xref: /linux/crypto/camellia_generic.c (revision 4949009eb8d40a441dcddcd96e101e77d31cf1b2) 
1 /*
2  * Copyright (C) 2006
3  * NTT (Nippon Telegraph and Telephone Corporation).
4  *
5  * This program is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU General Public License
7  * as published by the Free Software Foundation; either version 2
8  * of the License, or (at your option) any later version.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License
16  * along with this program; if not, write to the Free Software
17  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
18  */
19 
20 /*
21  * Algorithm Specification
22  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
23  */
24 
25 /*
26  *
27  * NOTE --- NOTE --- NOTE --- NOTE
28  * This implementation assumes that all memory addresses passed
29  * as parameters are four-byte aligned.
30  *
31  */
32 
33 #include <linux/crypto.h>
34 #include <linux/errno.h>
35 #include <linux/init.h>
36 #include <linux/kernel.h>
37 #include <linux/module.h>
38 #include <linux/bitops.h>
39 #include <asm/unaligned.h>
40 
41 static const u32 camellia_sp1110[256] = {
42 	0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00,
43 	0xb3b3b300, 0x27272700, 0xc0c0c000, 0xe5e5e500,
44 	0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
45 	0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100,
46 	0x23232300, 0xefefef00, 0x6b6b6b00, 0x93939300,
47 	0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
48 	0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00,
49 	0x1d1d1d00, 0x65656500, 0x92929200, 0xbdbdbd00,
50 	0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
51 	0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00,
52 	0x3e3e3e00, 0x30303000, 0xdcdcdc00, 0x5f5f5f00,
53 	0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
54 	0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00,
55 	0xd5d5d500, 0x47474700, 0x5d5d5d00, 0x3d3d3d00,
56 	0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
57 	0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00,
58 	0x8b8b8b00, 0x0d0d0d00, 0x9a9a9a00, 0x66666600,
59 	0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
60 	0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000,
61 	0xf0f0f000, 0xb1b1b100, 0x84848400, 0x99999900,
62 	0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
63 	0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500,
64 	0x6d6d6d00, 0xb7b7b700, 0xa9a9a900, 0x31313100,
65 	0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
66 	0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100,
67 	0xdedede00, 0x1b1b1b00, 0x11111100, 0x1c1c1c00,
68 	0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
69 	0x53535300, 0x18181800, 0xf2f2f200, 0x22222200,
70 	0xfefefe00, 0x44444400, 0xcfcfcf00, 0xb2b2b200,
71 	0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
72 	0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800,
73 	0x60606000, 0xfcfcfc00, 0x69696900, 0x50505000,
74 	0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
75 	0xa1a1a100, 0x89898900, 0x62626200, 0x97979700,
76 	0x54545400, 0x5b5b5b00, 0x1e1e1e00, 0x95959500,
77 	0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
78 	0x10101000, 0xc4c4c400, 0x00000000, 0x48484800,
79 	0xa3a3a300, 0xf7f7f700, 0x75757500, 0xdbdbdb00,
80 	0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
81 	0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400,
82 	0x87878700, 0x5c5c5c00, 0x83838300, 0x02020200,
83 	0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
84 	0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300,
85 	0x9d9d9d00, 0x7f7f7f00, 0xbfbfbf00, 0xe2e2e200,
86 	0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
87 	0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00,
88 	0x81818100, 0x96969600, 0x6f6f6f00, 0x4b4b4b00,
89 	0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
90 	0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00,
91 	0x9f9f9f00, 0x6e6e6e00, 0xbcbcbc00, 0x8e8e8e00,
92 	0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
93 	0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900,
94 	0x78787800, 0x98989800, 0x06060600, 0x6a6a6a00,
95 	0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
96 	0xd4d4d400, 0x25252500, 0xababab00, 0x42424200,
97 	0x88888800, 0xa2a2a200, 0x8d8d8d00, 0xfafafa00,
98 	0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
99 	0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00,
100 	0x36363600, 0x49494900, 0x2a2a2a00, 0x68686800,
101 	0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
102 	0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00,
103 	0xbbbbbb00, 0xc9c9c900, 0x43434300, 0xc1c1c100,
104 	0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
105 	0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00,
106 };
107 
108 static const u32 camellia_sp0222[256] = {
109 	0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9,
110 	0x00676767, 0x004e4e4e, 0x00818181, 0x00cbcbcb,
111 	0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
112 	0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282,
113 	0x00464646, 0x00dfdfdf, 0x00d6d6d6, 0x00272727,
114 	0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
115 	0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c,
116 	0x003a3a3a, 0x00cacaca, 0x00252525, 0x007b7b7b,
117 	0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
118 	0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d,
119 	0x007c7c7c, 0x00606060, 0x00b9b9b9, 0x00bebebe,
120 	0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
121 	0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595,
122 	0x00ababab, 0x008e8e8e, 0x00bababa, 0x007a7a7a,
123 	0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
124 	0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a,
125 	0x00171717, 0x001a1a1a, 0x00353535, 0x00cccccc,
126 	0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
127 	0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040,
128 	0x00e1e1e1, 0x00636363, 0x00090909, 0x00333333,
129 	0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
130 	0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a,
131 	0x00dadada, 0x006f6f6f, 0x00535353, 0x00626262,
132 	0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
133 	0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2,
134 	0x00bdbdbd, 0x00363636, 0x00222222, 0x00383838,
135 	0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
136 	0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444,
137 	0x00fdfdfd, 0x00888888, 0x009f9f9f, 0x00656565,
138 	0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
139 	0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151,
140 	0x00c0c0c0, 0x00f9f9f9, 0x00d2d2d2, 0x00a0a0a0,
141 	0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
142 	0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f,
143 	0x00a8a8a8, 0x00b6b6b6, 0x003c3c3c, 0x002b2b2b,
144 	0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
145 	0x00202020, 0x00898989, 0x00000000, 0x00909090,
146 	0x00474747, 0x00efefef, 0x00eaeaea, 0x00b7b7b7,
147 	0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
148 	0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929,
149 	0x000f0f0f, 0x00b8b8b8, 0x00070707, 0x00040404,
150 	0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
151 	0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7,
152 	0x003b3b3b, 0x00fefefe, 0x007f7f7f, 0x00c5c5c5,
153 	0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
154 	0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676,
155 	0x00030303, 0x002d2d2d, 0x00dedede, 0x00969696,
156 	0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
157 	0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919,
158 	0x003f3f3f, 0x00dcdcdc, 0x00797979, 0x001d1d1d,
159 	0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
160 	0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2,
161 	0x00f0f0f0, 0x00313131, 0x000c0c0c, 0x00d4d4d4,
162 	0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
163 	0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484,
164 	0x00111111, 0x00454545, 0x001b1b1b, 0x00f5f5f5,
165 	0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
166 	0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414,
167 	0x006c6c6c, 0x00929292, 0x00545454, 0x00d0d0d0,
168 	0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
169 	0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6,
170 	0x00777777, 0x00939393, 0x00868686, 0x00838383,
171 	0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
172 	0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d,
173 };
174 
175 static const u32 camellia_sp3033[256] = {
176 	0x38003838, 0x41004141, 0x16001616, 0x76007676,
177 	0xd900d9d9, 0x93009393, 0x60006060, 0xf200f2f2,
178 	0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
179 	0x75007575, 0x06000606, 0x57005757, 0xa000a0a0,
180 	0x91009191, 0xf700f7f7, 0xb500b5b5, 0xc900c9c9,
181 	0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
182 	0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727,
183 	0x8e008e8e, 0xb200b2b2, 0x49004949, 0xde00dede,
184 	0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
185 	0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767,
186 	0x1f001f1f, 0x18001818, 0x6e006e6e, 0xaf00afaf,
187 	0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
188 	0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565,
189 	0xea00eaea, 0xa300a3a3, 0xae00aeae, 0x9e009e9e,
190 	0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
191 	0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6,
192 	0xc500c5c5, 0x86008686, 0x4d004d4d, 0x33003333,
193 	0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
194 	0x3a003a3a, 0x09000909, 0x95009595, 0x10001010,
195 	0x78007878, 0xd800d8d8, 0x42004242, 0xcc00cccc,
196 	0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
197 	0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282,
198 	0xb600b6b6, 0xdb00dbdb, 0xd400d4d4, 0x98009898,
199 	0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
200 	0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0,
201 	0x6f006f6f, 0x8d008d8d, 0x88008888, 0x0e000e0e,
202 	0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
203 	0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111,
204 	0x7f007f7f, 0x22002222, 0xe700e7e7, 0x59005959,
205 	0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
206 	0x12001212, 0x04000404, 0x74007474, 0x54005454,
207 	0x30003030, 0x7e007e7e, 0xb400b4b4, 0x28002828,
208 	0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
209 	0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb,
210 	0x2a002a2a, 0xad00adad, 0x0f000f0f, 0xca00caca,
211 	0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
212 	0x08000808, 0x62006262, 0x00000000, 0x24002424,
213 	0xd100d1d1, 0xfb00fbfb, 0xba00baba, 0xed00eded,
214 	0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
215 	0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a,
216 	0xc300c3c3, 0x2e002e2e, 0xc100c1c1, 0x01000101,
217 	0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
218 	0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9,
219 	0xce00cece, 0xbf00bfbf, 0xdf00dfdf, 0x71007171,
220 	0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
221 	0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d,
222 	0xc000c0c0, 0x4b004b4b, 0xb700b7b7, 0xa500a5a5,
223 	0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
224 	0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646,
225 	0xcf00cfcf, 0x37003737, 0x5e005e5e, 0x47004747,
226 	0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
227 	0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac,
228 	0x3c003c3c, 0x4c004c4c, 0x03000303, 0x35003535,
229 	0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
230 	0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121,
231 	0x44004444, 0x51005151, 0xc600c6c6, 0x7d007d7d,
232 	0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
233 	0x7c007c7c, 0x77007777, 0x56005656, 0x05000505,
234 	0x1b001b1b, 0xa400a4a4, 0x15001515, 0x34003434,
235 	0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
236 	0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd,
237 	0xdd00dddd, 0xe400e4e4, 0xa100a1a1, 0xe000e0e0,
238 	0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
239 	0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f,
240 };
241 
242 static const u32 camellia_sp4404[256] = {
243 	0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0,
244 	0xe4e400e4, 0x57570057, 0xeaea00ea, 0xaeae00ae,
245 	0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
246 	0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092,
247 	0x86860086, 0xafaf00af, 0x7c7c007c, 0x1f1f001f,
248 	0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
249 	0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d,
250 	0xd9d900d9, 0x5a5a005a, 0x51510051, 0x6c6c006c,
251 	0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
252 	0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084,
253 	0xdfdf00df, 0xcbcb00cb, 0x34340034, 0x76760076,
254 	0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
255 	0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011,
256 	0x32320032, 0x9c9c009c, 0x53530053, 0xf2f200f2,
257 	0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
258 	0x24240024, 0xe8e800e8, 0x60600060, 0x69690069,
259 	0xaaaa00aa, 0xa0a000a0, 0xa1a100a1, 0x62620062,
260 	0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
261 	0x10100010, 0x00000000, 0xa3a300a3, 0x75750075,
262 	0x8a8a008a, 0xe6e600e6, 0x09090009, 0xdddd00dd,
263 	0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
264 	0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf,
265 	0x52520052, 0xd8d800d8, 0xc8c800c8, 0xc6c600c6,
266 	0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
267 	0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc,
268 	0x29290029, 0xf9f900f9, 0x2f2f002f, 0xb4b400b4,
269 	0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
270 	0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d,
271 	0x72720072, 0xb9b900b9, 0xf8f800f8, 0xacac00ac,
272 	0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
273 	0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043,
274 	0x15150015, 0xadad00ad, 0x77770077, 0x80800080,
275 	0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
276 	0x85850085, 0x35350035, 0x0c0c000c, 0x41410041,
277 	0xefef00ef, 0x93930093, 0x19190019, 0x21210021,
278 	0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
279 	0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce,
280 	0x30300030, 0x5f5f005f, 0xc5c500c5, 0x1a1a001a,
281 	0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
282 	0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d,
283 	0x0d0d000d, 0x66660066, 0xcccc00cc, 0x2d2d002d,
284 	0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
285 	0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005,
286 	0xb7b700b7, 0x31310031, 0x17170017, 0xd7d700d7,
287 	0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
288 	0x0f0f000f, 0x16160016, 0x18180018, 0x22220022,
289 	0x44440044, 0xb2b200b2, 0xb5b500b5, 0x91910091,
290 	0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
291 	0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097,
292 	0x5b5b005b, 0x95950095, 0xffff00ff, 0xd2d200d2,
293 	0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
294 	0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094,
295 	0x5c5c005c, 0x02020002, 0x4a4a004a, 0x33330033,
296 	0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
297 	0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b,
298 	0x96960096, 0x4b4b004b, 0xbebe00be, 0x2e2e002e,
299 	0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
300 	0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059,
301 	0x98980098, 0x6a6a006a, 0x46460046, 0xbaba00ba,
302 	0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
303 	0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a,
304 	0x49490049, 0x68680068, 0x38380038, 0xa4a400a4,
305 	0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
306 	0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e,
307 };
308 
309 
310 #define CAMELLIA_MIN_KEY_SIZE        16
311 #define CAMELLIA_MAX_KEY_SIZE        32
312 #define CAMELLIA_BLOCK_SIZE          16
313 #define CAMELLIA_TABLE_BYTE_LEN     272
314 
315 /*
316  * NB: L and R below stand for 'left' and 'right' as in written numbers.
317  * That is, in (xxxL,xxxR) pair xxxL holds most significant digits,
318  * _not_ least significant ones!
319  */
320 
321 
322 /* key constants */
323 
324 #define CAMELLIA_SIGMA1L (0xA09E667FL)
325 #define CAMELLIA_SIGMA1R (0x3BCC908BL)
326 #define CAMELLIA_SIGMA2L (0xB67AE858L)
327 #define CAMELLIA_SIGMA2R (0x4CAA73B2L)
328 #define CAMELLIA_SIGMA3L (0xC6EF372FL)
329 #define CAMELLIA_SIGMA3R (0xE94F82BEL)
330 #define CAMELLIA_SIGMA4L (0x54FF53A5L)
331 #define CAMELLIA_SIGMA4R (0xF1D36F1CL)
332 #define CAMELLIA_SIGMA5L (0x10E527FAL)
333 #define CAMELLIA_SIGMA5R (0xDE682D1DL)
334 #define CAMELLIA_SIGMA6L (0xB05688C2L)
335 #define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
336 
337 /*
338  *  macros
339  */
340 #define ROLDQ(ll, lr, rl, rr, w0, w1, bits) ({		\
341 	w0 = ll;					\
342 	ll = (ll << bits) + (lr >> (32 - bits));	\
343 	lr = (lr << bits) + (rl >> (32 - bits));	\
344 	rl = (rl << bits) + (rr >> (32 - bits));	\
345 	rr = (rr << bits) + (w0 >> (32 - bits));	\
346 })
347 
348 #define ROLDQo32(ll, lr, rl, rr, w0, w1, bits) ({	\
349 	w0 = ll;					\
350 	w1 = lr;					\
351 	ll = (lr << (bits - 32)) + (rl >> (64 - bits));	\
352 	lr = (rl << (bits - 32)) + (rr >> (64 - bits));	\
353 	rl = (rr << (bits - 32)) + (w0 >> (64 - bits));	\
354 	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
355 })
356 
357 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1) ({	\
358 	il = xl ^ kl;						\
359 	ir = xr ^ kr;						\
360 	t0 = il >> 16;						\
361 	t1 = ir >> 16;						\
362 	yl = camellia_sp1110[(u8)(ir)]				\
363 	   ^ camellia_sp0222[(u8)(t1 >> 8)]			\
364 	   ^ camellia_sp3033[(u8)(t1)]				\
365 	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
366 	yr = camellia_sp1110[(u8)(t0 >> 8)]			\
367 	   ^ camellia_sp0222[(u8)(t0)]				\
368 	   ^ camellia_sp3033[(u8)(il >> 8)]			\
369 	   ^ camellia_sp4404[(u8)(il)];				\
370 	yl ^= yr;						\
371 	yr = ror32(yr, 8);					\
372 	yr ^= yl;						\
373 })
374 
375 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
376 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
377 
378 static void camellia_setup_tail(u32 *subkey, u32 *subL, u32 *subR, int max)
379 {
380 	u32 dw, tl, tr;
381 	u32 kw4l, kw4r;
382 
383 	/* absorb kw2 to other subkeys */
384 	/* round 2 */
385 	subL[3] ^= subL[1]; subR[3] ^= subR[1];
386 	/* round 4 */
387 	subL[5] ^= subL[1]; subR[5] ^= subR[1];
388 	/* round 6 */
389 	subL[7] ^= subL[1]; subR[7] ^= subR[1];
390 	subL[1] ^= subR[1] & ~subR[9];
391 	dw = subL[1] & subL[9];
392 	subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl2) */
393 	/* round 8 */
394 	subL[11] ^= subL[1]; subR[11] ^= subR[1];
395 	/* round 10 */
396 	subL[13] ^= subL[1]; subR[13] ^= subR[1];
397 	/* round 12 */
398 	subL[15] ^= subL[1]; subR[15] ^= subR[1];
399 	subL[1] ^= subR[1] & ~subR[17];
400 	dw = subL[1] & subL[17];
401 	subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl4) */
402 	/* round 14 */
403 	subL[19] ^= subL[1]; subR[19] ^= subR[1];
404 	/* round 16 */
405 	subL[21] ^= subL[1]; subR[21] ^= subR[1];
406 	/* round 18 */
407 	subL[23] ^= subL[1]; subR[23] ^= subR[1];
408 	if (max == 24) {
409 		/* kw3 */
410 		subL[24] ^= subL[1]; subR[24] ^= subR[1];
411 
412 	/* absorb kw4 to other subkeys */
413 		kw4l = subL[25]; kw4r = subR[25];
414 	} else {
415 		subL[1] ^= subR[1] & ~subR[25];
416 		dw = subL[1] & subL[25];
417 		subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl6) */
418 		/* round 20 */
419 		subL[27] ^= subL[1]; subR[27] ^= subR[1];
420 		/* round 22 */
421 		subL[29] ^= subL[1]; subR[29] ^= subR[1];
422 		/* round 24 */
423 		subL[31] ^= subL[1]; subR[31] ^= subR[1];
424 		/* kw3 */
425 		subL[32] ^= subL[1]; subR[32] ^= subR[1];
426 
427 	/* absorb kw4 to other subkeys */
428 		kw4l = subL[33]; kw4r = subR[33];
429 		/* round 23 */
430 		subL[30] ^= kw4l; subR[30] ^= kw4r;
431 		/* round 21 */
432 		subL[28] ^= kw4l; subR[28] ^= kw4r;
433 		/* round 19 */
434 		subL[26] ^= kw4l; subR[26] ^= kw4r;
435 		kw4l ^= kw4r & ~subR[24];
436 		dw = kw4l & subL[24];
437 		kw4r ^= rol32(dw, 1); /* modified for FL(kl5) */
438 	}
439 	/* round 17 */
440 	subL[22] ^= kw4l; subR[22] ^= kw4r;
441 	/* round 15 */
442 	subL[20] ^= kw4l; subR[20] ^= kw4r;
443 	/* round 13 */
444 	subL[18] ^= kw4l; subR[18] ^= kw4r;
445 	kw4l ^= kw4r & ~subR[16];
446 	dw = kw4l & subL[16];
447 	kw4r ^= rol32(dw, 1); /* modified for FL(kl3) */
448 	/* round 11 */
449 	subL[14] ^= kw4l; subR[14] ^= kw4r;
450 	/* round 9 */
451 	subL[12] ^= kw4l; subR[12] ^= kw4r;
452 	/* round 7 */
453 	subL[10] ^= kw4l; subR[10] ^= kw4r;
454 	kw4l ^= kw4r & ~subR[8];
455 	dw = kw4l & subL[8];
456 	kw4r ^= rol32(dw, 1); /* modified for FL(kl1) */
457 	/* round 5 */
458 	subL[6] ^= kw4l; subR[6] ^= kw4r;
459 	/* round 3 */
460 	subL[4] ^= kw4l; subR[4] ^= kw4r;
461 	/* round 1 */
462 	subL[2] ^= kw4l; subR[2] ^= kw4r;
463 	/* kw1 */
464 	subL[0] ^= kw4l; subR[0] ^= kw4r;
465 
466 	/* key XOR is end of F-function */
467 	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
468 	SUBKEY_R(0) = subR[0] ^ subR[2];
469 	SUBKEY_L(2) = subL[3];       /* round 1 */
470 	SUBKEY_R(2) = subR[3];
471 	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
472 	SUBKEY_R(3) = subR[2] ^ subR[4];
473 	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
474 	SUBKEY_R(4) = subR[3] ^ subR[5];
475 	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
476 	SUBKEY_R(5) = subR[4] ^ subR[6];
477 	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
478 	SUBKEY_R(6) = subR[5] ^ subR[7];
479 	tl = subL[10] ^ (subR[10] & ~subR[8]);
480 	dw = tl & subL[8];  /* FL(kl1) */
481 	tr = subR[10] ^ rol32(dw, 1);
482 	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
483 	SUBKEY_R(7) = subR[6] ^ tr;
484 	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
485 	SUBKEY_R(8) = subR[8];
486 	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
487 	SUBKEY_R(9) = subR[9];
488 	tl = subL[7] ^ (subR[7] & ~subR[9]);
489 	dw = tl & subL[9];  /* FLinv(kl2) */
490 	tr = subR[7] ^ rol32(dw, 1);
491 	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
492 	SUBKEY_R(10) = tr ^ subR[11];
493 	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
494 	SUBKEY_R(11) = subR[10] ^ subR[12];
495 	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
496 	SUBKEY_R(12) = subR[11] ^ subR[13];
497 	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
498 	SUBKEY_R(13) = subR[12] ^ subR[14];
499 	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
500 	SUBKEY_R(14) = subR[13] ^ subR[15];
501 	tl = subL[18] ^ (subR[18] & ~subR[16]);
502 	dw = tl & subL[16]; /* FL(kl3) */
503 	tr = subR[18] ^ rol32(dw, 1);
504 	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
505 	SUBKEY_R(15) = subR[14] ^ tr;
506 	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
507 	SUBKEY_R(16) = subR[16];
508 	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
509 	SUBKEY_R(17) = subR[17];
510 	tl = subL[15] ^ (subR[15] & ~subR[17]);
511 	dw = tl & subL[17]; /* FLinv(kl4) */
512 	tr = subR[15] ^ rol32(dw, 1);
513 	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
514 	SUBKEY_R(18) = tr ^ subR[19];
515 	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
516 	SUBKEY_R(19) = subR[18] ^ subR[20];
517 	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
518 	SUBKEY_R(20) = subR[19] ^ subR[21];
519 	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
520 	SUBKEY_R(21) = subR[20] ^ subR[22];
521 	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
522 	SUBKEY_R(22) = subR[21] ^ subR[23];
523 	if (max == 24) {
524 		SUBKEY_L(23) = subL[22];     /* round 18 */
525 		SUBKEY_R(23) = subR[22];
526 		SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
527 		SUBKEY_R(24) = subR[24] ^ subR[23];
528 	} else {
529 		tl = subL[26] ^ (subR[26] & ~subR[24]);
530 		dw = tl & subL[24]; /* FL(kl5) */
531 		tr = subR[26] ^ rol32(dw, 1);
532 		SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
533 		SUBKEY_R(23) = subR[22] ^ tr;
534 		SUBKEY_L(24) = subL[24];     /* FL(kl5) */
535 		SUBKEY_R(24) = subR[24];
536 		SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
537 		SUBKEY_R(25) = subR[25];
538 		tl = subL[23] ^ (subR[23] & ~subR[25]);
539 		dw = tl & subL[25]; /* FLinv(kl6) */
540 		tr = subR[23] ^ rol32(dw, 1);
541 		SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
542 		SUBKEY_R(26) = tr ^ subR[27];
543 		SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
544 		SUBKEY_R(27) = subR[26] ^ subR[28];
545 		SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
546 		SUBKEY_R(28) = subR[27] ^ subR[29];
547 		SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
548 		SUBKEY_R(29) = subR[28] ^ subR[30];
549 		SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
550 		SUBKEY_R(30) = subR[29] ^ subR[31];
551 		SUBKEY_L(31) = subL[30];     /* round 24 */
552 		SUBKEY_R(31) = subR[30];
553 		SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
554 		SUBKEY_R(32) = subR[32] ^ subR[31];
555 	}
556 }
557 
558 static void camellia_setup128(const unsigned char *key, u32 *subkey)
559 {
560 	u32 kll, klr, krl, krr;
561 	u32 il, ir, t0, t1, w0, w1;
562 	u32 subL[26];
563 	u32 subR[26];
564 
565 	/**
566 	 *  k == kll || klr || krl || krr (|| is concatenation)
567 	 */
568 	kll = get_unaligned_be32(key);
569 	klr = get_unaligned_be32(key + 4);
570 	krl = get_unaligned_be32(key + 8);
571 	krr = get_unaligned_be32(key + 12);
572 
573 	/* generate KL dependent subkeys */
574 	/* kw1 */
575 	subL[0] = kll; subR[0] = klr;
576 	/* kw2 */
577 	subL[1] = krl; subR[1] = krr;
578 	/* rotation left shift 15bit */
579 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
580 	/* k3 */
581 	subL[4] = kll; subR[4] = klr;
582 	/* k4 */
583 	subL[5] = krl; subR[5] = krr;
584 	/* rotation left shift 15+30bit */
585 	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
586 	/* k7 */
587 	subL[10] = kll; subR[10] = klr;
588 	/* k8 */
589 	subL[11] = krl; subR[11] = krr;
590 	/* rotation left shift 15+30+15bit */
591 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
592 	/* k10 */
593 	subL[13] = krl; subR[13] = krr;
594 	/* rotation left shift 15+30+15+17 bit */
595 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
596 	/* kl3 */
597 	subL[16] = kll; subR[16] = klr;
598 	/* kl4 */
599 	subL[17] = krl; subR[17] = krr;
600 	/* rotation left shift 15+30+15+17+17 bit */
601 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
602 	/* k13 */
603 	subL[18] = kll; subR[18] = klr;
604 	/* k14 */
605 	subL[19] = krl; subR[19] = krr;
606 	/* rotation left shift 15+30+15+17+17+17 bit */
607 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
608 	/* k17 */
609 	subL[22] = kll; subR[22] = klr;
610 	/* k18 */
611 	subL[23] = krl; subR[23] = krr;
612 
613 	/* generate KA */
614 	kll = subL[0]; klr = subR[0];
615 	krl = subL[1]; krr = subR[1];
616 	CAMELLIA_F(kll, klr,
617 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
618 		   w0, w1, il, ir, t0, t1);
619 	krl ^= w0; krr ^= w1;
620 	CAMELLIA_F(krl, krr,
621 		   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
622 		   kll, klr, il, ir, t0, t1);
623 	/* current status == (kll, klr, w0, w1) */
624 	CAMELLIA_F(kll, klr,
625 		   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
626 		   krl, krr, il, ir, t0, t1);
627 	krl ^= w0; krr ^= w1;
628 	CAMELLIA_F(krl, krr,
629 		   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
630 		   w0, w1, il, ir, t0, t1);
631 	kll ^= w0; klr ^= w1;
632 
633 	/* generate KA dependent subkeys */
634 	/* k1, k2 */
635 	subL[2] = kll; subR[2] = klr;
636 	subL[3] = krl; subR[3] = krr;
637 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
638 	/* k5,k6 */
639 	subL[6] = kll; subR[6] = klr;
640 	subL[7] = krl; subR[7] = krr;
641 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
642 	/* kl1, kl2 */
643 	subL[8] = kll; subR[8] = klr;
644 	subL[9] = krl; subR[9] = krr;
645 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
646 	/* k9 */
647 	subL[12] = kll; subR[12] = klr;
648 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
649 	/* k11, k12 */
650 	subL[14] = kll; subR[14] = klr;
651 	subL[15] = krl; subR[15] = krr;
652 	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
653 	/* k15, k16 */
654 	subL[20] = kll; subR[20] = klr;
655 	subL[21] = krl; subR[21] = krr;
656 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
657 	/* kw3, kw4 */
658 	subL[24] = kll; subR[24] = klr;
659 	subL[25] = krl; subR[25] = krr;
660 
661 	camellia_setup_tail(subkey, subL, subR, 24);
662 }
663 
664 static void camellia_setup256(const unsigned char *key, u32 *subkey)
665 {
666 	u32 kll, klr, krl, krr;        /* left half of key */
667 	u32 krll, krlr, krrl, krrr;    /* right half of key */
668 	u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
669 	u32 subL[34];
670 	u32 subR[34];
671 
672 	/**
673 	 *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
674 	 *  (|| is concatenation)
675 	 */
676 	kll = get_unaligned_be32(key);
677 	klr = get_unaligned_be32(key + 4);
678 	krl = get_unaligned_be32(key + 8);
679 	krr = get_unaligned_be32(key + 12);
680 	krll = get_unaligned_be32(key + 16);
681 	krlr = get_unaligned_be32(key + 20);
682 	krrl = get_unaligned_be32(key + 24);
683 	krrr = get_unaligned_be32(key + 28);
684 
685 	/* generate KL dependent subkeys */
686 	/* kw1 */
687 	subL[0] = kll; subR[0] = klr;
688 	/* kw2 */
689 	subL[1] = krl; subR[1] = krr;
690 	ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
691 	/* k9 */
692 	subL[12] = kll; subR[12] = klr;
693 	/* k10 */
694 	subL[13] = krl; subR[13] = krr;
695 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
696 	/* kl3 */
697 	subL[16] = kll; subR[16] = klr;
698 	/* kl4 */
699 	subL[17] = krl; subR[17] = krr;
700 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
701 	/* k17 */
702 	subL[22] = kll; subR[22] = klr;
703 	/* k18 */
704 	subL[23] = krl; subR[23] = krr;
705 	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
706 	/* k23 */
707 	subL[30] = kll; subR[30] = klr;
708 	/* k24 */
709 	subL[31] = krl; subR[31] = krr;
710 
711 	/* generate KR dependent subkeys */
712 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
713 	/* k3 */
714 	subL[4] = krll; subR[4] = krlr;
715 	/* k4 */
716 	subL[5] = krrl; subR[5] = krrr;
717 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
718 	/* kl1 */
719 	subL[8] = krll; subR[8] = krlr;
720 	/* kl2 */
721 	subL[9] = krrl; subR[9] = krrr;
722 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
723 	/* k13 */
724 	subL[18] = krll; subR[18] = krlr;
725 	/* k14 */
726 	subL[19] = krrl; subR[19] = krrr;
727 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
728 	/* k19 */
729 	subL[26] = krll; subR[26] = krlr;
730 	/* k20 */
731 	subL[27] = krrl; subR[27] = krrr;
732 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
733 
734 	/* generate KA */
735 	kll = subL[0] ^ krll; klr = subR[0] ^ krlr;
736 	krl = subL[1] ^ krrl; krr = subR[1] ^ krrr;
737 	CAMELLIA_F(kll, klr,
738 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
739 		   w0, w1, il, ir, t0, t1);
740 	krl ^= w0; krr ^= w1;
741 	CAMELLIA_F(krl, krr,
742 		   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
743 		   kll, klr, il, ir, t0, t1);
744 	kll ^= krll; klr ^= krlr;
745 	CAMELLIA_F(kll, klr,
746 		   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
747 		   krl, krr, il, ir, t0, t1);
748 	krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
749 	CAMELLIA_F(krl, krr,
750 		   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
751 		   w0, w1, il, ir, t0, t1);
752 	kll ^= w0; klr ^= w1;
753 
754 	/* generate KB */
755 	krll ^= kll; krlr ^= klr;
756 	krrl ^= krl; krrr ^= krr;
757 	CAMELLIA_F(krll, krlr,
758 		   CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
759 		   w0, w1, il, ir, t0, t1);
760 	krrl ^= w0; krrr ^= w1;
761 	CAMELLIA_F(krrl, krrr,
762 		   CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
763 		   w0, w1, il, ir, t0, t1);
764 	krll ^= w0; krlr ^= w1;
765 
766 	/* generate KA dependent subkeys */
767 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
768 	/* k5 */
769 	subL[6] = kll; subR[6] = klr;
770 	/* k6 */
771 	subL[7] = krl; subR[7] = krr;
772 	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
773 	/* k11 */
774 	subL[14] = kll; subR[14] = klr;
775 	/* k12 */
776 	subL[15] = krl; subR[15] = krr;
777 	/* rotation left shift 32bit */
778 	/* kl5 */
779 	subL[24] = klr; subR[24] = krl;
780 	/* kl6 */
781 	subL[25] = krr; subR[25] = kll;
782 	/* rotation left shift 49 from k11,k12 -> k21,k22 */
783 	ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
784 	/* k21 */
785 	subL[28] = kll; subR[28] = klr;
786 	/* k22 */
787 	subL[29] = krl; subR[29] = krr;
788 
789 	/* generate KB dependent subkeys */
790 	/* k1 */
791 	subL[2] = krll; subR[2] = krlr;
792 	/* k2 */
793 	subL[3] = krrl; subR[3] = krrr;
794 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
795 	/* k7 */
796 	subL[10] = krll; subR[10] = krlr;
797 	/* k8 */
798 	subL[11] = krrl; subR[11] = krrr;
799 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
800 	/* k15 */
801 	subL[20] = krll; subR[20] = krlr;
802 	/* k16 */
803 	subL[21] = krrl; subR[21] = krrr;
804 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
805 	/* kw3 */
806 	subL[32] = krll; subR[32] = krlr;
807 	/* kw4 */
808 	subL[33] = krrl; subR[33] = krrr;
809 
810 	camellia_setup_tail(subkey, subL, subR, 32);
811 }
812 
813 static void camellia_setup192(const unsigned char *key, u32 *subkey)
814 {
815 	unsigned char kk[32];
816 	u32 krll, krlr, krrl, krrr;
817 
818 	memcpy(kk, key, 24);
819 	memcpy((unsigned char *)&krll, key+16, 4);
820 	memcpy((unsigned char *)&krlr, key+20, 4);
821 	krrl = ~krll;
822 	krrr = ~krlr;
823 	memcpy(kk+24, (unsigned char *)&krrl, 4);
824 	memcpy(kk+28, (unsigned char *)&krrr, 4);
825 	camellia_setup256(kk, subkey);
826 }
827 
828 
829 /*
830  * Encrypt/decrypt
831  */
832 #define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) ({ \
833 	t0 = kll;							\
834 	t2 = krr;							\
835 	t0 &= ll;							\
836 	t2 |= rr;							\
837 	rl ^= t2;							\
838 	lr ^= rol32(t0, 1);						\
839 	t3 = krl;							\
840 	t1 = klr;							\
841 	t3 &= rl;							\
842 	t1 |= lr;							\
843 	ll ^= t1;							\
844 	rr ^= rol32(t3, 1);						\
845 })
846 
847 #define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir) ({		\
848 	yl ^= kl;							\
849 	yr ^= kr;							\
850 	ir =  camellia_sp1110[(u8)xr];					\
851 	il =  camellia_sp1110[(u8)(xl >> 24)];				\
852 	ir ^= camellia_sp0222[(u8)(xr >> 24)];				\
853 	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
854 	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
855 	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
856 	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
857 	il ^= camellia_sp4404[(u8)xl];					\
858 	ir ^= il;							\
859 	yl ^= ir;							\
860 	yr ^= ror32(il, 8) ^ ir;					\
861 })
862 
863 /* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
864 static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
865 {
866 	u32 il, ir, t0, t1;            /* temporary variables */
867 
868 	/* pre whitening but absorb kw2 */
869 	io[0] ^= SUBKEY_L(0);
870 	io[1] ^= SUBKEY_R(0);
871 
872 	/* main iteration */
873 #define ROUNDS(i) ({ \
874 	CAMELLIA_ROUNDSM(io[0], io[1], \
875 			 SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
876 			 io[2], io[3], il, ir); \
877 	CAMELLIA_ROUNDSM(io[2], io[3], \
878 			 SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
879 			 io[0], io[1], il, ir); \
880 	CAMELLIA_ROUNDSM(io[0], io[1], \
881 			 SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
882 			 io[2], io[3], il, ir); \
883 	CAMELLIA_ROUNDSM(io[2], io[3], \
884 			 SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
885 			 io[0], io[1], il, ir); \
886 	CAMELLIA_ROUNDSM(io[0], io[1], \
887 			 SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
888 			 io[2], io[3], il, ir); \
889 	CAMELLIA_ROUNDSM(io[2], io[3], \
890 			 SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
891 			 io[0], io[1], il, ir); \
892 })
893 #define FLS(i) ({ \
894 	CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
895 		     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
896 		     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
897 		     t0, t1, il, ir); \
898 })
899 
900 	ROUNDS(0);
901 	FLS(8);
902 	ROUNDS(8);
903 	FLS(16);
904 	ROUNDS(16);
905 	if (max == 32) {
906 		FLS(24);
907 		ROUNDS(24);
908 	}
909 
910 #undef ROUNDS
911 #undef FLS
912 
913 	/* post whitening but kw4 */
914 	io[2] ^= SUBKEY_L(max);
915 	io[3] ^= SUBKEY_R(max);
916 	/* NB: io[0],[1] should be swapped with [2],[3] by caller! */
917 }
918 
919 static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
920 {
921 	u32 il, ir, t0, t1;            /* temporary variables */
922 
923 	/* pre whitening but absorb kw2 */
924 	io[0] ^= SUBKEY_L(i);
925 	io[1] ^= SUBKEY_R(i);
926 
927 	/* main iteration */
928 #define ROUNDS(i) ({ \
929 	CAMELLIA_ROUNDSM(io[0], io[1], \
930 			 SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
931 			 io[2], io[3], il, ir); \
932 	CAMELLIA_ROUNDSM(io[2], io[3], \
933 			 SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
934 			 io[0], io[1], il, ir); \
935 	CAMELLIA_ROUNDSM(io[0], io[1], \
936 			 SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
937 			 io[2], io[3], il, ir); \
938 	CAMELLIA_ROUNDSM(io[2], io[3], \
939 			 SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
940 			 io[0], io[1], il, ir); \
941 	CAMELLIA_ROUNDSM(io[0], io[1], \
942 			 SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
943 			 io[2], io[3], il, ir); \
944 	CAMELLIA_ROUNDSM(io[2], io[3], \
945 			 SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
946 			 io[0], io[1], il, ir); \
947 })
948 #define FLS(i) ({ \
949 	CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
950 		     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
951 		     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
952 		     t0, t1, il, ir); \
953 })
954 
955 	if (i == 32) {
956 		ROUNDS(24);
957 		FLS(24);
958 	}
959 	ROUNDS(16);
960 	FLS(16);
961 	ROUNDS(8);
962 	FLS(8);
963 	ROUNDS(0);
964 
965 #undef ROUNDS
966 #undef FLS
967 
968 	/* post whitening but kw4 */
969 	io[2] ^= SUBKEY_L(0);
970 	io[3] ^= SUBKEY_R(0);
971 	/* NB: 0,1 should be swapped with 2,3 by caller! */
972 }
973 
974 
975 struct camellia_ctx {
976 	int key_length;
977 	u32 key_table[CAMELLIA_TABLE_BYTE_LEN / sizeof(u32)];
978 };
979 
980 static int
981 camellia_set_key(struct crypto_tfm *tfm, const u8 *in_key,
982 		 unsigned int key_len)
983 {
984 	struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
985 	const unsigned char *key = (const unsigned char *)in_key;
986 	u32 *flags = &tfm->crt_flags;
987 
988 	if (key_len != 16 && key_len != 24 && key_len != 32) {
989 		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
990 		return -EINVAL;
991 	}
992 
993 	cctx->key_length = key_len;
994 
995 	switch (key_len) {
996 	case 16:
997 		camellia_setup128(key, cctx->key_table);
998 		break;
999 	case 24:
1000 		camellia_setup192(key, cctx->key_table);
1001 		break;
1002 	case 32:
1003 		camellia_setup256(key, cctx->key_table);
1004 		break;
1005 	}
1006 
1007 	return 0;
1008 }
1009 
1010 static void camellia_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1011 {
1012 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1013 	const __be32 *src = (const __be32 *)in;
1014 	__be32 *dst = (__be32 *)out;
1015 	unsigned int max;
1016 
1017 	u32 tmp[4];
1018 
1019 	tmp[0] = be32_to_cpu(src[0]);
1020 	tmp[1] = be32_to_cpu(src[1]);
1021 	tmp[2] = be32_to_cpu(src[2]);
1022 	tmp[3] = be32_to_cpu(src[3]);
1023 
1024 	if (cctx->key_length == 16)
1025 		max = 24;
1026 	else
1027 		max = 32; /* for key lengths of 24 and 32 */
1028 
1029 	camellia_do_encrypt(cctx->key_table, tmp, max);
1030 
1031 	/* do_encrypt returns 0,1 swapped with 2,3 */
1032 	dst[0] = cpu_to_be32(tmp[2]);
1033 	dst[1] = cpu_to_be32(tmp[3]);
1034 	dst[2] = cpu_to_be32(tmp[0]);
1035 	dst[3] = cpu_to_be32(tmp[1]);
1036 }
1037 
1038 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1039 {
1040 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1041 	const __be32 *src = (const __be32 *)in;
1042 	__be32 *dst = (__be32 *)out;
1043 	unsigned int max;
1044 
1045 	u32 tmp[4];
1046 
1047 	tmp[0] = be32_to_cpu(src[0]);
1048 	tmp[1] = be32_to_cpu(src[1]);
1049 	tmp[2] = be32_to_cpu(src[2]);
1050 	tmp[3] = be32_to_cpu(src[3]);
1051 
1052 	if (cctx->key_length == 16)
1053 		max = 24;
1054 	else
1055 		max = 32; /* for key lengths of 24 and 32 */
1056 
1057 	camellia_do_decrypt(cctx->key_table, tmp, max);
1058 
1059 	/* do_decrypt returns 0,1 swapped with 2,3 */
1060 	dst[0] = cpu_to_be32(tmp[2]);
1061 	dst[1] = cpu_to_be32(tmp[3]);
1062 	dst[2] = cpu_to_be32(tmp[0]);
1063 	dst[3] = cpu_to_be32(tmp[1]);
1064 }
1065 
1066 static struct crypto_alg camellia_alg = {
1067 	.cra_name		=	"camellia",
1068 	.cra_driver_name	=	"camellia-generic",
1069 	.cra_priority		=	100,
1070 	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
1071 	.cra_blocksize		=	CAMELLIA_BLOCK_SIZE,
1072 	.cra_ctxsize		=	sizeof(struct camellia_ctx),
1073 	.cra_alignmask		=	3,
1074 	.cra_module		=	THIS_MODULE,
1075 	.cra_u			=	{
1076 		.cipher = {
1077 			.cia_min_keysize	=	CAMELLIA_MIN_KEY_SIZE,
1078 			.cia_max_keysize	=	CAMELLIA_MAX_KEY_SIZE,
1079 			.cia_setkey		=	camellia_set_key,
1080 			.cia_encrypt		=	camellia_encrypt,
1081 			.cia_decrypt		=	camellia_decrypt
1082 		}
1083 	}
1084 };
1085 
1086 static int __init camellia_init(void)
1087 {
1088 	return crypto_register_alg(&camellia_alg);
1089 }
1090 
1091 static void __exit camellia_fini(void)
1092 {
1093 	crypto_unregister_alg(&camellia_alg);
1094 }
1095 
1096 module_init(camellia_init);
1097 module_exit(camellia_fini);
1098 
1099 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
1100 MODULE_LICENSE("GPL");
1101 MODULE_ALIAS_CRYPTO("camellia");
1102 MODULE_ALIAS_CRYPTO("camellia-generic");
1103