[deliverable/linux.git] / arch / i386 / crypto / aes.c

/* 
 * 
 * Glue Code for optimized 586 assembler version of AES
 *
 * Copyright (c) 2002, Dr Brian Gladman <>, Worcester, UK.
 * All rights reserved.
 *
 * LICENSE TERMS
 *
 * The free distribution and use of this software in both source and binary
 * form is allowed (with or without changes) provided that:
 *
 *   1. distributions of this source code include the above copyright
 *      notice, this list of conditions and the following disclaimer;
 *
 *   2. distributions in binary form include the above copyright
 *      notice, this list of conditions and the following disclaimer
 *      in the documentation and/or other associated materials;
 *
 *   3. the copyright holder's name is not used to endorse products
 *      built using this software without specific written permission.
 *
 * ALTERNATIVELY, provided that this notice is retained in full, this product
 * may be distributed under the terms of the GNU General Public License (GPL),
 * in which case the provisions of the GPL apply INSTEAD OF those given above.
 *
 * DISCLAIMER
 *
 * This software is provided 'as is' with no explicit or implied warranties
 * in respect of its properties, including, but not limited to, correctness
 * and/or fitness for purpose.
 *
 * Copyright (c) 2003, Adam J. Richter <adam@yggdrasil.com> (conversion to
 * 2.5 API).
 * Copyright (c) 2003, 2004 Fruhwirth Clemens <clemens@endorphin.org>
 * Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
 *
 */

#include <asm/byteorder.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/types.h>
#include <linux/crypto.h>
#include <linux/linkage.h>

asmlinkage void aes_enc_blk(const u8 *src, u8 *dst, void *ctx);
asmlinkage void aes_dec_blk(const u8 *src, u8 *dst, void *ctx);

#define AES_MIN_KEY_SIZE	16
#define AES_MAX_KEY_SIZE	32
#define AES_BLOCK_SIZE		16
#define AES_KS_LENGTH		4 * AES_BLOCK_SIZE
#define RC_LENGTH		29

struct aes_ctx {
	u32 ekey[AES_KS_LENGTH];
	u32 rounds;
	u32 dkey[AES_KS_LENGTH];
};

#define WPOLY 0x011b
#define bytes2word(b0, b1, b2, b3)  \
	(((u32)(b3) << 24) | ((u32)(b2) << 16) | ((u32)(b1) << 8) | (b0))

/* define the finite field multiplies required for Rijndael */
#define f2(x) ((x) ? pow[log[x] + 0x19] : 0)
#define f3(x) ((x) ? pow[log[x] + 0x01] : 0)
#define f9(x) ((x) ? pow[log[x] + 0xc7] : 0)
#define fb(x) ((x) ? pow[log[x] + 0x68] : 0)
#define fd(x) ((x) ? pow[log[x] + 0xee] : 0)
#define fe(x) ((x) ? pow[log[x] + 0xdf] : 0)
#define fi(x) ((x) ?   pow[255 - log[x]]: 0)

static inline u32 upr(u32 x, int n)
{
	return (x << 8 * n) | (x >> (32 - 8 * n));
}

static inline u8 bval(u32 x, int n)
{
	return x >> 8 * n;
}

/* The forward and inverse affine transformations used in the S-box */
#define fwd_affine(x) \
	(w = (u32)x, w ^= (w<<1)^(w<<2)^(w<<3)^(w<<4), 0x63^(u8)(w^(w>>8)))

#define inv_affine(x) \
	(w = (u32)x, w = (w<<1)^(w<<3)^(w<<6), 0x05^(u8)(w^(w>>8)))

static u32 rcon_tab[RC_LENGTH];

u32 ft_tab[4][256];
u32 fl_tab[4][256];
static u32 ls_tab[4][256];
static u32 im_tab[4][256];
u32 il_tab[4][256];
u32 it_tab[4][256];

static void gen_tabs(void)
{
	u32 i, w;
	u8 pow[512], log[256];

	/*
	 * log and power tables for GF(2^8) finite field with
	 * WPOLY as modular polynomial - the simplest primitive
	 * root is 0x03, used here to generate the tables.
	 */
	i = 0; w = 1; 
	
	do {
		pow[i] = (u8)w;
		pow[i + 255] = (u8)w;
		log[w] = (u8)i++;
		w ^=  (w << 1) ^ (w & 0x80 ? WPOLY : 0);
	} while (w != 1);
	
	for(i = 0, w = 1; i < RC_LENGTH; ++i) {
		rcon_tab[i] = bytes2word(w, 0, 0, 0);
		w = f2(w);
	}

	for(i = 0; i < 256; ++i) {
		u8 b;
		
		b = fwd_affine(fi((u8)i));
		w = bytes2word(f2(b), b, b, f3(b));

		/* tables for a normal encryption round */
		ft_tab[0][i] = w;
		ft_tab[1][i] = upr(w, 1);
		ft_tab[2][i] = upr(w, 2);
		ft_tab[3][i] = upr(w, 3);
		w = bytes2word(b, 0, 0, 0);
		
		/*
		 * tables for last encryption round
		 * (may also be used in the key schedule)
		 */
		fl_tab[0][i] = w;
		fl_tab[1][i] = upr(w, 1);
		fl_tab[2][i] = upr(w, 2);
		fl_tab[3][i] = upr(w, 3);
		
		/*
		 * table for key schedule if fl_tab above is
		 * not of the required form
		 */
		ls_tab[0][i] = w;
		ls_tab[1][i] = upr(w, 1);
		ls_tab[2][i] = upr(w, 2);
		ls_tab[3][i] = upr(w, 3);
		
		b = fi(inv_affine((u8)i));
		w = bytes2word(fe(b), f9(b), fd(b), fb(b));

		/* tables for the inverse mix column operation  */
		im_tab[0][b] = w;
		im_tab[1][b] = upr(w, 1);
		im_tab[2][b] = upr(w, 2);
		im_tab[3][b] = upr(w, 3);

		/* tables for a normal decryption round */
		it_tab[0][i] = w;
		it_tab[1][i] = upr(w,1);
		it_tab[2][i] = upr(w,2);
		it_tab[3][i] = upr(w,3);

		w = bytes2word(b, 0, 0, 0);
		
		/* tables for last decryption round */
		il_tab[0][i] = w;
		il_tab[1][i] = upr(w,1);
		il_tab[2][i] = upr(w,2);
		il_tab[3][i] = upr(w,3);
    }
}

#define four_tables(x,tab,vf,rf,c)		\
(	tab[0][bval(vf(x,0,c),rf(0,c))]	^	\
	tab[1][bval(vf(x,1,c),rf(1,c))] ^	\
	tab[2][bval(vf(x,2,c),rf(2,c))] ^	\
	tab[3][bval(vf(x,3,c),rf(3,c))]		\
)

#define vf1(x,r,c)  (x)
#define rf1(r,c)    (r)
#define rf2(r,c)    ((r-c)&3)

#define inv_mcol(x) four_tables(x,im_tab,vf1,rf1,0)
#define ls_box(x,c) four_tables(x,fl_tab,vf1,rf2,c)

#define ff(x) inv_mcol(x)

#define ke4(k,i)							\
{									\
	k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i];		\
	k[4*(i)+5] = ss[1] ^= ss[0];					\
	k[4*(i)+6] = ss[2] ^= ss[1];					\
	k[4*(i)+7] = ss[3] ^= ss[2];					\
}

#define kel4(k,i)							\
{									\
	k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i];		\
	k[4*(i)+5] = ss[1] ^= ss[0];					\
	k[4*(i)+6] = ss[2] ^= ss[1]; k[4*(i)+7] = ss[3] ^= ss[2];	\
}

#define ke6(k,i)							\
{									\
	k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];		\
	k[6*(i)+ 7] = ss[1] ^= ss[0];					\
	k[6*(i)+ 8] = ss[2] ^= ss[1];					\
	k[6*(i)+ 9] = ss[3] ^= ss[2];					\
	k[6*(i)+10] = ss[4] ^= ss[3];					\
	k[6*(i)+11] = ss[5] ^= ss[4];					\
}

#define kel6(k,i)							\
{									\
	k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];		\
	k[6*(i)+ 7] = ss[1] ^= ss[0];					\
	k[6*(i)+ 8] = ss[2] ^= ss[1];					\
	k[6*(i)+ 9] = ss[3] ^= ss[2];					\
}

#define ke8(k,i)							\
{									\
	k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];		\
	k[8*(i)+ 9] = ss[1] ^= ss[0];					\
	k[8*(i)+10] = ss[2] ^= ss[1];					\
	k[8*(i)+11] = ss[3] ^= ss[2];					\
	k[8*(i)+12] = ss[4] ^= ls_box(ss[3],0);				\
	k[8*(i)+13] = ss[5] ^= ss[4];					\
	k[8*(i)+14] = ss[6] ^= ss[5];					\
	k[8*(i)+15] = ss[7] ^= ss[6];					\
}

#define kel8(k,i)							\
{									\
	k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];		\
	k[8*(i)+ 9] = ss[1] ^= ss[0];					\
	k[8*(i)+10] = ss[2] ^= ss[1];					\
	k[8*(i)+11] = ss[3] ^= ss[2];					\
}

#define kdf4(k,i)							\
{									\
	ss[0] = ss[0] ^ ss[2] ^ ss[1] ^ ss[3];				\
	ss[1] = ss[1] ^ ss[3];						\
	ss[2] = ss[2] ^ ss[3];						\
	ss[3] = ss[3];							\
	ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];			\
	ss[i % 4] ^= ss[4];						\
	ss[4] ^= k[4*(i)];						\
	k[4*(i)+4] = ff(ss[4]);						\
	ss[4] ^= k[4*(i)+1];						\
	k[4*(i)+5] = ff(ss[4]);						\
	ss[4] ^= k[4*(i)+2];						\
	k[4*(i)+6] = ff(ss[4]);						\
	ss[4] ^= k[4*(i)+3];						\
	k[4*(i)+7] = ff(ss[4]);						\
}

#define kd4(k,i)							\
{									\
	ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];			\
	ss[i % 4] ^= ss[4];						\
	ss[4] = ff(ss[4]);						\
	k[4*(i)+4] = ss[4] ^= k[4*(i)];					\
	k[4*(i)+5] = ss[4] ^= k[4*(i)+1];				\
	k[4*(i)+6] = ss[4] ^= k[4*(i)+2];				\
	k[4*(i)+7] = ss[4] ^= k[4*(i)+3];				\
}

#define kdl4(k,i)							\
{									\
	ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i];			\
	ss[i % 4] ^= ss[4];						\
	k[4*(i)+4] = (ss[0] ^= ss[1]) ^ ss[2] ^ ss[3];			\
	k[4*(i)+5] = ss[1] ^ ss[3];					\
	k[4*(i)+6] = ss[0];						\
	k[4*(i)+7] = ss[1];						\
}

#define kdf6(k,i)							\
{									\
	ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];				\
	k[6*(i)+ 6] = ff(ss[0]);					\
	ss[1] ^= ss[0];							\
	k[6*(i)+ 7] = ff(ss[1]);					\
	ss[2] ^= ss[1];							\
	k[6*(i)+ 8] = ff(ss[2]);					\
	ss[3] ^= ss[2];							\
	k[6*(i)+ 9] = ff(ss[3]);					\
	ss[4] ^= ss[3];							\
	k[6*(i)+10] = ff(ss[4]);					\
	ss[5] ^= ss[4];							\
	k[6*(i)+11] = ff(ss[5]);					\
}

#define kd6(k,i)							\
{									\
	ss[6] = ls_box(ss[5],3) ^ rcon_tab[i];				\
	ss[0] ^= ss[6]; ss[6] = ff(ss[6]);				\
	k[6*(i)+ 6] = ss[6] ^= k[6*(i)];				\
	ss[1] ^= ss[0];							\
	k[6*(i)+ 7] = ss[6] ^= k[6*(i)+ 1];				\
	ss[2] ^= ss[1];							\
	k[6*(i)+ 8] = ss[6] ^= k[6*(i)+ 2];				\
	ss[3] ^= ss[2];							\
	k[6*(i)+ 9] = ss[6] ^= k[6*(i)+ 3];				\
	ss[4] ^= ss[3];							\
	k[6*(i)+10] = ss[6] ^= k[6*(i)+ 4];				\
	ss[5] ^= ss[4];							\
	k[6*(i)+11] = ss[6] ^= k[6*(i)+ 5];				\
}

#define kdl6(k,i)							\
{									\
	ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i];				\
	k[6*(i)+ 6] = ss[0];						\
	ss[1] ^= ss[0];							\
	k[6*(i)+ 7] = ss[1];						\
	ss[2] ^= ss[1];							\
	k[6*(i)+ 8] = ss[2];						\
	ss[3] ^= ss[2];							\
	k[6*(i)+ 9] = ss[3];						\
}

#define kdf8(k,i)							\
{									\
	ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];				\
	k[8*(i)+ 8] = ff(ss[0]);					\
	ss[1] ^= ss[0];							\
	k[8*(i)+ 9] = ff(ss[1]);					\
	ss[2] ^= ss[1];							\
	k[8*(i)+10] = ff(ss[2]);					\
	ss[3] ^= ss[2];							\
	k[8*(i)+11] = ff(ss[3]);					\
	ss[4] ^= ls_box(ss[3],0);					\
	k[8*(i)+12] = ff(ss[4]);					\
	ss[5] ^= ss[4];							\
	k[8*(i)+13] = ff(ss[5]);					\
	ss[6] ^= ss[5];							\
	k[8*(i)+14] = ff(ss[6]);					\
	ss[7] ^= ss[6];							\
	k[8*(i)+15] = ff(ss[7]);					\
}

#define kd8(k,i)							\
{									\
	u32 __g = ls_box(ss[7],3) ^ rcon_tab[i];			\
	ss[0] ^= __g;							\
	__g = ff(__g);							\
	k[8*(i)+ 8] = __g ^= k[8*(i)];					\
	ss[1] ^= ss[0];							\
	k[8*(i)+ 9] = __g ^= k[8*(i)+ 1];				\
	ss[2] ^= ss[1];							\
	k[8*(i)+10] = __g ^= k[8*(i)+ 2];				\
	ss[3] ^= ss[2];							\
	k[8*(i)+11] = __g ^= k[8*(i)+ 3];				\
	__g = ls_box(ss[3],0);						\
	ss[4] ^= __g;							\
	__g = ff(__g);							\
	k[8*(i)+12] = __g ^= k[8*(i)+ 4];				\
	ss[5] ^= ss[4];							\
	k[8*(i)+13] = __g ^= k[8*(i)+ 5];				\
	ss[6] ^= ss[5];							\
	k[8*(i)+14] = __g ^= k[8*(i)+ 6];				\
	ss[7] ^= ss[6];							\
	k[8*(i)+15] = __g ^= k[8*(i)+ 7];				\
}

#define kdl8(k,i)							\
{									\
	ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i];				\
	k[8*(i)+ 8] = ss[0];						\
	ss[1] ^= ss[0];							\
	k[8*(i)+ 9] = ss[1];						\
	ss[2] ^= ss[1];							\
	k[8*(i)+10] = ss[2];						\
	ss[3] ^= ss[2];							\
	k[8*(i)+11] = ss[3];						\
}

static int
aes_set_key(void *ctx_arg, const u8 *in_key, unsigned int key_len, u32 *flags)
{
	int i;
	u32 ss[8];
	struct aes_ctx *ctx = ctx_arg;
	const __le32 *key = (const __le32 *)in_key;

	/* encryption schedule */
	
	ctx->ekey[0] = ss[0] = le32_to_cpu(key[0]);
	ctx->ekey[1] = ss[1] = le32_to_cpu(key[1]);
	ctx->ekey[2] = ss[2] = le32_to_cpu(key[2]);
	ctx->ekey[3] = ss[3] = le32_to_cpu(key[3]);

	switch(key_len) {
	case 16:
		for (i = 0; i < 9; i++)
			ke4(ctx->ekey, i);
		kel4(ctx->ekey, 9);
		ctx->rounds = 10;
		break;
		
	case 24:
		ctx->ekey[4] = ss[4] = le32_to_cpu(key[4]);
		ctx->ekey[5] = ss[5] = le32_to_cpu(key[5]);
		for (i = 0; i < 7; i++)
			ke6(ctx->ekey, i);
		kel6(ctx->ekey, 7); 
		ctx->rounds = 12;
		break;

	case 32:
		ctx->ekey[4] = ss[4] = le32_to_cpu(key[4]);
		ctx->ekey[5] = ss[5] = le32_to_cpu(key[5]);
		ctx->ekey[6] = ss[6] = le32_to_cpu(key[6]);
		ctx->ekey[7] = ss[7] = le32_to_cpu(key[7]);
		for (i = 0; i < 6; i++)
			ke8(ctx->ekey, i);
		kel8(ctx->ekey, 6);
		ctx->rounds = 14;
		break;

	default:
		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
		return -EINVAL;
	}
	
	/* decryption schedule */
	
	ctx->dkey[0] = ss[0] = le32_to_cpu(key[0]);
	ctx->dkey[1] = ss[1] = le32_to_cpu(key[1]);
	ctx->dkey[2] = ss[2] = le32_to_cpu(key[2]);
	ctx->dkey[3] = ss[3] = le32_to_cpu(key[3]);

	switch (key_len) {
	case 16:
		kdf4(ctx->dkey, 0);
		for (i = 1; i < 9; i++)
			kd4(ctx->dkey, i);
		kdl4(ctx->dkey, 9);
		break;
		
	case 24:
		ctx->dkey[4] = ff(ss[4] = le32_to_cpu(key[4]));
		ctx->dkey[5] = ff(ss[5] = le32_to_cpu(key[5]));
		kdf6(ctx->dkey, 0);
		for (i = 1; i < 7; i++)
			kd6(ctx->dkey, i);
		kdl6(ctx->dkey, 7);
		break;

	case 32:
		ctx->dkey[4] = ff(ss[4] = le32_to_cpu(key[4]));
		ctx->dkey[5] = ff(ss[5] = le32_to_cpu(key[5]));
		ctx->dkey[6] = ff(ss[6] = le32_to_cpu(key[6]));
		ctx->dkey[7] = ff(ss[7] = le32_to_cpu(key[7]));
		kdf8(ctx->dkey, 0);
		for (i = 1; i < 6; i++)
			kd8(ctx->dkey, i);
		kdl8(ctx->dkey, 6);
		break;
	}
	return 0;
}

static inline void aes_encrypt(void *ctx, u8 *dst, const u8 *src)
{
	aes_enc_blk(src, dst, ctx);
}
static inline void aes_decrypt(void *ctx, u8 *dst, const u8 *src)
{
	aes_dec_blk(src, dst, ctx);
}


static struct crypto_alg aes_alg = {
	.cra_name		=	"aes",
	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
	.cra_blocksize		=	AES_BLOCK_SIZE,
	.cra_ctxsize		=	sizeof(struct aes_ctx),
	.cra_module		=	THIS_MODULE,
	.cra_list		=	LIST_HEAD_INIT(aes_alg.cra_list),
	.cra_u			=	{
		.cipher = {
			.cia_min_keysize	=	AES_MIN_KEY_SIZE,
			.cia_max_keysize	=	AES_MAX_KEY_SIZE,
			.cia_setkey	   	= 	aes_set_key,
			.cia_encrypt	 	=	aes_encrypt,
			.cia_decrypt	  	=	aes_decrypt
		}
	}
};

static int __init aes_init(void)
{
	gen_tabs();
	return crypto_register_alg(&aes_alg);
}

static void __exit aes_fini(void)
{
	crypto_unregister_alg(&aes_alg);
}

module_init(aes_init);
module_exit(aes_fini);

MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, i586 asm optimized");
MODULE_LICENSE("Dual BSD/GPL");
MODULE_AUTHOR("Fruhwirth Clemens, James Morris, Brian Gladman, Adam Richter");
MODULE_ALIAS("aes");
Commit	Line	Data
1da177e4 LT	1	/*
	2	*
	3	* Glue Code for optimized 586 assembler version of AES
	4	*
	5	* Copyright (c) 2002, Dr Brian Gladman <>, Worcester, UK.
	6	* All rights reserved.
	7	*
	8	* LICENSE TERMS
	9	*
	10	* The free distribution and use of this software in both source and binary
	11	* form is allowed (with or without changes) provided that:
	12	*
	13	* 1. distributions of this source code include the above copyright
	14	* notice, this list of conditions and the following disclaimer;
	15	*
	16	* 2. distributions in binary form include the above copyright
	17	* notice, this list of conditions and the following disclaimer
	18	* in the documentation and/or other associated materials;
	19	*
	20	* 3. the copyright holder's name is not used to endorse products
	21	* built using this software without specific written permission.
	22	*
	23	* ALTERNATIVELY, provided that this notice is retained in full, this product
	24	* may be distributed under the terms of the GNU General Public License (GPL),
	25	* in which case the provisions of the GPL apply INSTEAD OF those given above.
	26	*
	27	* DISCLAIMER
	28	*
	29	* This software is provided 'as is' with no explicit or implied warranties
	30	* in respect of its properties, including, but not limited to, correctness
	31	* and/or fitness for purpose.
	32	*
	33	* Copyright (c) 2003, Adam J. Richter <adam@yggdrasil.com> (conversion to
	34	* 2.5 API).
	35	* Copyright (c) 2003, 2004 Fruhwirth Clemens <clemens@endorphin.org>
	36	* Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
	37	*
	38	*/
06ace7a9 HX	39
06ace7a9 HX	40	#include <asm/byteorder.h>
1da177e4 LT	41	#include <linux/kernel.h>
	42	#include <linux/module.h>
	43	#include <linux/init.h>
	44	#include <linux/types.h>
	45	#include <linux/crypto.h>
	46	#include <linux/linkage.h>
	47
	48	asmlinkage void aes_enc_blk(const u8 src, u8 dst, void *ctx);
	49	asmlinkage void aes_dec_blk(const u8 src, u8 dst, void *ctx);
	50
	51	#define AES_MIN_KEY_SIZE 16
	52	#define AES_MAX_KEY_SIZE 32
	53	#define AES_BLOCK_SIZE 16
	54	#define AES_KS_LENGTH 4 * AES_BLOCK_SIZE
	55	#define RC_LENGTH 29
	56
	57	struct aes_ctx {
	58	u32 ekey[AES_KS_LENGTH];
	59	u32 rounds;
	60	u32 dkey[AES_KS_LENGTH];
	61	};
	62
	63	#define WPOLY 0x011b
1da177e4 LT	64	#define bytes2word(b0, b1, b2, b3) \
	65	(((u32)(b3) << 24) \| ((u32)(b2) << 16) \| ((u32)(b1) << 8) \| (b0))
	66
	67	/* define the finite field multiplies required for Rijndael */
	68	#define f2(x) ((x) ? pow[log[x] + 0x19] : 0)
	69	#define f3(x) ((x) ? pow[log[x] + 0x01] : 0)
	70	#define f9(x) ((x) ? pow[log[x] + 0xc7] : 0)
	71	#define fb(x) ((x) ? pow[log[x] + 0x68] : 0)
	72	#define fd(x) ((x) ? pow[log[x] + 0xee] : 0)
	73	#define fe(x) ((x) ? pow[log[x] + 0xdf] : 0)
	74	#define fi(x) ((x) ? pow[255 - log[x]]: 0)
	75
	76	static inline u32 upr(u32 x, int n)
	77	{
	78	return (x << 8 * n) \| (x >> (32 - 8 * n));
	79	}
	80
	81	static inline u8 bval(u32 x, int n)
	82	{
	83	return x >> 8 * n;
	84	}
	85
	86	/* The forward and inverse affine transformations used in the S-box */
	87	#define fwd_affine(x) \
	88	(w = (u32)x, w ^= (w<<1)^(w<<2)^(w<<3)^(w<<4), 0x63^(u8)(w^(w>>8)))
	89
	90	#define inv_affine(x) \
	91	(w = (u32)x, w = (w<<1)^(w<<3)^(w<<6), 0x05^(u8)(w^(w>>8)))
	92
	93	static u32 rcon_tab[RC_LENGTH];
	94
	95	u32 ft_tab[4][256];
	96	u32 fl_tab[4][256];
	97	static u32 ls_tab[4][256];
	98	static u32 im_tab[4][256];
	99	u32 il_tab[4][256];
	100	u32 it_tab[4][256];
	101
	102	static void gen_tabs(void)
	103	{
	104	u32 i, w;
	105	u8 pow[512], log[256];
	106
	107	/*
	108	* log and power tables for GF(2^8) finite field with
	109	* WPOLY as modular polynomial - the simplest primitive
	110	* root is 0x03, used here to generate the tables.
	111	*/
	112	i = 0; w = 1;
	113
	114	do {
	115	pow[i] = (u8)w;
	116	pow[i + 255] = (u8)w;
	117	log[w] = (u8)i++;
	118	w ^= (w << 1) ^ (w & 0x80 ? WPOLY : 0);
	119	} while (w != 1);
	120
	121	for(i = 0, w = 1; i < RC_LENGTH; ++i) {
	122	rcon_tab[i] = bytes2word(w, 0, 0, 0);
	123	w = f2(w);
	124	}
	125
	126	for(i = 0; i < 256; ++i) {
	127	u8 b;
128
129	b = fwd_affine(fi((u8)i));
130	w = bytes2word(f2(b), b, b, f3(b));
131
132	/* tables for a normal encryption round */
133	ft_tab[0][i] = w;
134	ft_tab[1][i] = upr(w, 1);
135	ft_tab[2][i] = upr(w, 2);
136	ft_tab[3][i] = upr(w, 3);
137	w = bytes2word(b, 0, 0, 0);
138
139	/*
140	* tables for last encryption round
141	* (may also be used in the key schedule)
142	*/
143	fl_tab[0][i] = w;
144	fl_tab[1][i] = upr(w, 1);
145	fl_tab[2][i] = upr(w, 2);
146	fl_tab[3][i] = upr(w, 3);
147
148	/*
149	* table for key schedule if fl_tab above is
150	* not of the required form
151	*/
152	ls_tab[0][i] = w;
153	ls_tab[1][i] = upr(w, 1);
154	ls_tab[2][i] = upr(w, 2);
155	ls_tab[3][i] = upr(w, 3);
156
157	b = fi(inv_affine((u8)i));
158	w = bytes2word(fe(b), f9(b), fd(b), fb(b));
159
160	/* tables for the inverse mix column operation */
161	im_tab[0][b] = w;
162	im_tab[1][b] = upr(w, 1);
163	im_tab[2][b] = upr(w, 2);
164	im_tab[3][b] = upr(w, 3);
165
166	/* tables for a normal decryption round */
167	it_tab[0][i] = w;
168	it_tab[1][i] = upr(w,1);
169	it_tab[2][i] = upr(w,2);
170	it_tab[3][i] = upr(w,3);
171
172	w = bytes2word(b, 0, 0, 0);
173
174	/* tables for last decryption round */
175	il_tab[0][i] = w;
176	il_tab[1][i] = upr(w,1);
177	il_tab[2][i] = upr(w,2);
178	il_tab[3][i] = upr(w,3);
179	}
180	}
181
182	#define four_tables(x,tab,vf,rf,c) \
183	( tab[0][bval(vf(x,0,c),rf(0,c))] ^ \
184	tab[1][bval(vf(x,1,c),rf(1,c))] ^ \
185	tab[2][bval(vf(x,2,c),rf(2,c))] ^ \
186	tab[3][bval(vf(x,3,c),rf(3,c))] \
187	)
188
189	#define vf1(x,r,c) (x)
190	#define rf1(r,c) (r)
191	#define rf2(r,c) ((r-c)&3)
192
193	#define inv_mcol(x) four_tables(x,im_tab,vf1,rf1,0)
194	#define ls_box(x,c) four_tables(x,fl_tab,vf1,rf2,c)
195
196	#define ff(x) inv_mcol(x)
197
198	#define ke4(k,i) \
199	{ \
200	k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i]; \
201	k[4*(i)+5] = ss[1] ^= ss[0]; \
202	k[4*(i)+6] = ss[2] ^= ss[1]; \
203	k[4*(i)+7] = ss[3] ^= ss[2]; \
204	}
205
206	#define kel4(k,i) \
207	{ \
208	k[4*(i)+4] = ss[0] ^= ls_box(ss[3],3) ^ rcon_tab[i]; \
209	k[4*(i)+5] = ss[1] ^= ss[0]; \
210	k[4(i)+6] = ss[2] ^= ss[1]; k[4(i)+7] = ss[3] ^= ss[2]; \
211	}
212
213	#define ke6(k,i) \
214	{ \
215	k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i]; \
216	k[6*(i)+ 7] = ss[1] ^= ss[0]; \
217	k[6*(i)+ 8] = ss[2] ^= ss[1]; \
218	k[6*(i)+ 9] = ss[3] ^= ss[2]; \
219	k[6*(i)+10] = ss[4] ^= ss[3]; \
220	k[6*(i)+11] = ss[5] ^= ss[4]; \
221	}
222
223	#define kel6(k,i) \
224	{ \
225	k[6*(i)+ 6] = ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i]; \
226	k[6*(i)+ 7] = ss[1] ^= ss[0]; \
227	k[6*(i)+ 8] = ss[2] ^= ss[1]; \
228	k[6*(i)+ 9] = ss[3] ^= ss[2]; \
229	}
230
231	#define ke8(k,i) \
232	{ \
233	k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i]; \
234	k[8*(i)+ 9] = ss[1] ^= ss[0]; \
235	k[8*(i)+10] = ss[2] ^= ss[1]; \
236	k[8*(i)+11] = ss[3] ^= ss[2]; \
237	k[8*(i)+12] = ss[4] ^= ls_box(ss[3],0); \
238	k[8*(i)+13] = ss[5] ^= ss[4]; \
239	k[8*(i)+14] = ss[6] ^= ss[5]; \
240	k[8*(i)+15] = ss[7] ^= ss[6]; \
241	}
242
243	#define kel8(k,i) \
244	{ \
245	k[8*(i)+ 8] = ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i]; \
246	k[8*(i)+ 9] = ss[1] ^= ss[0]; \
247	k[8*(i)+10] = ss[2] ^= ss[1]; \
248	k[8*(i)+11] = ss[3] ^= ss[2]; \
249	}
250
251	#define kdf4(k,i) \
252	{ \
253	ss[0] = ss[0] ^ ss[2] ^ ss[1] ^ ss[3]; \
254	ss[1] = ss[1] ^ ss[3]; \
255	ss[2] = ss[2] ^ ss[3]; \
256	ss[3] = ss[3]; \
257	ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i]; \
258	ss[i % 4] ^= ss[4]; \
259	ss[4] ^= k[4*(i)]; \
260	k[4*(i)+4] = ff(ss[4]); \
261	ss[4] ^= k[4*(i)+1]; \
262	k[4*(i)+5] = ff(ss[4]); \
263	ss[4] ^= k[4*(i)+2]; \
264	k[4*(i)+6] = ff(ss[4]); \
265	ss[4] ^= k[4*(i)+3]; \
266	k[4*(i)+7] = ff(ss[4]); \
267	}
268
269	#define kd4(k,i) \
270	{ \
271	ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i]; \
272	ss[i % 4] ^= ss[4]; \
273	ss[4] = ff(ss[4]); \
274	k[4(i)+4] = ss[4] ^= k[4(i)]; \
275	k[4(i)+5] = ss[4] ^= k[4(i)+1]; \
276	k[4(i)+6] = ss[4] ^= k[4(i)+2]; \
277	k[4(i)+7] = ss[4] ^= k[4(i)+3]; \
278	}
279
280	#define kdl4(k,i) \
281	{ \
282	ss[4] = ls_box(ss[(i+3) % 4], 3) ^ rcon_tab[i]; \
283	ss[i % 4] ^= ss[4]; \
284	k[4*(i)+4] = (ss[0] ^= ss[1]) ^ ss[2] ^ ss[3]; \
285	k[4*(i)+5] = ss[1] ^ ss[3]; \
286	k[4*(i)+6] = ss[0]; \
287	k[4*(i)+7] = ss[1]; \
288	}
289
290	#define kdf6(k,i) \
291	{ \
292	ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i]; \
293	k[6*(i)+ 6] = ff(ss[0]); \
294	ss[1] ^= ss[0]; \
295	k[6*(i)+ 7] = ff(ss[1]); \
296	ss[2] ^= ss[1]; \
297	k[6*(i)+ 8] = ff(ss[2]); \
298	ss[3] ^= ss[2]; \
299	k[6*(i)+ 9] = ff(ss[3]); \
300	ss[4] ^= ss[3]; \
301	k[6*(i)+10] = ff(ss[4]); \
302	ss[5] ^= ss[4]; \
303	k[6*(i)+11] = ff(ss[5]); \
304	}
305
306	#define kd6(k,i) \
307	{ \
308	ss[6] = ls_box(ss[5],3) ^ rcon_tab[i]; \
309	ss[0] ^= ss[6]; ss[6] = ff(ss[6]); \
310	k[6(i)+ 6] = ss[6] ^= k[6(i)]; \
311	ss[1] ^= ss[0]; \
312	k[6(i)+ 7] = ss[6] ^= k[6(i)+ 1]; \
313	ss[2] ^= ss[1]; \
314	k[6(i)+ 8] = ss[6] ^= k[6(i)+ 2]; \
315	ss[3] ^= ss[2]; \
316	k[6(i)+ 9] = ss[6] ^= k[6(i)+ 3]; \
317	ss[4] ^= ss[3]; \
318	k[6(i)+10] = ss[6] ^= k[6(i)+ 4]; \
319	ss[5] ^= ss[4]; \
320	k[6(i)+11] = ss[6] ^= k[6(i)+ 5]; \
321	}
322
323	#define kdl6(k,i) \
324	{ \
325	ss[0] ^= ls_box(ss[5],3) ^ rcon_tab[i]; \
326	k[6*(i)+ 6] = ss[0]; \
327	ss[1] ^= ss[0]; \
328	k[6*(i)+ 7] = ss[1]; \
329	ss[2] ^= ss[1]; \
330	k[6*(i)+ 8] = ss[2]; \
331	ss[3] ^= ss[2]; \
332	k[6*(i)+ 9] = ss[3]; \
333	}
334
335	#define kdf8(k,i) \
336	{ \
337	ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i]; \
338	k[8*(i)+ 8] = ff(ss[0]); \
339	ss[1] ^= ss[0]; \
340	k[8*(i)+ 9] = ff(ss[1]); \
341	ss[2] ^= ss[1]; \
342	k[8*(i)+10] = ff(ss[2]); \
343	ss[3] ^= ss[2]; \
344	k[8*(i)+11] = ff(ss[3]); \
345	ss[4] ^= ls_box(ss[3],0); \
346	k[8*(i)+12] = ff(ss[4]); \
347	ss[5] ^= ss[4]; \
348	k[8*(i)+13] = ff(ss[5]); \
349	ss[6] ^= ss[5]; \
350	k[8*(i)+14] = ff(ss[6]); \
351	ss[7] ^= ss[6]; \
352	k[8*(i)+15] = ff(ss[7]); \
353	}
354
355	#define kd8(k,i) \
356	{ \
357	u32 __g = ls_box(ss[7],3) ^ rcon_tab[i]; \
358	ss[0] ^= __g; \
359	__g = ff(__g); \
360	k[8(i)+ 8] = __g ^= k[8(i)]; \
361	ss[1] ^= ss[0]; \
362	k[8(i)+ 9] = __g ^= k[8(i)+ 1]; \
363	ss[2] ^= ss[1]; \
364	k[8(i)+10] = __g ^= k[8(i)+ 2]; \
365	ss[3] ^= ss[2]; \
366	k[8(i)+11] = __g ^= k[8(i)+ 3]; \
367	__g = ls_box(ss[3],0); \
368	ss[4] ^= __g; \
369	__g = ff(__g); \
370	k[8(i)+12] = __g ^= k[8(i)+ 4]; \
371	ss[5] ^= ss[4]; \
372	k[8(i)+13] = __g ^= k[8(i)+ 5]; \
373	ss[6] ^= ss[5]; \
374	k[8(i)+14] = __g ^= k[8(i)+ 6]; \
375	ss[7] ^= ss[6]; \
376	k[8(i)+15] = __g ^= k[8(i)+ 7]; \
377	}
378
379	#define kdl8(k,i) \
380	{ \
381	ss[0] ^= ls_box(ss[7],3) ^ rcon_tab[i]; \
382	k[8*(i)+ 8] = ss[0]; \
383	ss[1] ^= ss[0]; \
384	k[8*(i)+ 9] = ss[1]; \
385	ss[2] ^= ss[1]; \
386	k[8*(i)+10] = ss[2]; \
387	ss[3] ^= ss[2]; \
388	k[8*(i)+11] = ss[3]; \
389	}
390
391	static int
392	aes_set_key(void ctx_arg, const u8 in_key, unsigned int key_len, u32 *flags)
393	{
394	int i;
395	u32 ss[8];
396	struct aes_ctx *ctx = ctx_arg;
06ace7a9	397	const __le32 key = (const __le32 )in_key;
1da177e4 LT	398
	399	/* encryption schedule */
	400
06ace7a9 HX	401	ctx->ekey[0] = ss[0] = le32_to_cpu(key[0]);
	402	ctx->ekey[1] = ss[1] = le32_to_cpu(key[1]);
	403	ctx->ekey[2] = ss[2] = le32_to_cpu(key[2]);
	404	ctx->ekey[3] = ss[3] = le32_to_cpu(key[3]);
1da177e4 LT	405
	406	switch(key_len) {
	407	case 16:
	408	for (i = 0; i < 9; i++)
	409	ke4(ctx->ekey, i);
	410	kel4(ctx->ekey, 9);
	411	ctx->rounds = 10;
	412	break;
	413
	414	case 24:
06ace7a9 HX	415	ctx->ekey[4] = ss[4] = le32_to_cpu(key[4]);
06ace7a9 HX	416	ctx->ekey[5] = ss[5] = le32_to_cpu(key[5]);
1da177e4 LT	417	for (i = 0; i < 7; i++)
	418	ke6(ctx->ekey, i);
	419	kel6(ctx->ekey, 7);
	420	ctx->rounds = 12;
	421	break;
	422
	423	case 32:
06ace7a9 HX	424	ctx->ekey[4] = ss[4] = le32_to_cpu(key[4]);
	425	ctx->ekey[5] = ss[5] = le32_to_cpu(key[5]);
	426	ctx->ekey[6] = ss[6] = le32_to_cpu(key[6]);
	427	ctx->ekey[7] = ss[7] = le32_to_cpu(key[7]);
1da177e4 LT	428	for (i = 0; i < 6; i++)
	429	ke8(ctx->ekey, i);
	430	kel8(ctx->ekey, 6);
	431	ctx->rounds = 14;
	432	break;
	433
	434	default:
	435	*flags \|= CRYPTO_TFM_RES_BAD_KEY_LEN;
	436	return -EINVAL;
	437	}
	438
	439	/* decryption schedule */
	440
06ace7a9 HX	441	ctx->dkey[0] = ss[0] = le32_to_cpu(key[0]);
	442	ctx->dkey[1] = ss[1] = le32_to_cpu(key[1]);
	443	ctx->dkey[2] = ss[2] = le32_to_cpu(key[2]);
	444	ctx->dkey[3] = ss[3] = le32_to_cpu(key[3]);
1da177e4 LT	445
	446	switch (key_len) {
	447	case 16:
	448	kdf4(ctx->dkey, 0);
	449	for (i = 1; i < 9; i++)
	450	kd4(ctx->dkey, i);
	451	kdl4(ctx->dkey, 9);
	452	break;
	453
	454	case 24:
06ace7a9 HX	455	ctx->dkey[4] = ff(ss[4] = le32_to_cpu(key[4]));
06ace7a9 HX	456	ctx->dkey[5] = ff(ss[5] = le32_to_cpu(key[5]));
1da177e4 LT	457	kdf6(ctx->dkey, 0);
	458	for (i = 1; i < 7; i++)
	459	kd6(ctx->dkey, i);
	460	kdl6(ctx->dkey, 7);
	461	break;
	462
	463	case 32:
06ace7a9 HX	464	ctx->dkey[4] = ff(ss[4] = le32_to_cpu(key[4]));
	465	ctx->dkey[5] = ff(ss[5] = le32_to_cpu(key[5]));
	466	ctx->dkey[6] = ff(ss[6] = le32_to_cpu(key[6]));
	467	ctx->dkey[7] = ff(ss[7] = le32_to_cpu(key[7]));
1da177e4 LT	468	kdf8(ctx->dkey, 0);
	469	for (i = 1; i < 6; i++)
	470	kd8(ctx->dkey, i);
	471	kdl8(ctx->dkey, 6);
	472	break;
	473	}
	474	return 0;
	475	}
	476
	477	static inline void aes_encrypt(void ctx, u8 dst, const u8 *src)
	478	{
	479	aes_enc_blk(src, dst, ctx);
	480	}
	481	static inline void aes_decrypt(void ctx, u8 dst, const u8 *src)
	482	{
	483	aes_dec_blk(src, dst, ctx);
	484	}
	485
	486
	487	static struct crypto_alg aes_alg = {
	488	.cra_name = "aes",
	489	.cra_flags = CRYPTO_ALG_TYPE_CIPHER,
	490	.cra_blocksize = AES_BLOCK_SIZE,
	491	.cra_ctxsize = sizeof(struct aes_ctx),
	492	.cra_module = THIS_MODULE,
	493	.cra_list = LIST_HEAD_INIT(aes_alg.cra_list),
	494	.cra_u = {
	495	.cipher = {
	496	.cia_min_keysize = AES_MIN_KEY_SIZE,
	497	.cia_max_keysize = AES_MAX_KEY_SIZE,
	498	.cia_setkey = aes_set_key,
	499	.cia_encrypt = aes_encrypt,
	500	.cia_decrypt = aes_decrypt
	501	}
	502	}
	503	};
	504
	505	static int __init aes_init(void)
	506	{
	507	gen_tabs();
	508	return crypto_register_alg(&aes_alg);
	509	}
	510
	511	static void __exit aes_fini(void)
	512	{
	513	crypto_unregister_alg(&aes_alg);
	514	}
	515
	516	module_init(aes_init);
	517	module_exit(aes_fini);
	518
	519	MODULE_DESCRIPTION("Rijndael (AES) Cipher Algorithm, i586 asm optimized");
	520	MODULE_LICENSE("Dual BSD/GPL");
	521	MODULE_AUTHOR("Fruhwirth Clemens, James Morris, Brian Gladman, Adam Richter");
	522	MODULE_ALIAS("aes");