xref: /linux/crypto/camellia_generic.c (revision 06a130e42a5bfc84795464bff023bff4c16f58c5) 
1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3  * Copyright (C) 2006
4  * NTT (Nippon Telegraph and Telephone Corporation).
5  */
6 
7 /*
8  * Algorithm Specification
9  *  https://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
10  */
11 
12 #include <crypto/algapi.h>
13 #include <linux/errno.h>
14 #include <linux/init.h>
15 #include <linux/kernel.h>
16 #include <linux/module.h>
17 #include <linux/bitops.h>
18 #include <linux/unaligned.h>
19 
20 static const u32 camellia_sp1110[256] = {
21 	0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00,
22 	0xb3b3b300, 0x27272700, 0xc0c0c000, 0xe5e5e500,
23 	0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
24 	0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100,
25 	0x23232300, 0xefefef00, 0x6b6b6b00, 0x93939300,
26 	0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
27 	0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00,
28 	0x1d1d1d00, 0x65656500, 0x92929200, 0xbdbdbd00,
29 	0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
30 	0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00,
31 	0x3e3e3e00, 0x30303000, 0xdcdcdc00, 0x5f5f5f00,
32 	0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
33 	0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00,
34 	0xd5d5d500, 0x47474700, 0x5d5d5d00, 0x3d3d3d00,
35 	0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
36 	0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00,
37 	0x8b8b8b00, 0x0d0d0d00, 0x9a9a9a00, 0x66666600,
38 	0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
39 	0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000,
40 	0xf0f0f000, 0xb1b1b100, 0x84848400, 0x99999900,
41 	0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
42 	0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500,
43 	0x6d6d6d00, 0xb7b7b700, 0xa9a9a900, 0x31313100,
44 	0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
45 	0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100,
46 	0xdedede00, 0x1b1b1b00, 0x11111100, 0x1c1c1c00,
47 	0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
48 	0x53535300, 0x18181800, 0xf2f2f200, 0x22222200,
49 	0xfefefe00, 0x44444400, 0xcfcfcf00, 0xb2b2b200,
50 	0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
51 	0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800,
52 	0x60606000, 0xfcfcfc00, 0x69696900, 0x50505000,
53 	0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
54 	0xa1a1a100, 0x89898900, 0x62626200, 0x97979700,
55 	0x54545400, 0x5b5b5b00, 0x1e1e1e00, 0x95959500,
56 	0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
57 	0x10101000, 0xc4c4c400, 0x00000000, 0x48484800,
58 	0xa3a3a300, 0xf7f7f700, 0x75757500, 0xdbdbdb00,
59 	0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
60 	0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400,
61 	0x87878700, 0x5c5c5c00, 0x83838300, 0x02020200,
62 	0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
63 	0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300,
64 	0x9d9d9d00, 0x7f7f7f00, 0xbfbfbf00, 0xe2e2e200,
65 	0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
66 	0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00,
67 	0x81818100, 0x96969600, 0x6f6f6f00, 0x4b4b4b00,
68 	0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
69 	0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00,
70 	0x9f9f9f00, 0x6e6e6e00, 0xbcbcbc00, 0x8e8e8e00,
71 	0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
72 	0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900,
73 	0x78787800, 0x98989800, 0x06060600, 0x6a6a6a00,
74 	0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
75 	0xd4d4d400, 0x25252500, 0xababab00, 0x42424200,
76 	0x88888800, 0xa2a2a200, 0x8d8d8d00, 0xfafafa00,
77 	0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
78 	0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00,
79 	0x36363600, 0x49494900, 0x2a2a2a00, 0x68686800,
80 	0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
81 	0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00,
82 	0xbbbbbb00, 0xc9c9c900, 0x43434300, 0xc1c1c100,
83 	0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
84 	0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00,
85 };
86 
87 static const u32 camellia_sp0222[256] = {
88 	0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9,
89 	0x00676767, 0x004e4e4e, 0x00818181, 0x00cbcbcb,
90 	0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
91 	0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282,
92 	0x00464646, 0x00dfdfdf, 0x00d6d6d6, 0x00272727,
93 	0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
94 	0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c,
95 	0x003a3a3a, 0x00cacaca, 0x00252525, 0x007b7b7b,
96 	0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
97 	0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d,
98 	0x007c7c7c, 0x00606060, 0x00b9b9b9, 0x00bebebe,
99 	0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
100 	0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595,
101 	0x00ababab, 0x008e8e8e, 0x00bababa, 0x007a7a7a,
102 	0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
103 	0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a,
104 	0x00171717, 0x001a1a1a, 0x00353535, 0x00cccccc,
105 	0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
106 	0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040,
107 	0x00e1e1e1, 0x00636363, 0x00090909, 0x00333333,
108 	0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
109 	0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a,
110 	0x00dadada, 0x006f6f6f, 0x00535353, 0x00626262,
111 	0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
112 	0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2,
113 	0x00bdbdbd, 0x00363636, 0x00222222, 0x00383838,
114 	0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
115 	0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444,
116 	0x00fdfdfd, 0x00888888, 0x009f9f9f, 0x00656565,
117 	0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
118 	0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151,
119 	0x00c0c0c0, 0x00f9f9f9, 0x00d2d2d2, 0x00a0a0a0,
120 	0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
121 	0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f,
122 	0x00a8a8a8, 0x00b6b6b6, 0x003c3c3c, 0x002b2b2b,
123 	0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
124 	0x00202020, 0x00898989, 0x00000000, 0x00909090,
125 	0x00474747, 0x00efefef, 0x00eaeaea, 0x00b7b7b7,
126 	0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
127 	0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929,
128 	0x000f0f0f, 0x00b8b8b8, 0x00070707, 0x00040404,
129 	0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
130 	0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7,
131 	0x003b3b3b, 0x00fefefe, 0x007f7f7f, 0x00c5c5c5,
132 	0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
133 	0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676,
134 	0x00030303, 0x002d2d2d, 0x00dedede, 0x00969696,
135 	0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
136 	0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919,
137 	0x003f3f3f, 0x00dcdcdc, 0x00797979, 0x001d1d1d,
138 	0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
139 	0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2,
140 	0x00f0f0f0, 0x00313131, 0x000c0c0c, 0x00d4d4d4,
141 	0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
142 	0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484,
143 	0x00111111, 0x00454545, 0x001b1b1b, 0x00f5f5f5,
144 	0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
145 	0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414,
146 	0x006c6c6c, 0x00929292, 0x00545454, 0x00d0d0d0,
147 	0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
148 	0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6,
149 	0x00777777, 0x00939393, 0x00868686, 0x00838383,
150 	0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
151 	0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d,
152 };
153 
154 static const u32 camellia_sp3033[256] = {
155 	0x38003838, 0x41004141, 0x16001616, 0x76007676,
156 	0xd900d9d9, 0x93009393, 0x60006060, 0xf200f2f2,
157 	0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
158 	0x75007575, 0x06000606, 0x57005757, 0xa000a0a0,
159 	0x91009191, 0xf700f7f7, 0xb500b5b5, 0xc900c9c9,
160 	0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
161 	0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727,
162 	0x8e008e8e, 0xb200b2b2, 0x49004949, 0xde00dede,
163 	0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
164 	0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767,
165 	0x1f001f1f, 0x18001818, 0x6e006e6e, 0xaf00afaf,
166 	0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
167 	0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565,
168 	0xea00eaea, 0xa300a3a3, 0xae00aeae, 0x9e009e9e,
169 	0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
170 	0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6,
171 	0xc500c5c5, 0x86008686, 0x4d004d4d, 0x33003333,
172 	0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
173 	0x3a003a3a, 0x09000909, 0x95009595, 0x10001010,
174 	0x78007878, 0xd800d8d8, 0x42004242, 0xcc00cccc,
175 	0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
176 	0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282,
177 	0xb600b6b6, 0xdb00dbdb, 0xd400d4d4, 0x98009898,
178 	0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
179 	0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0,
180 	0x6f006f6f, 0x8d008d8d, 0x88008888, 0x0e000e0e,
181 	0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
182 	0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111,
183 	0x7f007f7f, 0x22002222, 0xe700e7e7, 0x59005959,
184 	0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
185 	0x12001212, 0x04000404, 0x74007474, 0x54005454,
186 	0x30003030, 0x7e007e7e, 0xb400b4b4, 0x28002828,
187 	0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
188 	0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb,
189 	0x2a002a2a, 0xad00adad, 0x0f000f0f, 0xca00caca,
190 	0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
191 	0x08000808, 0x62006262, 0x00000000, 0x24002424,
192 	0xd100d1d1, 0xfb00fbfb, 0xba00baba, 0xed00eded,
193 	0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
194 	0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a,
195 	0xc300c3c3, 0x2e002e2e, 0xc100c1c1, 0x01000101,
196 	0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
197 	0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9,
198 	0xce00cece, 0xbf00bfbf, 0xdf00dfdf, 0x71007171,
199 	0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
200 	0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d,
201 	0xc000c0c0, 0x4b004b4b, 0xb700b7b7, 0xa500a5a5,
202 	0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
203 	0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646,
204 	0xcf00cfcf, 0x37003737, 0x5e005e5e, 0x47004747,
205 	0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
206 	0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac,
207 	0x3c003c3c, 0x4c004c4c, 0x03000303, 0x35003535,
208 	0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
209 	0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121,
210 	0x44004444, 0x51005151, 0xc600c6c6, 0x7d007d7d,
211 	0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
212 	0x7c007c7c, 0x77007777, 0x56005656, 0x05000505,
213 	0x1b001b1b, 0xa400a4a4, 0x15001515, 0x34003434,
214 	0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
215 	0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd,
216 	0xdd00dddd, 0xe400e4e4, 0xa100a1a1, 0xe000e0e0,
217 	0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
218 	0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f,
219 };
220 
221 static const u32 camellia_sp4404[256] = {
222 	0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0,
223 	0xe4e400e4, 0x57570057, 0xeaea00ea, 0xaeae00ae,
224 	0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
225 	0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092,
226 	0x86860086, 0xafaf00af, 0x7c7c007c, 0x1f1f001f,
227 	0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
228 	0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d,
229 	0xd9d900d9, 0x5a5a005a, 0x51510051, 0x6c6c006c,
230 	0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
231 	0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084,
232 	0xdfdf00df, 0xcbcb00cb, 0x34340034, 0x76760076,
233 	0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
234 	0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011,
235 	0x32320032, 0x9c9c009c, 0x53530053, 0xf2f200f2,
236 	0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
237 	0x24240024, 0xe8e800e8, 0x60600060, 0x69690069,
238 	0xaaaa00aa, 0xa0a000a0, 0xa1a100a1, 0x62620062,
239 	0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
240 	0x10100010, 0x00000000, 0xa3a300a3, 0x75750075,
241 	0x8a8a008a, 0xe6e600e6, 0x09090009, 0xdddd00dd,
242 	0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
243 	0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf,
244 	0x52520052, 0xd8d800d8, 0xc8c800c8, 0xc6c600c6,
245 	0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
246 	0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc,
247 	0x29290029, 0xf9f900f9, 0x2f2f002f, 0xb4b400b4,
248 	0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
249 	0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d,
250 	0x72720072, 0xb9b900b9, 0xf8f800f8, 0xacac00ac,
251 	0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
252 	0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043,
253 	0x15150015, 0xadad00ad, 0x77770077, 0x80800080,
254 	0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
255 	0x85850085, 0x35350035, 0x0c0c000c, 0x41410041,
256 	0xefef00ef, 0x93930093, 0x19190019, 0x21210021,
257 	0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
258 	0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce,
259 	0x30300030, 0x5f5f005f, 0xc5c500c5, 0x1a1a001a,
260 	0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
261 	0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d,
262 	0x0d0d000d, 0x66660066, 0xcccc00cc, 0x2d2d002d,
263 	0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
264 	0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005,
265 	0xb7b700b7, 0x31310031, 0x17170017, 0xd7d700d7,
266 	0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
267 	0x0f0f000f, 0x16160016, 0x18180018, 0x22220022,
268 	0x44440044, 0xb2b200b2, 0xb5b500b5, 0x91910091,
269 	0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
270 	0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097,
271 	0x5b5b005b, 0x95950095, 0xffff00ff, 0xd2d200d2,
272 	0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
273 	0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094,
274 	0x5c5c005c, 0x02020002, 0x4a4a004a, 0x33330033,
275 	0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
276 	0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b,
277 	0x96960096, 0x4b4b004b, 0xbebe00be, 0x2e2e002e,
278 	0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
279 	0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059,
280 	0x98980098, 0x6a6a006a, 0x46460046, 0xbaba00ba,
281 	0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
282 	0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a,
283 	0x49490049, 0x68680068, 0x38380038, 0xa4a400a4,
284 	0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
285 	0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e,
286 };
287 
288 
289 #define CAMELLIA_MIN_KEY_SIZE        16
290 #define CAMELLIA_MAX_KEY_SIZE        32
291 #define CAMELLIA_BLOCK_SIZE          16
292 #define CAMELLIA_TABLE_BYTE_LEN     272
293 
294 /*
295  * NB: L and R below stand for 'left' and 'right' as in written numbers.
296  * That is, in (xxxL,xxxR) pair xxxL holds most significant digits,
297  * _not_ least significant ones!
298  */
299 
300 
301 /* key constants */
302 
303 #define CAMELLIA_SIGMA1L (0xA09E667FL)
304 #define CAMELLIA_SIGMA1R (0x3BCC908BL)
305 #define CAMELLIA_SIGMA2L (0xB67AE858L)
306 #define CAMELLIA_SIGMA2R (0x4CAA73B2L)
307 #define CAMELLIA_SIGMA3L (0xC6EF372FL)
308 #define CAMELLIA_SIGMA3R (0xE94F82BEL)
309 #define CAMELLIA_SIGMA4L (0x54FF53A5L)
310 #define CAMELLIA_SIGMA4R (0xF1D36F1CL)
311 #define CAMELLIA_SIGMA5L (0x10E527FAL)
312 #define CAMELLIA_SIGMA5R (0xDE682D1DL)
313 #define CAMELLIA_SIGMA6L (0xB05688C2L)
314 #define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
315 
316 /*
317  *  macros
318  */
319 #define ROLDQ(ll, lr, rl, rr, w0, w1, bits) ({		\
320 	w0 = ll;					\
321 	ll = (ll << bits) + (lr >> (32 - bits));	\
322 	lr = (lr << bits) + (rl >> (32 - bits));	\
323 	rl = (rl << bits) + (rr >> (32 - bits));	\
324 	rr = (rr << bits) + (w0 >> (32 - bits));	\
325 })
326 
327 #define ROLDQo32(ll, lr, rl, rr, w0, w1, bits) ({	\
328 	w0 = ll;					\
329 	w1 = lr;					\
330 	ll = (lr << (bits - 32)) + (rl >> (64 - bits));	\
331 	lr = (rl << (bits - 32)) + (rr >> (64 - bits));	\
332 	rl = (rr << (bits - 32)) + (w0 >> (64 - bits));	\
333 	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
334 })
335 
336 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1) ({	\
337 	il = xl ^ kl;						\
338 	ir = xr ^ kr;						\
339 	t0 = il >> 16;						\
340 	t1 = ir >> 16;						\
341 	yl = camellia_sp1110[(u8)(ir)]				\
342 	   ^ camellia_sp0222[(u8)(t1 >> 8)]			\
343 	   ^ camellia_sp3033[(u8)(t1)]				\
344 	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
345 	yr = camellia_sp1110[(u8)(t0 >> 8)]			\
346 	   ^ camellia_sp0222[(u8)(t0)]				\
347 	   ^ camellia_sp3033[(u8)(il >> 8)]			\
348 	   ^ camellia_sp4404[(u8)(il)];				\
349 	yl ^= yr;						\
350 	yr = ror32(yr, 8);					\
351 	yr ^= yl;						\
352 })
353 
354 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
355 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
356 
357 static void camellia_setup_tail(u32 *subkey, u32 *subL, u32 *subR, int max)
358 {
359 	u32 dw, tl, tr;
360 	u32 kw4l, kw4r;
361 
362 	/* absorb kw2 to other subkeys */
363 	/* round 2 */
364 	subL[3] ^= subL[1]; subR[3] ^= subR[1];
365 	/* round 4 */
366 	subL[5] ^= subL[1]; subR[5] ^= subR[1];
367 	/* round 6 */
368 	subL[7] ^= subL[1]; subR[7] ^= subR[1];
369 	subL[1] ^= subR[1] & ~subR[9];
370 	dw = subL[1] & subL[9];
371 	subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl2) */
372 	/* round 8 */
373 	subL[11] ^= subL[1]; subR[11] ^= subR[1];
374 	/* round 10 */
375 	subL[13] ^= subL[1]; subR[13] ^= subR[1];
376 	/* round 12 */
377 	subL[15] ^= subL[1]; subR[15] ^= subR[1];
378 	subL[1] ^= subR[1] & ~subR[17];
379 	dw = subL[1] & subL[17];
380 	subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl4) */
381 	/* round 14 */
382 	subL[19] ^= subL[1]; subR[19] ^= subR[1];
383 	/* round 16 */
384 	subL[21] ^= subL[1]; subR[21] ^= subR[1];
385 	/* round 18 */
386 	subL[23] ^= subL[1]; subR[23] ^= subR[1];
387 	if (max == 24) {
388 		/* kw3 */
389 		subL[24] ^= subL[1]; subR[24] ^= subR[1];
390 
391 	/* absorb kw4 to other subkeys */
392 		kw4l = subL[25]; kw4r = subR[25];
393 	} else {
394 		subL[1] ^= subR[1] & ~subR[25];
395 		dw = subL[1] & subL[25];
396 		subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl6) */
397 		/* round 20 */
398 		subL[27] ^= subL[1]; subR[27] ^= subR[1];
399 		/* round 22 */
400 		subL[29] ^= subL[1]; subR[29] ^= subR[1];
401 		/* round 24 */
402 		subL[31] ^= subL[1]; subR[31] ^= subR[1];
403 		/* kw3 */
404 		subL[32] ^= subL[1]; subR[32] ^= subR[1];
405 
406 	/* absorb kw4 to other subkeys */
407 		kw4l = subL[33]; kw4r = subR[33];
408 		/* round 23 */
409 		subL[30] ^= kw4l; subR[30] ^= kw4r;
410 		/* round 21 */
411 		subL[28] ^= kw4l; subR[28] ^= kw4r;
412 		/* round 19 */
413 		subL[26] ^= kw4l; subR[26] ^= kw4r;
414 		kw4l ^= kw4r & ~subR[24];
415 		dw = kw4l & subL[24];
416 		kw4r ^= rol32(dw, 1); /* modified for FL(kl5) */
417 	}
418 	/* round 17 */
419 	subL[22] ^= kw4l; subR[22] ^= kw4r;
420 	/* round 15 */
421 	subL[20] ^= kw4l; subR[20] ^= kw4r;
422 	/* round 13 */
423 	subL[18] ^= kw4l; subR[18] ^= kw4r;
424 	kw4l ^= kw4r & ~subR[16];
425 	dw = kw4l & subL[16];
426 	kw4r ^= rol32(dw, 1); /* modified for FL(kl3) */
427 	/* round 11 */
428 	subL[14] ^= kw4l; subR[14] ^= kw4r;
429 	/* round 9 */
430 	subL[12] ^= kw4l; subR[12] ^= kw4r;
431 	/* round 7 */
432 	subL[10] ^= kw4l; subR[10] ^= kw4r;
433 	kw4l ^= kw4r & ~subR[8];
434 	dw = kw4l & subL[8];
435 	kw4r ^= rol32(dw, 1); /* modified for FL(kl1) */
436 	/* round 5 */
437 	subL[6] ^= kw4l; subR[6] ^= kw4r;
438 	/* round 3 */
439 	subL[4] ^= kw4l; subR[4] ^= kw4r;
440 	/* round 1 */
441 	subL[2] ^= kw4l; subR[2] ^= kw4r;
442 	/* kw1 */
443 	subL[0] ^= kw4l; subR[0] ^= kw4r;
444 
445 	/* key XOR is end of F-function */
446 	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
447 	SUBKEY_R(0) = subR[0] ^ subR[2];
448 	SUBKEY_L(2) = subL[3];       /* round 1 */
449 	SUBKEY_R(2) = subR[3];
450 	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
451 	SUBKEY_R(3) = subR[2] ^ subR[4];
452 	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
453 	SUBKEY_R(4) = subR[3] ^ subR[5];
454 	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
455 	SUBKEY_R(5) = subR[4] ^ subR[6];
456 	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
457 	SUBKEY_R(6) = subR[5] ^ subR[7];
458 	tl = subL[10] ^ (subR[10] & ~subR[8]);
459 	dw = tl & subL[8];  /* FL(kl1) */
460 	tr = subR[10] ^ rol32(dw, 1);
461 	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
462 	SUBKEY_R(7) = subR[6] ^ tr;
463 	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
464 	SUBKEY_R(8) = subR[8];
465 	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
466 	SUBKEY_R(9) = subR[9];
467 	tl = subL[7] ^ (subR[7] & ~subR[9]);
468 	dw = tl & subL[9];  /* FLinv(kl2) */
469 	tr = subR[7] ^ rol32(dw, 1);
470 	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
471 	SUBKEY_R(10) = tr ^ subR[11];
472 	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
473 	SUBKEY_R(11) = subR[10] ^ subR[12];
474 	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
475 	SUBKEY_R(12) = subR[11] ^ subR[13];
476 	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
477 	SUBKEY_R(13) = subR[12] ^ subR[14];
478 	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
479 	SUBKEY_R(14) = subR[13] ^ subR[15];
480 	tl = subL[18] ^ (subR[18] & ~subR[16]);
481 	dw = tl & subL[16]; /* FL(kl3) */
482 	tr = subR[18] ^ rol32(dw, 1);
483 	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
484 	SUBKEY_R(15) = subR[14] ^ tr;
485 	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
486 	SUBKEY_R(16) = subR[16];
487 	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
488 	SUBKEY_R(17) = subR[17];
489 	tl = subL[15] ^ (subR[15] & ~subR[17]);
490 	dw = tl & subL[17]; /* FLinv(kl4) */
491 	tr = subR[15] ^ rol32(dw, 1);
492 	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
493 	SUBKEY_R(18) = tr ^ subR[19];
494 	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
495 	SUBKEY_R(19) = subR[18] ^ subR[20];
496 	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
497 	SUBKEY_R(20) = subR[19] ^ subR[21];
498 	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
499 	SUBKEY_R(21) = subR[20] ^ subR[22];
500 	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
501 	SUBKEY_R(22) = subR[21] ^ subR[23];
502 	if (max == 24) {
503 		SUBKEY_L(23) = subL[22];     /* round 18 */
504 		SUBKEY_R(23) = subR[22];
505 		SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
506 		SUBKEY_R(24) = subR[24] ^ subR[23];
507 	} else {
508 		tl = subL[26] ^ (subR[26] & ~subR[24]);
509 		dw = tl & subL[24]; /* FL(kl5) */
510 		tr = subR[26] ^ rol32(dw, 1);
511 		SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
512 		SUBKEY_R(23) = subR[22] ^ tr;
513 		SUBKEY_L(24) = subL[24];     /* FL(kl5) */
514 		SUBKEY_R(24) = subR[24];
515 		SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
516 		SUBKEY_R(25) = subR[25];
517 		tl = subL[23] ^ (subR[23] & ~subR[25]);
518 		dw = tl & subL[25]; /* FLinv(kl6) */
519 		tr = subR[23] ^ rol32(dw, 1);
520 		SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
521 		SUBKEY_R(26) = tr ^ subR[27];
522 		SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
523 		SUBKEY_R(27) = subR[26] ^ subR[28];
524 		SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
525 		SUBKEY_R(28) = subR[27] ^ subR[29];
526 		SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
527 		SUBKEY_R(29) = subR[28] ^ subR[30];
528 		SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
529 		SUBKEY_R(30) = subR[29] ^ subR[31];
530 		SUBKEY_L(31) = subL[30];     /* round 24 */
531 		SUBKEY_R(31) = subR[30];
532 		SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
533 		SUBKEY_R(32) = subR[32] ^ subR[31];
534 	}
535 }
536 
537 static void camellia_setup128(const unsigned char *key, u32 *subkey)
538 {
539 	u32 kll, klr, krl, krr;
540 	u32 il, ir, t0, t1, w0, w1;
541 	u32 subL[26];
542 	u32 subR[26];
543 
544 	/**
545 	 *  k == kll || klr || krl || krr (|| is concatenation)
546 	 */
547 	kll = get_unaligned_be32(key);
548 	klr = get_unaligned_be32(key + 4);
549 	krl = get_unaligned_be32(key + 8);
550 	krr = get_unaligned_be32(key + 12);
551 
552 	/* generate KL dependent subkeys */
553 	/* kw1 */
554 	subL[0] = kll; subR[0] = klr;
555 	/* kw2 */
556 	subL[1] = krl; subR[1] = krr;
557 	/* rotation left shift 15bit */
558 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
559 	/* k3 */
560 	subL[4] = kll; subR[4] = klr;
561 	/* k4 */
562 	subL[5] = krl; subR[5] = krr;
563 	/* rotation left shift 15+30bit */
564 	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
565 	/* k7 */
566 	subL[10] = kll; subR[10] = klr;
567 	/* k8 */
568 	subL[11] = krl; subR[11] = krr;
569 	/* rotation left shift 15+30+15bit */
570 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
571 	/* k10 */
572 	subL[13] = krl; subR[13] = krr;
573 	/* rotation left shift 15+30+15+17 bit */
574 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
575 	/* kl3 */
576 	subL[16] = kll; subR[16] = klr;
577 	/* kl4 */
578 	subL[17] = krl; subR[17] = krr;
579 	/* rotation left shift 15+30+15+17+17 bit */
580 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
581 	/* k13 */
582 	subL[18] = kll; subR[18] = klr;
583 	/* k14 */
584 	subL[19] = krl; subR[19] = krr;
585 	/* rotation left shift 15+30+15+17+17+17 bit */
586 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
587 	/* k17 */
588 	subL[22] = kll; subR[22] = klr;
589 	/* k18 */
590 	subL[23] = krl; subR[23] = krr;
591 
592 	/* generate KA */
593 	kll = subL[0]; klr = subR[0];
594 	krl = subL[1]; krr = subR[1];
595 	CAMELLIA_F(kll, klr,
596 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
597 		   w0, w1, il, ir, t0, t1);
598 	krl ^= w0; krr ^= w1;
599 	CAMELLIA_F(krl, krr,
600 		   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
601 		   kll, klr, il, ir, t0, t1);
602 	/* current status == (kll, klr, w0, w1) */
603 	CAMELLIA_F(kll, klr,
604 		   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
605 		   krl, krr, il, ir, t0, t1);
606 	krl ^= w0; krr ^= w1;
607 	CAMELLIA_F(krl, krr,
608 		   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
609 		   w0, w1, il, ir, t0, t1);
610 	kll ^= w0; klr ^= w1;
611 
612 	/* generate KA dependent subkeys */
613 	/* k1, k2 */
614 	subL[2] = kll; subR[2] = klr;
615 	subL[3] = krl; subR[3] = krr;
616 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
617 	/* k5,k6 */
618 	subL[6] = kll; subR[6] = klr;
619 	subL[7] = krl; subR[7] = krr;
620 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
621 	/* kl1, kl2 */
622 	subL[8] = kll; subR[8] = klr;
623 	subL[9] = krl; subR[9] = krr;
624 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
625 	/* k9 */
626 	subL[12] = kll; subR[12] = klr;
627 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
628 	/* k11, k12 */
629 	subL[14] = kll; subR[14] = klr;
630 	subL[15] = krl; subR[15] = krr;
631 	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
632 	/* k15, k16 */
633 	subL[20] = kll; subR[20] = klr;
634 	subL[21] = krl; subR[21] = krr;
635 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
636 	/* kw3, kw4 */
637 	subL[24] = kll; subR[24] = klr;
638 	subL[25] = krl; subR[25] = krr;
639 
640 	camellia_setup_tail(subkey, subL, subR, 24);
641 }
642 
643 static void camellia_setup256(const unsigned char *key, u32 *subkey)
644 {
645 	u32 kll, klr, krl, krr;        /* left half of key */
646 	u32 krll, krlr, krrl, krrr;    /* right half of key */
647 	u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
648 	u32 subL[34];
649 	u32 subR[34];
650 
651 	/**
652 	 *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
653 	 *  (|| is concatenation)
654 	 */
655 	kll = get_unaligned_be32(key);
656 	klr = get_unaligned_be32(key + 4);
657 	krl = get_unaligned_be32(key + 8);
658 	krr = get_unaligned_be32(key + 12);
659 	krll = get_unaligned_be32(key + 16);
660 	krlr = get_unaligned_be32(key + 20);
661 	krrl = get_unaligned_be32(key + 24);
662 	krrr = get_unaligned_be32(key + 28);
663 
664 	/* generate KL dependent subkeys */
665 	/* kw1 */
666 	subL[0] = kll; subR[0] = klr;
667 	/* kw2 */
668 	subL[1] = krl; subR[1] = krr;
669 	ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
670 	/* k9 */
671 	subL[12] = kll; subR[12] = klr;
672 	/* k10 */
673 	subL[13] = krl; subR[13] = krr;
674 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
675 	/* kl3 */
676 	subL[16] = kll; subR[16] = klr;
677 	/* kl4 */
678 	subL[17] = krl; subR[17] = krr;
679 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
680 	/* k17 */
681 	subL[22] = kll; subR[22] = klr;
682 	/* k18 */
683 	subL[23] = krl; subR[23] = krr;
684 	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
685 	/* k23 */
686 	subL[30] = kll; subR[30] = klr;
687 	/* k24 */
688 	subL[31] = krl; subR[31] = krr;
689 
690 	/* generate KR dependent subkeys */
691 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
692 	/* k3 */
693 	subL[4] = krll; subR[4] = krlr;
694 	/* k4 */
695 	subL[5] = krrl; subR[5] = krrr;
696 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
697 	/* kl1 */
698 	subL[8] = krll; subR[8] = krlr;
699 	/* kl2 */
700 	subL[9] = krrl; subR[9] = krrr;
701 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
702 	/* k13 */
703 	subL[18] = krll; subR[18] = krlr;
704 	/* k14 */
705 	subL[19] = krrl; subR[19] = krrr;
706 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
707 	/* k19 */
708 	subL[26] = krll; subR[26] = krlr;
709 	/* k20 */
710 	subL[27] = krrl; subR[27] = krrr;
711 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
712 
713 	/* generate KA */
714 	kll = subL[0] ^ krll; klr = subR[0] ^ krlr;
715 	krl = subL[1] ^ krrl; krr = subR[1] ^ krrr;
716 	CAMELLIA_F(kll, klr,
717 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
718 		   w0, w1, il, ir, t0, t1);
719 	krl ^= w0; krr ^= w1;
720 	CAMELLIA_F(krl, krr,
721 		   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
722 		   kll, klr, il, ir, t0, t1);
723 	kll ^= krll; klr ^= krlr;
724 	CAMELLIA_F(kll, klr,
725 		   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
726 		   krl, krr, il, ir, t0, t1);
727 	krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
728 	CAMELLIA_F(krl, krr,
729 		   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
730 		   w0, w1, il, ir, t0, t1);
731 	kll ^= w0; klr ^= w1;
732 
733 	/* generate KB */
734 	krll ^= kll; krlr ^= klr;
735 	krrl ^= krl; krrr ^= krr;
736 	CAMELLIA_F(krll, krlr,
737 		   CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
738 		   w0, w1, il, ir, t0, t1);
739 	krrl ^= w0; krrr ^= w1;
740 	CAMELLIA_F(krrl, krrr,
741 		   CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
742 		   w0, w1, il, ir, t0, t1);
743 	krll ^= w0; krlr ^= w1;
744 
745 	/* generate KA dependent subkeys */
746 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
747 	/* k5 */
748 	subL[6] = kll; subR[6] = klr;
749 	/* k6 */
750 	subL[7] = krl; subR[7] = krr;
751 	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
752 	/* k11 */
753 	subL[14] = kll; subR[14] = klr;
754 	/* k12 */
755 	subL[15] = krl; subR[15] = krr;
756 	/* rotation left shift 32bit */
757 	/* kl5 */
758 	subL[24] = klr; subR[24] = krl;
759 	/* kl6 */
760 	subL[25] = krr; subR[25] = kll;
761 	/* rotation left shift 49 from k11,k12 -> k21,k22 */
762 	ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
763 	/* k21 */
764 	subL[28] = kll; subR[28] = klr;
765 	/* k22 */
766 	subL[29] = krl; subR[29] = krr;
767 
768 	/* generate KB dependent subkeys */
769 	/* k1 */
770 	subL[2] = krll; subR[2] = krlr;
771 	/* k2 */
772 	subL[3] = krrl; subR[3] = krrr;
773 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
774 	/* k7 */
775 	subL[10] = krll; subR[10] = krlr;
776 	/* k8 */
777 	subL[11] = krrl; subR[11] = krrr;
778 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
779 	/* k15 */
780 	subL[20] = krll; subR[20] = krlr;
781 	/* k16 */
782 	subL[21] = krrl; subR[21] = krrr;
783 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
784 	/* kw3 */
785 	subL[32] = krll; subR[32] = krlr;
786 	/* kw4 */
787 	subL[33] = krrl; subR[33] = krrr;
788 
789 	camellia_setup_tail(subkey, subL, subR, 32);
790 }
791 
792 static void camellia_setup192(const unsigned char *key, u32 *subkey)
793 {
794 	unsigned char kk[32];
795 	u32 krll, krlr, krrl, krrr;
796 
797 	memcpy(kk, key, 24);
798 	memcpy((unsigned char *)&krll, key+16, 4);
799 	memcpy((unsigned char *)&krlr, key+20, 4);
800 	krrl = ~krll;
801 	krrr = ~krlr;
802 	memcpy(kk+24, (unsigned char *)&krrl, 4);
803 	memcpy(kk+28, (unsigned char *)&krrr, 4);
804 	camellia_setup256(kk, subkey);
805 }
806 
807 
808 /*
809  * Encrypt/decrypt
810  */
811 #define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) ({ \
812 	t0 = kll;							\
813 	t2 = krr;							\
814 	t0 &= ll;							\
815 	t2 |= rr;							\
816 	rl ^= t2;							\
817 	lr ^= rol32(t0, 1);						\
818 	t3 = krl;							\
819 	t1 = klr;							\
820 	t3 &= rl;							\
821 	t1 |= lr;							\
822 	ll ^= t1;							\
823 	rr ^= rol32(t3, 1);						\
824 })
825 
826 #define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir) ({		\
827 	yl ^= kl;							\
828 	yr ^= kr;							\
829 	ir =  camellia_sp1110[(u8)xr];					\
830 	il =  camellia_sp1110[(u8)(xl >> 24)];				\
831 	ir ^= camellia_sp0222[(u8)(xr >> 24)];				\
832 	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
833 	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
834 	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
835 	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
836 	il ^= camellia_sp4404[(u8)xl];					\
837 	ir ^= il;							\
838 	yl ^= ir;							\
839 	yr ^= ror32(il, 8) ^ ir;					\
840 })
841 
842 /* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
843 static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
844 {
845 	u32 il, ir, t0, t1;            /* temporary variables */
846 
847 	/* pre whitening but absorb kw2 */
848 	io[0] ^= SUBKEY_L(0);
849 	io[1] ^= SUBKEY_R(0);
850 
851 	/* main iteration */
852 #define ROUNDS(i) ({ \
853 	CAMELLIA_ROUNDSM(io[0], io[1], \
854 			 SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
855 			 io[2], io[3], il, ir); \
856 	CAMELLIA_ROUNDSM(io[2], io[3], \
857 			 SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
858 			 io[0], io[1], il, ir); \
859 	CAMELLIA_ROUNDSM(io[0], io[1], \
860 			 SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
861 			 io[2], io[3], il, ir); \
862 	CAMELLIA_ROUNDSM(io[2], io[3], \
863 			 SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
864 			 io[0], io[1], il, ir); \
865 	CAMELLIA_ROUNDSM(io[0], io[1], \
866 			 SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
867 			 io[2], io[3], il, ir); \
868 	CAMELLIA_ROUNDSM(io[2], io[3], \
869 			 SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
870 			 io[0], io[1], il, ir); \
871 })
872 #define FLS(i) ({ \
873 	CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
874 		     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
875 		     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
876 		     t0, t1, il, ir); \
877 })
878 
879 	ROUNDS(0);
880 	FLS(8);
881 	ROUNDS(8);
882 	FLS(16);
883 	ROUNDS(16);
884 	if (max == 32) {
885 		FLS(24);
886 		ROUNDS(24);
887 	}
888 
889 #undef ROUNDS
890 #undef FLS
891 
892 	/* post whitening but kw4 */
893 	io[2] ^= SUBKEY_L(max);
894 	io[3] ^= SUBKEY_R(max);
895 	/* NB: io[0],[1] should be swapped with [2],[3] by caller! */
896 }
897 
898 static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
899 {
900 	u32 il, ir, t0, t1;            /* temporary variables */
901 
902 	/* pre whitening but absorb kw2 */
903 	io[0] ^= SUBKEY_L(i);
904 	io[1] ^= SUBKEY_R(i);
905 
906 	/* main iteration */
907 #define ROUNDS(i) ({ \
908 	CAMELLIA_ROUNDSM(io[0], io[1], \
909 			 SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
910 			 io[2], io[3], il, ir); \
911 	CAMELLIA_ROUNDSM(io[2], io[3], \
912 			 SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
913 			 io[0], io[1], il, ir); \
914 	CAMELLIA_ROUNDSM(io[0], io[1], \
915 			 SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
916 			 io[2], io[3], il, ir); \
917 	CAMELLIA_ROUNDSM(io[2], io[3], \
918 			 SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
919 			 io[0], io[1], il, ir); \
920 	CAMELLIA_ROUNDSM(io[0], io[1], \
921 			 SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
922 			 io[2], io[3], il, ir); \
923 	CAMELLIA_ROUNDSM(io[2], io[3], \
924 			 SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
925 			 io[0], io[1], il, ir); \
926 })
927 #define FLS(i) ({ \
928 	CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
929 		     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
930 		     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
931 		     t0, t1, il, ir); \
932 })
933 
934 	if (i == 32) {
935 		ROUNDS(24);
936 		FLS(24);
937 	}
938 	ROUNDS(16);
939 	FLS(16);
940 	ROUNDS(8);
941 	FLS(8);
942 	ROUNDS(0);
943 
944 #undef ROUNDS
945 #undef FLS
946 
947 	/* post whitening but kw4 */
948 	io[2] ^= SUBKEY_L(0);
949 	io[3] ^= SUBKEY_R(0);
950 	/* NB: 0,1 should be swapped with 2,3 by caller! */
951 }
952 
953 
954 struct camellia_ctx {
955 	int key_length;
956 	u32 key_table[CAMELLIA_TABLE_BYTE_LEN / sizeof(u32)];
957 };
958 
959 static int
960 camellia_set_key(struct crypto_tfm *tfm, const u8 *in_key,
961 		 unsigned int key_len)
962 {
963 	struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
964 	const unsigned char *key = (const unsigned char *)in_key;
965 
966 	if (key_len != 16 && key_len != 24 && key_len != 32)
967 		return -EINVAL;
968 
969 	cctx->key_length = key_len;
970 
971 	switch (key_len) {
972 	case 16:
973 		camellia_setup128(key, cctx->key_table);
974 		break;
975 	case 24:
976 		camellia_setup192(key, cctx->key_table);
977 		break;
978 	case 32:
979 		camellia_setup256(key, cctx->key_table);
980 		break;
981 	}
982 
983 	return 0;
984 }
985 
986 static void camellia_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
987 {
988 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
989 	unsigned int max;
990 
991 	u32 tmp[4];
992 
993 	tmp[0] = get_unaligned_be32(in);
994 	tmp[1] = get_unaligned_be32(in + 4);
995 	tmp[2] = get_unaligned_be32(in + 8);
996 	tmp[3] = get_unaligned_be32(in + 12);
997 
998 	if (cctx->key_length == 16)
999 		max = 24;
1000 	else
1001 		max = 32; /* for key lengths of 24 and 32 */
1002 
1003 	camellia_do_encrypt(cctx->key_table, tmp, max);
1004 
1005 	/* do_encrypt returns 0,1 swapped with 2,3 */
1006 	put_unaligned_be32(tmp[2], out);
1007 	put_unaligned_be32(tmp[3], out + 4);
1008 	put_unaligned_be32(tmp[0], out + 8);
1009 	put_unaligned_be32(tmp[1], out + 12);
1010 }
1011 
1012 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1013 {
1014 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1015 	unsigned int max;
1016 
1017 	u32 tmp[4];
1018 
1019 	tmp[0] = get_unaligned_be32(in);
1020 	tmp[1] = get_unaligned_be32(in + 4);
1021 	tmp[2] = get_unaligned_be32(in + 8);
1022 	tmp[3] = get_unaligned_be32(in + 12);
1023 
1024 	if (cctx->key_length == 16)
1025 		max = 24;
1026 	else
1027 		max = 32; /* for key lengths of 24 and 32 */
1028 
1029 	camellia_do_decrypt(cctx->key_table, tmp, max);
1030 
1031 	/* do_decrypt returns 0,1 swapped with 2,3 */
1032 	put_unaligned_be32(tmp[2], out);
1033 	put_unaligned_be32(tmp[3], out + 4);
1034 	put_unaligned_be32(tmp[0], out + 8);
1035 	put_unaligned_be32(tmp[1], out + 12);
1036 }
1037 
1038 static struct crypto_alg camellia_alg = {
1039 	.cra_name		=	"camellia",
1040 	.cra_driver_name	=	"camellia-generic",
1041 	.cra_priority		=	100,
1042 	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
1043 	.cra_blocksize		=	CAMELLIA_BLOCK_SIZE,
1044 	.cra_ctxsize		=	sizeof(struct camellia_ctx),
1045 	.cra_module		=	THIS_MODULE,
1046 	.cra_u			=	{
1047 		.cipher = {
1048 			.cia_min_keysize	=	CAMELLIA_MIN_KEY_SIZE,
1049 			.cia_max_keysize	=	CAMELLIA_MAX_KEY_SIZE,
1050 			.cia_setkey		=	camellia_set_key,
1051 			.cia_encrypt		=	camellia_encrypt,
1052 			.cia_decrypt		=	camellia_decrypt
1053 		}
1054 	}
1055 };
1056 
1057 static int __init camellia_init(void)
1058 {
1059 	return crypto_register_alg(&camellia_alg);
1060 }
1061 
1062 static void __exit camellia_fini(void)
1063 {
1064 	crypto_unregister_alg(&camellia_alg);
1065 }
1066 
1067 subsys_initcall(camellia_init);
1068 module_exit(camellia_fini);
1069 
1070 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
1071 MODULE_LICENSE("GPL");
1072 MODULE_ALIAS_CRYPTO("camellia");
1073 MODULE_ALIAS_CRYPTO("camellia-generic");
1074