xref: /illumos-gate/usr/src/common/crypto/aes/aes_impl.c (revision 694c35faa87b858ecdadfe4fc592615f4eefbb07)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 #include <sys/types.h>
26 #include <sys/systm.h>
27 #include <sys/sysmacros.h>
28 #include <netinet/in.h>
29 #include "aes_impl.h"
30 #ifndef	_KERNEL
31 #include <strings.h>
32 #include <stdlib.h>
33 #endif	/* !_KERNEL */
34 
35 #ifdef __amd64
36 
37 #ifdef _KERNEL
38 #include <sys/cpuvar.h>		/* cpu_t, CPU */
39 #include <sys/x86_archext.h>	/* x86_featureset, X86FSET_AES */
40 #include <sys/disp.h>		/* kpreempt_disable(), kpreempt_enable */
41 
42 /* Workaround for no XMM kernel thread save/restore */
43 #define	KPREEMPT_DISABLE	kpreempt_disable()
44 #define	KPREEMPT_ENABLE		kpreempt_enable()
45 
46 #else
47 #include <sys/auxv.h>		/* getisax() */
48 #include <sys/auxv_386.h>	/* AV_386_AES bit */
49 #define	KPREEMPT_DISABLE
50 #define	KPREEMPT_ENABLE
51 #endif	/* _KERNEL */
52 #endif  /* __amd64 */
53 
54 
55 /*
56  * This file is derived from the file  rijndael-alg-fst.c  taken from the
57  * "optimized C code v3.0" on the "rijndael home page"
58  * http://www.iaik.tu-graz.ac.at/research/krypto/AES/old/~rijmen/rijndael/
59  * pointed by the NIST web-site http://csrc.nist.gov/archive/aes/
60  *
61  * The following note is from the original file:
62  */
63 
64 /*
65  * rijndael-alg-fst.c
66  *
67  * @version 3.0 (December 2000)
68  *
69  * Optimised ANSI C code for the Rijndael cipher (now AES)
70  *
71  * @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
72  * @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
73  * @author Paulo Barreto <paulo.barreto@terra.com.br>
74  *
75  * This code is hereby placed in the public domain.
76  *
77  * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
78  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
79  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
80  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
81  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
82  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
83  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
84  * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
85  * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
86  * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
87  * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
88  */
89 
90 #if defined(sun4u)
91 /* External assembly functions: */
92 extern void aes_encrypt_impl(const uint32_t rk[], int Nr, const uint32_t pt[4],
93 	uint32_t ct[4]);
94 extern void aes_decrypt_impl(const uint32_t rk[], int Nr, const uint32_t ct[4],
95 	uint32_t pt[4]);
96 
97 #define	AES_ENCRYPT_IMPL(a, b, c, d, e)	aes_encrypt_impl(a, b, c, d)
98 #define	AES_DECRYPT_IMPL(a, b, c, d, e)	aes_decrypt_impl(a, b, c, d)
99 
100 #elif defined(__amd64)
101 
102 /* These functions are used to execute amd64 instructions for AMD or Intel: */
103 extern int rijndael_key_setup_enc_amd64(uint32_t rk[],
104 	const uint32_t cipherKey[], int keyBits);
105 extern int rijndael_key_setup_dec_amd64(uint32_t rk[],
106 	const uint32_t cipherKey[], int keyBits);
107 extern void aes_encrypt_amd64(const uint32_t rk[], int Nr,
108 	const uint32_t pt[4], uint32_t ct[4]);
109 extern void aes_decrypt_amd64(const uint32_t rk[], int Nr,
110 	const uint32_t ct[4], uint32_t pt[4]);
111 
112 /* These functions are used to execute Intel-specific AES-NI instructions: */
113 extern int rijndael_key_setup_enc_intel(uint32_t rk[],
114 	const uint32_t cipherKey[], uint64_t keyBits);
115 extern int rijndael_key_setup_dec_intel(uint32_t rk[],
116 	const uint32_t cipherKey[], uint64_t keyBits);
117 extern void aes_encrypt_intel(const uint32_t rk[], int Nr,
118 	const uint32_t pt[4], uint32_t ct[4]);
119 extern void aes_decrypt_intel(const uint32_t rk[], int Nr,
120 	const uint32_t ct[4], uint32_t pt[4]);
121 
122 static int intel_aes_instructions_present(void);
123 
124 #define	AES_ENCRYPT_IMPL(a, b, c, d, e) rijndael_encrypt(a, b, c, d, e)
125 #define	AES_DECRYPT_IMPL(a, b, c, d, e) rijndael_decrypt(a, b, c, d, e)
126 
127 #else /* Generic C implementation */
128 
129 #define	AES_ENCRYPT_IMPL(a, b, c, d, e)	rijndael_encrypt(a, b, c, d)
130 #define	AES_DECRYPT_IMPL(a, b, c, d, e)	rijndael_decrypt(a, b, c, d)
131 #define	rijndael_key_setup_enc_raw	rijndael_key_setup_enc
132 #endif	/* sun4u || __amd64 */
133 
134 #if defined(_LITTLE_ENDIAN) && !defined(__amd64)
135 #define	AES_BYTE_SWAP
136 #endif
137 
138 
139 #if !defined(__amd64)
140 /*
141  *  Constant tables
142  */
143 
144 /*
145  * Te0[x] = S [x].[02, 01, 01, 03];
146  * Te1[x] = S [x].[03, 02, 01, 01];
147  * Te2[x] = S [x].[01, 03, 02, 01];
148  * Te3[x] = S [x].[01, 01, 03, 02];
149  * Te4[x] = S [x].[01, 01, 01, 01];
150  *
151  * Td0[x] = Si[x].[0e, 09, 0d, 0b];
152  * Td1[x] = Si[x].[0b, 0e, 09, 0d];
153  * Td2[x] = Si[x].[0d, 0b, 0e, 09];
154  * Td3[x] = Si[x].[09, 0d, 0b, 0e];
155  * Td4[x] = Si[x].[01, 01, 01, 01];
156  */
157 
158 /* Encrypt Sbox constants (for the substitute bytes operation) */
159 
160 #ifndef sun4u
161 
162 static const uint32_t Te0[256] =
163 {
164 	0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
165 	0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
166 	0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
167 	0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
168 	0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
169 	0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
170 	0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
171 	0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
172 	0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
173 	0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
174 	0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
175 	0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
176 	0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
177 	0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
178 	0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
179 	0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
180 	0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
181 	0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
182 	0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
183 	0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
184 	0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
185 	0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
186 	0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
187 	0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
188 	0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
189 	0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
190 	0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
191 	0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
192 	0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
193 	0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
194 	0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
195 	0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
196 	0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
197 	0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
198 	0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
199 	0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
200 	0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
201 	0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
202 	0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
203 	0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
204 	0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
205 	0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
206 	0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
207 	0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
208 	0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
209 	0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
210 	0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
211 	0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
212 	0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
213 	0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
214 	0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
215 	0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
216 	0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
217 	0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
218 	0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
219 	0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
220 	0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
221 	0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
222 	0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
223 	0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
224 	0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
225 	0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
226 	0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
227 	0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU
228 };
229 
230 
231 static const uint32_t Te1[256] =
232 {
233 	0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
234 	0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
235 	0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
236 	0x19e7fefeU, 0x62b5d7d7U, 0xe64dababU, 0x9aec7676U,
237 	0x458fcacaU, 0x9d1f8282U, 0x4089c9c9U, 0x87fa7d7dU,
238 	0x15effafaU, 0xebb25959U, 0xc98e4747U, 0x0bfbf0f0U,
239 	0xec41adadU, 0x67b3d4d4U, 0xfd5fa2a2U, 0xea45afafU,
240 	0xbf239c9cU, 0xf753a4a4U, 0x96e47272U, 0x5b9bc0c0U,
241 	0xc275b7b7U, 0x1ce1fdfdU, 0xae3d9393U, 0x6a4c2626U,
242 	0x5a6c3636U, 0x417e3f3fU, 0x02f5f7f7U, 0x4f83ccccU,
243 	0x5c683434U, 0xf451a5a5U, 0x34d1e5e5U, 0x08f9f1f1U,
244 	0x93e27171U, 0x73abd8d8U, 0x53623131U, 0x3f2a1515U,
245 	0x0c080404U, 0x5295c7c7U, 0x65462323U, 0x5e9dc3c3U,
246 	0x28301818U, 0xa1379696U, 0x0f0a0505U, 0xb52f9a9aU,
247 	0x090e0707U, 0x36241212U, 0x9b1b8080U, 0x3ddfe2e2U,
248 	0x26cdebebU, 0x694e2727U, 0xcd7fb2b2U, 0x9fea7575U,
249 	0x1b120909U, 0x9e1d8383U, 0x74582c2cU, 0x2e341a1aU,
250 	0x2d361b1bU, 0xb2dc6e6eU, 0xeeb45a5aU, 0xfb5ba0a0U,
251 	0xf6a45252U, 0x4d763b3bU, 0x61b7d6d6U, 0xce7db3b3U,
252 	0x7b522929U, 0x3edde3e3U, 0x715e2f2fU, 0x97138484U,
253 	0xf5a65353U, 0x68b9d1d1U, 0x00000000U, 0x2cc1ededU,
254 	0x60402020U, 0x1fe3fcfcU, 0xc879b1b1U, 0xedb65b5bU,
255 	0xbed46a6aU, 0x468dcbcbU, 0xd967bebeU, 0x4b723939U,
256 	0xde944a4aU, 0xd4984c4cU, 0xe8b05858U, 0x4a85cfcfU,
257 	0x6bbbd0d0U, 0x2ac5efefU, 0xe54faaaaU, 0x16edfbfbU,
258 	0xc5864343U, 0xd79a4d4dU, 0x55663333U, 0x94118585U,
259 	0xcf8a4545U, 0x10e9f9f9U, 0x06040202U, 0x81fe7f7fU,
260 	0xf0a05050U, 0x44783c3cU, 0xba259f9fU, 0xe34ba8a8U,
261 	0xf3a25151U, 0xfe5da3a3U, 0xc0804040U, 0x8a058f8fU,
262 	0xad3f9292U, 0xbc219d9dU, 0x48703838U, 0x04f1f5f5U,
263 	0xdf63bcbcU, 0xc177b6b6U, 0x75afdadaU, 0x63422121U,
264 	0x30201010U, 0x1ae5ffffU, 0x0efdf3f3U, 0x6dbfd2d2U,
265 	0x4c81cdcdU, 0x14180c0cU, 0x35261313U, 0x2fc3ececU,
266 	0xe1be5f5fU, 0xa2359797U, 0xcc884444U, 0x392e1717U,
267 	0x5793c4c4U, 0xf255a7a7U, 0x82fc7e7eU, 0x477a3d3dU,
268 	0xacc86464U, 0xe7ba5d5dU, 0x2b321919U, 0x95e67373U,
269 	0xa0c06060U, 0x98198181U, 0xd19e4f4fU, 0x7fa3dcdcU,
270 	0x66442222U, 0x7e542a2aU, 0xab3b9090U, 0x830b8888U,
271 	0xca8c4646U, 0x29c7eeeeU, 0xd36bb8b8U, 0x3c281414U,
272 	0x79a7dedeU, 0xe2bc5e5eU, 0x1d160b0bU, 0x76addbdbU,
273 	0x3bdbe0e0U, 0x56643232U, 0x4e743a3aU, 0x1e140a0aU,
274 	0xdb924949U, 0x0a0c0606U, 0x6c482424U, 0xe4b85c5cU,
275 	0x5d9fc2c2U, 0x6ebdd3d3U, 0xef43acacU, 0xa6c46262U,
276 	0xa8399191U, 0xa4319595U, 0x37d3e4e4U, 0x8bf27979U,
277 	0x32d5e7e7U, 0x438bc8c8U, 0x596e3737U, 0xb7da6d6dU,
278 	0x8c018d8dU, 0x64b1d5d5U, 0xd29c4e4eU, 0xe049a9a9U,
279 	0xb4d86c6cU, 0xfaac5656U, 0x07f3f4f4U, 0x25cfeaeaU,
280 	0xafca6565U, 0x8ef47a7aU, 0xe947aeaeU, 0x18100808U,
281 	0xd56fbabaU, 0x88f07878U, 0x6f4a2525U, 0x725c2e2eU,
282 	0x24381c1cU, 0xf157a6a6U, 0xc773b4b4U, 0x5197c6c6U,
283 	0x23cbe8e8U, 0x7ca1ddddU, 0x9ce87474U, 0x213e1f1fU,
284 	0xdd964b4bU, 0xdc61bdbdU, 0x860d8b8bU, 0x850f8a8aU,
285 	0x90e07070U, 0x427c3e3eU, 0xc471b5b5U, 0xaacc6666U,
286 	0xd8904848U, 0x05060303U, 0x01f7f6f6U, 0x121c0e0eU,
287 	0xa3c26161U, 0x5f6a3535U, 0xf9ae5757U, 0xd069b9b9U,
288 	0x91178686U, 0x5899c1c1U, 0x273a1d1dU, 0xb9279e9eU,
289 	0x38d9e1e1U, 0x13ebf8f8U, 0xb32b9898U, 0x33221111U,
290 	0xbbd26969U, 0x70a9d9d9U, 0x89078e8eU, 0xa7339494U,
291 	0xb62d9b9bU, 0x223c1e1eU, 0x92158787U, 0x20c9e9e9U,
292 	0x4987ceceU, 0xffaa5555U, 0x78502828U, 0x7aa5dfdfU,
293 	0x8f038c8cU, 0xf859a1a1U, 0x80098989U, 0x171a0d0dU,
294 	0xda65bfbfU, 0x31d7e6e6U, 0xc6844242U, 0xb8d06868U,
295 	0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
296 	0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U
297 };
298 
299 
300 static const uint32_t Te2[256] =
301 {
302 	0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
303 	0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
304 	0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
305 	0xfe19e7feU, 0xd762b5d7U, 0xabe64dabU, 0x769aec76U,
306 	0xca458fcaU, 0x829d1f82U, 0xc94089c9U, 0x7d87fa7dU,
307 	0xfa15effaU, 0x59ebb259U, 0x47c98e47U, 0xf00bfbf0U,
308 	0xadec41adU, 0xd467b3d4U, 0xa2fd5fa2U, 0xafea45afU,
309 	0x9cbf239cU, 0xa4f753a4U, 0x7296e472U, 0xc05b9bc0U,
310 	0xb7c275b7U, 0xfd1ce1fdU, 0x93ae3d93U, 0x266a4c26U,
311 	0x365a6c36U, 0x3f417e3fU, 0xf702f5f7U, 0xcc4f83ccU,
312 	0x345c6834U, 0xa5f451a5U, 0xe534d1e5U, 0xf108f9f1U,
313 	0x7193e271U, 0xd873abd8U, 0x31536231U, 0x153f2a15U,
314 	0x040c0804U, 0xc75295c7U, 0x23654623U, 0xc35e9dc3U,
315 	0x18283018U, 0x96a13796U, 0x050f0a05U, 0x9ab52f9aU,
316 	0x07090e07U, 0x12362412U, 0x809b1b80U, 0xe23ddfe2U,
317 	0xeb26cdebU, 0x27694e27U, 0xb2cd7fb2U, 0x759fea75U,
318 	0x091b1209U, 0x839e1d83U, 0x2c74582cU, 0x1a2e341aU,
319 	0x1b2d361bU, 0x6eb2dc6eU, 0x5aeeb45aU, 0xa0fb5ba0U,
320 	0x52f6a452U, 0x3b4d763bU, 0xd661b7d6U, 0xb3ce7db3U,
321 	0x297b5229U, 0xe33edde3U, 0x2f715e2fU, 0x84971384U,
322 	0x53f5a653U, 0xd168b9d1U, 0x00000000U, 0xed2cc1edU,
323 	0x20604020U, 0xfc1fe3fcU, 0xb1c879b1U, 0x5bedb65bU,
324 	0x6abed46aU, 0xcb468dcbU, 0xbed967beU, 0x394b7239U,
325 	0x4ade944aU, 0x4cd4984cU, 0x58e8b058U, 0xcf4a85cfU,
326 	0xd06bbbd0U, 0xef2ac5efU, 0xaae54faaU, 0xfb16edfbU,
327 	0x43c58643U, 0x4dd79a4dU, 0x33556633U, 0x85941185U,
328 	0x45cf8a45U, 0xf910e9f9U, 0x02060402U, 0x7f81fe7fU,
329 	0x50f0a050U, 0x3c44783cU, 0x9fba259fU, 0xa8e34ba8U,
330 	0x51f3a251U, 0xa3fe5da3U, 0x40c08040U, 0x8f8a058fU,
331 	0x92ad3f92U, 0x9dbc219dU, 0x38487038U, 0xf504f1f5U,
332 	0xbcdf63bcU, 0xb6c177b6U, 0xda75afdaU, 0x21634221U,
333 	0x10302010U, 0xff1ae5ffU, 0xf30efdf3U, 0xd26dbfd2U,
334 	0xcd4c81cdU, 0x0c14180cU, 0x13352613U, 0xec2fc3ecU,
335 	0x5fe1be5fU, 0x97a23597U, 0x44cc8844U, 0x17392e17U,
336 	0xc45793c4U, 0xa7f255a7U, 0x7e82fc7eU, 0x3d477a3dU,
337 	0x64acc864U, 0x5de7ba5dU, 0x192b3219U, 0x7395e673U,
338 	0x60a0c060U, 0x81981981U, 0x4fd19e4fU, 0xdc7fa3dcU,
339 	0x22664422U, 0x2a7e542aU, 0x90ab3b90U, 0x88830b88U,
340 	0x46ca8c46U, 0xee29c7eeU, 0xb8d36bb8U, 0x143c2814U,
341 	0xde79a7deU, 0x5ee2bc5eU, 0x0b1d160bU, 0xdb76addbU,
342 	0xe03bdbe0U, 0x32566432U, 0x3a4e743aU, 0x0a1e140aU,
343 	0x49db9249U, 0x060a0c06U, 0x246c4824U, 0x5ce4b85cU,
344 	0xc25d9fc2U, 0xd36ebdd3U, 0xacef43acU, 0x62a6c462U,
345 	0x91a83991U, 0x95a43195U, 0xe437d3e4U, 0x798bf279U,
346 	0xe732d5e7U, 0xc8438bc8U, 0x37596e37U, 0x6db7da6dU,
347 	0x8d8c018dU, 0xd564b1d5U, 0x4ed29c4eU, 0xa9e049a9U,
348 	0x6cb4d86cU, 0x56faac56U, 0xf407f3f4U, 0xea25cfeaU,
349 	0x65afca65U, 0x7a8ef47aU, 0xaee947aeU, 0x08181008U,
350 	0xbad56fbaU, 0x7888f078U, 0x256f4a25U, 0x2e725c2eU,
351 	0x1c24381cU, 0xa6f157a6U, 0xb4c773b4U, 0xc65197c6U,
352 	0xe823cbe8U, 0xdd7ca1ddU, 0x749ce874U, 0x1f213e1fU,
353 	0x4bdd964bU, 0xbddc61bdU, 0x8b860d8bU, 0x8a850f8aU,
354 	0x7090e070U, 0x3e427c3eU, 0xb5c471b5U, 0x66aacc66U,
355 	0x48d89048U, 0x03050603U, 0xf601f7f6U, 0x0e121c0eU,
356 	0x61a3c261U, 0x355f6a35U, 0x57f9ae57U, 0xb9d069b9U,
357 	0x86911786U, 0xc15899c1U, 0x1d273a1dU, 0x9eb9279eU,
358 	0xe138d9e1U, 0xf813ebf8U, 0x98b32b98U, 0x11332211U,
359 	0x69bbd269U, 0xd970a9d9U, 0x8e89078eU, 0x94a73394U,
360 	0x9bb62d9bU, 0x1e223c1eU, 0x87921587U, 0xe920c9e9U,
361 	0xce4987ceU, 0x55ffaa55U, 0x28785028U, 0xdf7aa5dfU,
362 	0x8c8f038cU, 0xa1f859a1U, 0x89800989U, 0x0d171a0dU,
363 	0xbfda65bfU, 0xe631d7e6U, 0x42c68442U, 0x68b8d068U,
364 	0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
365 	0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U
366 };
367 
368 
369 static const uint32_t Te3[256] =
370 {
371 	0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
372 	0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
373 	0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
374 	0xfefe19e7U, 0xd7d762b5U, 0xababe64dU, 0x76769aecU,
375 	0xcaca458fU, 0x82829d1fU, 0xc9c94089U, 0x7d7d87faU,
376 	0xfafa15efU, 0x5959ebb2U, 0x4747c98eU, 0xf0f00bfbU,
377 	0xadadec41U, 0xd4d467b3U, 0xa2a2fd5fU, 0xafafea45U,
378 	0x9c9cbf23U, 0xa4a4f753U, 0x727296e4U, 0xc0c05b9bU,
379 	0xb7b7c275U, 0xfdfd1ce1U, 0x9393ae3dU, 0x26266a4cU,
380 	0x36365a6cU, 0x3f3f417eU, 0xf7f702f5U, 0xcccc4f83U,
381 	0x34345c68U, 0xa5a5f451U, 0xe5e534d1U, 0xf1f108f9U,
382 	0x717193e2U, 0xd8d873abU, 0x31315362U, 0x15153f2aU,
383 	0x04040c08U, 0xc7c75295U, 0x23236546U, 0xc3c35e9dU,
384 	0x18182830U, 0x9696a137U, 0x05050f0aU, 0x9a9ab52fU,
385 	0x0707090eU, 0x12123624U, 0x80809b1bU, 0xe2e23ddfU,
386 	0xebeb26cdU, 0x2727694eU, 0xb2b2cd7fU, 0x75759feaU,
387 	0x09091b12U, 0x83839e1dU, 0x2c2c7458U, 0x1a1a2e34U,
388 	0x1b1b2d36U, 0x6e6eb2dcU, 0x5a5aeeb4U, 0xa0a0fb5bU,
389 	0x5252f6a4U, 0x3b3b4d76U, 0xd6d661b7U, 0xb3b3ce7dU,
390 	0x29297b52U, 0xe3e33eddU, 0x2f2f715eU, 0x84849713U,
391 	0x5353f5a6U, 0xd1d168b9U, 0x00000000U, 0xeded2cc1U,
392 	0x20206040U, 0xfcfc1fe3U, 0xb1b1c879U, 0x5b5bedb6U,
393 	0x6a6abed4U, 0xcbcb468dU, 0xbebed967U, 0x39394b72U,
394 	0x4a4ade94U, 0x4c4cd498U, 0x5858e8b0U, 0xcfcf4a85U,
395 	0xd0d06bbbU, 0xefef2ac5U, 0xaaaae54fU, 0xfbfb16edU,
396 	0x4343c586U, 0x4d4dd79aU, 0x33335566U, 0x85859411U,
397 	0x4545cf8aU, 0xf9f910e9U, 0x02020604U, 0x7f7f81feU,
398 	0x5050f0a0U, 0x3c3c4478U, 0x9f9fba25U, 0xa8a8e34bU,
399 	0x5151f3a2U, 0xa3a3fe5dU, 0x4040c080U, 0x8f8f8a05U,
400 	0x9292ad3fU, 0x9d9dbc21U, 0x38384870U, 0xf5f504f1U,
401 	0xbcbcdf63U, 0xb6b6c177U, 0xdada75afU, 0x21216342U,
402 	0x10103020U, 0xffff1ae5U, 0xf3f30efdU, 0xd2d26dbfU,
403 	0xcdcd4c81U, 0x0c0c1418U, 0x13133526U, 0xecec2fc3U,
404 	0x5f5fe1beU, 0x9797a235U, 0x4444cc88U, 0x1717392eU,
405 	0xc4c45793U, 0xa7a7f255U, 0x7e7e82fcU, 0x3d3d477aU,
406 	0x6464acc8U, 0x5d5de7baU, 0x19192b32U, 0x737395e6U,
407 	0x6060a0c0U, 0x81819819U, 0x4f4fd19eU, 0xdcdc7fa3U,
408 	0x22226644U, 0x2a2a7e54U, 0x9090ab3bU, 0x8888830bU,
409 	0x4646ca8cU, 0xeeee29c7U, 0xb8b8d36bU, 0x14143c28U,
410 	0xdede79a7U, 0x5e5ee2bcU, 0x0b0b1d16U, 0xdbdb76adU,
411 	0xe0e03bdbU, 0x32325664U, 0x3a3a4e74U, 0x0a0a1e14U,
412 	0x4949db92U, 0x06060a0cU, 0x24246c48U, 0x5c5ce4b8U,
413 	0xc2c25d9fU, 0xd3d36ebdU, 0xacacef43U, 0x6262a6c4U,
414 	0x9191a839U, 0x9595a431U, 0xe4e437d3U, 0x79798bf2U,
415 	0xe7e732d5U, 0xc8c8438bU, 0x3737596eU, 0x6d6db7daU,
416 	0x8d8d8c01U, 0xd5d564b1U, 0x4e4ed29cU, 0xa9a9e049U,
417 	0x6c6cb4d8U, 0x5656faacU, 0xf4f407f3U, 0xeaea25cfU,
418 	0x6565afcaU, 0x7a7a8ef4U, 0xaeaee947U, 0x08081810U,
419 	0xbabad56fU, 0x787888f0U, 0x25256f4aU, 0x2e2e725cU,
420 	0x1c1c2438U, 0xa6a6f157U, 0xb4b4c773U, 0xc6c65197U,
421 	0xe8e823cbU, 0xdddd7ca1U, 0x74749ce8U, 0x1f1f213eU,
422 	0x4b4bdd96U, 0xbdbddc61U, 0x8b8b860dU, 0x8a8a850fU,
423 	0x707090e0U, 0x3e3e427cU, 0xb5b5c471U, 0x6666aaccU,
424 	0x4848d890U, 0x03030506U, 0xf6f601f7U, 0x0e0e121cU,
425 	0x6161a3c2U, 0x35355f6aU, 0x5757f9aeU, 0xb9b9d069U,
426 	0x86869117U, 0xc1c15899U, 0x1d1d273aU, 0x9e9eb927U,
427 	0xe1e138d9U, 0xf8f813ebU, 0x9898b32bU, 0x11113322U,
428 	0x6969bbd2U, 0xd9d970a9U, 0x8e8e8907U, 0x9494a733U,
429 	0x9b9bb62dU, 0x1e1e223cU, 0x87879215U, 0xe9e920c9U,
430 	0xcece4987U, 0x5555ffaaU, 0x28287850U, 0xdfdf7aa5U,
431 	0x8c8c8f03U, 0xa1a1f859U, 0x89898009U, 0x0d0d171aU,
432 	0xbfbfda65U, 0xe6e631d7U, 0x4242c684U, 0x6868b8d0U,
433 	0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
434 	0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU
435 };
436 
437 #endif /* !sun4u */
438 
439 static const uint32_t Te4[256] =
440 {
441 	0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
442 	0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
443 	0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
444 	0xfefefefeU, 0xd7d7d7d7U, 0xababababU, 0x76767676U,
445 	0xcacacacaU, 0x82828282U, 0xc9c9c9c9U, 0x7d7d7d7dU,
446 	0xfafafafaU, 0x59595959U, 0x47474747U, 0xf0f0f0f0U,
447 	0xadadadadU, 0xd4d4d4d4U, 0xa2a2a2a2U, 0xafafafafU,
448 	0x9c9c9c9cU, 0xa4a4a4a4U, 0x72727272U, 0xc0c0c0c0U,
449 	0xb7b7b7b7U, 0xfdfdfdfdU, 0x93939393U, 0x26262626U,
450 	0x36363636U, 0x3f3f3f3fU, 0xf7f7f7f7U, 0xccccccccU,
451 	0x34343434U, 0xa5a5a5a5U, 0xe5e5e5e5U, 0xf1f1f1f1U,
452 	0x71717171U, 0xd8d8d8d8U, 0x31313131U, 0x15151515U,
453 	0x04040404U, 0xc7c7c7c7U, 0x23232323U, 0xc3c3c3c3U,
454 	0x18181818U, 0x96969696U, 0x05050505U, 0x9a9a9a9aU,
455 	0x07070707U, 0x12121212U, 0x80808080U, 0xe2e2e2e2U,
456 	0xebebebebU, 0x27272727U, 0xb2b2b2b2U, 0x75757575U,
457 	0x09090909U, 0x83838383U, 0x2c2c2c2cU, 0x1a1a1a1aU,
458 	0x1b1b1b1bU, 0x6e6e6e6eU, 0x5a5a5a5aU, 0xa0a0a0a0U,
459 	0x52525252U, 0x3b3b3b3bU, 0xd6d6d6d6U, 0xb3b3b3b3U,
460 	0x29292929U, 0xe3e3e3e3U, 0x2f2f2f2fU, 0x84848484U,
461 	0x53535353U, 0xd1d1d1d1U, 0x00000000U, 0xededededU,
462 	0x20202020U, 0xfcfcfcfcU, 0xb1b1b1b1U, 0x5b5b5b5bU,
463 	0x6a6a6a6aU, 0xcbcbcbcbU, 0xbebebebeU, 0x39393939U,
464 	0x4a4a4a4aU, 0x4c4c4c4cU, 0x58585858U, 0xcfcfcfcfU,
465 	0xd0d0d0d0U, 0xefefefefU, 0xaaaaaaaaU, 0xfbfbfbfbU,
466 	0x43434343U, 0x4d4d4d4dU, 0x33333333U, 0x85858585U,
467 	0x45454545U, 0xf9f9f9f9U, 0x02020202U, 0x7f7f7f7fU,
468 	0x50505050U, 0x3c3c3c3cU, 0x9f9f9f9fU, 0xa8a8a8a8U,
469 	0x51515151U, 0xa3a3a3a3U, 0x40404040U, 0x8f8f8f8fU,
470 	0x92929292U, 0x9d9d9d9dU, 0x38383838U, 0xf5f5f5f5U,
471 	0xbcbcbcbcU, 0xb6b6b6b6U, 0xdadadadaU, 0x21212121U,
472 	0x10101010U, 0xffffffffU, 0xf3f3f3f3U, 0xd2d2d2d2U,
473 	0xcdcdcdcdU, 0x0c0c0c0cU, 0x13131313U, 0xececececU,
474 	0x5f5f5f5fU, 0x97979797U, 0x44444444U, 0x17171717U,
475 	0xc4c4c4c4U, 0xa7a7a7a7U, 0x7e7e7e7eU, 0x3d3d3d3dU,
476 	0x64646464U, 0x5d5d5d5dU, 0x19191919U, 0x73737373U,
477 	0x60606060U, 0x81818181U, 0x4f4f4f4fU, 0xdcdcdcdcU,
478 	0x22222222U, 0x2a2a2a2aU, 0x90909090U, 0x88888888U,
479 	0x46464646U, 0xeeeeeeeeU, 0xb8b8b8b8U, 0x14141414U,
480 	0xdedededeU, 0x5e5e5e5eU, 0x0b0b0b0bU, 0xdbdbdbdbU,
481 	0xe0e0e0e0U, 0x32323232U, 0x3a3a3a3aU, 0x0a0a0a0aU,
482 	0x49494949U, 0x06060606U, 0x24242424U, 0x5c5c5c5cU,
483 	0xc2c2c2c2U, 0xd3d3d3d3U, 0xacacacacU, 0x62626262U,
484 	0x91919191U, 0x95959595U, 0xe4e4e4e4U, 0x79797979U,
485 	0xe7e7e7e7U, 0xc8c8c8c8U, 0x37373737U, 0x6d6d6d6dU,
486 	0x8d8d8d8dU, 0xd5d5d5d5U, 0x4e4e4e4eU, 0xa9a9a9a9U,
487 	0x6c6c6c6cU, 0x56565656U, 0xf4f4f4f4U, 0xeaeaeaeaU,
488 	0x65656565U, 0x7a7a7a7aU, 0xaeaeaeaeU, 0x08080808U,
489 	0xbabababaU, 0x78787878U, 0x25252525U, 0x2e2e2e2eU,
490 	0x1c1c1c1cU, 0xa6a6a6a6U, 0xb4b4b4b4U, 0xc6c6c6c6U,
491 	0xe8e8e8e8U, 0xddddddddU, 0x74747474U, 0x1f1f1f1fU,
492 	0x4b4b4b4bU, 0xbdbdbdbdU, 0x8b8b8b8bU, 0x8a8a8a8aU,
493 	0x70707070U, 0x3e3e3e3eU, 0xb5b5b5b5U, 0x66666666U,
494 	0x48484848U, 0x03030303U, 0xf6f6f6f6U, 0x0e0e0e0eU,
495 	0x61616161U, 0x35353535U, 0x57575757U, 0xb9b9b9b9U,
496 	0x86868686U, 0xc1c1c1c1U, 0x1d1d1d1dU, 0x9e9e9e9eU,
497 	0xe1e1e1e1U, 0xf8f8f8f8U, 0x98989898U, 0x11111111U,
498 	0x69696969U, 0xd9d9d9d9U, 0x8e8e8e8eU, 0x94949494U,
499 	0x9b9b9b9bU, 0x1e1e1e1eU, 0x87878787U, 0xe9e9e9e9U,
500 	0xcecececeU, 0x55555555U, 0x28282828U, 0xdfdfdfdfU,
501 	0x8c8c8c8cU, 0xa1a1a1a1U, 0x89898989U, 0x0d0d0d0dU,
502 	0xbfbfbfbfU, 0xe6e6e6e6U, 0x42424242U, 0x68686868U,
503 	0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
504 	0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U
505 };
506 
507 /* Decrypt Sbox constants (for the substitute bytes operation) */
508 
509 static const uint32_t Td0[256] =
510 {
511 	0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
512 	0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
513 	0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
514 	0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
515 	0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
516 	0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
517 	0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
518 	0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
519 	0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
520 	0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
521 	0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
522 	0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
523 	0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
524 	0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
525 	0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
526 	0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
527 	0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
528 	0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
529 	0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
530 	0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
531 	0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
532 	0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
533 	0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
534 	0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
535 	0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
536 	0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
537 	0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
538 	0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
539 	0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
540 	0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
541 	0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
542 	0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
543 	0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
544 	0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
545 	0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
546 	0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
547 	0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
548 	0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
549 	0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
550 	0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
551 	0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
552 	0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
553 	0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
554 	0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
555 	0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
556 	0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
557 	0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
558 	0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
559 	0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
560 	0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
561 	0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
562 	0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
563 	0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
564 	0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
565 	0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
566 	0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
567 	0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
568 	0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
569 	0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
570 	0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
571 	0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
572 	0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
573 	0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
574 	0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U
575 };
576 
577 static const uint32_t Td1[256] =
578 {
579 	0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
580 	0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
581 	0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
582 	0xfc4fe5d7U, 0xd7c52acbU, 0x80263544U, 0x8fb562a3U,
583 	0x49deb15aU, 0x6725ba1bU, 0x9845ea0eU, 0xe15dfec0U,
584 	0x02c32f75U, 0x12814cf0U, 0xa38d4697U, 0xc66bd3f9U,
585 	0xe7038f5fU, 0x9515929cU, 0xebbf6d7aU, 0xda955259U,
586 	0x2dd4be83U, 0xd3587421U, 0x2949e069U, 0x448ec9c8U,
587 	0x6a75c289U, 0x78f48e79U, 0x6b99583eU, 0xdd27b971U,
588 	0xb6bee14fU, 0x17f088adU, 0x66c920acU, 0xb47dce3aU,
589 	0x1863df4aU, 0x82e51a31U, 0x60975133U, 0x4562537fU,
590 	0xe0b16477U, 0x84bb6baeU, 0x1cfe81a0U, 0x94f9082bU,
591 	0x58704868U, 0x198f45fdU, 0x8794de6cU, 0xb7527bf8U,
592 	0x23ab73d3U, 0xe2724b02U, 0x57e31f8fU, 0x2a6655abU,
593 	0x07b2eb28U, 0x032fb5c2U, 0x9a86c57bU, 0xa5d33708U,
594 	0xf2302887U, 0xb223bfa5U, 0xba02036aU, 0x5ced1682U,
595 	0x2b8acf1cU, 0x92a779b4U, 0xf0f307f2U, 0xa14e69e2U,
596 	0xcd65daf4U, 0xd50605beU, 0x1fd13462U, 0x8ac4a6feU,
597 	0x9d342e53U, 0xa0a2f355U, 0x32058ae1U, 0x75a4f6ebU,
598 	0x390b83ecU, 0xaa4060efU, 0x065e719fU, 0x51bd6e10U,
599 	0xf93e218aU, 0x3d96dd06U, 0xaedd3e05U, 0x464de6bdU,
600 	0xb591548dU, 0x0571c45dU, 0x6f0406d4U, 0xff605015U,
601 	0x241998fbU, 0x97d6bde9U, 0xcc894043U, 0x7767d99eU,
602 	0xbdb0e842U, 0x8807898bU, 0x38e7195bU, 0xdb79c8eeU,
603 	0x47a17c0aU, 0xe97c420fU, 0xc9f8841eU, 0x00000000U,
604 	0x83098086U, 0x48322bedU, 0xac1e1170U, 0x4e6c5a72U,
605 	0xfbfd0effU, 0x560f8538U, 0x1e3daed5U, 0x27362d39U,
606 	0x640a0fd9U, 0x21685ca6U, 0xd19b5b54U, 0x3a24362eU,
607 	0xb10c0a67U, 0x0f9357e7U, 0xd2b4ee96U, 0x9e1b9b91U,
608 	0x4f80c0c5U, 0xa261dc20U, 0x695a774bU, 0x161c121aU,
609 	0x0ae293baU, 0xe5c0a02aU, 0x433c22e0U, 0x1d121b17U,
610 	0x0b0e090dU, 0xadf28bc7U, 0xb92db6a8U, 0xc8141ea9U,
611 	0x8557f119U, 0x4caf7507U, 0xbbee99ddU, 0xfda37f60U,
612 	0x9ff70126U, 0xbc5c72f5U, 0xc544663bU, 0x345bfb7eU,
613 	0x768b4329U, 0xdccb23c6U, 0x68b6edfcU, 0x63b8e4f1U,
614 	0xcad731dcU, 0x10426385U, 0x40139722U, 0x2084c611U,
615 	0x7d854a24U, 0xf8d2bb3dU, 0x11aef932U, 0x6dc729a1U,
616 	0x4b1d9e2fU, 0xf3dcb230U, 0xec0d8652U, 0xd077c1e3U,
617 	0x6c2bb316U, 0x99a970b9U, 0xfa119448U, 0x2247e964U,
618 	0xc4a8fc8cU, 0x1aa0f03fU, 0xd8567d2cU, 0xef223390U,
619 	0xc787494eU, 0xc1d938d1U, 0xfe8ccaa2U, 0x3698d40bU,
620 	0xcfa6f581U, 0x28a57adeU, 0x26dab78eU, 0xa43fadbfU,
621 	0xe42c3a9dU, 0x0d507892U, 0x9b6a5fccU, 0x62547e46U,
622 	0xc2f68d13U, 0xe890d8b8U, 0x5e2e39f7U, 0xf582c3afU,
623 	0xbe9f5d80U, 0x7c69d093U, 0xa96fd52dU, 0xb3cf2512U,
624 	0x3bc8ac99U, 0xa710187dU, 0x6ee89c63U, 0x7bdb3bbbU,
625 	0x09cd2678U, 0xf46e5918U, 0x01ec9ab7U, 0xa8834f9aU,
626 	0x65e6956eU, 0x7eaaffe6U, 0x0821bccfU, 0xe6ef15e8U,
627 	0xd9bae79bU, 0xce4a6f36U, 0xd4ea9f09U, 0xd629b07cU,
628 	0xaf31a4b2U, 0x312a3f23U, 0x30c6a594U, 0xc035a266U,
629 	0x37744ebcU, 0xa6fc82caU, 0xb0e090d0U, 0x1533a7d8U,
630 	0x4af10498U, 0xf741ecdaU, 0x0e7fcd50U, 0x2f1791f6U,
631 	0x8d764dd6U, 0x4d43efb0U, 0x54ccaa4dU, 0xdfe49604U,
632 	0xe39ed1b5U, 0x1b4c6a88U, 0xb8c12c1fU, 0x7f466551U,
633 	0x049d5eeaU, 0x5d018c35U, 0x73fa8774U, 0x2efb0b41U,
634 	0x5ab3671dU, 0x5292dbd2U, 0x33e91056U, 0x136dd647U,
635 	0x8c9ad761U, 0x7a37a10cU, 0x8e59f814U, 0x89eb133cU,
636 	0xeecea927U, 0x35b761c9U, 0xede11ce5U, 0x3c7a47b1U,
637 	0x599cd2dfU, 0x3f55f273U, 0x791814ceU, 0xbf73c737U,
638 	0xea53f7cdU, 0x5b5ffdaaU, 0x14df3d6fU, 0x867844dbU,
639 	0x81caaff3U, 0x3eb968c4U, 0x2c382434U, 0x5fc2a340U,
640 	0x72161dc3U, 0x0cbce225U, 0x8b283c49U, 0x41ff0d95U,
641 	0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
642 	0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U
643 };
644 
645 static const uint32_t Td2[256] =
646 {
647 	0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
648 	0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
649 	0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
650 	0xd7fc4fe5U, 0xcbd7c52aU, 0x44802635U, 0xa38fb562U,
651 	0x5a49deb1U, 0x1b6725baU, 0x0e9845eaU, 0xc0e15dfeU,
652 	0x7502c32fU, 0xf012814cU, 0x97a38d46U, 0xf9c66bd3U,
653 	0x5fe7038fU, 0x9c951592U, 0x7aebbf6dU, 0x59da9552U,
654 	0x832dd4beU, 0x21d35874U, 0x692949e0U, 0xc8448ec9U,
655 	0x896a75c2U, 0x7978f48eU, 0x3e6b9958U, 0x71dd27b9U,
656 	0x4fb6bee1U, 0xad17f088U, 0xac66c920U, 0x3ab47dceU,
657 	0x4a1863dfU, 0x3182e51aU, 0x33609751U, 0x7f456253U,
658 	0x77e0b164U, 0xae84bb6bU, 0xa01cfe81U, 0x2b94f908U,
659 	0x68587048U, 0xfd198f45U, 0x6c8794deU, 0xf8b7527bU,
660 	0xd323ab73U, 0x02e2724bU, 0x8f57e31fU, 0xab2a6655U,
661 	0x2807b2ebU, 0xc2032fb5U, 0x7b9a86c5U, 0x08a5d337U,
662 	0x87f23028U, 0xa5b223bfU, 0x6aba0203U, 0x825ced16U,
663 	0x1c2b8acfU, 0xb492a779U, 0xf2f0f307U, 0xe2a14e69U,
664 	0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
665 	0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
666 	0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
667 	0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
668 	0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
669 	0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
670 	0x42bdb0e8U, 0x8b880789U, 0x5b38e719U, 0xeedb79c8U,
671 	0x0a47a17cU, 0x0fe97c42U, 0x1ec9f884U, 0x00000000U,
672 	0x86830980U, 0xed48322bU, 0x70ac1e11U, 0x724e6c5aU,
673 	0xfffbfd0eU, 0x38560f85U, 0xd51e3daeU, 0x3927362dU,
674 	0xd9640a0fU, 0xa621685cU, 0x54d19b5bU, 0x2e3a2436U,
675 	0x67b10c0aU, 0xe70f9357U, 0x96d2b4eeU, 0x919e1b9bU,
676 	0xc54f80c0U, 0x20a261dcU, 0x4b695a77U, 0x1a161c12U,
677 	0xba0ae293U, 0x2ae5c0a0U, 0xe0433c22U, 0x171d121bU,
678 	0x0d0b0e09U, 0xc7adf28bU, 0xa8b92db6U, 0xa9c8141eU,
679 	0x198557f1U, 0x074caf75U, 0xddbbee99U, 0x60fda37fU,
680 	0x269ff701U, 0xf5bc5c72U, 0x3bc54466U, 0x7e345bfbU,
681 	0x29768b43U, 0xc6dccb23U, 0xfc68b6edU, 0xf163b8e4U,
682 	0xdccad731U, 0x85104263U, 0x22401397U, 0x112084c6U,
683 	0x247d854aU, 0x3df8d2bbU, 0x3211aef9U, 0xa16dc729U,
684 	0x2f4b1d9eU, 0x30f3dcb2U, 0x52ec0d86U, 0xe3d077c1U,
685 	0x166c2bb3U, 0xb999a970U, 0x48fa1194U, 0x642247e9U,
686 	0x8cc4a8fcU, 0x3f1aa0f0U, 0x2cd8567dU, 0x90ef2233U,
687 	0x4ec78749U, 0xd1c1d938U, 0xa2fe8ccaU, 0x0b3698d4U,
688 	0x81cfa6f5U, 0xde28a57aU, 0x8e26dab7U, 0xbfa43fadU,
689 	0x9de42c3aU, 0x920d5078U, 0xcc9b6a5fU, 0x4662547eU,
690 	0x13c2f68dU, 0xb8e890d8U, 0xf75e2e39U, 0xaff582c3U,
691 	0x80be9f5dU, 0x937c69d0U, 0x2da96fd5U, 0x12b3cf25U,
692 	0x993bc8acU, 0x7da71018U, 0x636ee89cU, 0xbb7bdb3bU,
693 	0x7809cd26U, 0x18f46e59U, 0xb701ec9aU, 0x9aa8834fU,
694 	0x6e65e695U, 0xe67eaaffU, 0xcf0821bcU, 0xe8e6ef15U,
695 	0x9bd9bae7U, 0x36ce4a6fU, 0x09d4ea9fU, 0x7cd629b0U,
696 	0xb2af31a4U, 0x23312a3fU, 0x9430c6a5U, 0x66c035a2U,
697 	0xbc37744eU, 0xcaa6fc82U, 0xd0b0e090U, 0xd81533a7U,
698 	0x984af104U, 0xdaf741ecU, 0x500e7fcdU, 0xf62f1791U,
699 	0xd68d764dU, 0xb04d43efU, 0x4d54ccaaU, 0x04dfe496U,
700 	0xb5e39ed1U, 0x881b4c6aU, 0x1fb8c12cU, 0x517f4665U,
701 	0xea049d5eU, 0x355d018cU, 0x7473fa87U, 0x412efb0bU,
702 	0x1d5ab367U, 0xd25292dbU, 0x5633e910U, 0x47136dd6U,
703 	0x618c9ad7U, 0x0c7a37a1U, 0x148e59f8U, 0x3c89eb13U,
704 	0x27eecea9U, 0xc935b761U, 0xe5ede11cU, 0xb13c7a47U,
705 	0xdf599cd2U, 0x733f55f2U, 0xce791814U, 0x37bf73c7U,
706 	0xcdea53f7U, 0xaa5b5ffdU, 0x6f14df3dU, 0xdb867844U,
707 	0xf381caafU, 0xc43eb968U, 0x342c3824U, 0x405fc2a3U,
708 	0xc372161dU, 0x250cbce2U, 0x498b283cU, 0x9541ff0dU,
709 	0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
710 	0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U
711 };
712 
713 static const uint32_t Td3[256] =
714 {
715 	0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
716 	0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
717 	0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
718 	0xe5d7fc4fU, 0x2acbd7c5U, 0x35448026U, 0x62a38fb5U,
719 	0xb15a49deU, 0xba1b6725U, 0xea0e9845U, 0xfec0e15dU,
720 	0x2f7502c3U, 0x4cf01281U, 0x4697a38dU, 0xd3f9c66bU,
721 	0x8f5fe703U, 0x929c9515U, 0x6d7aebbfU, 0x5259da95U,
722 	0xbe832dd4U, 0x7421d358U, 0xe0692949U, 0xc9c8448eU,
723 	0xc2896a75U, 0x8e7978f4U, 0x583e6b99U, 0xb971dd27U,
724 	0xe14fb6beU, 0x88ad17f0U, 0x20ac66c9U, 0xce3ab47dU,
725 	0xdf4a1863U, 0x1a3182e5U, 0x51336097U, 0x537f4562U,
726 	0x6477e0b1U, 0x6bae84bbU, 0x81a01cfeU, 0x082b94f9U,
727 	0x48685870U, 0x45fd198fU, 0xde6c8794U, 0x7bf8b752U,
728 	0x73d323abU, 0x4b02e272U, 0x1f8f57e3U, 0x55ab2a66U,
729 	0xeb2807b2U, 0xb5c2032fU, 0xc57b9a86U, 0x3708a5d3U,
730 	0x2887f230U, 0xbfa5b223U, 0x036aba02U, 0x16825cedU,
731 	0xcf1c2b8aU, 0x79b492a7U, 0x07f2f0f3U, 0x69e2a14eU,
732 	0xdaf4cd65U, 0x05bed506U, 0x34621fd1U, 0xa6fe8ac4U,
733 	0x2e539d34U, 0xf355a0a2U, 0x8ae13205U, 0xf6eb75a4U,
734 	0x83ec390bU, 0x60efaa40U, 0x719f065eU, 0x6e1051bdU,
735 	0x218af93eU, 0xdd063d96U, 0x3e05aeddU, 0xe6bd464dU,
736 	0x548db591U, 0xc45d0571U, 0x06d46f04U, 0x5015ff60U,
737 	0x98fb2419U, 0xbde997d6U, 0x4043cc89U, 0xd99e7767U,
738 	0xe842bdb0U, 0x898b8807U, 0x195b38e7U, 0xc8eedb79U,
739 	0x7c0a47a1U, 0x420fe97cU, 0x841ec9f8U, 0x00000000U,
740 	0x80868309U, 0x2bed4832U, 0x1170ac1eU, 0x5a724e6cU,
741 	0x0efffbfdU, 0x8538560fU, 0xaed51e3dU, 0x2d392736U,
742 	0x0fd9640aU, 0x5ca62168U, 0x5b54d19bU, 0x362e3a24U,
743 	0x0a67b10cU, 0x57e70f93U, 0xee96d2b4U, 0x9b919e1bU,
744 	0xc0c54f80U, 0xdc20a261U, 0x774b695aU, 0x121a161cU,
745 	0x93ba0ae2U, 0xa02ae5c0U, 0x22e0433cU, 0x1b171d12U,
746 	0x090d0b0eU, 0x8bc7adf2U, 0xb6a8b92dU, 0x1ea9c814U,
747 	0xf1198557U, 0x75074cafU, 0x99ddbbeeU, 0x7f60fda3U,
748 	0x01269ff7U, 0x72f5bc5cU, 0x663bc544U, 0xfb7e345bU,
749 	0x4329768bU, 0x23c6dccbU, 0xedfc68b6U, 0xe4f163b8U,
750 	0x31dccad7U, 0x63851042U, 0x97224013U, 0xc6112084U,
751 	0x4a247d85U, 0xbb3df8d2U, 0xf93211aeU, 0x29a16dc7U,
752 	0x9e2f4b1dU, 0xb230f3dcU, 0x8652ec0dU, 0xc1e3d077U,
753 	0xb3166c2bU, 0x70b999a9U, 0x9448fa11U, 0xe9642247U,
754 	0xfc8cc4a8U, 0xf03f1aa0U, 0x7d2cd856U, 0x3390ef22U,
755 	0x494ec787U, 0x38d1c1d9U, 0xcaa2fe8cU, 0xd40b3698U,
756 	0xf581cfa6U, 0x7ade28a5U, 0xb78e26daU, 0xadbfa43fU,
757 	0x3a9de42cU, 0x78920d50U, 0x5fcc9b6aU, 0x7e466254U,
758 	0x8d13c2f6U, 0xd8b8e890U, 0x39f75e2eU, 0xc3aff582U,
759 	0x5d80be9fU, 0xd0937c69U, 0xd52da96fU, 0x2512b3cfU,
760 	0xac993bc8U, 0x187da710U, 0x9c636ee8U, 0x3bbb7bdbU,
761 	0x267809cdU, 0x5918f46eU, 0x9ab701ecU, 0x4f9aa883U,
762 	0x956e65e6U, 0xffe67eaaU, 0xbccf0821U, 0x15e8e6efU,
763 	0xe79bd9baU, 0x6f36ce4aU, 0x9f09d4eaU, 0xb07cd629U,
764 	0xa4b2af31U, 0x3f23312aU, 0xa59430c6U, 0xa266c035U,
765 	0x4ebc3774U, 0x82caa6fcU, 0x90d0b0e0U, 0xa7d81533U,
766 	0x04984af1U, 0xecdaf741U, 0xcd500e7fU, 0x91f62f17U,
767 	0x4dd68d76U, 0xefb04d43U, 0xaa4d54ccU, 0x9604dfe4U,
768 	0xd1b5e39eU, 0x6a881b4cU, 0x2c1fb8c1U, 0x65517f46U,
769 	0x5eea049dU, 0x8c355d01U, 0x877473faU, 0x0b412efbU,
770 	0x671d5ab3U, 0xdbd25292U, 0x105633e9U, 0xd647136dU,
771 	0xd7618c9aU, 0xa10c7a37U, 0xf8148e59U, 0x133c89ebU,
772 	0xa927eeceU, 0x61c935b7U, 0x1ce5ede1U, 0x47b13c7aU,
773 	0xd2df599cU, 0xf2733f55U, 0x14ce7918U, 0xc737bf73U,
774 	0xf7cdea53U, 0xfdaa5b5fU, 0x3d6f14dfU, 0x44db8678U,
775 	0xaff381caU, 0x68c43eb9U, 0x24342c38U, 0xa3405fc2U,
776 	0x1dc37216U, 0xe2250cbcU, 0x3c498b28U, 0x0d9541ffU,
777 	0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
778 	0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U
779 };
780 
781 #ifndef sun4u
782 
783 static const uint32_t Td4[256] =
784 {
785 	0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
786 	0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
787 	0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
788 	0x81818181U, 0xf3f3f3f3U, 0xd7d7d7d7U, 0xfbfbfbfbU,
789 	0x7c7c7c7cU, 0xe3e3e3e3U, 0x39393939U, 0x82828282U,
790 	0x9b9b9b9bU, 0x2f2f2f2fU, 0xffffffffU, 0x87878787U,
791 	0x34343434U, 0x8e8e8e8eU, 0x43434343U, 0x44444444U,
792 	0xc4c4c4c4U, 0xdedededeU, 0xe9e9e9e9U, 0xcbcbcbcbU,
793 	0x54545454U, 0x7b7b7b7bU, 0x94949494U, 0x32323232U,
794 	0xa6a6a6a6U, 0xc2c2c2c2U, 0x23232323U, 0x3d3d3d3dU,
795 	0xeeeeeeeeU, 0x4c4c4c4cU, 0x95959595U, 0x0b0b0b0bU,
796 	0x42424242U, 0xfafafafaU, 0xc3c3c3c3U, 0x4e4e4e4eU,
797 	0x08080808U, 0x2e2e2e2eU, 0xa1a1a1a1U, 0x66666666U,
798 	0x28282828U, 0xd9d9d9d9U, 0x24242424U, 0xb2b2b2b2U,
799 	0x76767676U, 0x5b5b5b5bU, 0xa2a2a2a2U, 0x49494949U,
800 	0x6d6d6d6dU, 0x8b8b8b8bU, 0xd1d1d1d1U, 0x25252525U,
801 	0x72727272U, 0xf8f8f8f8U, 0xf6f6f6f6U, 0x64646464U,
802 	0x86868686U, 0x68686868U, 0x98989898U, 0x16161616U,
803 	0xd4d4d4d4U, 0xa4a4a4a4U, 0x5c5c5c5cU, 0xccccccccU,
804 	0x5d5d5d5dU, 0x65656565U, 0xb6b6b6b6U, 0x92929292U,
805 	0x6c6c6c6cU, 0x70707070U, 0x48484848U, 0x50505050U,
806 	0xfdfdfdfdU, 0xededededU, 0xb9b9b9b9U, 0xdadadadaU,
807 	0x5e5e5e5eU, 0x15151515U, 0x46464646U, 0x57575757U,
808 	0xa7a7a7a7U, 0x8d8d8d8dU, 0x9d9d9d9dU, 0x84848484U,
809 	0x90909090U, 0xd8d8d8d8U, 0xababababU, 0x00000000U,
810 	0x8c8c8c8cU, 0xbcbcbcbcU, 0xd3d3d3d3U, 0x0a0a0a0aU,
811 	0xf7f7f7f7U, 0xe4e4e4e4U, 0x58585858U, 0x05050505U,
812 	0xb8b8b8b8U, 0xb3b3b3b3U, 0x45454545U, 0x06060606U,
813 	0xd0d0d0d0U, 0x2c2c2c2cU, 0x1e1e1e1eU, 0x8f8f8f8fU,
814 	0xcacacacaU, 0x3f3f3f3fU, 0x0f0f0f0fU, 0x02020202U,
815 	0xc1c1c1c1U, 0xafafafafU, 0xbdbdbdbdU, 0x03030303U,
816 	0x01010101U, 0x13131313U, 0x8a8a8a8aU, 0x6b6b6b6bU,
817 	0x3a3a3a3aU, 0x91919191U, 0x11111111U, 0x41414141U,
818 	0x4f4f4f4fU, 0x67676767U, 0xdcdcdcdcU, 0xeaeaeaeaU,
819 	0x97979797U, 0xf2f2f2f2U, 0xcfcfcfcfU, 0xcecececeU,
820 	0xf0f0f0f0U, 0xb4b4b4b4U, 0xe6e6e6e6U, 0x73737373U,
821 	0x96969696U, 0xacacacacU, 0x74747474U, 0x22222222U,
822 	0xe7e7e7e7U, 0xadadadadU, 0x35353535U, 0x85858585U,
823 	0xe2e2e2e2U, 0xf9f9f9f9U, 0x37373737U, 0xe8e8e8e8U,
824 	0x1c1c1c1cU, 0x75757575U, 0xdfdfdfdfU, 0x6e6e6e6eU,
825 	0x47474747U, 0xf1f1f1f1U, 0x1a1a1a1aU, 0x71717171U,
826 	0x1d1d1d1dU, 0x29292929U, 0xc5c5c5c5U, 0x89898989U,
827 	0x6f6f6f6fU, 0xb7b7b7b7U, 0x62626262U, 0x0e0e0e0eU,
828 	0xaaaaaaaaU, 0x18181818U, 0xbebebebeU, 0x1b1b1b1bU,
829 	0xfcfcfcfcU, 0x56565656U, 0x3e3e3e3eU, 0x4b4b4b4bU,
830 	0xc6c6c6c6U, 0xd2d2d2d2U, 0x79797979U, 0x20202020U,
831 	0x9a9a9a9aU, 0xdbdbdbdbU, 0xc0c0c0c0U, 0xfefefefeU,
832 	0x78787878U, 0xcdcdcdcdU, 0x5a5a5a5aU, 0xf4f4f4f4U,
833 	0x1f1f1f1fU, 0xddddddddU, 0xa8a8a8a8U, 0x33333333U,
834 	0x88888888U, 0x07070707U, 0xc7c7c7c7U, 0x31313131U,
835 	0xb1b1b1b1U, 0x12121212U, 0x10101010U, 0x59595959U,
836 	0x27272727U, 0x80808080U, 0xececececU, 0x5f5f5f5fU,
837 	0x60606060U, 0x51515151U, 0x7f7f7f7fU, 0xa9a9a9a9U,
838 	0x19191919U, 0xb5b5b5b5U, 0x4a4a4a4aU, 0x0d0d0d0dU,
839 	0x2d2d2d2dU, 0xe5e5e5e5U, 0x7a7a7a7aU, 0x9f9f9f9fU,
840 	0x93939393U, 0xc9c9c9c9U, 0x9c9c9c9cU, 0xefefefefU,
841 	0xa0a0a0a0U, 0xe0e0e0e0U, 0x3b3b3b3bU, 0x4d4d4d4dU,
842 	0xaeaeaeaeU, 0x2a2a2a2aU, 0xf5f5f5f5U, 0xb0b0b0b0U,
843 	0xc8c8c8c8U, 0xebebebebU, 0xbbbbbbbbU, 0x3c3c3c3cU,
844 	0x83838383U, 0x53535353U, 0x99999999U, 0x61616161U,
845 	0x17171717U, 0x2b2b2b2bU, 0x04040404U, 0x7e7e7e7eU,
846 	0xbabababaU, 0x77777777U, 0xd6d6d6d6U, 0x26262626U,
847 	0xe1e1e1e1U, 0x69696969U, 0x14141414U, 0x63636363U,
848 	0x55555555U, 0x21212121U, 0x0c0c0c0cU, 0x7d7d7d7dU
849 };
850 
851 #endif /* !sun4u */
852 
853 /* Rcon is Round Constant; used for encryption key expansion */
854 static const uint32_t rcon[RC_LENGTH] =
855 {
856 	/* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
857 	0x01000000, 0x02000000, 0x04000000, 0x08000000,
858 	0x10000000, 0x20000000, 0x40000000, 0x80000000,
859 	0x1B000000, 0x36000000
860 };
861 
862 
863 /*
864  * Expand the cipher key into the encryption key schedule.
865  *
866  * Return the number of rounds for the given cipher key size.
867  * The size of the key schedule depends on the number of rounds
868  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
869  *
870  * Parameters:
871  * rk		AES key schedule 32-bit array to be initialized
872  * cipherKey	User key
873  * keyBits	AES key size (128, 192, or 256 bits)
874  */
875 static int
rijndael_key_setup_enc_raw(uint32_t rk[],const uint32_t cipherKey[],int keyBits)876 rijndael_key_setup_enc_raw(uint32_t rk[], const uint32_t cipherKey[],
877     int keyBits)
878 {
879 	int		i = 0;
880 	uint32_t	temp;
881 
882 	rk[0] = cipherKey[0];
883 	rk[1] = cipherKey[1];
884 	rk[2] = cipherKey[2];
885 	rk[3] = cipherKey[3];
886 
887 	if (keyBits == 128) {
888 		for (;;) {
889 			temp  = rk[3];
890 			rk[4] = rk[0] ^
891 			    (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
892 			    (Te4[(temp >> 8) & 0xff] & 0x00ff0000) ^
893 			    (Te4[temp & 0xff] & 0x0000ff00) ^
894 			    (Te4[temp >> 24] & 0x000000ff) ^
895 			    rcon[i];
896 			rk[5] = rk[1] ^ rk[4];
897 			rk[6] = rk[2] ^ rk[5];
898 			rk[7] = rk[3] ^ rk[6];
899 
900 			if (++i == 10) {
901 				return (10);
902 			}
903 			rk += 4;
904 		}
905 	}
906 
907 	rk[4] = cipherKey[4];
908 	rk[5] = cipherKey[5];
909 
910 	if (keyBits == 192) {
911 		for (;;) {
912 			temp = rk[5];
913 			rk[6] = rk[0] ^
914 			    (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
915 			    (Te4[(temp >> 8) & 0xff] & 0x00ff0000) ^
916 			    (Te4[temp & 0xff] & 0x0000ff00) ^
917 			    (Te4[temp >> 24] & 0x000000ff) ^
918 			    rcon[i];
919 			rk[7] = rk[1] ^ rk[6];
920 			rk[8] = rk[2] ^ rk[7];
921 			rk[9] = rk[3] ^ rk[8];
922 
923 			if (++i == 8) {
924 				return (12);
925 			}
926 
927 			rk[10] = rk[4] ^ rk[9];
928 			rk[11] = rk[5] ^ rk[10];
929 			rk += 6;
930 		}
931 	}
932 
933 	rk[6] = cipherKey[6];
934 	rk[7] = cipherKey[7];
935 
936 	if (keyBits == 256) {
937 		for (;;) {
938 			temp = rk[7];
939 			rk[8] = rk[0] ^
940 			    (Te4[(temp >> 16) & 0xff] & 0xff000000) ^
941 			    (Te4[(temp >> 8) & 0xff] & 0x00ff0000) ^
942 			    (Te4[temp & 0xff] & 0x0000ff00) ^
943 			    (Te4[temp >> 24] & 0x000000ff) ^
944 			    rcon[i];
945 			rk[9] = rk[1] ^ rk[8];
946 			rk[10] = rk[2] ^ rk[9];
947 			rk[11] = rk[3] ^ rk[10];
948 
949 			if (++i == 7) {
950 				return (14);
951 			}
952 			temp = rk[11];
953 			rk[12] = rk[4] ^
954 			    (Te4[temp >> 24] & 0xff000000) ^
955 			    (Te4[(temp >> 16) & 0xff] & 0x00ff0000) ^
956 			    (Te4[(temp >> 8) & 0xff] & 0x0000ff00) ^
957 			    (Te4[temp & 0xff] & 0x000000ff);
958 			rk[13] = rk[5] ^ rk[12];
959 			rk[14] = rk[6] ^ rk[13];
960 			rk[15] = rk[7] ^ rk[14];
961 
962 			rk += 8;
963 		}
964 	}
965 
966 	return (0);
967 }
968 #endif	/* !__amd64 */
969 
970 
971 #ifdef	sun4u
972 
973 /*
974  * Expand the cipher key into the encryption key schedule.
975  * by the sun4u optimized assembly implementation.
976  *
977  * Return the number of rounds for the given cipher key size.
978  * The size of the key schedule depends on the number of rounds
979  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
980  *
981  * Parameters:
982  * rk		AES key schedule 64-bit array to be initialized
983  * cipherKey	User key
984  * keyBits	AES key size (128, 192, or 256 bits)
985  */
986 static int
rijndael_key_setup_enc(uint64_t rk[],const uint32_t cipherKey[],int keyBits)987 rijndael_key_setup_enc(uint64_t rk[], const uint32_t cipherKey[], int keyBits)
988 {
989 	uint32_t	rk1[4 * (MAX_AES_NR + 1)];
990 	uint64_t	*rk64 = (uint64_t *)rk;
991 	uint32_t	*rkt;
992 	uint64_t	t;
993 	int		i, Nr;
994 
995 	Nr = rijndael_key_setup_enc_raw(rk1, cipherKey, keyBits);
996 
997 	for (i = 0; i < 4 * Nr; i++) {
998 		t = (uint64_t)(rk1[i]);
999 		rk64[i] = ((t & 0xff000000) << 11) |
1000 		    ((t & 0xff0000) << 8) |
1001 		    ((t & 0xffff) << 3);
1002 	}
1003 
1004 	rkt = (uint32_t *)(&(rk64[4 * Nr]));
1005 
1006 	for (i = 0; i < 4; i++) {
1007 		rkt[i] = rk1[4 * Nr+i];
1008 	}
1009 
1010 	return (Nr);
1011 }
1012 
1013 
1014 /*
1015  * Expand the cipher key into the decryption key schedule as used
1016  * by the sun4u optimized assembly implementation.
1017  *
1018  * Return the number of rounds for the given cipher key size.
1019  * The size of the key schedule depends on the number of rounds
1020  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
1021  *
1022  * Parameters:
1023  * rk		AES key schedule 32-bit array to be initialized
1024  * cipherKey	User key
1025  * keyBits	AES key size (128, 192, or 256 bits)
1026  */
1027 static int
rijndael_key_setup_dec_raw(uint32_t rk[],const uint32_t cipherKey[],int keyBits)1028 rijndael_key_setup_dec_raw(uint32_t rk[], const uint32_t cipherKey[],
1029     int keyBits)
1030 {
1031 	int		Nr, i;
1032 	uint32_t	temp;
1033 
1034 	/* expand the cipher key: */
1035 	Nr = rijndael_key_setup_enc_raw(rk, cipherKey, keyBits);
1036 
1037 	/* invert the order of the round keys: */
1038 
1039 	for (i = 0; i < 2 * Nr + 2; i++) {
1040 		temp = rk[i];
1041 		rk[i] = rk[4 * Nr - i + 3];
1042 		rk[4 * Nr - i + 3] = temp;
1043 	}
1044 
1045 	/*
1046 	 * apply the inverse MixColumn transform to all
1047 	 * round keys but the first and the last:
1048 	 */
1049 	for (i = 1; i < Nr; i++) {
1050 		rk += 4;
1051 		rk[0] = Td0[Te4[rk[0] >> 24] & 0xff] ^
1052 		    Td1[Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
1053 		    Td2[Te4[(rk[0] >>  8) & 0xff] & 0xff] ^
1054 		    Td3[Te4[rk[0] & 0xff] & 0xff];
1055 		rk[1] = Td0[Te4[rk[1] >> 24] & 0xff] ^
1056 		    Td1[Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
1057 		    Td2[Te4[(rk[1] >> 8) & 0xff] & 0xff] ^
1058 		    Td3[Te4[rk[1] & 0xff] & 0xff];
1059 		rk[2] = Td0[Te4[rk[2] >> 24] & 0xff] ^
1060 		    Td1[Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
1061 		    Td2[Te4[(rk[2] >> 8) & 0xff] & 0xff] ^
1062 		    Td3[Te4[rk[2] & 0xff] & 0xff];
1063 		rk[3] = Td0[Te4[rk[3] >> 24] & 0xff] ^
1064 		    Td1[Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
1065 		    Td2[Te4[(rk[3] >> 8) & 0xff] & 0xff] ^
1066 		    Td3[Te4[rk[3] & 0xff] & 0xff];
1067 	}
1068 
1069 	return (Nr);
1070 }
1071 
1072 
1073 /*
1074  * The size of the key schedule depends on the number of rounds
1075  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
1076  *
1077  * Parameters:
1078  * rk		AES key schedule 64-bit array to be initialized
1079  * cipherKey	User key
1080  * keyBits	AES key size (128, 192, or 256 bits)
1081  */
1082 static int
rijndael_key_setup_dec(uint64_t rk[],const uint32_t cipherKey[],int keyBits)1083 rijndael_key_setup_dec(uint64_t rk[], const uint32_t cipherKey[], int keyBits)
1084 {
1085 	uint32_t	rk1[4 * (MAX_AES_NR + 1)];
1086 	uint64_t	*rk64 = (uint64_t *)rk;
1087 	uint32_t	*rkt;
1088 	uint64_t	t;
1089 	int		i, Nr;
1090 
1091 	Nr = rijndael_key_setup_dec_raw(rk1, cipherKey, keyBits);
1092 	for (i = 0; i < 4 * Nr; i++) {
1093 		t = (uint64_t)(rk1[i]);
1094 		rk64[i] = ((t & 0xff000000) << 11) |
1095 		    ((t & 0xff0000) << 8) |
1096 		    ((t & 0xffff) << 3);
1097 	}
1098 
1099 	rkt = (uint32_t *)(&(rk64[4 * Nr]));
1100 
1101 	for (i = 0; i < 4; i++) {
1102 		rkt[i] = rk1[4 * Nr + i];
1103 	}
1104 
1105 	return (Nr);
1106 }
1107 
1108 
1109 /*
1110  * Expand the 64-bit AES cipher key array into the encryption and decryption
1111  * key schedules.
1112  *
1113  * Parameters:
1114  * key		AES key schedule to be initialized
1115  * keyarr32	User key
1116  * keyBits	AES key size (128, 192, or 256 bits)
1117  */
1118 static void
aes_setupkeys(aes_key_t * key,const uint32_t * keyarr32,int keybits)1119 aes_setupkeys(aes_key_t *key, const uint32_t *keyarr32, int keybits)
1120 {
1121 	key->nr = rijndael_key_setup_enc(&(key->encr_ks.ks64[0]), keyarr32,
1122 	    keybits);
1123 	key->nr = rijndael_key_setup_dec(&(key->decr_ks.ks64[0]), keyarr32,
1124 	    keybits);
1125 	key->type = AES_64BIT_KS;
1126 }
1127 
1128 
1129 #elif defined(__amd64)
1130 
1131 /*
1132  * Expand the 32-bit AES cipher key array into the encryption and decryption
1133  * key schedules.
1134  *
1135  * Parameters:
1136  * key		AES key schedule to be initialized
1137  * keyarr32	User key
1138  * keyBits	AES key size (128, 192, or 256 bits)
1139  */
1140 static void
aes_setupkeys(aes_key_t * key,const uint32_t * keyarr32,int keybits)1141 aes_setupkeys(aes_key_t *key, const uint32_t *keyarr32, int keybits)
1142 {
1143 	if (intel_aes_instructions_present()) {
1144 		key->flags = INTEL_AES_NI_CAPABLE;
1145 		KPREEMPT_DISABLE;
1146 		key->nr = rijndael_key_setup_enc_intel(&(key->encr_ks.ks32[0]),
1147 		    keyarr32, keybits);
1148 		key->nr = rijndael_key_setup_dec_intel(&(key->decr_ks.ks32[0]),
1149 		    keyarr32, keybits);
1150 		KPREEMPT_ENABLE;
1151 	} else {
1152 		key->flags = 0;
1153 		key->nr = rijndael_key_setup_enc_amd64(&(key->encr_ks.ks32[0]),
1154 		    keyarr32, keybits);
1155 		key->nr = rijndael_key_setup_dec_amd64(&(key->decr_ks.ks32[0]),
1156 		    keyarr32, keybits);
1157 	}
1158 
1159 	key->type = AES_32BIT_KS;
1160 }
1161 
1162 /*
1163  * Encrypt one block of data. The block is assumed to be an array
1164  * of four uint32_t values, so copy for alignment (and byte-order
1165  * reversal for little endian systems might be necessary on the
1166  * input and output byte streams.
1167  * The size of the key schedule depends on the number of rounds
1168  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
1169  *
1170  * Parameters:
1171  * rk		Key schedule, of aes_ks_t (60 32-bit integers)
1172  * Nr		Number of rounds
1173  * pt		Input block (plain text)
1174  * ct		Output block (crypto text).  Can overlap with pt
1175  * flags	Indicates whether we're on Intel AES-NI-capable hardware
1176  */
1177 static void
rijndael_encrypt(const uint32_t rk[],int Nr,const uint32_t pt[4],uint32_t ct[4],int flags)1178 rijndael_encrypt(const uint32_t rk[], int Nr, const uint32_t pt[4],
1179     uint32_t ct[4], int flags) {
1180 	if (flags & INTEL_AES_NI_CAPABLE) {
1181 		KPREEMPT_DISABLE;
1182 		aes_encrypt_intel(rk, Nr, pt, ct);
1183 		KPREEMPT_ENABLE;
1184 	} else {
1185 		aes_encrypt_amd64(rk, Nr, pt, ct);
1186 	}
1187 }
1188 
1189 /*
1190  * Decrypt one block of data. The block is assumed to be an array
1191  * of four uint32_t values, so copy for alignment (and byte-order
1192  * reversal for little endian systems might be necessary on the
1193  * input and output byte streams.
1194  * The size of the key schedule depends on the number of rounds
1195  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
1196  *
1197  * Parameters:
1198  * rk		Key schedule, of aes_ks_t (60 32-bit integers)
1199  * Nr		Number of rounds
1200  * ct		Input block (crypto text)
1201  * pt		Output block (plain text). Can overlap with pt
1202  * flags	Indicates whether we're on Intel AES-NI-capable hardware
1203  */
1204 static void
rijndael_decrypt(const uint32_t rk[],int Nr,const uint32_t ct[4],uint32_t pt[4],int flags)1205 rijndael_decrypt(const uint32_t rk[], int Nr, const uint32_t ct[4],
1206     uint32_t pt[4], int flags) {
1207 	if (flags & INTEL_AES_NI_CAPABLE) {
1208 		KPREEMPT_DISABLE;
1209 		aes_decrypt_intel(rk, Nr, ct, pt);
1210 		KPREEMPT_ENABLE;
1211 	} else {
1212 		aes_decrypt_amd64(rk, Nr, ct, pt);
1213 	}
1214 }
1215 
1216 
1217 #else /* generic C implementation */
1218 
1219 /*
1220  *  Expand the cipher key into the decryption key schedule.
1221  *  Return the number of rounds for the given cipher key size.
1222  *  The size of the key schedule depends on the number of rounds
1223  *  (which can be computed from the size of the key), i.e. 4*(Nr + 1).
1224  *
1225  * Parameters:
1226  * rk		AES key schedule 32-bit array to be initialized
1227  * cipherKey	User key
1228  * keyBits	AES key size (128, 192, or 256 bits)
1229  */
1230 static int
rijndael_key_setup_dec(uint32_t rk[],const uint32_t cipherKey[],int keyBits)1231 rijndael_key_setup_dec(uint32_t rk[], const uint32_t cipherKey[], int keyBits)
1232 {
1233 	int	 Nr, i, j;
1234 	uint32_t temp;
1235 
1236 	/* expand the cipher key: */
1237 	Nr = rijndael_key_setup_enc_raw(rk, cipherKey, keyBits);
1238 
1239 	/* invert the order of the round keys: */
1240 	for (i = 0, j = 4 * Nr; i < j; i += 4, j -= 4) {
1241 		temp = rk[i];
1242 		rk[i] = rk[j];
1243 		rk[j] = temp;
1244 		temp = rk[i + 1];
1245 		rk[i + 1] = rk[j + 1];
1246 		rk[j + 1] = temp;
1247 		temp = rk[i + 2];
1248 		rk[i + 2] = rk[j + 2];
1249 		rk[j + 2] = temp;
1250 		temp = rk[i + 3];
1251 		rk[i + 3] = rk[j + 3];
1252 		rk[j + 3] = temp;
1253 	}
1254 
1255 	/*
1256 	 * apply the inverse MixColumn transform to all
1257 	 * round keys but the first and the last:
1258 	 */
1259 	for (i = 1; i < Nr; i++) {
1260 		rk += 4;
1261 		rk[0] = Td0[Te4[rk[0] >> 24] & 0xff] ^
1262 		    Td1[Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
1263 		    Td2[Te4[(rk[0] >> 8) & 0xff] & 0xff] ^
1264 		    Td3[Te4[rk[0] & 0xff] & 0xff];
1265 		rk[1] = Td0[Te4[rk[1] >> 24] & 0xff] ^
1266 		    Td1[Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
1267 		    Td2[Te4[(rk[1] >> 8) & 0xff] & 0xff] ^
1268 		    Td3[Te4[rk[1] & 0xff] & 0xff];
1269 		rk[2] = Td0[Te4[rk[2] >> 24] & 0xff] ^
1270 		    Td1[Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
1271 		    Td2[Te4[(rk[2] >> 8) & 0xff] & 0xff] ^
1272 		    Td3[Te4[rk[2] & 0xff] & 0xff];
1273 		rk[3] = Td0[Te4[rk[3] >> 24] & 0xff] ^
1274 		    Td1[Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
1275 		    Td2[Te4[(rk[3] >> 8) & 0xff] & 0xff] ^
1276 		    Td3[Te4[rk[3] & 0xff] & 0xff];
1277 	}
1278 
1279 	return (Nr);
1280 }
1281 
1282 
1283 /*
1284  * Expand the 32-bit AES cipher key array into the encryption and decryption
1285  * key schedules.
1286  *
1287  * Parameters:
1288  * key		AES key schedule to be initialized
1289  * keyarr32	User key
1290  * keyBits	AES key size (128, 192, or 256 bits)
1291  */
1292 static void
aes_setupkeys(aes_key_t * key,const uint32_t * keyarr32,int keybits)1293 aes_setupkeys(aes_key_t *key, const uint32_t *keyarr32, int keybits)
1294 {
1295 	key->nr = rijndael_key_setup_enc(&(key->encr_ks.ks32[0]), keyarr32,
1296 	    keybits);
1297 	key->nr = rijndael_key_setup_dec(&(key->decr_ks.ks32[0]), keyarr32,
1298 	    keybits);
1299 	key->type = AES_32BIT_KS;
1300 }
1301 
1302 
1303 /*
1304  * Encrypt one block of data. The block is assumed to be an array
1305  * of four uint32_t values, so copy for alignment (and byte-order
1306  * reversal for little endian systems might be necessary on the
1307  * input and output byte streams.
1308  * The size of the key schedule depends on the number of rounds
1309  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
1310  *
1311  * Parameters:
1312  * rk	Key schedule, of aes_ks_t (60 32-bit integers)
1313  * Nr	Number of rounds
1314  * pt	Input block (plain text)
1315  * ct	Output block (crypto text).  Can overlap with pt
1316  */
1317 static void
rijndael_encrypt(const uint32_t rk[],int Nr,const uint32_t pt[4],uint32_t ct[4])1318 rijndael_encrypt(const uint32_t rk[], int Nr, const uint32_t pt[4],
1319     uint32_t ct[4])
1320 {
1321 	uint32_t	s0, s1, s2, s3, t0, t1, t2, t3;
1322 	int		r;
1323 
1324 	/*
1325 	 * map byte array block to cipher state
1326 	 * and add initial round key:
1327 	 */
1328 
1329 	s0 = pt[0] ^ rk[0];
1330 	s1 = pt[1] ^ rk[1];
1331 	s2 = pt[2] ^ rk[2];
1332 	s3 = pt[3] ^ rk[3];
1333 
1334 	/*
1335 	 * Nr - 1 full rounds:
1336 	 */
1337 
1338 	r = Nr >> 1;
1339 
1340 	for (;;) {
1341 		t0 = Te0[s0 >> 24] ^
1342 		    Te1[(s1 >> 16) & 0xff] ^
1343 		    Te2[(s2 >>  8) & 0xff] ^
1344 		    Te3[s3 & 0xff] ^
1345 		    rk[4];
1346 
1347 		t1 = Te0[s1 >> 24] ^
1348 		    Te1[(s2 >> 16) & 0xff] ^
1349 		    Te2[(s3 >>  8) & 0xff] ^
1350 		    Te3[s0 & 0xff] ^
1351 		    rk[5];
1352 
1353 		t2 = Te0[s2 >> 24] ^
1354 		    Te1[(s3 >> 16) & 0xff] ^
1355 		    Te2[(s0 >>  8) & 0xff] ^
1356 		    Te3[s1 & 0xff] ^
1357 		    rk[6];
1358 
1359 		t3 = Te0[s3 >> 24] ^
1360 		    Te1[(s0 >> 16) & 0xff] ^
1361 		    Te2[(s1 >>  8) & 0xff] ^
1362 		    Te3[s2 & 0xff] ^
1363 		    rk[7];
1364 
1365 		rk += 8;
1366 
1367 		if (--r == 0) {
1368 			break;
1369 		}
1370 
1371 		s0 = Te0[t0 >> 24] ^
1372 		    Te1[(t1 >> 16) & 0xff] ^
1373 		    Te2[(t2 >>  8) & 0xff] ^
1374 		    Te3[t3 & 0xff] ^
1375 		    rk[0];
1376 
1377 		s1 = Te0[t1 >> 24] ^
1378 		    Te1[(t2 >> 16) & 0xff] ^
1379 		    Te2[(t3 >>  8) & 0xff] ^
1380 		    Te3[t0 & 0xff] ^
1381 		    rk[1];
1382 
1383 		s2 = Te0[t2 >> 24] ^
1384 		    Te1[(t3 >> 16) & 0xff] ^
1385 		    Te2[(t0 >>  8) & 0xff] ^
1386 		    Te3[t1 & 0xff] ^
1387 		    rk[2];
1388 
1389 		s3 = Te0[t3 >> 24] ^
1390 		    Te1[(t0 >> 16) & 0xff] ^
1391 		    Te2[(t1 >>  8) & 0xff] ^
1392 		    Te3[t2 & 0xff] ^
1393 		    rk[3];
1394 	}
1395 
1396 	/*
1397 	 * apply last round and
1398 	 * map cipher state to byte array block:
1399 	 */
1400 
1401 	s0 = (Te4[(t0 >> 24)] & 0xff000000) ^
1402 	    (Te4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
1403 	    (Te4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
1404 	    (Te4[t3 & 0xff] & 0x000000ff) ^
1405 	    rk[0];
1406 	ct[0] = s0;
1407 
1408 	s1 = (Te4[(t1 >> 24)] & 0xff000000) ^
1409 	    (Te4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
1410 	    (Te4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
1411 	    (Te4[t0 & 0xff] & 0x000000ff) ^
1412 	    rk[1];
1413 	ct[1] = s1;
1414 
1415 	s2 = (Te4[(t2 >> 24)] & 0xff000000) ^
1416 	    (Te4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
1417 	    (Te4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
1418 	    (Te4[t1 & 0xff] & 0x000000ff) ^
1419 	    rk[2];
1420 	ct[2] = s2;
1421 
1422 	s3 = (Te4[(t3 >> 24)] & 0xff000000) ^
1423 	    (Te4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
1424 	    (Te4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
1425 	    (Te4[t2 & 0xff] & 0x000000ff) ^
1426 	    rk[3];
1427 	ct[3] = s3;
1428 }
1429 
1430 
1431 /*
1432  * Decrypt one block of data. The block is assumed to be an array
1433  * of four uint32_t values, so copy for alignment (and byte-order
1434  * reversal for little endian systems might be necessary on the
1435  * input and output byte streams.
1436  * The size of the key schedule depends on the number of rounds
1437  * (which can be computed from the size of the key), i.e. 4*(Nr + 1).
1438  *
1439  * Parameters:
1440  * rk	Key schedule, of aes_ks_t (60 32-bit integers)
1441  * Nr	Number of rounds
1442  * ct	Input block (crypto text)
1443  * pt	Output block (plain text). Can overlap with pt
1444  */
1445 static void
rijndael_decrypt(const uint32_t rk[],int Nr,const uint32_t ct[4],uint32_t pt[4])1446 rijndael_decrypt(const uint32_t rk[], int Nr, const uint32_t ct[4],
1447     uint32_t pt[4])
1448 {
1449 	uint32_t s0, s1, s2, s3, t0, t1, t2, t3;
1450 	int	 r;
1451 
1452 	/*
1453 	 * map byte array block to cipher state
1454 	 * and add initial round key:
1455 	 */
1456 	s0 = ct[0] ^ rk[0];
1457 	s1 = ct[1] ^ rk[1];
1458 	s2 = ct[2] ^ rk[2];
1459 	s3 = ct[3] ^ rk[3];
1460 
1461 	/*
1462 	 * Nr - 1 full rounds:
1463 	 */
1464 
1465 	r = Nr >> 1;
1466 
1467 	for (;;) {
1468 		t0 = Td0[s0 >> 24] ^
1469 		    Td1[(s3 >> 16) & 0xff] ^
1470 		    Td2[(s2 >> 8) & 0xff] ^
1471 		    Td3[s1 & 0xff] ^
1472 		    rk[4];
1473 
1474 		t1 = Td0[s1 >> 24] ^
1475 		    Td1[(s0 >> 16) & 0xff] ^
1476 		    Td2[(s3 >>  8) & 0xff] ^
1477 		    Td3[s2 & 0xff] ^
1478 		    rk[5];
1479 
1480 		t2 = Td0[s2 >> 24] ^
1481 		    Td1[(s1 >> 16) & 0xff] ^
1482 		    Td2[(s0 >>  8) & 0xff] ^
1483 		    Td3[s3 & 0xff] ^
1484 		    rk[6];
1485 
1486 		t3 = Td0[s3 >> 24] ^
1487 		    Td1[(s2 >> 16) & 0xff] ^
1488 		    Td2[(s1 >> 8) & 0xff] ^
1489 		    Td3[s0 & 0xff] ^
1490 		    rk[7];
1491 
1492 		rk += 8;
1493 
1494 		if (--r == 0) {
1495 			break;
1496 		}
1497 
1498 		s0 = Td0[t0 >> 24] ^
1499 		    Td1[(t3 >> 16) & 0xff] ^
1500 		    Td2[(t2 >> 8) & 0xff] ^
1501 		    Td3[t1 & 0xff] ^
1502 		    rk[0];
1503 
1504 		s1 = Td0[t1 >> 24] ^
1505 		    Td1[(t0 >> 16) & 0xff] ^
1506 		    Td2[(t3 >> 8) & 0xff] ^
1507 		    Td3[t2 & 0xff] ^
1508 		    rk[1];
1509 
1510 		s2 = Td0[t2 >> 24] ^
1511 		    Td1[(t1 >> 16) & 0xff] ^
1512 		    Td2[(t0 >> 8) & 0xff] ^
1513 		    Td3[t3 & 0xff] ^
1514 		    rk[2];
1515 
1516 		s3 = Td0[t3 >> 24] ^
1517 		    Td1[(t2 >> 16) & 0xff] ^
1518 		    Td2[(t1 >> 8) & 0xff] ^
1519 		    Td3[t0 & 0xff] ^
1520 		    rk[3];
1521 	}
1522 
1523 	/*
1524 	 * apply last round and
1525 	 * map cipher state to byte array block:
1526 	 */
1527 
1528 	s0 = (Td4[t0 >> 24] & 0xff000000) ^
1529 	    (Td4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
1530 	    (Td4[(t2 >> 8) & 0xff] & 0x0000ff00) ^
1531 	    (Td4[t1 & 0xff] & 0x000000ff) ^
1532 	    rk[0];
1533 	pt[0] = s0;
1534 
1535 	s1 = (Td4[t1 >> 24] & 0xff000000) ^
1536 	    (Td4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
1537 	    (Td4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
1538 	    (Td4[t2 & 0xff] & 0x000000ff) ^
1539 	    rk[1];
1540 	pt[1] = s1;
1541 
1542 	s2 = (Td4[t2 >> 24] & 0xff000000) ^
1543 	    (Td4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
1544 	    (Td4[(t0 >> 8) & 0xff] & 0x0000ff00) ^
1545 	    (Td4[t3 & 0xff] & 0x000000ff) ^
1546 	    rk[2];
1547 	pt[2] = s2;
1548 
1549 	s3 = (Td4[t3 >> 24] & 0xff000000) ^
1550 	    (Td4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
1551 	    (Td4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
1552 	    (Td4[t0 & 0xff] & 0x000000ff) ^
1553 	    rk[3];
1554 	pt[3] = s3;
1555 }
1556 #endif	/* sun4u, __amd64 */
1557 
1558 
1559 /*
1560  * Initialize AES encryption and decryption key schedules.
1561  *
1562  * Parameters:
1563  * cipherKey	User key
1564  * keyBits	AES key size (128, 192, or 256 bits)
1565  * keysched	AES key schedule to be initialized, of type aes_key_t.
1566  *		Allocated by aes_alloc_keysched().
1567  */
1568 void
aes_init_keysched(const uint8_t * cipherKey,uint_t keyBits,void * keysched)1569 aes_init_keysched(const uint8_t *cipherKey, uint_t keyBits, void *keysched)
1570 {
1571 	aes_key_t	*newbie = keysched;
1572 	uint_t		keysize, i, j;
1573 	union {
1574 		uint64_t	ka64[4];
1575 		uint32_t	ka32[8];
1576 		} keyarr;
1577 
1578 	switch (keyBits) {
1579 	case 128:
1580 		newbie->nr = 10;
1581 		break;
1582 
1583 	case 192:
1584 		newbie->nr = 12;
1585 		break;
1586 
1587 	case 256:
1588 		newbie->nr = 14;
1589 		break;
1590 
1591 	default:
1592 		/* should never get here */
1593 		return;
1594 	}
1595 	keysize = CRYPTO_BITS2BYTES(keyBits);
1596 
1597 	/*
1598 	 * For _LITTLE_ENDIAN machines (except AMD64), reverse every
1599 	 * 4 bytes in the key.  On _BIG_ENDIAN and AMD64, copy the key
1600 	 * without reversing bytes.
1601 	 * For AMD64, do not byte swap for aes_setupkeys().
1602 	 *
1603 	 * SPARCv8/v9 uses a key schedule array with 64-bit elements.
1604 	 * X86/AMD64  uses a key schedule array with 32-bit elements.
1605 	 */
1606 #ifndef	AES_BYTE_SWAP
1607 	if (IS_P2ALIGNED(cipherKey, sizeof (uint64_t))) {
1608 		for (i = 0, j = 0; j < keysize; i++, j += 8) {
1609 			/* LINTED: pointer alignment */
1610 			keyarr.ka64[i] = *((uint64_t *)&cipherKey[j]);
1611 		}
1612 	} else {
1613 		bcopy(cipherKey, keyarr.ka32, keysize);
1614 	}
1615 
1616 #else	/* byte swap */
1617 	for (i = 0, j = 0; j < keysize; i++, j += 4) {
1618 		keyarr.ka32[i] = htonl(*(uint32_t *)(void *)&cipherKey[j]);
1619 	}
1620 #endif
1621 
1622 	aes_setupkeys(newbie, keyarr.ka32, keyBits);
1623 }
1624 
1625 
1626 /*
1627  * Encrypt one block using AES.
1628  * Align if needed and (for x86 32-bit only) byte-swap.
1629  *
1630  * Parameters:
1631  * ks	Key schedule, of type aes_key_t
1632  * pt	Input block (plain text)
1633  * ct	Output block (crypto text).  Can overlap with pt
1634  */
1635 int
aes_encrypt_block(const void * ks,const uint8_t * pt,uint8_t * ct)1636 aes_encrypt_block(const void *ks, const uint8_t *pt, uint8_t *ct)
1637 {
1638 	aes_key_t	*ksch = (aes_key_t *)ks;
1639 
1640 #ifndef	AES_BYTE_SWAP
1641 	if (IS_P2ALIGNED2(pt, ct, sizeof (uint32_t))) {
1642 		/* LINTED:  pointer alignment */
1643 		AES_ENCRYPT_IMPL(&ksch->encr_ks.ks32[0], ksch->nr,
1644 		    /* LINTED:  pointer alignment */
1645 		    (uint32_t *)pt, (uint32_t *)ct, ksch->flags);
1646 	} else {
1647 #endif
1648 		uint32_t buffer[AES_BLOCK_LEN / sizeof (uint32_t)];
1649 
1650 		/* Copy input block into buffer */
1651 #ifndef	AES_BYTE_SWAP
1652 		bcopy(pt, &buffer, AES_BLOCK_LEN);
1653 
1654 #else	/* byte swap */
1655 		buffer[0] = htonl(*(uint32_t *)(void *)&pt[0]);
1656 		buffer[1] = htonl(*(uint32_t *)(void *)&pt[4]);
1657 		buffer[2] = htonl(*(uint32_t *)(void *)&pt[8]);
1658 		buffer[3] = htonl(*(uint32_t *)(void *)&pt[12]);
1659 #endif
1660 
1661 		AES_ENCRYPT_IMPL(&ksch->encr_ks.ks32[0], ksch->nr,
1662 		    buffer, buffer, ksch->flags);
1663 
1664 		/* Copy result from buffer to output block */
1665 #ifndef	AES_BYTE_SWAP
1666 		bcopy(&buffer, ct, AES_BLOCK_LEN);
1667 	}
1668 
1669 #else	/* byte swap */
1670 		*(uint32_t *)(void *)&ct[0] = htonl(buffer[0]);
1671 		*(uint32_t *)(void *)&ct[4] = htonl(buffer[1]);
1672 		*(uint32_t *)(void *)&ct[8] = htonl(buffer[2]);
1673 		*(uint32_t *)(void *)&ct[12] = htonl(buffer[3]);
1674 #endif
1675 	return (CRYPTO_SUCCESS);
1676 }
1677 
1678 
1679 /*
1680  * Decrypt one block using AES.
1681  * Align and byte-swap if needed.
1682  *
1683  * Parameters:
1684  * ks	Key schedule, of type aes_key_t
1685  * ct	Input block (crypto text)
1686  * pt	Output block (plain text). Can overlap with pt
1687  */
1688 int
aes_decrypt_block(const void * ks,const uint8_t * ct,uint8_t * pt)1689 aes_decrypt_block(const void *ks, const uint8_t *ct, uint8_t *pt)
1690 {
1691 	aes_key_t	*ksch = (aes_key_t *)ks;
1692 
1693 #ifndef	AES_BYTE_SWAP
1694 	if (IS_P2ALIGNED2(ct, pt, sizeof (uint32_t))) {
1695 		/* LINTED:  pointer alignment */
1696 		AES_DECRYPT_IMPL(&ksch->decr_ks.ks32[0], ksch->nr,
1697 		    /* LINTED:  pointer alignment */
1698 		    (uint32_t *)ct, (uint32_t *)pt, ksch->flags);
1699 	} else {
1700 #endif
1701 		uint32_t buffer[AES_BLOCK_LEN / sizeof (uint32_t)];
1702 
1703 		/* Copy input block into buffer */
1704 #ifndef	AES_BYTE_SWAP
1705 		bcopy(ct, &buffer, AES_BLOCK_LEN);
1706 
1707 #else	/* byte swap */
1708 		buffer[0] = htonl(*(uint32_t *)(void *)&ct[0]);
1709 		buffer[1] = htonl(*(uint32_t *)(void *)&ct[4]);
1710 		buffer[2] = htonl(*(uint32_t *)(void *)&ct[8]);
1711 		buffer[3] = htonl(*(uint32_t *)(void *)&ct[12]);
1712 #endif
1713 
1714 		AES_DECRYPT_IMPL(&ksch->decr_ks.ks32[0], ksch->nr,
1715 		    buffer, buffer, ksch->flags);
1716 
1717 		/* Copy result from buffer to output block */
1718 #ifndef	AES_BYTE_SWAP
1719 		bcopy(&buffer, pt, AES_BLOCK_LEN);
1720 	}
1721 
1722 #else	/* byte swap */
1723 	*(uint32_t *)(void *)&pt[0] = htonl(buffer[0]);
1724 	*(uint32_t *)(void *)&pt[4] = htonl(buffer[1]);
1725 	*(uint32_t *)(void *)&pt[8] = htonl(buffer[2]);
1726 	*(uint32_t *)(void *)&pt[12] = htonl(buffer[3]);
1727 #endif
1728 
1729 	return (CRYPTO_SUCCESS);
1730 }
1731 
1732 
1733 /*
1734  * Allocate key schedule for AES.
1735  *
1736  * Return the pointer and set size to the number of bytes allocated.
1737  * Memory allocated must be freed by the caller when done.
1738  *
1739  * Parameters:
1740  * size		Size of key schedule allocated, in bytes
1741  * kmflag	Flag passed to kmem_alloc(9F); ignored in userland.
1742  */
1743 /* ARGSUSED */
1744 void *
aes_alloc_keysched(size_t * size,int kmflag)1745 aes_alloc_keysched(size_t *size, int kmflag)
1746 {
1747 	aes_key_t *keysched;
1748 
1749 #ifdef	_KERNEL
1750 	keysched = (aes_key_t *)kmem_alloc(sizeof (aes_key_t), kmflag);
1751 #else	/* !_KERNEL */
1752 	keysched = (aes_key_t *)malloc(sizeof (aes_key_t));
1753 #endif	/* _KERNEL */
1754 
1755 	if (keysched != NULL) {
1756 		*size = sizeof (aes_key_t);
1757 		return (keysched);
1758 	}
1759 	return (NULL);
1760 }
1761 
1762 
1763 #ifdef __amd64
1764 /*
1765  * Return 1 if executing on Intel with AES-NI instructions,
1766  * otherwise 0 (i.e., Intel without AES-NI or AMD64).
1767  * Cache the result, as the CPU can't change.
1768  *
1769  * Note: the userland version uses getisax().  The kernel version uses
1770  * global variable x86_featureset.
1771  */
1772 static int
intel_aes_instructions_present(void)1773 intel_aes_instructions_present(void)
1774 {
1775 	static int	cached_result = -1;
1776 
1777 	if (cached_result == -1) { /* first time */
1778 #ifdef _KERNEL
1779 		cached_result = is_x86_feature(x86_featureset, X86FSET_AES);
1780 #else
1781 		uint_t		ui = 0;
1782 
1783 		(void) getisax(&ui, 1);
1784 		cached_result = (ui & AV_386_AES) != 0;
1785 #endif	/* _KERNEL */
1786 	}
1787 
1788 	return (cached_result);
1789 }
1790 #endif	/* __amd64 */
1791