linux/crypto/camellia_generic.c
<<
>>
Prefs
   1/*
   2 * Copyright (C) 2006
   3 * NTT (Nippon Telegraph and Telephone Corporation).
   4 *
   5 * This program is free software; you can redistribute it and/or
   6 * modify it under the terms of the GNU General Public License
   7 * as published by the Free Software Foundation; either version 2
   8 * of the License, or (at your option) any later version.
   9 *
  10 * This program is distributed in the hope that it will be useful,
  11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 * GNU General Public License for more details.
  14 *
  15 * You should have received a copy of the GNU General Public License
  16 * along with this program; if not, write to the Free Software
  17 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
  18 */
  19
  20/*
  21 * Algorithm Specification
  22 *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
  23 */
  24
  25/*
  26 *
  27 * NOTE --- NOTE --- NOTE --- NOTE
  28 * This implementation assumes that all memory addresses passed
  29 * as parameters are four-byte aligned.
  30 *
  31 */
  32
  33#include <linux/crypto.h>
  34#include <linux/errno.h>
  35#include <linux/init.h>
  36#include <linux/kernel.h>
  37#include <linux/module.h>
  38#include <linux/bitops.h>
  39#include <asm/unaligned.h>
  40
  41static const u32 camellia_sp1110[256] = {
  42        0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00,
  43        0xb3b3b300, 0x27272700, 0xc0c0c000, 0xe5e5e500,
  44        0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
  45        0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100,
  46        0x23232300, 0xefefef00, 0x6b6b6b00, 0x93939300,
  47        0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
  48        0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00,
  49        0x1d1d1d00, 0x65656500, 0x92929200, 0xbdbdbd00,
  50        0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
  51        0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00,
  52        0x3e3e3e00, 0x30303000, 0xdcdcdc00, 0x5f5f5f00,
  53        0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
  54        0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00,
  55        0xd5d5d500, 0x47474700, 0x5d5d5d00, 0x3d3d3d00,
  56        0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
  57        0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00,
  58        0x8b8b8b00, 0x0d0d0d00, 0x9a9a9a00, 0x66666600,
  59        0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
  60        0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000,
  61        0xf0f0f000, 0xb1b1b100, 0x84848400, 0x99999900,
  62        0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
  63        0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500,
  64        0x6d6d6d00, 0xb7b7b700, 0xa9a9a900, 0x31313100,
  65        0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
  66        0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100,
  67        0xdedede00, 0x1b1b1b00, 0x11111100, 0x1c1c1c00,
  68        0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
  69        0x53535300, 0x18181800, 0xf2f2f200, 0x22222200,
  70        0xfefefe00, 0x44444400, 0xcfcfcf00, 0xb2b2b200,
  71        0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
  72        0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800,
  73        0x60606000, 0xfcfcfc00, 0x69696900, 0x50505000,
  74        0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
  75        0xa1a1a100, 0x89898900, 0x62626200, 0x97979700,
  76        0x54545400, 0x5b5b5b00, 0x1e1e1e00, 0x95959500,
  77        0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
  78        0x10101000, 0xc4c4c400, 0x00000000, 0x48484800,
  79        0xa3a3a300, 0xf7f7f700, 0x75757500, 0xdbdbdb00,
  80        0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
  81        0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400,
  82        0x87878700, 0x5c5c5c00, 0x83838300, 0x02020200,
  83        0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
  84        0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300,
  85        0x9d9d9d00, 0x7f7f7f00, 0xbfbfbf00, 0xe2e2e200,
  86        0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
  87        0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00,
  88        0x81818100, 0x96969600, 0x6f6f6f00, 0x4b4b4b00,
  89        0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
  90        0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00,
  91        0x9f9f9f00, 0x6e6e6e00, 0xbcbcbc00, 0x8e8e8e00,
  92        0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
  93        0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900,
  94        0x78787800, 0x98989800, 0x06060600, 0x6a6a6a00,
  95        0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
  96        0xd4d4d400, 0x25252500, 0xababab00, 0x42424200,
  97        0x88888800, 0xa2a2a200, 0x8d8d8d00, 0xfafafa00,
  98        0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
  99        0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00,
 100        0x36363600, 0x49494900, 0x2a2a2a00, 0x68686800,
 101        0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
 102        0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00,
 103        0xbbbbbb00, 0xc9c9c900, 0x43434300, 0xc1c1c100,
 104        0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
 105        0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00,
 106};
 107
 108static const u32 camellia_sp0222[256] = {
 109        0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9,
 110        0x00676767, 0x004e4e4e, 0x00818181, 0x00cbcbcb,
 111        0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
 112        0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282,
 113        0x00464646, 0x00dfdfdf, 0x00d6d6d6, 0x00272727,
 114        0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
 115        0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c,
 116        0x003a3a3a, 0x00cacaca, 0x00252525, 0x007b7b7b,
 117        0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
 118        0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d,
 119        0x007c7c7c, 0x00606060, 0x00b9b9b9, 0x00bebebe,
 120        0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
 121        0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595,
 122        0x00ababab, 0x008e8e8e, 0x00bababa, 0x007a7a7a,
 123        0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
 124        0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a,
 125        0x00171717, 0x001a1a1a, 0x00353535, 0x00cccccc,
 126        0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
 127        0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040,
 128        0x00e1e1e1, 0x00636363, 0x00090909, 0x00333333,
 129        0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
 130        0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a,
 131        0x00dadada, 0x006f6f6f, 0x00535353, 0x00626262,
 132        0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
 133        0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2,
 134        0x00bdbdbd, 0x00363636, 0x00222222, 0x00383838,
 135        0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
 136        0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444,
 137        0x00fdfdfd, 0x00888888, 0x009f9f9f, 0x00656565,
 138        0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
 139        0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151,
 140        0x00c0c0c0, 0x00f9f9f9, 0x00d2d2d2, 0x00a0a0a0,
 141        0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
 142        0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f,
 143        0x00a8a8a8, 0x00b6b6b6, 0x003c3c3c, 0x002b2b2b,
 144        0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
 145        0x00202020, 0x00898989, 0x00000000, 0x00909090,
 146        0x00474747, 0x00efefef, 0x00eaeaea, 0x00b7b7b7,
 147        0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
 148        0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929,
 149        0x000f0f0f, 0x00b8b8b8, 0x00070707, 0x00040404,
 150        0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
 151        0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7,
 152        0x003b3b3b, 0x00fefefe, 0x007f7f7f, 0x00c5c5c5,
 153        0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
 154        0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676,
 155        0x00030303, 0x002d2d2d, 0x00dedede, 0x00969696,
 156        0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
 157        0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919,
 158        0x003f3f3f, 0x00dcdcdc, 0x00797979, 0x001d1d1d,
 159        0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
 160        0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2,
 161        0x00f0f0f0, 0x00313131, 0x000c0c0c, 0x00d4d4d4,
 162        0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
 163        0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484,
 164        0x00111111, 0x00454545, 0x001b1b1b, 0x00f5f5f5,
 165        0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
 166        0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414,
 167        0x006c6c6c, 0x00929292, 0x00545454, 0x00d0d0d0,
 168        0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
 169        0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6,
 170        0x00777777, 0x00939393, 0x00868686, 0x00838383,
 171        0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
 172        0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d,
 173};
 174
 175static const u32 camellia_sp3033[256] = {
 176        0x38003838, 0x41004141, 0x16001616, 0x76007676,
 177        0xd900d9d9, 0x93009393, 0x60006060, 0xf200f2f2,
 178        0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
 179        0x75007575, 0x06000606, 0x57005757, 0xa000a0a0,
 180        0x91009191, 0xf700f7f7, 0xb500b5b5, 0xc900c9c9,
 181        0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
 182        0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727,
 183        0x8e008e8e, 0xb200b2b2, 0x49004949, 0xde00dede,
 184        0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
 185        0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767,
 186        0x1f001f1f, 0x18001818, 0x6e006e6e, 0xaf00afaf,
 187        0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
 188        0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565,
 189        0xea00eaea, 0xa300a3a3, 0xae00aeae, 0x9e009e9e,
 190        0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
 191        0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6,
 192        0xc500c5c5, 0x86008686, 0x4d004d4d, 0x33003333,
 193        0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
 194        0x3a003a3a, 0x09000909, 0x95009595, 0x10001010,
 195        0x78007878, 0xd800d8d8, 0x42004242, 0xcc00cccc,
 196        0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
 197        0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282,
 198        0xb600b6b6, 0xdb00dbdb, 0xd400d4d4, 0x98009898,
 199        0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
 200        0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0,
 201        0x6f006f6f, 0x8d008d8d, 0x88008888, 0x0e000e0e,
 202        0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
 203        0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111,
 204        0x7f007f7f, 0x22002222, 0xe700e7e7, 0x59005959,
 205        0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
 206        0x12001212, 0x04000404, 0x74007474, 0x54005454,
 207        0x30003030, 0x7e007e7e, 0xb400b4b4, 0x28002828,
 208        0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
 209        0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb,
 210        0x2a002a2a, 0xad00adad, 0x0f000f0f, 0xca00caca,
 211        0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
 212        0x08000808, 0x62006262, 0x00000000, 0x24002424,
 213        0xd100d1d1, 0xfb00fbfb, 0xba00baba, 0xed00eded,
 214        0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
 215        0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a,
 216        0xc300c3c3, 0x2e002e2e, 0xc100c1c1, 0x01000101,
 217        0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
 218        0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9,
 219        0xce00cece, 0xbf00bfbf, 0xdf00dfdf, 0x71007171,
 220        0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
 221        0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d,
 222        0xc000c0c0, 0x4b004b4b, 0xb700b7b7, 0xa500a5a5,
 223        0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
 224        0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646,
 225        0xcf00cfcf, 0x37003737, 0x5e005e5e, 0x47004747,
 226        0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
 227        0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac,
 228        0x3c003c3c, 0x4c004c4c, 0x03000303, 0x35003535,
 229        0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
 230        0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121,
 231        0x44004444, 0x51005151, 0xc600c6c6, 0x7d007d7d,
 232        0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
 233        0x7c007c7c, 0x77007777, 0x56005656, 0x05000505,
 234        0x1b001b1b, 0xa400a4a4, 0x15001515, 0x34003434,
 235        0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
 236        0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd,
 237        0xdd00dddd, 0xe400e4e4, 0xa100a1a1, 0xe000e0e0,
 238        0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
 239        0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f,
 240};
 241
 242static const u32 camellia_sp4404[256] = {
 243        0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0,
 244        0xe4e400e4, 0x57570057, 0xeaea00ea, 0xaeae00ae,
 245        0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
 246        0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092,
 247        0x86860086, 0xafaf00af, 0x7c7c007c, 0x1f1f001f,
 248        0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
 249        0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d,
 250        0xd9d900d9, 0x5a5a005a, 0x51510051, 0x6c6c006c,
 251        0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
 252        0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084,
 253        0xdfdf00df, 0xcbcb00cb, 0x34340034, 0x76760076,
 254        0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
 255        0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011,
 256        0x32320032, 0x9c9c009c, 0x53530053, 0xf2f200f2,
 257        0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
 258        0x24240024, 0xe8e800e8, 0x60600060, 0x69690069,
 259        0xaaaa00aa, 0xa0a000a0, 0xa1a100a1, 0x62620062,
 260        0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
 261        0x10100010, 0x00000000, 0xa3a300a3, 0x75750075,
 262        0x8a8a008a, 0xe6e600e6, 0x09090009, 0xdddd00dd,
 263        0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
 264        0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf,
 265        0x52520052, 0xd8d800d8, 0xc8c800c8, 0xc6c600c6,
 266        0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
 267        0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc,
 268        0x29290029, 0xf9f900f9, 0x2f2f002f, 0xb4b400b4,
 269        0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
 270        0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d,
 271        0x72720072, 0xb9b900b9, 0xf8f800f8, 0xacac00ac,
 272        0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
 273        0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043,
 274        0x15150015, 0xadad00ad, 0x77770077, 0x80800080,
 275        0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
 276        0x85850085, 0x35350035, 0x0c0c000c, 0x41410041,
 277        0xefef00ef, 0x93930093, 0x19190019, 0x21210021,
 278        0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
 279        0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce,
 280        0x30300030, 0x5f5f005f, 0xc5c500c5, 0x1a1a001a,
 281        0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
 282        0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d,
 283        0x0d0d000d, 0x66660066, 0xcccc00cc, 0x2d2d002d,
 284        0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
 285        0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005,
 286        0xb7b700b7, 0x31310031, 0x17170017, 0xd7d700d7,
 287        0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
 288        0x0f0f000f, 0x16160016, 0x18180018, 0x22220022,
 289        0x44440044, 0xb2b200b2, 0xb5b500b5, 0x91910091,
 290        0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
 291        0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097,
 292        0x5b5b005b, 0x95950095, 0xffff00ff, 0xd2d200d2,
 293        0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
 294        0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094,
 295        0x5c5c005c, 0x02020002, 0x4a4a004a, 0x33330033,
 296        0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
 297        0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b,
 298        0x96960096, 0x4b4b004b, 0xbebe00be, 0x2e2e002e,
 299        0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
 300        0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059,
 301        0x98980098, 0x6a6a006a, 0x46460046, 0xbaba00ba,
 302        0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
 303        0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a,
 304        0x49490049, 0x68680068, 0x38380038, 0xa4a400a4,
 305        0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
 306        0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e,
 307};
 308
 309
 310#define CAMELLIA_MIN_KEY_SIZE        16
 311#define CAMELLIA_MAX_KEY_SIZE        32
 312#define CAMELLIA_BLOCK_SIZE          16
 313#define CAMELLIA_TABLE_BYTE_LEN     272
 314
 315/*
 316 * NB: L and R below stand for 'left' and 'right' as in written numbers.
 317 * That is, in (xxxL,xxxR) pair xxxL holds most significant digits,
 318 * _not_ least significant ones!
 319 */
 320
 321
 322/* key constants */
 323
 324#define CAMELLIA_SIGMA1L (0xA09E667FL)
 325#define CAMELLIA_SIGMA1R (0x3BCC908BL)
 326#define CAMELLIA_SIGMA2L (0xB67AE858L)
 327#define CAMELLIA_SIGMA2R (0x4CAA73B2L)
 328#define CAMELLIA_SIGMA3L (0xC6EF372FL)
 329#define CAMELLIA_SIGMA3R (0xE94F82BEL)
 330#define CAMELLIA_SIGMA4L (0x54FF53A5L)
 331#define CAMELLIA_SIGMA4R (0xF1D36F1CL)
 332#define CAMELLIA_SIGMA5L (0x10E527FAL)
 333#define CAMELLIA_SIGMA5R (0xDE682D1DL)
 334#define CAMELLIA_SIGMA6L (0xB05688C2L)
 335#define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
 336
 337/*
 338 *  macros
 339 */
 340#define ROLDQ(ll, lr, rl, rr, w0, w1, bits) ({          \
 341        w0 = ll;                                        \
 342        ll = (ll << bits) + (lr >> (32 - bits));        \
 343        lr = (lr << bits) + (rl >> (32 - bits));        \
 344        rl = (rl << bits) + (rr >> (32 - bits));        \
 345        rr = (rr << bits) + (w0 >> (32 - bits));        \
 346})
 347
 348#define ROLDQo32(ll, lr, rl, rr, w0, w1, bits) ({       \
 349        w0 = ll;                                        \
 350        w1 = lr;                                        \
 351        ll = (lr << (bits - 32)) + (rl >> (64 - bits)); \
 352        lr = (rl << (bits - 32)) + (rr >> (64 - bits)); \
 353        rl = (rr << (bits - 32)) + (w0 >> (64 - bits)); \
 354        rr = (w0 << (bits - 32)) + (w1 >> (64 - bits)); \
 355})
 356
 357#define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1) ({   \
 358        il = xl ^ kl;                                           \
 359        ir = xr ^ kr;                                           \
 360        t0 = il >> 16;                                          \
 361        t1 = ir >> 16;                                          \
 362        yl = camellia_sp1110[(u8)(ir)]                          \
 363           ^ camellia_sp0222[(u8)(t1 >> 8)]                     \
 364           ^ camellia_sp3033[(u8)(t1)]                          \
 365           ^ camellia_sp4404[(u8)(ir >> 8)];                    \
 366        yr = camellia_sp1110[(u8)(t0 >> 8)]                     \
 367           ^ camellia_sp0222[(u8)(t0)]                          \
 368           ^ camellia_sp3033[(u8)(il >> 8)]                     \
 369           ^ camellia_sp4404[(u8)(il)];                         \
 370        yl ^= yr;                                               \
 371        yr = ror32(yr, 8);                                      \
 372        yr ^= yl;                                               \
 373})
 374
 375#define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 376#define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 377
 378static void camellia_setup_tail(u32 *subkey, u32 *subL, u32 *subR, int max)
 379{
 380        u32 dw, tl, tr;
 381        u32 kw4l, kw4r;
 382
 383        /* absorb kw2 to other subkeys */
 384        /* round 2 */
 385        subL[3] ^= subL[1]; subR[3] ^= subR[1];
 386        /* round 4 */
 387        subL[5] ^= subL[1]; subR[5] ^= subR[1];
 388        /* round 6 */
 389        subL[7] ^= subL[1]; subR[7] ^= subR[1];
 390        subL[1] ^= subR[1] & ~subR[9];
 391        dw = subL[1] & subL[9];
 392        subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl2) */
 393        /* round 8 */
 394        subL[11] ^= subL[1]; subR[11] ^= subR[1];
 395        /* round 10 */
 396        subL[13] ^= subL[1]; subR[13] ^= subR[1];
 397        /* round 12 */
 398        subL[15] ^= subL[1]; subR[15] ^= subR[1];
 399        subL[1] ^= subR[1] & ~subR[17];
 400        dw = subL[1] & subL[17];
 401        subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl4) */
 402        /* round 14 */
 403        subL[19] ^= subL[1]; subR[19] ^= subR[1];
 404        /* round 16 */
 405        subL[21] ^= subL[1]; subR[21] ^= subR[1];
 406        /* round 18 */
 407        subL[23] ^= subL[1]; subR[23] ^= subR[1];
 408        if (max == 24) {
 409                /* kw3 */
 410                subL[24] ^= subL[1]; subR[24] ^= subR[1];
 411
 412        /* absorb kw4 to other subkeys */
 413                kw4l = subL[25]; kw4r = subR[25];
 414        } else {
 415                subL[1] ^= subR[1] & ~subR[25];
 416                dw = subL[1] & subL[25];
 417                subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl6) */
 418                /* round 20 */
 419                subL[27] ^= subL[1]; subR[27] ^= subR[1];
 420                /* round 22 */
 421                subL[29] ^= subL[1]; subR[29] ^= subR[1];
 422                /* round 24 */
 423                subL[31] ^= subL[1]; subR[31] ^= subR[1];
 424                /* kw3 */
 425                subL[32] ^= subL[1]; subR[32] ^= subR[1];
 426
 427        /* absorb kw4 to other subkeys */
 428                kw4l = subL[33]; kw4r = subR[33];
 429                /* round 23 */
 430                subL[30] ^= kw4l; subR[30] ^= kw4r;
 431                /* round 21 */
 432                subL[28] ^= kw4l; subR[28] ^= kw4r;
 433                /* round 19 */
 434                subL[26] ^= kw4l; subR[26] ^= kw4r;
 435                kw4l ^= kw4r & ~subR[24];
 436                dw = kw4l & subL[24];
 437                kw4r ^= rol32(dw, 1); /* modified for FL(kl5) */
 438        }
 439        /* round 17 */
 440        subL[22] ^= kw4l; subR[22] ^= kw4r;
 441        /* round 15 */
 442        subL[20] ^= kw4l; subR[20] ^= kw4r;
 443        /* round 13 */
 444        subL[18] ^= kw4l; subR[18] ^= kw4r;
 445        kw4l ^= kw4r & ~subR[16];
 446        dw = kw4l & subL[16];
 447        kw4r ^= rol32(dw, 1); /* modified for FL(kl3) */
 448        /* round 11 */
 449        subL[14] ^= kw4l; subR[14] ^= kw4r;
 450        /* round 9 */
 451        subL[12] ^= kw4l; subR[12] ^= kw4r;
 452        /* round 7 */
 453        subL[10] ^= kw4l; subR[10] ^= kw4r;
 454        kw4l ^= kw4r & ~subR[8];
 455        dw = kw4l & subL[8];
 456        kw4r ^= rol32(dw, 1); /* modified for FL(kl1) */
 457        /* round 5 */
 458        subL[6] ^= kw4l; subR[6] ^= kw4r;
 459        /* round 3 */
 460        subL[4] ^= kw4l; subR[4] ^= kw4r;
 461        /* round 1 */
 462        subL[2] ^= kw4l; subR[2] ^= kw4r;
 463        /* kw1 */
 464        subL[0] ^= kw4l; subR[0] ^= kw4r;
 465
 466        /* key XOR is end of F-function */
 467        SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
 468        SUBKEY_R(0) = subR[0] ^ subR[2];
 469        SUBKEY_L(2) = subL[3];       /* round 1 */
 470        SUBKEY_R(2) = subR[3];
 471        SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
 472        SUBKEY_R(3) = subR[2] ^ subR[4];
 473        SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
 474        SUBKEY_R(4) = subR[3] ^ subR[5];
 475        SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
 476        SUBKEY_R(5) = subR[4] ^ subR[6];
 477        SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
 478        SUBKEY_R(6) = subR[5] ^ subR[7];
 479        tl = subL[10] ^ (subR[10] & ~subR[8]);
 480        dw = tl & subL[8];  /* FL(kl1) */
 481        tr = subR[10] ^ rol32(dw, 1);
 482        SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
 483        SUBKEY_R(7) = subR[6] ^ tr;
 484        SUBKEY_L(8) = subL[8];       /* FL(kl1) */
 485        SUBKEY_R(8) = subR[8];
 486        SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
 487        SUBKEY_R(9) = subR[9];
 488        tl = subL[7] ^ (subR[7] & ~subR[9]);
 489        dw = tl & subL[9];  /* FLinv(kl2) */
 490        tr = subR[7] ^ rol32(dw, 1);
 491        SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
 492        SUBKEY_R(10) = tr ^ subR[11];
 493        SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
 494        SUBKEY_R(11) = subR[10] ^ subR[12];
 495        SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
 496        SUBKEY_R(12) = subR[11] ^ subR[13];
 497        SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
 498        SUBKEY_R(13) = subR[12] ^ subR[14];
 499        SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
 500        SUBKEY_R(14) = subR[13] ^ subR[15];
 501        tl = subL[18] ^ (subR[18] & ~subR[16]);
 502        dw = tl & subL[16]; /* FL(kl3) */
 503        tr = subR[18] ^ rol32(dw, 1);
 504        SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
 505        SUBKEY_R(15) = subR[14] ^ tr;
 506        SUBKEY_L(16) = subL[16];     /* FL(kl3) */
 507        SUBKEY_R(16) = subR[16];
 508        SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
 509        SUBKEY_R(17) = subR[17];
 510        tl = subL[15] ^ (subR[15] & ~subR[17]);
 511        dw = tl & subL[17]; /* FLinv(kl4) */
 512        tr = subR[15] ^ rol32(dw, 1);
 513        SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
 514        SUBKEY_R(18) = tr ^ subR[19];
 515        SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
 516        SUBKEY_R(19) = subR[18] ^ subR[20];
 517        SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
 518        SUBKEY_R(20) = subR[19] ^ subR[21];
 519        SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
 520        SUBKEY_R(21) = subR[20] ^ subR[22];
 521        SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
 522        SUBKEY_R(22) = subR[21] ^ subR[23];
 523        if (max == 24) {
 524                SUBKEY_L(23) = subL[22];     /* round 18 */
 525                SUBKEY_R(23) = subR[22];
 526                SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
 527                SUBKEY_R(24) = subR[24] ^ subR[23];
 528        } else {
 529                tl = subL[26] ^ (subR[26] & ~subR[24]);
 530                dw = tl & subL[24]; /* FL(kl5) */
 531                tr = subR[26] ^ rol32(dw, 1);
 532                SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
 533                SUBKEY_R(23) = subR[22] ^ tr;
 534                SUBKEY_L(24) = subL[24];     /* FL(kl5) */
 535                SUBKEY_R(24) = subR[24];
 536                SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
 537                SUBKEY_R(25) = subR[25];
 538                tl = subL[23] ^ (subR[23] & ~subR[25]);
 539                dw = tl & subL[25]; /* FLinv(kl6) */
 540                tr = subR[23] ^ rol32(dw, 1);
 541                SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
 542                SUBKEY_R(26) = tr ^ subR[27];
 543                SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
 544                SUBKEY_R(27) = subR[26] ^ subR[28];
 545                SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
 546                SUBKEY_R(28) = subR[27] ^ subR[29];
 547                SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
 548                SUBKEY_R(29) = subR[28] ^ subR[30];
 549                SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
 550                SUBKEY_R(30) = subR[29] ^ subR[31];
 551                SUBKEY_L(31) = subL[30];     /* round 24 */
 552                SUBKEY_R(31) = subR[30];
 553                SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
 554                SUBKEY_R(32) = subR[32] ^ subR[31];
 555        }
 556}
 557
 558static void camellia_setup128(const unsigned char *key, u32 *subkey)
 559{
 560        u32 kll, klr, krl, krr;
 561        u32 il, ir, t0, t1, w0, w1;
 562        u32 subL[26];
 563        u32 subR[26];
 564
 565        /**
 566         *  k == kll || klr || krl || krr (|| is concatenation)
 567         */
 568        kll = get_unaligned_be32(key);
 569        klr = get_unaligned_be32(key + 4);
 570        krl = get_unaligned_be32(key + 8);
 571        krr = get_unaligned_be32(key + 12);
 572
 573        /* generate KL dependent subkeys */
 574        /* kw1 */
 575        subL[0] = kll; subR[0] = klr;
 576        /* kw2 */
 577        subL[1] = krl; subR[1] = krr;
 578        /* rotation left shift 15bit */
 579        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 580        /* k3 */
 581        subL[4] = kll; subR[4] = klr;
 582        /* k4 */
 583        subL[5] = krl; subR[5] = krr;
 584        /* rotation left shift 15+30bit */
 585        ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 586        /* k7 */
 587        subL[10] = kll; subR[10] = klr;
 588        /* k8 */
 589        subL[11] = krl; subR[11] = krr;
 590        /* rotation left shift 15+30+15bit */
 591        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 592        /* k10 */
 593        subL[13] = krl; subR[13] = krr;
 594        /* rotation left shift 15+30+15+17 bit */
 595        ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 596        /* kl3 */
 597        subL[16] = kll; subR[16] = klr;
 598        /* kl4 */
 599        subL[17] = krl; subR[17] = krr;
 600        /* rotation left shift 15+30+15+17+17 bit */
 601        ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 602        /* k13 */
 603        subL[18] = kll; subR[18] = klr;
 604        /* k14 */
 605        subL[19] = krl; subR[19] = krr;
 606        /* rotation left shift 15+30+15+17+17+17 bit */
 607        ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 608        /* k17 */
 609        subL[22] = kll; subR[22] = klr;
 610        /* k18 */
 611        subL[23] = krl; subR[23] = krr;
 612
 613        /* generate KA */
 614        kll = subL[0]; klr = subR[0];
 615        krl = subL[1]; krr = subR[1];
 616        CAMELLIA_F(kll, klr,
 617                   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 618                   w0, w1, il, ir, t0, t1);
 619        krl ^= w0; krr ^= w1;
 620        CAMELLIA_F(krl, krr,
 621                   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
 622                   kll, klr, il, ir, t0, t1);
 623        /* current status == (kll, klr, w0, w1) */
 624        CAMELLIA_F(kll, klr,
 625                   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
 626                   krl, krr, il, ir, t0, t1);
 627        krl ^= w0; krr ^= w1;
 628        CAMELLIA_F(krl, krr,
 629                   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
 630                   w0, w1, il, ir, t0, t1);
 631        kll ^= w0; klr ^= w1;
 632
 633        /* generate KA dependent subkeys */
 634        /* k1, k2 */
 635        subL[2] = kll; subR[2] = klr;
 636        subL[3] = krl; subR[3] = krr;
 637        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 638        /* k5,k6 */
 639        subL[6] = kll; subR[6] = klr;
 640        subL[7] = krl; subR[7] = krr;
 641        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 642        /* kl1, kl2 */
 643        subL[8] = kll; subR[8] = klr;
 644        subL[9] = krl; subR[9] = krr;
 645        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 646        /* k9 */
 647        subL[12] = kll; subR[12] = klr;
 648        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 649        /* k11, k12 */
 650        subL[14] = kll; subR[14] = klr;
 651        subL[15] = krl; subR[15] = krr;
 652        ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 653        /* k15, k16 */
 654        subL[20] = kll; subR[20] = klr;
 655        subL[21] = krl; subR[21] = krr;
 656        ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 657        /* kw3, kw4 */
 658        subL[24] = kll; subR[24] = klr;
 659        subL[25] = krl; subR[25] = krr;
 660
 661        camellia_setup_tail(subkey, subL, subR, 24);
 662}
 663
 664static void camellia_setup256(const unsigned char *key, u32 *subkey)
 665{
 666        u32 kll, klr, krl, krr;        /* left half of key */
 667        u32 krll, krlr, krrl, krrr;    /* right half of key */
 668        u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
 669        u32 subL[34];
 670        u32 subR[34];
 671
 672        /**
 673         *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
 674         *  (|| is concatenation)
 675         */
 676        kll = get_unaligned_be32(key);
 677        klr = get_unaligned_be32(key + 4);
 678        krl = get_unaligned_be32(key + 8);
 679        krr = get_unaligned_be32(key + 12);
 680        krll = get_unaligned_be32(key + 16);
 681        krlr = get_unaligned_be32(key + 20);
 682        krrl = get_unaligned_be32(key + 24);
 683        krrr = get_unaligned_be32(key + 28);
 684
 685        /* generate KL dependent subkeys */
 686        /* kw1 */
 687        subL[0] = kll; subR[0] = klr;
 688        /* kw2 */
 689        subL[1] = krl; subR[1] = krr;
 690        ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
 691        /* k9 */
 692        subL[12] = kll; subR[12] = klr;
 693        /* k10 */
 694        subL[13] = krl; subR[13] = krr;
 695        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 696        /* kl3 */
 697        subL[16] = kll; subR[16] = klr;
 698        /* kl4 */
 699        subL[17] = krl; subR[17] = krr;
 700        ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 701        /* k17 */
 702        subL[22] = kll; subR[22] = klr;
 703        /* k18 */
 704        subL[23] = krl; subR[23] = krr;
 705        ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 706        /* k23 */
 707        subL[30] = kll; subR[30] = klr;
 708        /* k24 */
 709        subL[31] = krl; subR[31] = krr;
 710
 711        /* generate KR dependent subkeys */
 712        ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 713        /* k3 */
 714        subL[4] = krll; subR[4] = krlr;
 715        /* k4 */
 716        subL[5] = krrl; subR[5] = krrr;
 717        ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 718        /* kl1 */
 719        subL[8] = krll; subR[8] = krlr;
 720        /* kl2 */
 721        subL[9] = krrl; subR[9] = krrr;
 722        ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 723        /* k13 */
 724        subL[18] = krll; subR[18] = krlr;
 725        /* k14 */
 726        subL[19] = krrl; subR[19] = krrr;
 727        ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 728        /* k19 */
 729        subL[26] = krll; subR[26] = krlr;
 730        /* k20 */
 731        subL[27] = krrl; subR[27] = krrr;
 732        ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 733
 734        /* generate KA */
 735        kll = subL[0] ^ krll; klr = subR[0] ^ krlr;
 736        krl = subL[1] ^ krrl; krr = subR[1] ^ krrr;
 737        CAMELLIA_F(kll, klr,
 738                   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 739                   w0, w1, il, ir, t0, t1);
 740        krl ^= w0; krr ^= w1;
 741        CAMELLIA_F(krl, krr,
 742                   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
 743                   kll, klr, il, ir, t0, t1);
 744        kll ^= krll; klr ^= krlr;
 745        CAMELLIA_F(kll, klr,
 746                   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
 747                   krl, krr, il, ir, t0, t1);
 748        krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
 749        CAMELLIA_F(krl, krr,
 750                   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
 751                   w0, w1, il, ir, t0, t1);
 752        kll ^= w0; klr ^= w1;
 753
 754        /* generate KB */
 755        krll ^= kll; krlr ^= klr;
 756        krrl ^= krl; krrr ^= krr;
 757        CAMELLIA_F(krll, krlr,
 758                   CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
 759                   w0, w1, il, ir, t0, t1);
 760        krrl ^= w0; krrr ^= w1;
 761        CAMELLIA_F(krrl, krrr,
 762                   CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
 763                   w0, w1, il, ir, t0, t1);
 764        krll ^= w0; krlr ^= w1;
 765
 766        /* generate KA dependent subkeys */
 767        ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 768        /* k5 */
 769        subL[6] = kll; subR[6] = klr;
 770        /* k6 */
 771        subL[7] = krl; subR[7] = krr;
 772        ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 773        /* k11 */
 774        subL[14] = kll; subR[14] = klr;
 775        /* k12 */
 776        subL[15] = krl; subR[15] = krr;
 777        /* rotation left shift 32bit */
 778        /* kl5 */
 779        subL[24] = klr; subR[24] = krl;
 780        /* kl6 */
 781        subL[25] = krr; subR[25] = kll;
 782        /* rotation left shift 49 from k11,k12 -> k21,k22 */
 783        ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
 784        /* k21 */
 785        subL[28] = kll; subR[28] = klr;
 786        /* k22 */
 787        subL[29] = krl; subR[29] = krr;
 788
 789        /* generate KB dependent subkeys */
 790        /* k1 */
 791        subL[2] = krll; subR[2] = krlr;
 792        /* k2 */
 793        subL[3] = krrl; subR[3] = krrr;
 794        ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 795        /* k7 */
 796        subL[10] = krll; subR[10] = krlr;
 797        /* k8 */
 798        subL[11] = krrl; subR[11] = krrr;
 799        ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 800        /* k15 */
 801        subL[20] = krll; subR[20] = krlr;
 802        /* k16 */
 803        subL[21] = krrl; subR[21] = krrr;
 804        ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
 805        /* kw3 */
 806        subL[32] = krll; subR[32] = krlr;
 807        /* kw4 */
 808        subL[33] = krrl; subR[33] = krrr;
 809
 810        camellia_setup_tail(subkey, subL, subR, 32);
 811}
 812
 813static void camellia_setup192(const unsigned char *key, u32 *subkey)
 814{
 815        unsigned char kk[32];
 816        u32 krll, krlr, krrl, krrr;
 817
 818        memcpy(kk, key, 24);
 819        memcpy((unsigned char *)&krll, key+16, 4);
 820        memcpy((unsigned char *)&krlr, key+20, 4);
 821        krrl = ~krll;
 822        krrr = ~krlr;
 823        memcpy(kk+24, (unsigned char *)&krrl, 4);
 824        memcpy(kk+28, (unsigned char *)&krrr, 4);
 825        camellia_setup256(kk, subkey);
 826}
 827
 828
 829/*
 830 * Encrypt/decrypt
 831 */
 832#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) ({ \
 833        t0 = kll;                                                       \
 834        t2 = krr;                                                       \
 835        t0 &= ll;                                                       \
 836        t2 |= rr;                                                       \
 837        rl ^= t2;                                                       \
 838        lr ^= rol32(t0, 1);                                             \
 839        t3 = krl;                                                       \
 840        t1 = klr;                                                       \
 841        t3 &= rl;                                                       \
 842        t1 |= lr;                                                       \
 843        ll ^= t1;                                                       \
 844        rr ^= rol32(t3, 1);                                             \
 845})
 846
 847#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir) ({             \
 848        yl ^= kl;                                                       \
 849        yr ^= kr;                                                       \
 850        ir =  camellia_sp1110[(u8)xr];                                  \
 851        il =  camellia_sp1110[(u8)(xl >> 24)];                          \
 852        ir ^= camellia_sp0222[(u8)(xr >> 24)];                          \
 853        il ^= camellia_sp0222[(u8)(xl >> 16)];                          \
 854        ir ^= camellia_sp3033[(u8)(xr >> 16)];                          \
 855        il ^= camellia_sp3033[(u8)(xl >> 8)];                           \
 856        ir ^= camellia_sp4404[(u8)(xr >> 8)];                           \
 857        il ^= camellia_sp4404[(u8)xl];                                  \
 858        ir ^= il;                                                       \
 859        yl ^= ir;                                                       \
 860        yr ^= ror32(il, 8) ^ ir;                                        \
 861})
 862
 863/* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
 864static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
 865{
 866        u32 il, ir, t0, t1;            /* temporary variables */
 867
 868        /* pre whitening but absorb kw2 */
 869        io[0] ^= SUBKEY_L(0);
 870        io[1] ^= SUBKEY_R(0);
 871
 872        /* main iteration */
 873#define ROUNDS(i) ({ \
 874        CAMELLIA_ROUNDSM(io[0], io[1], \
 875                         SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
 876                         io[2], io[3], il, ir); \
 877        CAMELLIA_ROUNDSM(io[2], io[3], \
 878                         SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
 879                         io[0], io[1], il, ir); \
 880        CAMELLIA_ROUNDSM(io[0], io[1], \
 881                         SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
 882                         io[2], io[3], il, ir); \
 883        CAMELLIA_ROUNDSM(io[2], io[3], \
 884                         SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
 885                         io[0], io[1], il, ir); \
 886        CAMELLIA_ROUNDSM(io[0], io[1], \
 887                         SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
 888                         io[2], io[3], il, ir); \
 889        CAMELLIA_ROUNDSM(io[2], io[3], \
 890                         SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
 891                         io[0], io[1], il, ir); \
 892})
 893#define FLS(i) ({ \
 894        CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
 895                     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
 896                     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
 897                     t0, t1, il, ir); \
 898})
 899
 900        ROUNDS(0);
 901        FLS(8);
 902        ROUNDS(8);
 903        FLS(16);
 904        ROUNDS(16);
 905        if (max == 32) {
 906                FLS(24);
 907                ROUNDS(24);
 908        }
 909
 910#undef ROUNDS
 911#undef FLS
 912
 913        /* post whitening but kw4 */
 914        io[2] ^= SUBKEY_L(max);
 915        io[3] ^= SUBKEY_R(max);
 916        /* NB: io[0],[1] should be swapped with [2],[3] by caller! */
 917}
 918
 919static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
 920{
 921        u32 il, ir, t0, t1;            /* temporary variables */
 922
 923        /* pre whitening but absorb kw2 */
 924        io[0] ^= SUBKEY_L(i);
 925        io[1] ^= SUBKEY_R(i);
 926
 927        /* main iteration */
 928#define ROUNDS(i) ({ \
 929        CAMELLIA_ROUNDSM(io[0], io[1], \
 930                         SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
 931                         io[2], io[3], il, ir); \
 932        CAMELLIA_ROUNDSM(io[2], io[3], \
 933                         SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
 934                         io[0], io[1], il, ir); \
 935        CAMELLIA_ROUNDSM(io[0], io[1], \
 936                         SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
 937                         io[2], io[3], il, ir); \
 938        CAMELLIA_ROUNDSM(io[2], io[3], \
 939                         SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
 940                         io[0], io[1], il, ir); \
 941        CAMELLIA_ROUNDSM(io[0], io[1], \
 942                         SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
 943                         io[2], io[3], il, ir); \
 944        CAMELLIA_ROUNDSM(io[2], io[3], \
 945                         SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
 946                         io[0], io[1], il, ir); \
 947})
 948#define FLS(i) ({ \
 949        CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
 950                     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
 951                     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
 952                     t0, t1, il, ir); \
 953})
 954
 955        if (i == 32) {
 956                ROUNDS(24);
 957                FLS(24);
 958        }
 959        ROUNDS(16);
 960        FLS(16);
 961        ROUNDS(8);
 962        FLS(8);
 963        ROUNDS(0);
 964
 965#undef ROUNDS
 966#undef FLS
 967
 968        /* post whitening but kw4 */
 969        io[2] ^= SUBKEY_L(0);
 970        io[3] ^= SUBKEY_R(0);
 971        /* NB: 0,1 should be swapped with 2,3 by caller! */
 972}
 973
 974
 975struct camellia_ctx {
 976        int key_length;
 977        u32 key_table[CAMELLIA_TABLE_BYTE_LEN / sizeof(u32)];
 978};
 979
 980static int
 981camellia_set_key(struct crypto_tfm *tfm, const u8 *in_key,
 982                 unsigned int key_len)
 983{
 984        struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
 985        const unsigned char *key = (const unsigned char *)in_key;
 986        u32 *flags = &tfm->crt_flags;
 987
 988        if (key_len != 16 && key_len != 24 && key_len != 32) {
 989                *flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
 990                return -EINVAL;
 991        }
 992
 993        cctx->key_length = key_len;
 994
 995        switch (key_len) {
 996        case 16:
 997                camellia_setup128(key, cctx->key_table);
 998                break;
 999        case 24:
1000                camellia_setup192(key, cctx->key_table);
1001                break;
1002        case 32:
1003                camellia_setup256(key, cctx->key_table);
1004                break;
1005        }
1006
1007        return 0;
1008}
1009
1010static void camellia_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1011{
1012        const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1013        const __be32 *src = (const __be32 *)in;
1014        __be32 *dst = (__be32 *)out;
1015        unsigned int max;
1016
1017        u32 tmp[4];
1018
1019        tmp[0] = be32_to_cpu(src[0]);
1020        tmp[1] = be32_to_cpu(src[1]);
1021        tmp[2] = be32_to_cpu(src[2]);
1022        tmp[3] = be32_to_cpu(src[3]);
1023
1024        if (cctx->key_length == 16)
1025                max = 24;
1026        else
1027                max = 32; /* for key lengths of 24 and 32 */
1028
1029        camellia_do_encrypt(cctx->key_table, tmp, max);
1030
1031        /* do_encrypt returns 0,1 swapped with 2,3 */
1032        dst[0] = cpu_to_be32(tmp[2]);
1033        dst[1] = cpu_to_be32(tmp[3]);
1034        dst[2] = cpu_to_be32(tmp[0]);
1035        dst[3] = cpu_to_be32(tmp[1]);
1036}
1037
1038static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1039{
1040        const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1041        const __be32 *src = (const __be32 *)in;
1042        __be32 *dst = (__be32 *)out;
1043        unsigned int max;
1044
1045        u32 tmp[4];
1046
1047        tmp[0] = be32_to_cpu(src[0]);
1048        tmp[1] = be32_to_cpu(src[1]);
1049        tmp[2] = be32_to_cpu(src[2]);
1050        tmp[3] = be32_to_cpu(src[3]);
1051
1052        if (cctx->key_length == 16)
1053                max = 24;
1054        else
1055                max = 32; /* for key lengths of 24 and 32 */
1056
1057        camellia_do_decrypt(cctx->key_table, tmp, max);
1058
1059        /* do_decrypt returns 0,1 swapped with 2,3 */
1060        dst[0] = cpu_to_be32(tmp[2]);
1061        dst[1] = cpu_to_be32(tmp[3]);
1062        dst[2] = cpu_to_be32(tmp[0]);
1063        dst[3] = cpu_to_be32(tmp[1]);
1064}
1065
1066static struct crypto_alg camellia_alg = {
1067        .cra_name               =       "camellia",
1068        .cra_driver_name        =       "camellia-generic",
1069        .cra_priority           =       100,
1070        .cra_flags              =       CRYPTO_ALG_TYPE_CIPHER,
1071        .cra_blocksize          =       CAMELLIA_BLOCK_SIZE,
1072        .cra_ctxsize            =       sizeof(struct camellia_ctx),
1073        .cra_alignmask          =       3,
1074        .cra_module             =       THIS_MODULE,
1075        .cra_u                  =       {
1076                .cipher = {
1077                        .cia_min_keysize        =       CAMELLIA_MIN_KEY_SIZE,
1078                        .cia_max_keysize        =       CAMELLIA_MAX_KEY_SIZE,
1079                        .cia_setkey             =       camellia_set_key,
1080                        .cia_encrypt            =       camellia_encrypt,
1081                        .cia_decrypt            =       camellia_decrypt
1082                }
1083        }
1084};
1085
1086static int __init camellia_init(void)
1087{
1088        return crypto_register_alg(&camellia_alg);
1089}
1090
1091static void __exit camellia_fini(void)
1092{
1093        crypto_unregister_alg(&camellia_alg);
1094}
1095
1096module_init(camellia_init);
1097module_exit(camellia_fini);
1098
1099MODULE_DESCRIPTION("Camellia Cipher Algorithm");
1100MODULE_LICENSE("GPL");
1101MODULE_ALIAS_CRYPTO("camellia");
1102MODULE_ALIAS_CRYPTO("camellia-generic");
1103