xref: /linux/crypto/camellia_generic.c (revision 307797159ac25fe5a2048bf5c6a5718298edca57) 
1 /*
2  * Copyright (C) 2006
3  * NTT (Nippon Telegraph and Telephone Corporation).
4  *
5  * This program is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU General Public License
7  * as published by the Free Software Foundation; either version 2
8  * of the License, or (at your option) any later version.
9  *
10  * This program is distributed in the hope that it will be useful,
11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
13  * GNU General Public License for more details.
14  *
15  * You should have received a copy of the GNU General Public License
16  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
17  */
18 
19 /*
20  * Algorithm Specification
21  *  http://info.isl.ntt.co.jp/crypt/eng/camellia/specifications.html
22  */
23 
24 /*
25  *
26  * NOTE --- NOTE --- NOTE --- NOTE
27  * This implementation assumes that all memory addresses passed
28  * as parameters are four-byte aligned.
29  *
30  */
31 
32 #include <linux/crypto.h>
33 #include <linux/errno.h>
34 #include <linux/init.h>
35 #include <linux/kernel.h>
36 #include <linux/module.h>
37 #include <linux/bitops.h>
38 #include <asm/unaligned.h>
39 
40 static const u32 camellia_sp1110[256] = {
41 	0x70707000, 0x82828200, 0x2c2c2c00, 0xececec00,
42 	0xb3b3b300, 0x27272700, 0xc0c0c000, 0xe5e5e500,
43 	0xe4e4e400, 0x85858500, 0x57575700, 0x35353500,
44 	0xeaeaea00, 0x0c0c0c00, 0xaeaeae00, 0x41414100,
45 	0x23232300, 0xefefef00, 0x6b6b6b00, 0x93939300,
46 	0x45454500, 0x19191900, 0xa5a5a500, 0x21212100,
47 	0xededed00, 0x0e0e0e00, 0x4f4f4f00, 0x4e4e4e00,
48 	0x1d1d1d00, 0x65656500, 0x92929200, 0xbdbdbd00,
49 	0x86868600, 0xb8b8b800, 0xafafaf00, 0x8f8f8f00,
50 	0x7c7c7c00, 0xebebeb00, 0x1f1f1f00, 0xcecece00,
51 	0x3e3e3e00, 0x30303000, 0xdcdcdc00, 0x5f5f5f00,
52 	0x5e5e5e00, 0xc5c5c500, 0x0b0b0b00, 0x1a1a1a00,
53 	0xa6a6a600, 0xe1e1e100, 0x39393900, 0xcacaca00,
54 	0xd5d5d500, 0x47474700, 0x5d5d5d00, 0x3d3d3d00,
55 	0xd9d9d900, 0x01010100, 0x5a5a5a00, 0xd6d6d600,
56 	0x51515100, 0x56565600, 0x6c6c6c00, 0x4d4d4d00,
57 	0x8b8b8b00, 0x0d0d0d00, 0x9a9a9a00, 0x66666600,
58 	0xfbfbfb00, 0xcccccc00, 0xb0b0b000, 0x2d2d2d00,
59 	0x74747400, 0x12121200, 0x2b2b2b00, 0x20202000,
60 	0xf0f0f000, 0xb1b1b100, 0x84848400, 0x99999900,
61 	0xdfdfdf00, 0x4c4c4c00, 0xcbcbcb00, 0xc2c2c200,
62 	0x34343400, 0x7e7e7e00, 0x76767600, 0x05050500,
63 	0x6d6d6d00, 0xb7b7b700, 0xa9a9a900, 0x31313100,
64 	0xd1d1d100, 0x17171700, 0x04040400, 0xd7d7d700,
65 	0x14141400, 0x58585800, 0x3a3a3a00, 0x61616100,
66 	0xdedede00, 0x1b1b1b00, 0x11111100, 0x1c1c1c00,
67 	0x32323200, 0x0f0f0f00, 0x9c9c9c00, 0x16161600,
68 	0x53535300, 0x18181800, 0xf2f2f200, 0x22222200,
69 	0xfefefe00, 0x44444400, 0xcfcfcf00, 0xb2b2b200,
70 	0xc3c3c300, 0xb5b5b500, 0x7a7a7a00, 0x91919100,
71 	0x24242400, 0x08080800, 0xe8e8e800, 0xa8a8a800,
72 	0x60606000, 0xfcfcfc00, 0x69696900, 0x50505000,
73 	0xaaaaaa00, 0xd0d0d000, 0xa0a0a000, 0x7d7d7d00,
74 	0xa1a1a100, 0x89898900, 0x62626200, 0x97979700,
75 	0x54545400, 0x5b5b5b00, 0x1e1e1e00, 0x95959500,
76 	0xe0e0e000, 0xffffff00, 0x64646400, 0xd2d2d200,
77 	0x10101000, 0xc4c4c400, 0x00000000, 0x48484800,
78 	0xa3a3a300, 0xf7f7f700, 0x75757500, 0xdbdbdb00,
79 	0x8a8a8a00, 0x03030300, 0xe6e6e600, 0xdadada00,
80 	0x09090900, 0x3f3f3f00, 0xdddddd00, 0x94949400,
81 	0x87878700, 0x5c5c5c00, 0x83838300, 0x02020200,
82 	0xcdcdcd00, 0x4a4a4a00, 0x90909000, 0x33333300,
83 	0x73737300, 0x67676700, 0xf6f6f600, 0xf3f3f300,
84 	0x9d9d9d00, 0x7f7f7f00, 0xbfbfbf00, 0xe2e2e200,
85 	0x52525200, 0x9b9b9b00, 0xd8d8d800, 0x26262600,
86 	0xc8c8c800, 0x37373700, 0xc6c6c600, 0x3b3b3b00,
87 	0x81818100, 0x96969600, 0x6f6f6f00, 0x4b4b4b00,
88 	0x13131300, 0xbebebe00, 0x63636300, 0x2e2e2e00,
89 	0xe9e9e900, 0x79797900, 0xa7a7a700, 0x8c8c8c00,
90 	0x9f9f9f00, 0x6e6e6e00, 0xbcbcbc00, 0x8e8e8e00,
91 	0x29292900, 0xf5f5f500, 0xf9f9f900, 0xb6b6b600,
92 	0x2f2f2f00, 0xfdfdfd00, 0xb4b4b400, 0x59595900,
93 	0x78787800, 0x98989800, 0x06060600, 0x6a6a6a00,
94 	0xe7e7e700, 0x46464600, 0x71717100, 0xbababa00,
95 	0xd4d4d400, 0x25252500, 0xababab00, 0x42424200,
96 	0x88888800, 0xa2a2a200, 0x8d8d8d00, 0xfafafa00,
97 	0x72727200, 0x07070700, 0xb9b9b900, 0x55555500,
98 	0xf8f8f800, 0xeeeeee00, 0xacacac00, 0x0a0a0a00,
99 	0x36363600, 0x49494900, 0x2a2a2a00, 0x68686800,
100 	0x3c3c3c00, 0x38383800, 0xf1f1f100, 0xa4a4a400,
101 	0x40404000, 0x28282800, 0xd3d3d300, 0x7b7b7b00,
102 	0xbbbbbb00, 0xc9c9c900, 0x43434300, 0xc1c1c100,
103 	0x15151500, 0xe3e3e300, 0xadadad00, 0xf4f4f400,
104 	0x77777700, 0xc7c7c700, 0x80808000, 0x9e9e9e00,
105 };
106 
107 static const u32 camellia_sp0222[256] = {
108 	0x00e0e0e0, 0x00050505, 0x00585858, 0x00d9d9d9,
109 	0x00676767, 0x004e4e4e, 0x00818181, 0x00cbcbcb,
110 	0x00c9c9c9, 0x000b0b0b, 0x00aeaeae, 0x006a6a6a,
111 	0x00d5d5d5, 0x00181818, 0x005d5d5d, 0x00828282,
112 	0x00464646, 0x00dfdfdf, 0x00d6d6d6, 0x00272727,
113 	0x008a8a8a, 0x00323232, 0x004b4b4b, 0x00424242,
114 	0x00dbdbdb, 0x001c1c1c, 0x009e9e9e, 0x009c9c9c,
115 	0x003a3a3a, 0x00cacaca, 0x00252525, 0x007b7b7b,
116 	0x000d0d0d, 0x00717171, 0x005f5f5f, 0x001f1f1f,
117 	0x00f8f8f8, 0x00d7d7d7, 0x003e3e3e, 0x009d9d9d,
118 	0x007c7c7c, 0x00606060, 0x00b9b9b9, 0x00bebebe,
119 	0x00bcbcbc, 0x008b8b8b, 0x00161616, 0x00343434,
120 	0x004d4d4d, 0x00c3c3c3, 0x00727272, 0x00959595,
121 	0x00ababab, 0x008e8e8e, 0x00bababa, 0x007a7a7a,
122 	0x00b3b3b3, 0x00020202, 0x00b4b4b4, 0x00adadad,
123 	0x00a2a2a2, 0x00acacac, 0x00d8d8d8, 0x009a9a9a,
124 	0x00171717, 0x001a1a1a, 0x00353535, 0x00cccccc,
125 	0x00f7f7f7, 0x00999999, 0x00616161, 0x005a5a5a,
126 	0x00e8e8e8, 0x00242424, 0x00565656, 0x00404040,
127 	0x00e1e1e1, 0x00636363, 0x00090909, 0x00333333,
128 	0x00bfbfbf, 0x00989898, 0x00979797, 0x00858585,
129 	0x00686868, 0x00fcfcfc, 0x00ececec, 0x000a0a0a,
130 	0x00dadada, 0x006f6f6f, 0x00535353, 0x00626262,
131 	0x00a3a3a3, 0x002e2e2e, 0x00080808, 0x00afafaf,
132 	0x00282828, 0x00b0b0b0, 0x00747474, 0x00c2c2c2,
133 	0x00bdbdbd, 0x00363636, 0x00222222, 0x00383838,
134 	0x00646464, 0x001e1e1e, 0x00393939, 0x002c2c2c,
135 	0x00a6a6a6, 0x00303030, 0x00e5e5e5, 0x00444444,
136 	0x00fdfdfd, 0x00888888, 0x009f9f9f, 0x00656565,
137 	0x00878787, 0x006b6b6b, 0x00f4f4f4, 0x00232323,
138 	0x00484848, 0x00101010, 0x00d1d1d1, 0x00515151,
139 	0x00c0c0c0, 0x00f9f9f9, 0x00d2d2d2, 0x00a0a0a0,
140 	0x00555555, 0x00a1a1a1, 0x00414141, 0x00fafafa,
141 	0x00434343, 0x00131313, 0x00c4c4c4, 0x002f2f2f,
142 	0x00a8a8a8, 0x00b6b6b6, 0x003c3c3c, 0x002b2b2b,
143 	0x00c1c1c1, 0x00ffffff, 0x00c8c8c8, 0x00a5a5a5,
144 	0x00202020, 0x00898989, 0x00000000, 0x00909090,
145 	0x00474747, 0x00efefef, 0x00eaeaea, 0x00b7b7b7,
146 	0x00151515, 0x00060606, 0x00cdcdcd, 0x00b5b5b5,
147 	0x00121212, 0x007e7e7e, 0x00bbbbbb, 0x00292929,
148 	0x000f0f0f, 0x00b8b8b8, 0x00070707, 0x00040404,
149 	0x009b9b9b, 0x00949494, 0x00212121, 0x00666666,
150 	0x00e6e6e6, 0x00cecece, 0x00ededed, 0x00e7e7e7,
151 	0x003b3b3b, 0x00fefefe, 0x007f7f7f, 0x00c5c5c5,
152 	0x00a4a4a4, 0x00373737, 0x00b1b1b1, 0x004c4c4c,
153 	0x00919191, 0x006e6e6e, 0x008d8d8d, 0x00767676,
154 	0x00030303, 0x002d2d2d, 0x00dedede, 0x00969696,
155 	0x00262626, 0x007d7d7d, 0x00c6c6c6, 0x005c5c5c,
156 	0x00d3d3d3, 0x00f2f2f2, 0x004f4f4f, 0x00191919,
157 	0x003f3f3f, 0x00dcdcdc, 0x00797979, 0x001d1d1d,
158 	0x00525252, 0x00ebebeb, 0x00f3f3f3, 0x006d6d6d,
159 	0x005e5e5e, 0x00fbfbfb, 0x00696969, 0x00b2b2b2,
160 	0x00f0f0f0, 0x00313131, 0x000c0c0c, 0x00d4d4d4,
161 	0x00cfcfcf, 0x008c8c8c, 0x00e2e2e2, 0x00757575,
162 	0x00a9a9a9, 0x004a4a4a, 0x00575757, 0x00848484,
163 	0x00111111, 0x00454545, 0x001b1b1b, 0x00f5f5f5,
164 	0x00e4e4e4, 0x000e0e0e, 0x00737373, 0x00aaaaaa,
165 	0x00f1f1f1, 0x00dddddd, 0x00595959, 0x00141414,
166 	0x006c6c6c, 0x00929292, 0x00545454, 0x00d0d0d0,
167 	0x00787878, 0x00707070, 0x00e3e3e3, 0x00494949,
168 	0x00808080, 0x00505050, 0x00a7a7a7, 0x00f6f6f6,
169 	0x00777777, 0x00939393, 0x00868686, 0x00838383,
170 	0x002a2a2a, 0x00c7c7c7, 0x005b5b5b, 0x00e9e9e9,
171 	0x00eeeeee, 0x008f8f8f, 0x00010101, 0x003d3d3d,
172 };
173 
174 static const u32 camellia_sp3033[256] = {
175 	0x38003838, 0x41004141, 0x16001616, 0x76007676,
176 	0xd900d9d9, 0x93009393, 0x60006060, 0xf200f2f2,
177 	0x72007272, 0xc200c2c2, 0xab00abab, 0x9a009a9a,
178 	0x75007575, 0x06000606, 0x57005757, 0xa000a0a0,
179 	0x91009191, 0xf700f7f7, 0xb500b5b5, 0xc900c9c9,
180 	0xa200a2a2, 0x8c008c8c, 0xd200d2d2, 0x90009090,
181 	0xf600f6f6, 0x07000707, 0xa700a7a7, 0x27002727,
182 	0x8e008e8e, 0xb200b2b2, 0x49004949, 0xde00dede,
183 	0x43004343, 0x5c005c5c, 0xd700d7d7, 0xc700c7c7,
184 	0x3e003e3e, 0xf500f5f5, 0x8f008f8f, 0x67006767,
185 	0x1f001f1f, 0x18001818, 0x6e006e6e, 0xaf00afaf,
186 	0x2f002f2f, 0xe200e2e2, 0x85008585, 0x0d000d0d,
187 	0x53005353, 0xf000f0f0, 0x9c009c9c, 0x65006565,
188 	0xea00eaea, 0xa300a3a3, 0xae00aeae, 0x9e009e9e,
189 	0xec00ecec, 0x80008080, 0x2d002d2d, 0x6b006b6b,
190 	0xa800a8a8, 0x2b002b2b, 0x36003636, 0xa600a6a6,
191 	0xc500c5c5, 0x86008686, 0x4d004d4d, 0x33003333,
192 	0xfd00fdfd, 0x66006666, 0x58005858, 0x96009696,
193 	0x3a003a3a, 0x09000909, 0x95009595, 0x10001010,
194 	0x78007878, 0xd800d8d8, 0x42004242, 0xcc00cccc,
195 	0xef00efef, 0x26002626, 0xe500e5e5, 0x61006161,
196 	0x1a001a1a, 0x3f003f3f, 0x3b003b3b, 0x82008282,
197 	0xb600b6b6, 0xdb00dbdb, 0xd400d4d4, 0x98009898,
198 	0xe800e8e8, 0x8b008b8b, 0x02000202, 0xeb00ebeb,
199 	0x0a000a0a, 0x2c002c2c, 0x1d001d1d, 0xb000b0b0,
200 	0x6f006f6f, 0x8d008d8d, 0x88008888, 0x0e000e0e,
201 	0x19001919, 0x87008787, 0x4e004e4e, 0x0b000b0b,
202 	0xa900a9a9, 0x0c000c0c, 0x79007979, 0x11001111,
203 	0x7f007f7f, 0x22002222, 0xe700e7e7, 0x59005959,
204 	0xe100e1e1, 0xda00dada, 0x3d003d3d, 0xc800c8c8,
205 	0x12001212, 0x04000404, 0x74007474, 0x54005454,
206 	0x30003030, 0x7e007e7e, 0xb400b4b4, 0x28002828,
207 	0x55005555, 0x68006868, 0x50005050, 0xbe00bebe,
208 	0xd000d0d0, 0xc400c4c4, 0x31003131, 0xcb00cbcb,
209 	0x2a002a2a, 0xad00adad, 0x0f000f0f, 0xca00caca,
210 	0x70007070, 0xff00ffff, 0x32003232, 0x69006969,
211 	0x08000808, 0x62006262, 0x00000000, 0x24002424,
212 	0xd100d1d1, 0xfb00fbfb, 0xba00baba, 0xed00eded,
213 	0x45004545, 0x81008181, 0x73007373, 0x6d006d6d,
214 	0x84008484, 0x9f009f9f, 0xee00eeee, 0x4a004a4a,
215 	0xc300c3c3, 0x2e002e2e, 0xc100c1c1, 0x01000101,
216 	0xe600e6e6, 0x25002525, 0x48004848, 0x99009999,
217 	0xb900b9b9, 0xb300b3b3, 0x7b007b7b, 0xf900f9f9,
218 	0xce00cece, 0xbf00bfbf, 0xdf00dfdf, 0x71007171,
219 	0x29002929, 0xcd00cdcd, 0x6c006c6c, 0x13001313,
220 	0x64006464, 0x9b009b9b, 0x63006363, 0x9d009d9d,
221 	0xc000c0c0, 0x4b004b4b, 0xb700b7b7, 0xa500a5a5,
222 	0x89008989, 0x5f005f5f, 0xb100b1b1, 0x17001717,
223 	0xf400f4f4, 0xbc00bcbc, 0xd300d3d3, 0x46004646,
224 	0xcf00cfcf, 0x37003737, 0x5e005e5e, 0x47004747,
225 	0x94009494, 0xfa00fafa, 0xfc00fcfc, 0x5b005b5b,
226 	0x97009797, 0xfe00fefe, 0x5a005a5a, 0xac00acac,
227 	0x3c003c3c, 0x4c004c4c, 0x03000303, 0x35003535,
228 	0xf300f3f3, 0x23002323, 0xb800b8b8, 0x5d005d5d,
229 	0x6a006a6a, 0x92009292, 0xd500d5d5, 0x21002121,
230 	0x44004444, 0x51005151, 0xc600c6c6, 0x7d007d7d,
231 	0x39003939, 0x83008383, 0xdc00dcdc, 0xaa00aaaa,
232 	0x7c007c7c, 0x77007777, 0x56005656, 0x05000505,
233 	0x1b001b1b, 0xa400a4a4, 0x15001515, 0x34003434,
234 	0x1e001e1e, 0x1c001c1c, 0xf800f8f8, 0x52005252,
235 	0x20002020, 0x14001414, 0xe900e9e9, 0xbd00bdbd,
236 	0xdd00dddd, 0xe400e4e4, 0xa100a1a1, 0xe000e0e0,
237 	0x8a008a8a, 0xf100f1f1, 0xd600d6d6, 0x7a007a7a,
238 	0xbb00bbbb, 0xe300e3e3, 0x40004040, 0x4f004f4f,
239 };
240 
241 static const u32 camellia_sp4404[256] = {
242 	0x70700070, 0x2c2c002c, 0xb3b300b3, 0xc0c000c0,
243 	0xe4e400e4, 0x57570057, 0xeaea00ea, 0xaeae00ae,
244 	0x23230023, 0x6b6b006b, 0x45450045, 0xa5a500a5,
245 	0xeded00ed, 0x4f4f004f, 0x1d1d001d, 0x92920092,
246 	0x86860086, 0xafaf00af, 0x7c7c007c, 0x1f1f001f,
247 	0x3e3e003e, 0xdcdc00dc, 0x5e5e005e, 0x0b0b000b,
248 	0xa6a600a6, 0x39390039, 0xd5d500d5, 0x5d5d005d,
249 	0xd9d900d9, 0x5a5a005a, 0x51510051, 0x6c6c006c,
250 	0x8b8b008b, 0x9a9a009a, 0xfbfb00fb, 0xb0b000b0,
251 	0x74740074, 0x2b2b002b, 0xf0f000f0, 0x84840084,
252 	0xdfdf00df, 0xcbcb00cb, 0x34340034, 0x76760076,
253 	0x6d6d006d, 0xa9a900a9, 0xd1d100d1, 0x04040004,
254 	0x14140014, 0x3a3a003a, 0xdede00de, 0x11110011,
255 	0x32320032, 0x9c9c009c, 0x53530053, 0xf2f200f2,
256 	0xfefe00fe, 0xcfcf00cf, 0xc3c300c3, 0x7a7a007a,
257 	0x24240024, 0xe8e800e8, 0x60600060, 0x69690069,
258 	0xaaaa00aa, 0xa0a000a0, 0xa1a100a1, 0x62620062,
259 	0x54540054, 0x1e1e001e, 0xe0e000e0, 0x64640064,
260 	0x10100010, 0x00000000, 0xa3a300a3, 0x75750075,
261 	0x8a8a008a, 0xe6e600e6, 0x09090009, 0xdddd00dd,
262 	0x87870087, 0x83830083, 0xcdcd00cd, 0x90900090,
263 	0x73730073, 0xf6f600f6, 0x9d9d009d, 0xbfbf00bf,
264 	0x52520052, 0xd8d800d8, 0xc8c800c8, 0xc6c600c6,
265 	0x81810081, 0x6f6f006f, 0x13130013, 0x63630063,
266 	0xe9e900e9, 0xa7a700a7, 0x9f9f009f, 0xbcbc00bc,
267 	0x29290029, 0xf9f900f9, 0x2f2f002f, 0xb4b400b4,
268 	0x78780078, 0x06060006, 0xe7e700e7, 0x71710071,
269 	0xd4d400d4, 0xabab00ab, 0x88880088, 0x8d8d008d,
270 	0x72720072, 0xb9b900b9, 0xf8f800f8, 0xacac00ac,
271 	0x36360036, 0x2a2a002a, 0x3c3c003c, 0xf1f100f1,
272 	0x40400040, 0xd3d300d3, 0xbbbb00bb, 0x43430043,
273 	0x15150015, 0xadad00ad, 0x77770077, 0x80800080,
274 	0x82820082, 0xecec00ec, 0x27270027, 0xe5e500e5,
275 	0x85850085, 0x35350035, 0x0c0c000c, 0x41410041,
276 	0xefef00ef, 0x93930093, 0x19190019, 0x21210021,
277 	0x0e0e000e, 0x4e4e004e, 0x65650065, 0xbdbd00bd,
278 	0xb8b800b8, 0x8f8f008f, 0xebeb00eb, 0xcece00ce,
279 	0x30300030, 0x5f5f005f, 0xc5c500c5, 0x1a1a001a,
280 	0xe1e100e1, 0xcaca00ca, 0x47470047, 0x3d3d003d,
281 	0x01010001, 0xd6d600d6, 0x56560056, 0x4d4d004d,
282 	0x0d0d000d, 0x66660066, 0xcccc00cc, 0x2d2d002d,
283 	0x12120012, 0x20200020, 0xb1b100b1, 0x99990099,
284 	0x4c4c004c, 0xc2c200c2, 0x7e7e007e, 0x05050005,
285 	0xb7b700b7, 0x31310031, 0x17170017, 0xd7d700d7,
286 	0x58580058, 0x61610061, 0x1b1b001b, 0x1c1c001c,
287 	0x0f0f000f, 0x16160016, 0x18180018, 0x22220022,
288 	0x44440044, 0xb2b200b2, 0xb5b500b5, 0x91910091,
289 	0x08080008, 0xa8a800a8, 0xfcfc00fc, 0x50500050,
290 	0xd0d000d0, 0x7d7d007d, 0x89890089, 0x97970097,
291 	0x5b5b005b, 0x95950095, 0xffff00ff, 0xd2d200d2,
292 	0xc4c400c4, 0x48480048, 0xf7f700f7, 0xdbdb00db,
293 	0x03030003, 0xdada00da, 0x3f3f003f, 0x94940094,
294 	0x5c5c005c, 0x02020002, 0x4a4a004a, 0x33330033,
295 	0x67670067, 0xf3f300f3, 0x7f7f007f, 0xe2e200e2,
296 	0x9b9b009b, 0x26260026, 0x37370037, 0x3b3b003b,
297 	0x96960096, 0x4b4b004b, 0xbebe00be, 0x2e2e002e,
298 	0x79790079, 0x8c8c008c, 0x6e6e006e, 0x8e8e008e,
299 	0xf5f500f5, 0xb6b600b6, 0xfdfd00fd, 0x59590059,
300 	0x98980098, 0x6a6a006a, 0x46460046, 0xbaba00ba,
301 	0x25250025, 0x42420042, 0xa2a200a2, 0xfafa00fa,
302 	0x07070007, 0x55550055, 0xeeee00ee, 0x0a0a000a,
303 	0x49490049, 0x68680068, 0x38380038, 0xa4a400a4,
304 	0x28280028, 0x7b7b007b, 0xc9c900c9, 0xc1c100c1,
305 	0xe3e300e3, 0xf4f400f4, 0xc7c700c7, 0x9e9e009e,
306 };
307 
308 
309 #define CAMELLIA_MIN_KEY_SIZE        16
310 #define CAMELLIA_MAX_KEY_SIZE        32
311 #define CAMELLIA_BLOCK_SIZE          16
312 #define CAMELLIA_TABLE_BYTE_LEN     272
313 
314 /*
315  * NB: L and R below stand for 'left' and 'right' as in written numbers.
316  * That is, in (xxxL,xxxR) pair xxxL holds most significant digits,
317  * _not_ least significant ones!
318  */
319 
320 
321 /* key constants */
322 
323 #define CAMELLIA_SIGMA1L (0xA09E667FL)
324 #define CAMELLIA_SIGMA1R (0x3BCC908BL)
325 #define CAMELLIA_SIGMA2L (0xB67AE858L)
326 #define CAMELLIA_SIGMA2R (0x4CAA73B2L)
327 #define CAMELLIA_SIGMA3L (0xC6EF372FL)
328 #define CAMELLIA_SIGMA3R (0xE94F82BEL)
329 #define CAMELLIA_SIGMA4L (0x54FF53A5L)
330 #define CAMELLIA_SIGMA4R (0xF1D36F1CL)
331 #define CAMELLIA_SIGMA5L (0x10E527FAL)
332 #define CAMELLIA_SIGMA5R (0xDE682D1DL)
333 #define CAMELLIA_SIGMA6L (0xB05688C2L)
334 #define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
335 
336 /*
337  *  macros
338  */
339 #define ROLDQ(ll, lr, rl, rr, w0, w1, bits) ({		\
340 	w0 = ll;					\
341 	ll = (ll << bits) + (lr >> (32 - bits));	\
342 	lr = (lr << bits) + (rl >> (32 - bits));	\
343 	rl = (rl << bits) + (rr >> (32 - bits));	\
344 	rr = (rr << bits) + (w0 >> (32 - bits));	\
345 })
346 
347 #define ROLDQo32(ll, lr, rl, rr, w0, w1, bits) ({	\
348 	w0 = ll;					\
349 	w1 = lr;					\
350 	ll = (lr << (bits - 32)) + (rl >> (64 - bits));	\
351 	lr = (rl << (bits - 32)) + (rr >> (64 - bits));	\
352 	rl = (rr << (bits - 32)) + (w0 >> (64 - bits));	\
353 	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
354 })
355 
356 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1) ({	\
357 	il = xl ^ kl;						\
358 	ir = xr ^ kr;						\
359 	t0 = il >> 16;						\
360 	t1 = ir >> 16;						\
361 	yl = camellia_sp1110[(u8)(ir)]				\
362 	   ^ camellia_sp0222[(u8)(t1 >> 8)]			\
363 	   ^ camellia_sp3033[(u8)(t1)]				\
364 	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
365 	yr = camellia_sp1110[(u8)(t0 >> 8)]			\
366 	   ^ camellia_sp0222[(u8)(t0)]				\
367 	   ^ camellia_sp3033[(u8)(il >> 8)]			\
368 	   ^ camellia_sp4404[(u8)(il)];				\
369 	yl ^= yr;						\
370 	yr = ror32(yr, 8);					\
371 	yr ^= yl;						\
372 })
373 
374 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
375 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
376 
377 static void camellia_setup_tail(u32 *subkey, u32 *subL, u32 *subR, int max)
378 {
379 	u32 dw, tl, tr;
380 	u32 kw4l, kw4r;
381 
382 	/* absorb kw2 to other subkeys */
383 	/* round 2 */
384 	subL[3] ^= subL[1]; subR[3] ^= subR[1];
385 	/* round 4 */
386 	subL[5] ^= subL[1]; subR[5] ^= subR[1];
387 	/* round 6 */
388 	subL[7] ^= subL[1]; subR[7] ^= subR[1];
389 	subL[1] ^= subR[1] & ~subR[9];
390 	dw = subL[1] & subL[9];
391 	subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl2) */
392 	/* round 8 */
393 	subL[11] ^= subL[1]; subR[11] ^= subR[1];
394 	/* round 10 */
395 	subL[13] ^= subL[1]; subR[13] ^= subR[1];
396 	/* round 12 */
397 	subL[15] ^= subL[1]; subR[15] ^= subR[1];
398 	subL[1] ^= subR[1] & ~subR[17];
399 	dw = subL[1] & subL[17];
400 	subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl4) */
401 	/* round 14 */
402 	subL[19] ^= subL[1]; subR[19] ^= subR[1];
403 	/* round 16 */
404 	subL[21] ^= subL[1]; subR[21] ^= subR[1];
405 	/* round 18 */
406 	subL[23] ^= subL[1]; subR[23] ^= subR[1];
407 	if (max == 24) {
408 		/* kw3 */
409 		subL[24] ^= subL[1]; subR[24] ^= subR[1];
410 
411 	/* absorb kw4 to other subkeys */
412 		kw4l = subL[25]; kw4r = subR[25];
413 	} else {
414 		subL[1] ^= subR[1] & ~subR[25];
415 		dw = subL[1] & subL[25];
416 		subR[1] ^= rol32(dw, 1); /* modified for FLinv(kl6) */
417 		/* round 20 */
418 		subL[27] ^= subL[1]; subR[27] ^= subR[1];
419 		/* round 22 */
420 		subL[29] ^= subL[1]; subR[29] ^= subR[1];
421 		/* round 24 */
422 		subL[31] ^= subL[1]; subR[31] ^= subR[1];
423 		/* kw3 */
424 		subL[32] ^= subL[1]; subR[32] ^= subR[1];
425 
426 	/* absorb kw4 to other subkeys */
427 		kw4l = subL[33]; kw4r = subR[33];
428 		/* round 23 */
429 		subL[30] ^= kw4l; subR[30] ^= kw4r;
430 		/* round 21 */
431 		subL[28] ^= kw4l; subR[28] ^= kw4r;
432 		/* round 19 */
433 		subL[26] ^= kw4l; subR[26] ^= kw4r;
434 		kw4l ^= kw4r & ~subR[24];
435 		dw = kw4l & subL[24];
436 		kw4r ^= rol32(dw, 1); /* modified for FL(kl5) */
437 	}
438 	/* round 17 */
439 	subL[22] ^= kw4l; subR[22] ^= kw4r;
440 	/* round 15 */
441 	subL[20] ^= kw4l; subR[20] ^= kw4r;
442 	/* round 13 */
443 	subL[18] ^= kw4l; subR[18] ^= kw4r;
444 	kw4l ^= kw4r & ~subR[16];
445 	dw = kw4l & subL[16];
446 	kw4r ^= rol32(dw, 1); /* modified for FL(kl3) */
447 	/* round 11 */
448 	subL[14] ^= kw4l; subR[14] ^= kw4r;
449 	/* round 9 */
450 	subL[12] ^= kw4l; subR[12] ^= kw4r;
451 	/* round 7 */
452 	subL[10] ^= kw4l; subR[10] ^= kw4r;
453 	kw4l ^= kw4r & ~subR[8];
454 	dw = kw4l & subL[8];
455 	kw4r ^= rol32(dw, 1); /* modified for FL(kl1) */
456 	/* round 5 */
457 	subL[6] ^= kw4l; subR[6] ^= kw4r;
458 	/* round 3 */
459 	subL[4] ^= kw4l; subR[4] ^= kw4r;
460 	/* round 1 */
461 	subL[2] ^= kw4l; subR[2] ^= kw4r;
462 	/* kw1 */
463 	subL[0] ^= kw4l; subR[0] ^= kw4r;
464 
465 	/* key XOR is end of F-function */
466 	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
467 	SUBKEY_R(0) = subR[0] ^ subR[2];
468 	SUBKEY_L(2) = subL[3];       /* round 1 */
469 	SUBKEY_R(2) = subR[3];
470 	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
471 	SUBKEY_R(3) = subR[2] ^ subR[4];
472 	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
473 	SUBKEY_R(4) = subR[3] ^ subR[5];
474 	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
475 	SUBKEY_R(5) = subR[4] ^ subR[6];
476 	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
477 	SUBKEY_R(6) = subR[5] ^ subR[7];
478 	tl = subL[10] ^ (subR[10] & ~subR[8]);
479 	dw = tl & subL[8];  /* FL(kl1) */
480 	tr = subR[10] ^ rol32(dw, 1);
481 	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
482 	SUBKEY_R(7) = subR[6] ^ tr;
483 	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
484 	SUBKEY_R(8) = subR[8];
485 	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
486 	SUBKEY_R(9) = subR[9];
487 	tl = subL[7] ^ (subR[7] & ~subR[9]);
488 	dw = tl & subL[9];  /* FLinv(kl2) */
489 	tr = subR[7] ^ rol32(dw, 1);
490 	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
491 	SUBKEY_R(10) = tr ^ subR[11];
492 	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
493 	SUBKEY_R(11) = subR[10] ^ subR[12];
494 	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
495 	SUBKEY_R(12) = subR[11] ^ subR[13];
496 	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
497 	SUBKEY_R(13) = subR[12] ^ subR[14];
498 	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
499 	SUBKEY_R(14) = subR[13] ^ subR[15];
500 	tl = subL[18] ^ (subR[18] & ~subR[16]);
501 	dw = tl & subL[16]; /* FL(kl3) */
502 	tr = subR[18] ^ rol32(dw, 1);
503 	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
504 	SUBKEY_R(15) = subR[14] ^ tr;
505 	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
506 	SUBKEY_R(16) = subR[16];
507 	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
508 	SUBKEY_R(17) = subR[17];
509 	tl = subL[15] ^ (subR[15] & ~subR[17]);
510 	dw = tl & subL[17]; /* FLinv(kl4) */
511 	tr = subR[15] ^ rol32(dw, 1);
512 	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
513 	SUBKEY_R(18) = tr ^ subR[19];
514 	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
515 	SUBKEY_R(19) = subR[18] ^ subR[20];
516 	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
517 	SUBKEY_R(20) = subR[19] ^ subR[21];
518 	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
519 	SUBKEY_R(21) = subR[20] ^ subR[22];
520 	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
521 	SUBKEY_R(22) = subR[21] ^ subR[23];
522 	if (max == 24) {
523 		SUBKEY_L(23) = subL[22];     /* round 18 */
524 		SUBKEY_R(23) = subR[22];
525 		SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
526 		SUBKEY_R(24) = subR[24] ^ subR[23];
527 	} else {
528 		tl = subL[26] ^ (subR[26] & ~subR[24]);
529 		dw = tl & subL[24]; /* FL(kl5) */
530 		tr = subR[26] ^ rol32(dw, 1);
531 		SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
532 		SUBKEY_R(23) = subR[22] ^ tr;
533 		SUBKEY_L(24) = subL[24];     /* FL(kl5) */
534 		SUBKEY_R(24) = subR[24];
535 		SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
536 		SUBKEY_R(25) = subR[25];
537 		tl = subL[23] ^ (subR[23] & ~subR[25]);
538 		dw = tl & subL[25]; /* FLinv(kl6) */
539 		tr = subR[23] ^ rol32(dw, 1);
540 		SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
541 		SUBKEY_R(26) = tr ^ subR[27];
542 		SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
543 		SUBKEY_R(27) = subR[26] ^ subR[28];
544 		SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
545 		SUBKEY_R(28) = subR[27] ^ subR[29];
546 		SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
547 		SUBKEY_R(29) = subR[28] ^ subR[30];
548 		SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
549 		SUBKEY_R(30) = subR[29] ^ subR[31];
550 		SUBKEY_L(31) = subL[30];     /* round 24 */
551 		SUBKEY_R(31) = subR[30];
552 		SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
553 		SUBKEY_R(32) = subR[32] ^ subR[31];
554 	}
555 }
556 
557 static void camellia_setup128(const unsigned char *key, u32 *subkey)
558 {
559 	u32 kll, klr, krl, krr;
560 	u32 il, ir, t0, t1, w0, w1;
561 	u32 subL[26];
562 	u32 subR[26];
563 
564 	/**
565 	 *  k == kll || klr || krl || krr (|| is concatenation)
566 	 */
567 	kll = get_unaligned_be32(key);
568 	klr = get_unaligned_be32(key + 4);
569 	krl = get_unaligned_be32(key + 8);
570 	krr = get_unaligned_be32(key + 12);
571 
572 	/* generate KL dependent subkeys */
573 	/* kw1 */
574 	subL[0] = kll; subR[0] = klr;
575 	/* kw2 */
576 	subL[1] = krl; subR[1] = krr;
577 	/* rotation left shift 15bit */
578 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
579 	/* k3 */
580 	subL[4] = kll; subR[4] = klr;
581 	/* k4 */
582 	subL[5] = krl; subR[5] = krr;
583 	/* rotation left shift 15+30bit */
584 	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
585 	/* k7 */
586 	subL[10] = kll; subR[10] = klr;
587 	/* k8 */
588 	subL[11] = krl; subR[11] = krr;
589 	/* rotation left shift 15+30+15bit */
590 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
591 	/* k10 */
592 	subL[13] = krl; subR[13] = krr;
593 	/* rotation left shift 15+30+15+17 bit */
594 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
595 	/* kl3 */
596 	subL[16] = kll; subR[16] = klr;
597 	/* kl4 */
598 	subL[17] = krl; subR[17] = krr;
599 	/* rotation left shift 15+30+15+17+17 bit */
600 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
601 	/* k13 */
602 	subL[18] = kll; subR[18] = klr;
603 	/* k14 */
604 	subL[19] = krl; subR[19] = krr;
605 	/* rotation left shift 15+30+15+17+17+17 bit */
606 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
607 	/* k17 */
608 	subL[22] = kll; subR[22] = klr;
609 	/* k18 */
610 	subL[23] = krl; subR[23] = krr;
611 
612 	/* generate KA */
613 	kll = subL[0]; klr = subR[0];
614 	krl = subL[1]; krr = subR[1];
615 	CAMELLIA_F(kll, klr,
616 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
617 		   w0, w1, il, ir, t0, t1);
618 	krl ^= w0; krr ^= w1;
619 	CAMELLIA_F(krl, krr,
620 		   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
621 		   kll, klr, il, ir, t0, t1);
622 	/* current status == (kll, klr, w0, w1) */
623 	CAMELLIA_F(kll, klr,
624 		   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
625 		   krl, krr, il, ir, t0, t1);
626 	krl ^= w0; krr ^= w1;
627 	CAMELLIA_F(krl, krr,
628 		   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
629 		   w0, w1, il, ir, t0, t1);
630 	kll ^= w0; klr ^= w1;
631 
632 	/* generate KA dependent subkeys */
633 	/* k1, k2 */
634 	subL[2] = kll; subR[2] = klr;
635 	subL[3] = krl; subR[3] = krr;
636 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
637 	/* k5,k6 */
638 	subL[6] = kll; subR[6] = klr;
639 	subL[7] = krl; subR[7] = krr;
640 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
641 	/* kl1, kl2 */
642 	subL[8] = kll; subR[8] = klr;
643 	subL[9] = krl; subR[9] = krr;
644 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
645 	/* k9 */
646 	subL[12] = kll; subR[12] = klr;
647 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
648 	/* k11, k12 */
649 	subL[14] = kll; subR[14] = klr;
650 	subL[15] = krl; subR[15] = krr;
651 	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
652 	/* k15, k16 */
653 	subL[20] = kll; subR[20] = klr;
654 	subL[21] = krl; subR[21] = krr;
655 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
656 	/* kw3, kw4 */
657 	subL[24] = kll; subR[24] = klr;
658 	subL[25] = krl; subR[25] = krr;
659 
660 	camellia_setup_tail(subkey, subL, subR, 24);
661 }
662 
663 static void camellia_setup256(const unsigned char *key, u32 *subkey)
664 {
665 	u32 kll, klr, krl, krr;        /* left half of key */
666 	u32 krll, krlr, krrl, krrr;    /* right half of key */
667 	u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
668 	u32 subL[34];
669 	u32 subR[34];
670 
671 	/**
672 	 *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
673 	 *  (|| is concatenation)
674 	 */
675 	kll = get_unaligned_be32(key);
676 	klr = get_unaligned_be32(key + 4);
677 	krl = get_unaligned_be32(key + 8);
678 	krr = get_unaligned_be32(key + 12);
679 	krll = get_unaligned_be32(key + 16);
680 	krlr = get_unaligned_be32(key + 20);
681 	krrl = get_unaligned_be32(key + 24);
682 	krrr = get_unaligned_be32(key + 28);
683 
684 	/* generate KL dependent subkeys */
685 	/* kw1 */
686 	subL[0] = kll; subR[0] = klr;
687 	/* kw2 */
688 	subL[1] = krl; subR[1] = krr;
689 	ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
690 	/* k9 */
691 	subL[12] = kll; subR[12] = klr;
692 	/* k10 */
693 	subL[13] = krl; subR[13] = krr;
694 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
695 	/* kl3 */
696 	subL[16] = kll; subR[16] = klr;
697 	/* kl4 */
698 	subL[17] = krl; subR[17] = krr;
699 	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
700 	/* k17 */
701 	subL[22] = kll; subR[22] = klr;
702 	/* k18 */
703 	subL[23] = krl; subR[23] = krr;
704 	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
705 	/* k23 */
706 	subL[30] = kll; subR[30] = klr;
707 	/* k24 */
708 	subL[31] = krl; subR[31] = krr;
709 
710 	/* generate KR dependent subkeys */
711 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
712 	/* k3 */
713 	subL[4] = krll; subR[4] = krlr;
714 	/* k4 */
715 	subL[5] = krrl; subR[5] = krrr;
716 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
717 	/* kl1 */
718 	subL[8] = krll; subR[8] = krlr;
719 	/* kl2 */
720 	subL[9] = krrl; subR[9] = krrr;
721 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
722 	/* k13 */
723 	subL[18] = krll; subR[18] = krlr;
724 	/* k14 */
725 	subL[19] = krrl; subR[19] = krrr;
726 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
727 	/* k19 */
728 	subL[26] = krll; subR[26] = krlr;
729 	/* k20 */
730 	subL[27] = krrl; subR[27] = krrr;
731 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
732 
733 	/* generate KA */
734 	kll = subL[0] ^ krll; klr = subR[0] ^ krlr;
735 	krl = subL[1] ^ krrl; krr = subR[1] ^ krrr;
736 	CAMELLIA_F(kll, klr,
737 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
738 		   w0, w1, il, ir, t0, t1);
739 	krl ^= w0; krr ^= w1;
740 	CAMELLIA_F(krl, krr,
741 		   CAMELLIA_SIGMA2L, CAMELLIA_SIGMA2R,
742 		   kll, klr, il, ir, t0, t1);
743 	kll ^= krll; klr ^= krlr;
744 	CAMELLIA_F(kll, klr,
745 		   CAMELLIA_SIGMA3L, CAMELLIA_SIGMA3R,
746 		   krl, krr, il, ir, t0, t1);
747 	krl ^= w0 ^ krrl; krr ^= w1 ^ krrr;
748 	CAMELLIA_F(krl, krr,
749 		   CAMELLIA_SIGMA4L, CAMELLIA_SIGMA4R,
750 		   w0, w1, il, ir, t0, t1);
751 	kll ^= w0; klr ^= w1;
752 
753 	/* generate KB */
754 	krll ^= kll; krlr ^= klr;
755 	krrl ^= krl; krrr ^= krr;
756 	CAMELLIA_F(krll, krlr,
757 		   CAMELLIA_SIGMA5L, CAMELLIA_SIGMA5R,
758 		   w0, w1, il, ir, t0, t1);
759 	krrl ^= w0; krrr ^= w1;
760 	CAMELLIA_F(krrl, krrr,
761 		   CAMELLIA_SIGMA6L, CAMELLIA_SIGMA6R,
762 		   w0, w1, il, ir, t0, t1);
763 	krll ^= w0; krlr ^= w1;
764 
765 	/* generate KA dependent subkeys */
766 	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
767 	/* k5 */
768 	subL[6] = kll; subR[6] = klr;
769 	/* k6 */
770 	subL[7] = krl; subR[7] = krr;
771 	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
772 	/* k11 */
773 	subL[14] = kll; subR[14] = klr;
774 	/* k12 */
775 	subL[15] = krl; subR[15] = krr;
776 	/* rotation left shift 32bit */
777 	/* kl5 */
778 	subL[24] = klr; subR[24] = krl;
779 	/* kl6 */
780 	subL[25] = krr; subR[25] = kll;
781 	/* rotation left shift 49 from k11,k12 -> k21,k22 */
782 	ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
783 	/* k21 */
784 	subL[28] = kll; subR[28] = klr;
785 	/* k22 */
786 	subL[29] = krl; subR[29] = krr;
787 
788 	/* generate KB dependent subkeys */
789 	/* k1 */
790 	subL[2] = krll; subR[2] = krlr;
791 	/* k2 */
792 	subL[3] = krrl; subR[3] = krrr;
793 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
794 	/* k7 */
795 	subL[10] = krll; subR[10] = krlr;
796 	/* k8 */
797 	subL[11] = krrl; subR[11] = krrr;
798 	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
799 	/* k15 */
800 	subL[20] = krll; subR[20] = krlr;
801 	/* k16 */
802 	subL[21] = krrl; subR[21] = krrr;
803 	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
804 	/* kw3 */
805 	subL[32] = krll; subR[32] = krlr;
806 	/* kw4 */
807 	subL[33] = krrl; subR[33] = krrr;
808 
809 	camellia_setup_tail(subkey, subL, subR, 32);
810 }
811 
812 static void camellia_setup192(const unsigned char *key, u32 *subkey)
813 {
814 	unsigned char kk[32];
815 	u32 krll, krlr, krrl, krrr;
816 
817 	memcpy(kk, key, 24);
818 	memcpy((unsigned char *)&krll, key+16, 4);
819 	memcpy((unsigned char *)&krlr, key+20, 4);
820 	krrl = ~krll;
821 	krrr = ~krlr;
822 	memcpy(kk+24, (unsigned char *)&krrl, 4);
823 	memcpy(kk+28, (unsigned char *)&krrr, 4);
824 	camellia_setup256(kk, subkey);
825 }
826 
827 
828 /*
829  * Encrypt/decrypt
830  */
831 #define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) ({ \
832 	t0 = kll;							\
833 	t2 = krr;							\
834 	t0 &= ll;							\
835 	t2 |= rr;							\
836 	rl ^= t2;							\
837 	lr ^= rol32(t0, 1);						\
838 	t3 = krl;							\
839 	t1 = klr;							\
840 	t3 &= rl;							\
841 	t1 |= lr;							\
842 	ll ^= t1;							\
843 	rr ^= rol32(t3, 1);						\
844 })
845 
846 #define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir) ({		\
847 	yl ^= kl;							\
848 	yr ^= kr;							\
849 	ir =  camellia_sp1110[(u8)xr];					\
850 	il =  camellia_sp1110[(u8)(xl >> 24)];				\
851 	ir ^= camellia_sp0222[(u8)(xr >> 24)];				\
852 	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
853 	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
854 	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
855 	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
856 	il ^= camellia_sp4404[(u8)xl];					\
857 	ir ^= il;							\
858 	yl ^= ir;							\
859 	yr ^= ror32(il, 8) ^ ir;					\
860 })
861 
862 /* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
863 static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
864 {
865 	u32 il, ir, t0, t1;            /* temporary variables */
866 
867 	/* pre whitening but absorb kw2 */
868 	io[0] ^= SUBKEY_L(0);
869 	io[1] ^= SUBKEY_R(0);
870 
871 	/* main iteration */
872 #define ROUNDS(i) ({ \
873 	CAMELLIA_ROUNDSM(io[0], io[1], \
874 			 SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
875 			 io[2], io[3], il, ir); \
876 	CAMELLIA_ROUNDSM(io[2], io[3], \
877 			 SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
878 			 io[0], io[1], il, ir); \
879 	CAMELLIA_ROUNDSM(io[0], io[1], \
880 			 SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
881 			 io[2], io[3], il, ir); \
882 	CAMELLIA_ROUNDSM(io[2], io[3], \
883 			 SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
884 			 io[0], io[1], il, ir); \
885 	CAMELLIA_ROUNDSM(io[0], io[1], \
886 			 SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
887 			 io[2], io[3], il, ir); \
888 	CAMELLIA_ROUNDSM(io[2], io[3], \
889 			 SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
890 			 io[0], io[1], il, ir); \
891 })
892 #define FLS(i) ({ \
893 	CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
894 		     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
895 		     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
896 		     t0, t1, il, ir); \
897 })
898 
899 	ROUNDS(0);
900 	FLS(8);
901 	ROUNDS(8);
902 	FLS(16);
903 	ROUNDS(16);
904 	if (max == 32) {
905 		FLS(24);
906 		ROUNDS(24);
907 	}
908 
909 #undef ROUNDS
910 #undef FLS
911 
912 	/* post whitening but kw4 */
913 	io[2] ^= SUBKEY_L(max);
914 	io[3] ^= SUBKEY_R(max);
915 	/* NB: io[0],[1] should be swapped with [2],[3] by caller! */
916 }
917 
918 static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
919 {
920 	u32 il, ir, t0, t1;            /* temporary variables */
921 
922 	/* pre whitening but absorb kw2 */
923 	io[0] ^= SUBKEY_L(i);
924 	io[1] ^= SUBKEY_R(i);
925 
926 	/* main iteration */
927 #define ROUNDS(i) ({ \
928 	CAMELLIA_ROUNDSM(io[0], io[1], \
929 			 SUBKEY_L(i + 7), SUBKEY_R(i + 7), \
930 			 io[2], io[3], il, ir); \
931 	CAMELLIA_ROUNDSM(io[2], io[3], \
932 			 SUBKEY_L(i + 6), SUBKEY_R(i + 6), \
933 			 io[0], io[1], il, ir); \
934 	CAMELLIA_ROUNDSM(io[0], io[1], \
935 			 SUBKEY_L(i + 5), SUBKEY_R(i + 5), \
936 			 io[2], io[3], il, ir); \
937 	CAMELLIA_ROUNDSM(io[2], io[3], \
938 			 SUBKEY_L(i + 4), SUBKEY_R(i + 4), \
939 			 io[0], io[1], il, ir); \
940 	CAMELLIA_ROUNDSM(io[0], io[1], \
941 			 SUBKEY_L(i + 3), SUBKEY_R(i + 3), \
942 			 io[2], io[3], il, ir); \
943 	CAMELLIA_ROUNDSM(io[2], io[3], \
944 			 SUBKEY_L(i + 2), SUBKEY_R(i + 2), \
945 			 io[0], io[1], il, ir); \
946 })
947 #define FLS(i) ({ \
948 	CAMELLIA_FLS(io[0], io[1], io[2], io[3], \
949 		     SUBKEY_L(i + 1), SUBKEY_R(i + 1), \
950 		     SUBKEY_L(i + 0), SUBKEY_R(i + 0), \
951 		     t0, t1, il, ir); \
952 })
953 
954 	if (i == 32) {
955 		ROUNDS(24);
956 		FLS(24);
957 	}
958 	ROUNDS(16);
959 	FLS(16);
960 	ROUNDS(8);
961 	FLS(8);
962 	ROUNDS(0);
963 
964 #undef ROUNDS
965 #undef FLS
966 
967 	/* post whitening but kw4 */
968 	io[2] ^= SUBKEY_L(0);
969 	io[3] ^= SUBKEY_R(0);
970 	/* NB: 0,1 should be swapped with 2,3 by caller! */
971 }
972 
973 
974 struct camellia_ctx {
975 	int key_length;
976 	u32 key_table[CAMELLIA_TABLE_BYTE_LEN / sizeof(u32)];
977 };
978 
979 static int
980 camellia_set_key(struct crypto_tfm *tfm, const u8 *in_key,
981 		 unsigned int key_len)
982 {
983 	struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
984 	const unsigned char *key = (const unsigned char *)in_key;
985 	u32 *flags = &tfm->crt_flags;
986 
987 	if (key_len != 16 && key_len != 24 && key_len != 32) {
988 		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
989 		return -EINVAL;
990 	}
991 
992 	cctx->key_length = key_len;
993 
994 	switch (key_len) {
995 	case 16:
996 		camellia_setup128(key, cctx->key_table);
997 		break;
998 	case 24:
999 		camellia_setup192(key, cctx->key_table);
1000 		break;
1001 	case 32:
1002 		camellia_setup256(key, cctx->key_table);
1003 		break;
1004 	}
1005 
1006 	return 0;
1007 }
1008 
1009 static void camellia_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1010 {
1011 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1012 	const __be32 *src = (const __be32 *)in;
1013 	__be32 *dst = (__be32 *)out;
1014 	unsigned int max;
1015 
1016 	u32 tmp[4];
1017 
1018 	tmp[0] = be32_to_cpu(src[0]);
1019 	tmp[1] = be32_to_cpu(src[1]);
1020 	tmp[2] = be32_to_cpu(src[2]);
1021 	tmp[3] = be32_to_cpu(src[3]);
1022 
1023 	if (cctx->key_length == 16)
1024 		max = 24;
1025 	else
1026 		max = 32; /* for key lengths of 24 and 32 */
1027 
1028 	camellia_do_encrypt(cctx->key_table, tmp, max);
1029 
1030 	/* do_encrypt returns 0,1 swapped with 2,3 */
1031 	dst[0] = cpu_to_be32(tmp[2]);
1032 	dst[1] = cpu_to_be32(tmp[3]);
1033 	dst[2] = cpu_to_be32(tmp[0]);
1034 	dst[3] = cpu_to_be32(tmp[1]);
1035 }
1036 
1037 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
1038 {
1039 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);
1040 	const __be32 *src = (const __be32 *)in;
1041 	__be32 *dst = (__be32 *)out;
1042 	unsigned int max;
1043 
1044 	u32 tmp[4];
1045 
1046 	tmp[0] = be32_to_cpu(src[0]);
1047 	tmp[1] = be32_to_cpu(src[1]);
1048 	tmp[2] = be32_to_cpu(src[2]);
1049 	tmp[3] = be32_to_cpu(src[3]);
1050 
1051 	if (cctx->key_length == 16)
1052 		max = 24;
1053 	else
1054 		max = 32; /* for key lengths of 24 and 32 */
1055 
1056 	camellia_do_decrypt(cctx->key_table, tmp, max);
1057 
1058 	/* do_decrypt returns 0,1 swapped with 2,3 */
1059 	dst[0] = cpu_to_be32(tmp[2]);
1060 	dst[1] = cpu_to_be32(tmp[3]);
1061 	dst[2] = cpu_to_be32(tmp[0]);
1062 	dst[3] = cpu_to_be32(tmp[1]);
1063 }
1064 
1065 static struct crypto_alg camellia_alg = {
1066 	.cra_name		=	"camellia",
1067 	.cra_driver_name	=	"camellia-generic",
1068 	.cra_priority		=	100,
1069 	.cra_flags		=	CRYPTO_ALG_TYPE_CIPHER,
1070 	.cra_blocksize		=	CAMELLIA_BLOCK_SIZE,
1071 	.cra_ctxsize		=	sizeof(struct camellia_ctx),
1072 	.cra_alignmask		=	3,
1073 	.cra_module		=	THIS_MODULE,
1074 	.cra_u			=	{
1075 		.cipher = {
1076 			.cia_min_keysize	=	CAMELLIA_MIN_KEY_SIZE,
1077 			.cia_max_keysize	=	CAMELLIA_MAX_KEY_SIZE,
1078 			.cia_setkey		=	camellia_set_key,
1079 			.cia_encrypt		=	camellia_encrypt,
1080 			.cia_decrypt		=	camellia_decrypt
1081 		}
1082 	}
1083 };
1084 
1085 static int __init camellia_init(void)
1086 {
1087 	return crypto_register_alg(&camellia_alg);
1088 }
1089 
1090 static void __exit camellia_fini(void)
1091 {
1092 	crypto_unregister_alg(&camellia_alg);
1093 }
1094 
1095 module_init(camellia_init);
1096 module_exit(camellia_fini);
1097 
1098 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
1099 MODULE_LICENSE("GPL");
1100 MODULE_ALIAS_CRYPTO("camellia");
1101 MODULE_ALIAS_CRYPTO("camellia-generic");
1102