1 /* gf128mul.c - GF(2^128) multiplication functions
17  ---------------------------------------------------------------------------
44  ---------------------------------------------------------------------------
92  * Given a value i in 0..255 as the byte overflow when a field element
94  * 16-bit value that must be XOR-ed into the low-degree end of the
98  * the "be" convention where the highest-order bit is the coefficient of
99  * the highest-degree polynomial term, and one for the "le" convention
100  * where the highest-order bit is the coefficient of the lowest-degree
101  * polynomial term.  In both cases the values are stored in CPU byte
107  * Therefore, provided that the appropriate byte endianness conversions
129 static const u16 gf128mul_table_le[256] = gf128mul_dat(xda_le);
130 static const u16 gf128mul_table_be[256] = gf128mul_dat(xda_be);
134  * the polynomial field representation.  They use 64-bit word operations
141 	u64 a = be64_to_cpu(x->a);  in gf128mul_x8_lle()
142 	u64 b = be64_to_cpu(x->b);  in gf128mul_x8_lle()
145 	x->b = cpu_to_be64((b >> 8) | (a << 56));  in gf128mul_x8_lle()
146 	x->a = cpu_to_be64((a >> 8) ^ (_tt << 48));  in gf128mul_x8_lle()
151 	u64 a = be64_to_cpu(x->a);  in gf128mul_x8_bbe()
152 	u64 b = be64_to_cpu(x->b);  in gf128mul_x8_bbe()
155 	x->a = cpu_to_be64((a << 8) | (b >> 56));  in gf128mul_x8_bbe()
156 	x->b = cpu_to_be64((b << 8) ^ _tt);  in gf128mul_x8_bbe()
161 	u64 a = le64_to_cpu(x->a);  in gf128mul_x8_ble()
162 	u64 b = le64_to_cpu(x->b);  in gf128mul_x8_ble()
165 	r->a = cpu_to_le64((a << 8) | (b >> 56));  in gf128mul_x8_ble()
166 	r->b = cpu_to_le64((b << 8) ^ _tt);  in gf128mul_x8_ble()
181 		u8 ch = ((u8 *)b)[15 - i];  in gf128mul_lle()
247     A 16 byte buffer has to be multiplied by a 16 byte key
249     the buffer's lowest byte, we can construct a table of
250     the 256 16 byte values that result from the 256 values
251     of this byte.  This requires 4096 bytes. But we also
256  * t[0][BYTE] contains g*BYTE
257  * t[1][BYTE] contains g*x^8*BYTE
259  * t[15][BYTE] contains g*x^120*BYTE */
270 		t->t[i] = kzalloc(sizeof(*t->t[i]), GFP_KERNEL);  in gf128mul_init_64k_bbe()
271 		if (!t->t[i]) {  in gf128mul_init_64k_bbe()
278 	t->t[0]->t[1] = *g;  in gf128mul_init_64k_bbe()
280 		gf128mul_x_bbe(&t->t[0]->t[j + j], &t->t[0]->t[j]);  in gf128mul_init_64k_bbe()
283 		for (j = 2; j < 256; j += j)  in gf128mul_init_64k_bbe()
285 				be128_xor(&t->t[i]->t[j + k],  in gf128mul_init_64k_bbe()
286 					  &t->t[i]->t[j], &t->t[i]->t[k]);  in gf128mul_init_64k_bbe()
292 			t->t[i]->t[j] = t->t[i - 1]->t[j];  in gf128mul_init_64k_bbe()
293 			gf128mul_x8_bbe(&t->t[i]->t[j]);  in gf128mul_init_64k_bbe()
307 		kfree_sensitive(t->t[i]);  in gf128mul_free_64k()
318 	*r = t->t[0]->t[ap[15]];  in gf128mul_64k_bbe()
320 		be128_xor(r, r, &t->t[i]->t[ap[15 - i]]);  in gf128mul_64k_bbe()
326     A 16 byte buffer has to be multiplied by a 16 byte key
328     single byte, we can construct a table of the 256 16 byte
329     values that result from the 256 values of this byte.
330     This requires 4096 bytes. If we take the highest byte in
333     next highest byte the result has to be multiplied by x^112
336     byte.  We repeatedly multiply the accumulator value by
338     lower byte in the buffer, stopping when we reach the
339     lowest byte. This requires a 4096 byte table.
350 	t->t[128] = *g;  in gf128mul_init_4k_lle()
352 		gf128mul_x_lle(&t->t[j], &t->t[j+j]);  in gf128mul_init_4k_lle()
354 	for (j = 2; j < 256; j += j)  in gf128mul_init_4k_lle()
356 			be128_xor(&t->t[j + k], &t->t[j], &t->t[k]);  in gf128mul_init_4k_lle()
372 	t->t[1] = *g;  in gf128mul_init_4k_bbe()
374 		gf128mul_x_bbe(&t->t[j + j], &t->t[j]);  in gf128mul_init_4k_bbe()
376 	for (j = 2; j < 256; j += j)  in gf128mul_init_4k_bbe()
378 			be128_xor(&t->t[j + k], &t->t[j], &t->t[k]);  in gf128mul_init_4k_bbe()
391 	*r = t->t[ap[15]];  in gf128mul_4k_lle()
392 	while (i--) {  in gf128mul_4k_lle()
394 		be128_xor(r, r, &t->t[ap[i]]);  in gf128mul_4k_lle()
406 	*r = t->t[ap[0]];  in gf128mul_4k_bbe()
409 		be128_xor(r, r, &t->t[ap[i]]);  in gf128mul_4k_bbe()