #define	no_table(x, box, vf, rf, c) bytes2word(\
697 	box[bval(vf(x, 0, c), rf(0, c))], \
698 	box[bval(vf(x, 1, c), rf(1, c))], \
699 	box[bval(vf(x, 2, c), rf(2, c))], \
700 	box[bval(vf(x, 3, c), rf(3, c))])
701 
702 #define	one_table(x, op, tab, vf, rf, c) \
703 	(tab[bval(vf(x, 0, c), rf(0, c))] \
704 	^ op(tab[bval(vf(x, 1, c), rf(1, c))], 1) \
705 	^ op(tab[bval(vf(x, 2, c), rf(2, c))], 2) \
706 	^ op(tab[bval(vf(x, 3, c), rf(3, c))], 3))
707 
708 #define	four_tables(x, tab, vf, rf, c) \
709 	(tab[0][bval(vf(x, 0, c), rf(0, c))] \
710 	^ tab[1][bval(vf(x, 1, c), rf(1, c))] \
711 	^ tab[2][bval(vf(x, 2, c), rf(2, c))] \
712 	^ tab[3][bval(vf(x, 3, c), rf(3, c))])
713 
714 #define	vf1(x, r, c)	(x)
715 #define	rf1(r, c)	(r)
716 #define	rf2(r, c)	((8+r-c)&3)
717 
718 /*
719  * Perform forward and inverse column mix operation on four bytes in long word
720  * x in parallel. NOTE: x must be a simple variable, NOT an expression in
721  * these macros.
722  */
723 
724 #if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
725 	defined(ASM_X86_V2C)))
726 
727 #if defined(FM4_SET)	/* not currently used */
728 #define	fwd_mcol(x)	four_tables(x, t_use(f, m), vf1, rf1, 0)
729 #elif defined(FM1_SET)	/* not currently used */
730 #define	fwd_mcol(x)	one_table(x, upr, t_use(f, m), vf1, rf1, 0)
731 #else
732 #define	dec_fmvars	uint32_t g2
733 #define	fwd_mcol(x)	(g2 = gf_mulx(x), g2 ^ upr((x) ^ g2, 3) ^ \
734 				upr((x), 2) ^ upr((x), 1))
735 #endif
736 
737 #if defined(IM4_SET)
738 #define	inv_mcol(x)	four_tables(x, t_use(i, m), vf1, rf1, 0)
739 #elif defined(IM1_SET)
740 #define	inv_mcol(x)	one_table(x, upr, t_use(i, m), vf1, rf1, 0)
741 #else
742 #define	dec_imvars	uint32_t g2, g4, g9
743 #define	inv_mcol(x)	(g2 = gf_mulx(x), g4 = gf_mulx(g2), g9 = \
744 				(x) ^ gf_mulx(g4), g4 ^= g9, \
745 				(x) ^ g2 ^ g4 ^ upr(g2 ^ g9, 3) ^ \
746 				upr(g4, 2) ^ upr(g9, 1))
747 #endif
748 
749 #if defined(FL4_SET)
750 #define	ls_box(x, c)	four_tables(x, t_use(f, l), vf1, rf2, c)
751 #elif defined(LS4_SET)
752 #define	ls_box(x, c)	four_tables(x, t_use(l, s), vf1, rf2, c)
753 #elif defined(FL1_SET)
754 #define	ls_box(x, c)	one_table(x, upr, t_use(f, l), vf1, rf2, c)
755 #elif defined(LS1_SET)
756 #define	ls_box(x, c)	one_table(x, upr, t_use(l, s), vf1, rf2, c)
757 #else
758 #define	ls_box(x, c)	no_table(x, t_use(s, box), vf1, rf2, c)
759 #endif
760 
761 #endif
762 
763 #if defined(ASM_X86_V1C) && defined(AES_DECRYPT) && !defined(ISB_SET)
764 #define	ISB_SET
765 #endif
766 
767 #ifdef	__cplusplus
768 }
769 #endif
770 
771 #endif	/* _AESOPT_H */
772