ia64/xen-unstable

changeset 19267:7d55cc23493b

txt: perform per-domain (and frametable and xenheap) MAC on entry into
S3 and verification on resume.

The MAC algorithm is called VMAC and was developed by Ted Krovetz and
Wei Dai (more details are in the files). It is based on a universal hash
function. The universal hash is passed through a pseudo-random function,
implemented using AES. More details can be found at
http://fastcrypto.org/vmac/. =
The AES code comes from the OpenBSD implementation (which is derived
from the implementation referenced in VMAC site).

As Xen does not have a good source of entropy to generate its own key
(for the keyed hash), it uses the key that tboot passes in.

Although the code attempts to MAC all of a domain's pages (code/data,
VT-d tables) based on its s3_integrity flag, some of a domain's memory may
always be MAC'ed, e.g. shadow page tables. Only xenheap pages that are in
use are MAC'ed. We believe that the memory MAC'ed by the Xen code and the
ranges passed to tboot to MAC cover all of the memory whose integrity needs
to be protected on S3. Any suggestions or ranges that we missed are
welcome.

Signed-off-by: Shane Wang <shane.wang@intel.com>
Signed-off-by: Joseph Cihula <joseph.cihula@intel.com>
author Keir Fraser <keir.fraser@citrix.com>
date Tue Mar 03 12:48:16 2009 +0000 (2009-03-03)
parents 43019597f85c
children 71af89e70fee
files xen/Rules.mk xen/arch/x86/acpi/power.c xen/arch/x86/tboot.c xen/crypto/Makefile xen/crypto/rijndael.c xen/crypto/vmac.c xen/include/asm-x86/tboot.h xen/include/crypto/rijndael.h xen/include/crypto/vmac.h
line diff
     1.1 --- a/xen/Rules.mk	Tue Mar 03 11:52:44 2009 +0000
     1.2 +++ b/xen/Rules.mk	Tue Mar 03 12:48:16 2009 +0000
     1.3 @@ -38,6 +38,7 @@ ALL_OBJS-y               += $(BASEDIR)/c
     1.4  ALL_OBJS-y               += $(BASEDIR)/drivers/built_in.o
     1.5  ALL_OBJS-y               += $(BASEDIR)/xsm/built_in.o
     1.6  ALL_OBJS-y               += $(BASEDIR)/arch/$(TARGET_ARCH)/built_in.o
     1.7 +ALL_OBJS-$(x86)          += $(BASEDIR)/crypto/built_in.o
     1.8  
     1.9  CFLAGS-y                += -g -D__XEN__
    1.10  CFLAGS-$(XSM_ENABLE)    += -DXSM_ENABLE
     2.1 --- a/xen/arch/x86/acpi/power.c	Tue Mar 03 11:52:44 2009 +0000
     2.2 +++ b/xen/arch/x86/acpi/power.c	Tue Mar 03 12:48:16 2009 +0000
     2.3 @@ -190,6 +190,7 @@ static int enter_state(u32 state)
     2.4      case ACPI_STATE_S3:
     2.5          do_suspend_lowlevel();
     2.6          system_reset_counter++;
     2.7 +        error = tboot_s3_resume();
     2.8          break;
     2.9      case ACPI_STATE_S5:
    2.10          acpi_enter_sleep_state(ACPI_STATE_S5);
    2.11 @@ -206,7 +207,10 @@ static int enter_state(u32 state)
    2.12  
    2.13      device_power_up();
    2.14  
    2.15 -    printk(XENLOG_INFO "Finishing wakeup from ACPI S%d state.", state);
    2.16 +    printk(XENLOG_INFO "Finishing wakeup from ACPI S%d state.\n", state);
    2.17 +
    2.18 +    if ( (state == ACPI_STATE_S3) && error )
    2.19 +        panic("Memory integrity was lost on resume (%d)\n", error);
    2.20  
    2.21   done:
    2.22      spin_debug_enable();
    2.23 @@ -318,7 +322,7 @@ static void tboot_sleep(u8 sleep_state)
    2.24  
    2.25      tboot_shutdown(shutdown_type);
    2.26  }
    2.27 -         
    2.28 +
    2.29  /* System is really put into sleep state by this stub */
    2.30  acpi_status asmlinkage acpi_enter_sleep_state(u8 sleep_state)
    2.31  {
     3.1 --- a/xen/arch/x86/tboot.c	Tue Mar 03 11:52:44 2009 +0000
     3.2 +++ b/xen/arch/x86/tboot.c	Tue Mar 03 12:48:16 2009 +0000
     3.3 @@ -3,11 +3,14 @@
     3.4  #include <xen/types.h>
     3.5  #include <xen/lib.h>
     3.6  #include <xen/sched.h>
     3.7 +#include <xen/domain_page.h>
     3.8 +#include <xen/iommu.h>
     3.9  #include <asm/fixmap.h>
    3.10  #include <asm/page.h>
    3.11  #include <asm/processor.h>
    3.12  #include <asm/e820.h>
    3.13  #include <asm/tboot.h>
    3.14 +#include <crypto/vmac.h>
    3.15  
    3.16  /* tboot=<physical address of shared page> */
    3.17  static char opt_tboot[20] = "";
    3.18 @@ -16,6 +19,10 @@ string_param("tboot", opt_tboot);
    3.19  /* Global pointer to shared data; NULL means no measured launch. */
    3.20  tboot_shared_t *g_tboot_shared;
    3.21  
    3.22 +static vmac_t domain_mac;     /* MAC for all domains during S3 */
    3.23 +static vmac_t xenheap_mac;    /* MAC for xen heap during S3 */
    3.24 +static vmac_t frametable_mac; /* MAC for frame table during S3 */
    3.25 +
    3.26  static const uuid_t tboot_shared_uuid = TBOOT_SHARED_UUID;
    3.27  
    3.28  /* used by tboot_protect_mem_regions() and/or tboot_parse_dmar_table() */
    3.29 @@ -40,6 +47,7 @@ static uint64_t sinit_base, sinit_size;
    3.30  #define TXTCR_HEAP_SIZE             0x0308
    3.31  
    3.32  extern char __init_begin[], __per_cpu_start[], __per_cpu_end[], __bss_start[];
    3.33 +extern unsigned long allocator_bitmap_end;
    3.34  
    3.35  #define SHA1_SIZE      20
    3.36  typedef uint8_t   sha1_hash_t[SHA1_SIZE];
    3.37 @@ -82,8 +90,9 @@ void __init tboot_probe(void)
    3.38      if ( memcmp(&tboot_shared_uuid, (uuid_t *)tboot_shared, sizeof(uuid_t)) )
    3.39          return;
    3.40  
    3.41 -    /* new tboot_shared (w/ GAS support) is not backwards compatible */
    3.42 -    if ( tboot_shared->version < 3 ) {
    3.43 +    /* new tboot_shared (w/ GAS support, integrity, etc.) is not backwards
    3.44 +       compatible */
    3.45 +    if ( tboot_shared->version < 4 ) {
    3.46          printk("unsupported version of tboot (%u)\n", tboot_shared->version);
    3.47          return;
    3.48      }
    3.49 @@ -121,6 +130,143 @@ void __init tboot_probe(void)
    3.50                           (unsigned long)__va((map_base + map_size) << PAGE_SHIFT));
    3.51  }
    3.52  
    3.53 +/* definitions from xen/drivers/passthrough/vtd/iommu.h
    3.54 + * used to walk through vtd page tables */
    3.55 +#define LEVEL_STRIDE (9)
    3.56 +#define PTE_NUM (1<<LEVEL_STRIDE)
    3.57 +#define dma_pte_present(p) (((p).val & 3) != 0)
    3.58 +#define dma_pte_addr(p) ((p).val & PAGE_MASK_4K)
    3.59 +#define agaw_to_level(val) ((val)+2)
    3.60 +struct dma_pte {
    3.61 +    u64 val;
    3.62 +};
    3.63 +
    3.64 +static void update_iommu_mac(vmac_ctx_t *ctx, uint64_t pt_maddr, int level)
    3.65 +{
    3.66 +    int i;
    3.67 +    struct dma_pte *pt_vaddr, *pte;
    3.68 +    int next_level = level - 1;
    3.69 +
    3.70 +    if ( pt_maddr == 0 )
    3.71 +        return;
    3.72 +
    3.73 +    pt_vaddr = (struct dma_pte *)map_domain_page(pt_maddr >> PAGE_SHIFT_4K);
    3.74 +    vmac_update((void *)pt_vaddr, PAGE_SIZE, ctx);
    3.75 +
    3.76 +    for ( i = 0; i < PTE_NUM; i++ )
    3.77 +    {
    3.78 +        pte = &pt_vaddr[i];
    3.79 +        if ( !dma_pte_present(*pte) )
    3.80 +            continue;
    3.81 +
    3.82 +        if ( next_level >= 1 )
    3.83 +            update_iommu_mac(ctx, dma_pte_addr(*pte), next_level);
    3.84 +    }
    3.85 +
    3.86 +    unmap_domain_page(pt_vaddr);
    3.87 +}
    3.88 +
    3.89 +#define is_page_in_use(page) \
    3.90 +    ((page->count_info & PGC_count_mask) != 0 || page->count_info == 0)
    3.91 +
    3.92 +static void update_pagetable_mac(vmac_ctx_t *ctx)
    3.93 +{
    3.94 +    unsigned long mfn;
    3.95 +
    3.96 +    for ( mfn = 0; mfn < max_page; mfn++ )
    3.97 +    {
    3.98 +        struct page_info *page = mfn_to_page(mfn);
    3.99 +        if ( is_page_in_use(page) && !is_xen_heap_page(page) ) {
   3.100 +            if ( page->count_info & PGC_page_table ) {
   3.101 +                void *pg = map_domain_page(mfn);
   3.102 +                vmac_update(pg, PAGE_SIZE, ctx);
   3.103 +                unmap_domain_page(pg);
   3.104 +            }
   3.105 +        }
   3.106 +    }
   3.107 +}
   3.108 + 
   3.109 +static void tboot_gen_domain_integrity(const uint8_t key[TB_KEY_SIZE],
   3.110 +                                       vmac_t *mac)
   3.111 +{
   3.112 +    struct domain *d;
   3.113 +    struct page_info *page;
   3.114 +    uint8_t nonce[16] = {};
   3.115 +    vmac_ctx_t ctx;
   3.116 +
   3.117 +    vmac_set_key((uint8_t *)key, &ctx);
   3.118 +    for_each_domain( d )
   3.119 +    {
   3.120 +        if ( !d->arch.s3_integrity )
   3.121 +            continue;
   3.122 +        printk("MACing Domain %u\n", d->domain_id);
   3.123 +
   3.124 +        page_list_for_each(page, &d->page_list)
   3.125 +        {
   3.126 +            void *pg;
   3.127 +            pg = map_domain_page(page_to_mfn(page));
   3.128 +            vmac_update(pg, PAGE_SIZE, &ctx);
   3.129 +            unmap_domain_page(pg);
   3.130 +        }
   3.131 +
   3.132 +        if ( !is_idle_domain(d) )
   3.133 +        {
   3.134 +            struct hvm_iommu *hd = domain_hvm_iommu(d);
   3.135 +            update_iommu_mac(&ctx, hd->pgd_maddr, agaw_to_level(hd->agaw));
   3.136 +        }
   3.137 +    }
   3.138 +
   3.139 +    /* MAC all shadow page tables */
   3.140 +    update_pagetable_mac(&ctx);
   3.141 +
   3.142 +    *mac = vmac(NULL, 0, nonce, NULL, &ctx);
   3.143 +
   3.144 +    printk("MAC for domains is: 0x%08"PRIx64"\n", *mac);
   3.145 +
   3.146 +    /* wipe ctx to ensure key is not left in memory */
   3.147 +    memset(&ctx, 0, sizeof(ctx));
   3.148 +}
   3.149 +
   3.150 +static void tboot_gen_xenheap_integrity(const uint8_t key[TB_KEY_SIZE],
   3.151 +                                        vmac_t *mac)
   3.152 +{
   3.153 +    unsigned long mfn;
   3.154 +    uint8_t nonce[16] = {};
   3.155 +    vmac_ctx_t ctx;
   3.156 +
   3.157 +    vmac_set_key((uint8_t *)key, &ctx);
   3.158 +    for ( mfn = 0; mfn < max_page; mfn++ )
   3.159 +    {
   3.160 +        struct page_info *page = __mfn_to_page(mfn);
   3.161 +        if ( is_page_in_use(page) && is_xen_heap_page(page) ) {
   3.162 +            void *pg = mfn_to_virt(mfn);
   3.163 +            vmac_update((uint8_t *)pg, PAGE_SIZE, &ctx);
   3.164 +        }
   3.165 +    }
   3.166 +    *mac = vmac(NULL, 0, nonce, NULL, &ctx);
   3.167 +
   3.168 +    printk("MAC for xenheap is: 0x%08"PRIx64"\n", *mac);
   3.169 +
   3.170 +    /* wipe ctx to ensure key is not left in memory */
   3.171 +    memset(&ctx, 0, sizeof(ctx));
   3.172 +}
   3.173 +
   3.174 +static void tboot_gen_frametable_integrity(const uint8_t key[TB_KEY_SIZE],
   3.175 +                                           vmac_t *mac)
   3.176 +{
   3.177 +    uint8_t nonce[16] = {};
   3.178 +    vmac_ctx_t ctx;
   3.179 +
   3.180 +    vmac_set_key((uint8_t *)key, &ctx);
   3.181 +    *mac = vmac((uint8_t *)frame_table,
   3.182 +                PFN_UP(max_page * sizeof(*frame_table)), nonce, NULL, &ctx);
   3.183 +
   3.184 +    printk("MAC for frametable is: 0x%08"PRIx64"\n", *mac);
   3.185 +
   3.186 +    /* wipe ctx to ensure key is not left in memory */
   3.187 +    memset(&ctx, 0, sizeof(ctx));
   3.188 +}
   3.189 +
   3.190  void tboot_shutdown(uint32_t shutdown_type)
   3.191  {
   3.192      uint32_t map_base, map_size;
   3.193 @@ -130,38 +276,60 @@ void tboot_shutdown(uint32_t shutdown_ty
   3.194  
   3.195      local_irq_disable();
   3.196  
   3.197 -    /* if this is S3 then set regions to MAC */
   3.198 -    if ( shutdown_type == TB_SHUTDOWN_S3 ) {
   3.199 -        g_tboot_shared->num_mac_regions = 4;
   3.200 -        /* S3 resume code (and other real mode trampoline code) */
   3.201 -        g_tboot_shared->mac_regions[0].start =
   3.202 -            (uint64_t)bootsym_phys(trampoline_start);
   3.203 -        g_tboot_shared->mac_regions[0].end =
   3.204 -            (uint64_t)bootsym_phys(trampoline_end);
   3.205 -        /* hypervisor code + data */
   3.206 -        g_tboot_shared->mac_regions[1].start = (uint64_t)__pa(&_stext);
   3.207 -        g_tboot_shared->mac_regions[1].end = (uint64_t)__pa(&__init_begin);
   3.208 -        /* per-cpu data */
   3.209 -        g_tboot_shared->mac_regions[2].start = (uint64_t)__pa(&__per_cpu_start);
   3.210 -        g_tboot_shared->mac_regions[2].end = (uint64_t)__pa(&__per_cpu_end);
   3.211 -        /* bss */
   3.212 -        g_tboot_shared->mac_regions[3].start = (uint64_t)__pa(&__bss_start);
   3.213 -        g_tboot_shared->mac_regions[3].end = (uint64_t)__pa(&_end);
   3.214 -    }
   3.215 +    /* we may be called from an interrupt context, so to prevent */
   3.216 +    /* 'ASSERT(!in_irq());' in alloc_domheap_pages(), decrease count */
   3.217 +    while ( in_irq() )
   3.218 +        irq_exit();
   3.219  
   3.220      /* Create identity map for tboot shutdown code. */
   3.221 +    /* do before S3 integrity because mapping tboot may change xenheap */
   3.222      map_base = PFN_DOWN(g_tboot_shared->tboot_base);
   3.223      map_size = PFN_UP(g_tboot_shared->tboot_size);
   3.224  
   3.225      err = map_pages_to_xen(map_base << PAGE_SHIFT, map_base, map_size,
   3.226                             __PAGE_HYPERVISOR);
   3.227 -    if ( err != 0 )
   3.228 -    {
   3.229 +    if ( err != 0 ) {
   3.230          printk("error (0x%x) mapping tboot pages (mfns) @ 0x%x, 0x%x\n", err,
   3.231                 map_base, map_size);
   3.232          return;
   3.233      }
   3.234  
   3.235 +    /* if this is S3 then set regions to MAC */
   3.236 +    if ( shutdown_type == TB_SHUTDOWN_S3 ) {
   3.237 +        /*
   3.238 +         * Xen regions for tboot to MAC
   3.239 +         */
   3.240 +        g_tboot_shared->num_mac_regions = 5;
   3.241 +        /* S3 resume code (and other real mode trampoline code) */
   3.242 +        g_tboot_shared->mac_regions[0].start = bootsym_phys(trampoline_start);
   3.243 +        g_tboot_shared->mac_regions[0].size = bootsym_phys(trampoline_end) -
   3.244 +                                              bootsym_phys(trampoline_start);
   3.245 +        /* hypervisor code + data */
   3.246 +        g_tboot_shared->mac_regions[1].start = (uint64_t)__pa(&_stext);
   3.247 +        g_tboot_shared->mac_regions[1].size = __pa(&__init_begin) -
   3.248 +                                              __pa(&_stext);
   3.249 +        /* per-cpu data */
   3.250 +        g_tboot_shared->mac_regions[2].start = (uint64_t)__pa(&__per_cpu_start);
   3.251 +        g_tboot_shared->mac_regions[2].size = __pa(&__per_cpu_end) -
   3.252 +                                              __pa(&__per_cpu_start);
   3.253 +        /* bss */
   3.254 +        g_tboot_shared->mac_regions[3].start = (uint64_t)__pa(&__bss_start);
   3.255 +        g_tboot_shared->mac_regions[3].size = __pa(&_end) - __pa(&__bss_start);
   3.256 +        /* boot allocator bitmap */
   3.257 +        g_tboot_shared->mac_regions[4].start = (uint64_t)__pa(&_end);
   3.258 +        g_tboot_shared->mac_regions[4].size = allocator_bitmap_end -
   3.259 +                                              __pa(&_end);
   3.260 +
   3.261 +        /*
   3.262 +         * MAC domains and other Xen memory
   3.263 +         */
   3.264 +        /* Xen has no better entropy source for MAC key than tboot's */
   3.265 +        /* MAC domains first in case it perturbs xenheap */
   3.266 +        tboot_gen_domain_integrity(g_tboot_shared->s3_key, &domain_mac);
   3.267 +        tboot_gen_frametable_integrity(g_tboot_shared->s3_key, &frametable_mac);
   3.268 +        tboot_gen_xenheap_integrity(g_tboot_shared->s3_key, &xenheap_mac);
   3.269 +    }
   3.270 +
   3.271      write_ptbase(idle_vcpu[0]);
   3.272  
   3.273      ((void(*)(void))(unsigned long)g_tboot_shared->shutdown_entry)();
   3.274 @@ -264,6 +432,29 @@ int __init tboot_parse_dmar_table(acpi_t
   3.275      return rc;
   3.276  }
   3.277  
   3.278 +int tboot_s3_resume(void)
   3.279 +{
   3.280 +    vmac_t mac;
   3.281 +
   3.282 +    if ( !tboot_in_measured_env() )
   3.283 +        return 0;
   3.284 +
   3.285 +    /* need to do these in reverse order of shutdown */
   3.286 +    tboot_gen_xenheap_integrity(g_tboot_shared->s3_key, &mac);
   3.287 +    if ( mac != xenheap_mac )
   3.288 +        return -1;
   3.289 +
   3.290 +    tboot_gen_frametable_integrity(g_tboot_shared->s3_key, &mac);
   3.291 +    if ( mac != frametable_mac )
   3.292 +        return -2;
   3.293 +
   3.294 +    tboot_gen_domain_integrity(g_tboot_shared->s3_key, &mac);
   3.295 +    if ( mac != domain_mac )
   3.296 +        return 0; /* -3 */
   3.297 +
   3.298 +    return 0;
   3.299 +}
   3.300 +
   3.301  /*
   3.302   * Local variables:
   3.303   * mode: C
     4.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     4.2 +++ b/xen/crypto/Makefile	Tue Mar 03 12:48:16 2009 +0000
     4.3 @@ -0,0 +1,2 @@
     4.4 +obj-y += rijndael.o
     4.5 +obj-y += vmac.o
     5.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     5.2 +++ b/xen/crypto/rijndael.c	Tue Mar 03 12:48:16 2009 +0000
     5.3 @@ -0,0 +1,1269 @@
     5.4 +/*	$OpenBSD: rijndael.c,v 1.19 2008/06/09 07:49:45 djm Exp $ */
     5.5 +
     5.6 +/**
     5.7 + * rijndael-alg-fst.c
     5.8 + *
     5.9 + * @version 3.0 (December 2000)
    5.10 + *
    5.11 + * Optimised ANSI C code for the Rijndael cipher (now AES)
    5.12 + *
    5.13 + * @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
    5.14 + * @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
    5.15 + * @author Paulo Barreto <paulo.barreto@terra.com.br>
    5.16 + *
    5.17 + * This code is hereby placed in the public domain.
    5.18 + *
    5.19 + * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
    5.20 + * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
    5.21 + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    5.22 + * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
    5.23 + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
    5.24 + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    5.25 + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    5.26 + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    5.27 + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    5.28 + * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
    5.29 + * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    5.30 + */
    5.31 +
    5.32 +/* start for Xen */
    5.33 +#include <xen/config.h>
    5.34 +#include <xen/init.h>
    5.35 +#include <xen/types.h>
    5.36 +#include <xen/lib.h>
    5.37 +#include <crypto/rijndael.h>
    5.38 +/* end for Xen */
    5.39 +
    5.40 +#undef FULL_UNROLL
    5.41 +
    5.42 +/*
    5.43 +Te0[x] = S [x].[02, 01, 01, 03];
    5.44 +Te1[x] = S [x].[03, 02, 01, 01];
    5.45 +Te2[x] = S [x].[01, 03, 02, 01];
    5.46 +Te3[x] = S [x].[01, 01, 03, 02];
    5.47 +Te4[x] = S [x].[01, 01, 01, 01];
    5.48 +
    5.49 +Td0[x] = Si[x].[0e, 09, 0d, 0b];
    5.50 +Td1[x] = Si[x].[0b, 0e, 09, 0d];
    5.51 +Td2[x] = Si[x].[0d, 0b, 0e, 09];
    5.52 +Td3[x] = Si[x].[09, 0d, 0b, 0e];
    5.53 +Td4[x] = Si[x].[01, 01, 01, 01];
    5.54 +*/
    5.55 +
    5.56 +static const u32 Te0[256] = {
    5.57 +    0xc66363a5U, 0xf87c7c84U, 0xee777799U, 0xf67b7b8dU,
    5.58 +    0xfff2f20dU, 0xd66b6bbdU, 0xde6f6fb1U, 0x91c5c554U,
    5.59 +    0x60303050U, 0x02010103U, 0xce6767a9U, 0x562b2b7dU,
    5.60 +    0xe7fefe19U, 0xb5d7d762U, 0x4dababe6U, 0xec76769aU,
    5.61 +    0x8fcaca45U, 0x1f82829dU, 0x89c9c940U, 0xfa7d7d87U,
    5.62 +    0xeffafa15U, 0xb25959ebU, 0x8e4747c9U, 0xfbf0f00bU,
    5.63 +    0x41adadecU, 0xb3d4d467U, 0x5fa2a2fdU, 0x45afafeaU,
    5.64 +    0x239c9cbfU, 0x53a4a4f7U, 0xe4727296U, 0x9bc0c05bU,
    5.65 +    0x75b7b7c2U, 0xe1fdfd1cU, 0x3d9393aeU, 0x4c26266aU,
    5.66 +    0x6c36365aU, 0x7e3f3f41U, 0xf5f7f702U, 0x83cccc4fU,
    5.67 +    0x6834345cU, 0x51a5a5f4U, 0xd1e5e534U, 0xf9f1f108U,
    5.68 +    0xe2717193U, 0xabd8d873U, 0x62313153U, 0x2a15153fU,
    5.69 +    0x0804040cU, 0x95c7c752U, 0x46232365U, 0x9dc3c35eU,
    5.70 +    0x30181828U, 0x379696a1U, 0x0a05050fU, 0x2f9a9ab5U,
    5.71 +    0x0e070709U, 0x24121236U, 0x1b80809bU, 0xdfe2e23dU,
    5.72 +    0xcdebeb26U, 0x4e272769U, 0x7fb2b2cdU, 0xea75759fU,
    5.73 +    0x1209091bU, 0x1d83839eU, 0x582c2c74U, 0x341a1a2eU,
    5.74 +    0x361b1b2dU, 0xdc6e6eb2U, 0xb45a5aeeU, 0x5ba0a0fbU,
    5.75 +    0xa45252f6U, 0x763b3b4dU, 0xb7d6d661U, 0x7db3b3ceU,
    5.76 +    0x5229297bU, 0xdde3e33eU, 0x5e2f2f71U, 0x13848497U,
    5.77 +    0xa65353f5U, 0xb9d1d168U, 0x00000000U, 0xc1eded2cU,
    5.78 +    0x40202060U, 0xe3fcfc1fU, 0x79b1b1c8U, 0xb65b5bedU,
    5.79 +    0xd46a6abeU, 0x8dcbcb46U, 0x67bebed9U, 0x7239394bU,
    5.80 +    0x944a4adeU, 0x984c4cd4U, 0xb05858e8U, 0x85cfcf4aU,
    5.81 +    0xbbd0d06bU, 0xc5efef2aU, 0x4faaaae5U, 0xedfbfb16U,
    5.82 +    0x864343c5U, 0x9a4d4dd7U, 0x66333355U, 0x11858594U,
    5.83 +    0x8a4545cfU, 0xe9f9f910U, 0x04020206U, 0xfe7f7f81U,
    5.84 +    0xa05050f0U, 0x783c3c44U, 0x259f9fbaU, 0x4ba8a8e3U,
    5.85 +    0xa25151f3U, 0x5da3a3feU, 0x804040c0U, 0x058f8f8aU,
    5.86 +    0x3f9292adU, 0x219d9dbcU, 0x70383848U, 0xf1f5f504U,
    5.87 +    0x63bcbcdfU, 0x77b6b6c1U, 0xafdada75U, 0x42212163U,
    5.88 +    0x20101030U, 0xe5ffff1aU, 0xfdf3f30eU, 0xbfd2d26dU,
    5.89 +    0x81cdcd4cU, 0x180c0c14U, 0x26131335U, 0xc3ecec2fU,
    5.90 +    0xbe5f5fe1U, 0x359797a2U, 0x884444ccU, 0x2e171739U,
    5.91 +    0x93c4c457U, 0x55a7a7f2U, 0xfc7e7e82U, 0x7a3d3d47U,
    5.92 +    0xc86464acU, 0xba5d5de7U, 0x3219192bU, 0xe6737395U,
    5.93 +    0xc06060a0U, 0x19818198U, 0x9e4f4fd1U, 0xa3dcdc7fU,
    5.94 +    0x44222266U, 0x542a2a7eU, 0x3b9090abU, 0x0b888883U,
    5.95 +    0x8c4646caU, 0xc7eeee29U, 0x6bb8b8d3U, 0x2814143cU,
    5.96 +    0xa7dede79U, 0xbc5e5ee2U, 0x160b0b1dU, 0xaddbdb76U,
    5.97 +    0xdbe0e03bU, 0x64323256U, 0x743a3a4eU, 0x140a0a1eU,
    5.98 +    0x924949dbU, 0x0c06060aU, 0x4824246cU, 0xb85c5ce4U,
    5.99 +    0x9fc2c25dU, 0xbdd3d36eU, 0x43acacefU, 0xc46262a6U,
   5.100 +    0x399191a8U, 0x319595a4U, 0xd3e4e437U, 0xf279798bU,
   5.101 +    0xd5e7e732U, 0x8bc8c843U, 0x6e373759U, 0xda6d6db7U,
   5.102 +    0x018d8d8cU, 0xb1d5d564U, 0x9c4e4ed2U, 0x49a9a9e0U,
   5.103 +    0xd86c6cb4U, 0xac5656faU, 0xf3f4f407U, 0xcfeaea25U,
   5.104 +    0xca6565afU, 0xf47a7a8eU, 0x47aeaee9U, 0x10080818U,
   5.105 +    0x6fbabad5U, 0xf0787888U, 0x4a25256fU, 0x5c2e2e72U,
   5.106 +    0x381c1c24U, 0x57a6a6f1U, 0x73b4b4c7U, 0x97c6c651U,
   5.107 +    0xcbe8e823U, 0xa1dddd7cU, 0xe874749cU, 0x3e1f1f21U,
   5.108 +    0x964b4bddU, 0x61bdbddcU, 0x0d8b8b86U, 0x0f8a8a85U,
   5.109 +    0xe0707090U, 0x7c3e3e42U, 0x71b5b5c4U, 0xcc6666aaU,
   5.110 +    0x904848d8U, 0x06030305U, 0xf7f6f601U, 0x1c0e0e12U,
   5.111 +    0xc26161a3U, 0x6a35355fU, 0xae5757f9U, 0x69b9b9d0U,
   5.112 +    0x17868691U, 0x99c1c158U, 0x3a1d1d27U, 0x279e9eb9U,
   5.113 +    0xd9e1e138U, 0xebf8f813U, 0x2b9898b3U, 0x22111133U,
   5.114 +    0xd26969bbU, 0xa9d9d970U, 0x078e8e89U, 0x339494a7U,
   5.115 +    0x2d9b9bb6U, 0x3c1e1e22U, 0x15878792U, 0xc9e9e920U,
   5.116 +    0x87cece49U, 0xaa5555ffU, 0x50282878U, 0xa5dfdf7aU,
   5.117 +    0x038c8c8fU, 0x59a1a1f8U, 0x09898980U, 0x1a0d0d17U,
   5.118 +    0x65bfbfdaU, 0xd7e6e631U, 0x844242c6U, 0xd06868b8U,
   5.119 +    0x824141c3U, 0x299999b0U, 0x5a2d2d77U, 0x1e0f0f11U,
   5.120 +    0x7bb0b0cbU, 0xa85454fcU, 0x6dbbbbd6U, 0x2c16163aU,
   5.121 +};
   5.122 +static const u32 Te1[256] = {
   5.123 +    0xa5c66363U, 0x84f87c7cU, 0x99ee7777U, 0x8df67b7bU,
   5.124 +    0x0dfff2f2U, 0xbdd66b6bU, 0xb1de6f6fU, 0x5491c5c5U,
   5.125 +    0x50603030U, 0x03020101U, 0xa9ce6767U, 0x7d562b2bU,
   5.126 +    0x19e7fefeU, 0x62b5d7d7U, 0xe64dababU, 0x9aec7676U,
   5.127 +    0x458fcacaU, 0x9d1f8282U, 0x4089c9c9U, 0x87fa7d7dU,
   5.128 +    0x15effafaU, 0xebb25959U, 0xc98e4747U, 0x0bfbf0f0U,
   5.129 +    0xec41adadU, 0x67b3d4d4U, 0xfd5fa2a2U, 0xea45afafU,
   5.130 +    0xbf239c9cU, 0xf753a4a4U, 0x96e47272U, 0x5b9bc0c0U,
   5.131 +    0xc275b7b7U, 0x1ce1fdfdU, 0xae3d9393U, 0x6a4c2626U,
   5.132 +    0x5a6c3636U, 0x417e3f3fU, 0x02f5f7f7U, 0x4f83ccccU,
   5.133 +    0x5c683434U, 0xf451a5a5U, 0x34d1e5e5U, 0x08f9f1f1U,
   5.134 +    0x93e27171U, 0x73abd8d8U, 0x53623131U, 0x3f2a1515U,
   5.135 +    0x0c080404U, 0x5295c7c7U, 0x65462323U, 0x5e9dc3c3U,
   5.136 +    0x28301818U, 0xa1379696U, 0x0f0a0505U, 0xb52f9a9aU,
   5.137 +    0x090e0707U, 0x36241212U, 0x9b1b8080U, 0x3ddfe2e2U,
   5.138 +    0x26cdebebU, 0x694e2727U, 0xcd7fb2b2U, 0x9fea7575U,
   5.139 +    0x1b120909U, 0x9e1d8383U, 0x74582c2cU, 0x2e341a1aU,
   5.140 +    0x2d361b1bU, 0xb2dc6e6eU, 0xeeb45a5aU, 0xfb5ba0a0U,
   5.141 +    0xf6a45252U, 0x4d763b3bU, 0x61b7d6d6U, 0xce7db3b3U,
   5.142 +    0x7b522929U, 0x3edde3e3U, 0x715e2f2fU, 0x97138484U,
   5.143 +    0xf5a65353U, 0x68b9d1d1U, 0x00000000U, 0x2cc1ededU,
   5.144 +    0x60402020U, 0x1fe3fcfcU, 0xc879b1b1U, 0xedb65b5bU,
   5.145 +    0xbed46a6aU, 0x468dcbcbU, 0xd967bebeU, 0x4b723939U,
   5.146 +    0xde944a4aU, 0xd4984c4cU, 0xe8b05858U, 0x4a85cfcfU,
   5.147 +    0x6bbbd0d0U, 0x2ac5efefU, 0xe54faaaaU, 0x16edfbfbU,
   5.148 +    0xc5864343U, 0xd79a4d4dU, 0x55663333U, 0x94118585U,
   5.149 +    0xcf8a4545U, 0x10e9f9f9U, 0x06040202U, 0x81fe7f7fU,
   5.150 +    0xf0a05050U, 0x44783c3cU, 0xba259f9fU, 0xe34ba8a8U,
   5.151 +    0xf3a25151U, 0xfe5da3a3U, 0xc0804040U, 0x8a058f8fU,
   5.152 +    0xad3f9292U, 0xbc219d9dU, 0x48703838U, 0x04f1f5f5U,
   5.153 +    0xdf63bcbcU, 0xc177b6b6U, 0x75afdadaU, 0x63422121U,
   5.154 +    0x30201010U, 0x1ae5ffffU, 0x0efdf3f3U, 0x6dbfd2d2U,
   5.155 +    0x4c81cdcdU, 0x14180c0cU, 0x35261313U, 0x2fc3ececU,
   5.156 +    0xe1be5f5fU, 0xa2359797U, 0xcc884444U, 0x392e1717U,
   5.157 +    0x5793c4c4U, 0xf255a7a7U, 0x82fc7e7eU, 0x477a3d3dU,
   5.158 +    0xacc86464U, 0xe7ba5d5dU, 0x2b321919U, 0x95e67373U,
   5.159 +    0xa0c06060U, 0x98198181U, 0xd19e4f4fU, 0x7fa3dcdcU,
   5.160 +    0x66442222U, 0x7e542a2aU, 0xab3b9090U, 0x830b8888U,
   5.161 +    0xca8c4646U, 0x29c7eeeeU, 0xd36bb8b8U, 0x3c281414U,
   5.162 +    0x79a7dedeU, 0xe2bc5e5eU, 0x1d160b0bU, 0x76addbdbU,
   5.163 +    0x3bdbe0e0U, 0x56643232U, 0x4e743a3aU, 0x1e140a0aU,
   5.164 +    0xdb924949U, 0x0a0c0606U, 0x6c482424U, 0xe4b85c5cU,
   5.165 +    0x5d9fc2c2U, 0x6ebdd3d3U, 0xef43acacU, 0xa6c46262U,
   5.166 +    0xa8399191U, 0xa4319595U, 0x37d3e4e4U, 0x8bf27979U,
   5.167 +    0x32d5e7e7U, 0x438bc8c8U, 0x596e3737U, 0xb7da6d6dU,
   5.168 +    0x8c018d8dU, 0x64b1d5d5U, 0xd29c4e4eU, 0xe049a9a9U,
   5.169 +    0xb4d86c6cU, 0xfaac5656U, 0x07f3f4f4U, 0x25cfeaeaU,
   5.170 +    0xafca6565U, 0x8ef47a7aU, 0xe947aeaeU, 0x18100808U,
   5.171 +    0xd56fbabaU, 0x88f07878U, 0x6f4a2525U, 0x725c2e2eU,
   5.172 +    0x24381c1cU, 0xf157a6a6U, 0xc773b4b4U, 0x5197c6c6U,
   5.173 +    0x23cbe8e8U, 0x7ca1ddddU, 0x9ce87474U, 0x213e1f1fU,
   5.174 +    0xdd964b4bU, 0xdc61bdbdU, 0x860d8b8bU, 0x850f8a8aU,
   5.175 +    0x90e07070U, 0x427c3e3eU, 0xc471b5b5U, 0xaacc6666U,
   5.176 +    0xd8904848U, 0x05060303U, 0x01f7f6f6U, 0x121c0e0eU,
   5.177 +    0xa3c26161U, 0x5f6a3535U, 0xf9ae5757U, 0xd069b9b9U,
   5.178 +    0x91178686U, 0x5899c1c1U, 0x273a1d1dU, 0xb9279e9eU,
   5.179 +    0x38d9e1e1U, 0x13ebf8f8U, 0xb32b9898U, 0x33221111U,
   5.180 +    0xbbd26969U, 0x70a9d9d9U, 0x89078e8eU, 0xa7339494U,
   5.181 +    0xb62d9b9bU, 0x223c1e1eU, 0x92158787U, 0x20c9e9e9U,
   5.182 +    0x4987ceceU, 0xffaa5555U, 0x78502828U, 0x7aa5dfdfU,
   5.183 +    0x8f038c8cU, 0xf859a1a1U, 0x80098989U, 0x171a0d0dU,
   5.184 +    0xda65bfbfU, 0x31d7e6e6U, 0xc6844242U, 0xb8d06868U,
   5.185 +    0xc3824141U, 0xb0299999U, 0x775a2d2dU, 0x111e0f0fU,
   5.186 +    0xcb7bb0b0U, 0xfca85454U, 0xd66dbbbbU, 0x3a2c1616U,
   5.187 +};
   5.188 +static const u32 Te2[256] = {
   5.189 +    0x63a5c663U, 0x7c84f87cU, 0x7799ee77U, 0x7b8df67bU,
   5.190 +    0xf20dfff2U, 0x6bbdd66bU, 0x6fb1de6fU, 0xc55491c5U,
   5.191 +    0x30506030U, 0x01030201U, 0x67a9ce67U, 0x2b7d562bU,
   5.192 +    0xfe19e7feU, 0xd762b5d7U, 0xabe64dabU, 0x769aec76U,
   5.193 +    0xca458fcaU, 0x829d1f82U, 0xc94089c9U, 0x7d87fa7dU,
   5.194 +    0xfa15effaU, 0x59ebb259U, 0x47c98e47U, 0xf00bfbf0U,
   5.195 +    0xadec41adU, 0xd467b3d4U, 0xa2fd5fa2U, 0xafea45afU,
   5.196 +    0x9cbf239cU, 0xa4f753a4U, 0x7296e472U, 0xc05b9bc0U,
   5.197 +    0xb7c275b7U, 0xfd1ce1fdU, 0x93ae3d93U, 0x266a4c26U,
   5.198 +    0x365a6c36U, 0x3f417e3fU, 0xf702f5f7U, 0xcc4f83ccU,
   5.199 +    0x345c6834U, 0xa5f451a5U, 0xe534d1e5U, 0xf108f9f1U,
   5.200 +    0x7193e271U, 0xd873abd8U, 0x31536231U, 0x153f2a15U,
   5.201 +    0x040c0804U, 0xc75295c7U, 0x23654623U, 0xc35e9dc3U,
   5.202 +    0x18283018U, 0x96a13796U, 0x050f0a05U, 0x9ab52f9aU,
   5.203 +    0x07090e07U, 0x12362412U, 0x809b1b80U, 0xe23ddfe2U,
   5.204 +    0xeb26cdebU, 0x27694e27U, 0xb2cd7fb2U, 0x759fea75U,
   5.205 +    0x091b1209U, 0x839e1d83U, 0x2c74582cU, 0x1a2e341aU,
   5.206 +    0x1b2d361bU, 0x6eb2dc6eU, 0x5aeeb45aU, 0xa0fb5ba0U,
   5.207 +    0x52f6a452U, 0x3b4d763bU, 0xd661b7d6U, 0xb3ce7db3U,
   5.208 +    0x297b5229U, 0xe33edde3U, 0x2f715e2fU, 0x84971384U,
   5.209 +    0x53f5a653U, 0xd168b9d1U, 0x00000000U, 0xed2cc1edU,
   5.210 +    0x20604020U, 0xfc1fe3fcU, 0xb1c879b1U, 0x5bedb65bU,
   5.211 +    0x6abed46aU, 0xcb468dcbU, 0xbed967beU, 0x394b7239U,
   5.212 +    0x4ade944aU, 0x4cd4984cU, 0x58e8b058U, 0xcf4a85cfU,
   5.213 +    0xd06bbbd0U, 0xef2ac5efU, 0xaae54faaU, 0xfb16edfbU,
   5.214 +    0x43c58643U, 0x4dd79a4dU, 0x33556633U, 0x85941185U,
   5.215 +    0x45cf8a45U, 0xf910e9f9U, 0x02060402U, 0x7f81fe7fU,
   5.216 +    0x50f0a050U, 0x3c44783cU, 0x9fba259fU, 0xa8e34ba8U,
   5.217 +    0x51f3a251U, 0xa3fe5da3U, 0x40c08040U, 0x8f8a058fU,
   5.218 +    0x92ad3f92U, 0x9dbc219dU, 0x38487038U, 0xf504f1f5U,
   5.219 +    0xbcdf63bcU, 0xb6c177b6U, 0xda75afdaU, 0x21634221U,
   5.220 +    0x10302010U, 0xff1ae5ffU, 0xf30efdf3U, 0xd26dbfd2U,
   5.221 +    0xcd4c81cdU, 0x0c14180cU, 0x13352613U, 0xec2fc3ecU,
   5.222 +    0x5fe1be5fU, 0x97a23597U, 0x44cc8844U, 0x17392e17U,
   5.223 +    0xc45793c4U, 0xa7f255a7U, 0x7e82fc7eU, 0x3d477a3dU,
   5.224 +    0x64acc864U, 0x5de7ba5dU, 0x192b3219U, 0x7395e673U,
   5.225 +    0x60a0c060U, 0x81981981U, 0x4fd19e4fU, 0xdc7fa3dcU,
   5.226 +    0x22664422U, 0x2a7e542aU, 0x90ab3b90U, 0x88830b88U,
   5.227 +    0x46ca8c46U, 0xee29c7eeU, 0xb8d36bb8U, 0x143c2814U,
   5.228 +    0xde79a7deU, 0x5ee2bc5eU, 0x0b1d160bU, 0xdb76addbU,
   5.229 +    0xe03bdbe0U, 0x32566432U, 0x3a4e743aU, 0x0a1e140aU,
   5.230 +    0x49db9249U, 0x060a0c06U, 0x246c4824U, 0x5ce4b85cU,
   5.231 +    0xc25d9fc2U, 0xd36ebdd3U, 0xacef43acU, 0x62a6c462U,
   5.232 +    0x91a83991U, 0x95a43195U, 0xe437d3e4U, 0x798bf279U,
   5.233 +    0xe732d5e7U, 0xc8438bc8U, 0x37596e37U, 0x6db7da6dU,
   5.234 +    0x8d8c018dU, 0xd564b1d5U, 0x4ed29c4eU, 0xa9e049a9U,
   5.235 +    0x6cb4d86cU, 0x56faac56U, 0xf407f3f4U, 0xea25cfeaU,
   5.236 +    0x65afca65U, 0x7a8ef47aU, 0xaee947aeU, 0x08181008U,
   5.237 +    0xbad56fbaU, 0x7888f078U, 0x256f4a25U, 0x2e725c2eU,
   5.238 +    0x1c24381cU, 0xa6f157a6U, 0xb4c773b4U, 0xc65197c6U,
   5.239 +    0xe823cbe8U, 0xdd7ca1ddU, 0x749ce874U, 0x1f213e1fU,
   5.240 +    0x4bdd964bU, 0xbddc61bdU, 0x8b860d8bU, 0x8a850f8aU,
   5.241 +    0x7090e070U, 0x3e427c3eU, 0xb5c471b5U, 0x66aacc66U,
   5.242 +    0x48d89048U, 0x03050603U, 0xf601f7f6U, 0x0e121c0eU,
   5.243 +    0x61a3c261U, 0x355f6a35U, 0x57f9ae57U, 0xb9d069b9U,
   5.244 +    0x86911786U, 0xc15899c1U, 0x1d273a1dU, 0x9eb9279eU,
   5.245 +    0xe138d9e1U, 0xf813ebf8U, 0x98b32b98U, 0x11332211U,
   5.246 +    0x69bbd269U, 0xd970a9d9U, 0x8e89078eU, 0x94a73394U,
   5.247 +    0x9bb62d9bU, 0x1e223c1eU, 0x87921587U, 0xe920c9e9U,
   5.248 +    0xce4987ceU, 0x55ffaa55U, 0x28785028U, 0xdf7aa5dfU,
   5.249 +    0x8c8f038cU, 0xa1f859a1U, 0x89800989U, 0x0d171a0dU,
   5.250 +    0xbfda65bfU, 0xe631d7e6U, 0x42c68442U, 0x68b8d068U,
   5.251 +    0x41c38241U, 0x99b02999U, 0x2d775a2dU, 0x0f111e0fU,
   5.252 +    0xb0cb7bb0U, 0x54fca854U, 0xbbd66dbbU, 0x163a2c16U,
   5.253 +};
   5.254 +static const u32 Te3[256] = {
   5.255 +    0x6363a5c6U, 0x7c7c84f8U, 0x777799eeU, 0x7b7b8df6U,
   5.256 +    0xf2f20dffU, 0x6b6bbdd6U, 0x6f6fb1deU, 0xc5c55491U,
   5.257 +    0x30305060U, 0x01010302U, 0x6767a9ceU, 0x2b2b7d56U,
   5.258 +    0xfefe19e7U, 0xd7d762b5U, 0xababe64dU, 0x76769aecU,
   5.259 +    0xcaca458fU, 0x82829d1fU, 0xc9c94089U, 0x7d7d87faU,
   5.260 +    0xfafa15efU, 0x5959ebb2U, 0x4747c98eU, 0xf0f00bfbU,
   5.261 +    0xadadec41U, 0xd4d467b3U, 0xa2a2fd5fU, 0xafafea45U,
   5.262 +    0x9c9cbf23U, 0xa4a4f753U, 0x727296e4U, 0xc0c05b9bU,
   5.263 +    0xb7b7c275U, 0xfdfd1ce1U, 0x9393ae3dU, 0x26266a4cU,
   5.264 +    0x36365a6cU, 0x3f3f417eU, 0xf7f702f5U, 0xcccc4f83U,
   5.265 +    0x34345c68U, 0xa5a5f451U, 0xe5e534d1U, 0xf1f108f9U,
   5.266 +    0x717193e2U, 0xd8d873abU, 0x31315362U, 0x15153f2aU,
   5.267 +    0x04040c08U, 0xc7c75295U, 0x23236546U, 0xc3c35e9dU,
   5.268 +    0x18182830U, 0x9696a137U, 0x05050f0aU, 0x9a9ab52fU,
   5.269 +    0x0707090eU, 0x12123624U, 0x80809b1bU, 0xe2e23ddfU,
   5.270 +    0xebeb26cdU, 0x2727694eU, 0xb2b2cd7fU, 0x75759feaU,
   5.271 +    0x09091b12U, 0x83839e1dU, 0x2c2c7458U, 0x1a1a2e34U,
   5.272 +    0x1b1b2d36U, 0x6e6eb2dcU, 0x5a5aeeb4U, 0xa0a0fb5bU,
   5.273 +    0x5252f6a4U, 0x3b3b4d76U, 0xd6d661b7U, 0xb3b3ce7dU,
   5.274 +    0x29297b52U, 0xe3e33eddU, 0x2f2f715eU, 0x84849713U,
   5.275 +    0x5353f5a6U, 0xd1d168b9U, 0x00000000U, 0xeded2cc1U,
   5.276 +    0x20206040U, 0xfcfc1fe3U, 0xb1b1c879U, 0x5b5bedb6U,
   5.277 +    0x6a6abed4U, 0xcbcb468dU, 0xbebed967U, 0x39394b72U,
   5.278 +    0x4a4ade94U, 0x4c4cd498U, 0x5858e8b0U, 0xcfcf4a85U,
   5.279 +    0xd0d06bbbU, 0xefef2ac5U, 0xaaaae54fU, 0xfbfb16edU,
   5.280 +    0x4343c586U, 0x4d4dd79aU, 0x33335566U, 0x85859411U,
   5.281 +    0x4545cf8aU, 0xf9f910e9U, 0x02020604U, 0x7f7f81feU,
   5.282 +    0x5050f0a0U, 0x3c3c4478U, 0x9f9fba25U, 0xa8a8e34bU,
   5.283 +    0x5151f3a2U, 0xa3a3fe5dU, 0x4040c080U, 0x8f8f8a05U,
   5.284 +    0x9292ad3fU, 0x9d9dbc21U, 0x38384870U, 0xf5f504f1U,
   5.285 +    0xbcbcdf63U, 0xb6b6c177U, 0xdada75afU, 0x21216342U,
   5.286 +    0x10103020U, 0xffff1ae5U, 0xf3f30efdU, 0xd2d26dbfU,
   5.287 +    0xcdcd4c81U, 0x0c0c1418U, 0x13133526U, 0xecec2fc3U,
   5.288 +    0x5f5fe1beU, 0x9797a235U, 0x4444cc88U, 0x1717392eU,
   5.289 +    0xc4c45793U, 0xa7a7f255U, 0x7e7e82fcU, 0x3d3d477aU,
   5.290 +    0x6464acc8U, 0x5d5de7baU, 0x19192b32U, 0x737395e6U,
   5.291 +    0x6060a0c0U, 0x81819819U, 0x4f4fd19eU, 0xdcdc7fa3U,
   5.292 +    0x22226644U, 0x2a2a7e54U, 0x9090ab3bU, 0x8888830bU,
   5.293 +    0x4646ca8cU, 0xeeee29c7U, 0xb8b8d36bU, 0x14143c28U,
   5.294 +    0xdede79a7U, 0x5e5ee2bcU, 0x0b0b1d16U, 0xdbdb76adU,
   5.295 +    0xe0e03bdbU, 0x32325664U, 0x3a3a4e74U, 0x0a0a1e14U,
   5.296 +    0x4949db92U, 0x06060a0cU, 0x24246c48U, 0x5c5ce4b8U,
   5.297 +    0xc2c25d9fU, 0xd3d36ebdU, 0xacacef43U, 0x6262a6c4U,
   5.298 +    0x9191a839U, 0x9595a431U, 0xe4e437d3U, 0x79798bf2U,
   5.299 +    0xe7e732d5U, 0xc8c8438bU, 0x3737596eU, 0x6d6db7daU,
   5.300 +    0x8d8d8c01U, 0xd5d564b1U, 0x4e4ed29cU, 0xa9a9e049U,
   5.301 +    0x6c6cb4d8U, 0x5656faacU, 0xf4f407f3U, 0xeaea25cfU,
   5.302 +    0x6565afcaU, 0x7a7a8ef4U, 0xaeaee947U, 0x08081810U,
   5.303 +    0xbabad56fU, 0x787888f0U, 0x25256f4aU, 0x2e2e725cU,
   5.304 +    0x1c1c2438U, 0xa6a6f157U, 0xb4b4c773U, 0xc6c65197U,
   5.305 +    0xe8e823cbU, 0xdddd7ca1U, 0x74749ce8U, 0x1f1f213eU,
   5.306 +    0x4b4bdd96U, 0xbdbddc61U, 0x8b8b860dU, 0x8a8a850fU,
   5.307 +    0x707090e0U, 0x3e3e427cU, 0xb5b5c471U, 0x6666aaccU,
   5.308 +    0x4848d890U, 0x03030506U, 0xf6f601f7U, 0x0e0e121cU,
   5.309 +    0x6161a3c2U, 0x35355f6aU, 0x5757f9aeU, 0xb9b9d069U,
   5.310 +    0x86869117U, 0xc1c15899U, 0x1d1d273aU, 0x9e9eb927U,
   5.311 +    0xe1e138d9U, 0xf8f813ebU, 0x9898b32bU, 0x11113322U,
   5.312 +    0x6969bbd2U, 0xd9d970a9U, 0x8e8e8907U, 0x9494a733U,
   5.313 +    0x9b9bb62dU, 0x1e1e223cU, 0x87879215U, 0xe9e920c9U,
   5.314 +    0xcece4987U, 0x5555ffaaU, 0x28287850U, 0xdfdf7aa5U,
   5.315 +    0x8c8c8f03U, 0xa1a1f859U, 0x89898009U, 0x0d0d171aU,
   5.316 +    0xbfbfda65U, 0xe6e631d7U, 0x4242c684U, 0x6868b8d0U,
   5.317 +    0x4141c382U, 0x9999b029U, 0x2d2d775aU, 0x0f0f111eU,
   5.318 +    0xb0b0cb7bU, 0x5454fca8U, 0xbbbbd66dU, 0x16163a2cU,
   5.319 +};
   5.320 +static const u32 Te4[256] = {
   5.321 +    0x63636363U, 0x7c7c7c7cU, 0x77777777U, 0x7b7b7b7bU,
   5.322 +    0xf2f2f2f2U, 0x6b6b6b6bU, 0x6f6f6f6fU, 0xc5c5c5c5U,
   5.323 +    0x30303030U, 0x01010101U, 0x67676767U, 0x2b2b2b2bU,
   5.324 +    0xfefefefeU, 0xd7d7d7d7U, 0xababababU, 0x76767676U,
   5.325 +    0xcacacacaU, 0x82828282U, 0xc9c9c9c9U, 0x7d7d7d7dU,
   5.326 +    0xfafafafaU, 0x59595959U, 0x47474747U, 0xf0f0f0f0U,
   5.327 +    0xadadadadU, 0xd4d4d4d4U, 0xa2a2a2a2U, 0xafafafafU,
   5.328 +    0x9c9c9c9cU, 0xa4a4a4a4U, 0x72727272U, 0xc0c0c0c0U,
   5.329 +    0xb7b7b7b7U, 0xfdfdfdfdU, 0x93939393U, 0x26262626U,
   5.330 +    0x36363636U, 0x3f3f3f3fU, 0xf7f7f7f7U, 0xccccccccU,
   5.331 +    0x34343434U, 0xa5a5a5a5U, 0xe5e5e5e5U, 0xf1f1f1f1U,
   5.332 +    0x71717171U, 0xd8d8d8d8U, 0x31313131U, 0x15151515U,
   5.333 +    0x04040404U, 0xc7c7c7c7U, 0x23232323U, 0xc3c3c3c3U,
   5.334 +    0x18181818U, 0x96969696U, 0x05050505U, 0x9a9a9a9aU,
   5.335 +    0x07070707U, 0x12121212U, 0x80808080U, 0xe2e2e2e2U,
   5.336 +    0xebebebebU, 0x27272727U, 0xb2b2b2b2U, 0x75757575U,
   5.337 +    0x09090909U, 0x83838383U, 0x2c2c2c2cU, 0x1a1a1a1aU,
   5.338 +    0x1b1b1b1bU, 0x6e6e6e6eU, 0x5a5a5a5aU, 0xa0a0a0a0U,
   5.339 +    0x52525252U, 0x3b3b3b3bU, 0xd6d6d6d6U, 0xb3b3b3b3U,
   5.340 +    0x29292929U, 0xe3e3e3e3U, 0x2f2f2f2fU, 0x84848484U,
   5.341 +    0x53535353U, 0xd1d1d1d1U, 0x00000000U, 0xededededU,
   5.342 +    0x20202020U, 0xfcfcfcfcU, 0xb1b1b1b1U, 0x5b5b5b5bU,
   5.343 +    0x6a6a6a6aU, 0xcbcbcbcbU, 0xbebebebeU, 0x39393939U,
   5.344 +    0x4a4a4a4aU, 0x4c4c4c4cU, 0x58585858U, 0xcfcfcfcfU,
   5.345 +    0xd0d0d0d0U, 0xefefefefU, 0xaaaaaaaaU, 0xfbfbfbfbU,
   5.346 +    0x43434343U, 0x4d4d4d4dU, 0x33333333U, 0x85858585U,
   5.347 +    0x45454545U, 0xf9f9f9f9U, 0x02020202U, 0x7f7f7f7fU,
   5.348 +    0x50505050U, 0x3c3c3c3cU, 0x9f9f9f9fU, 0xa8a8a8a8U,
   5.349 +    0x51515151U, 0xa3a3a3a3U, 0x40404040U, 0x8f8f8f8fU,
   5.350 +    0x92929292U, 0x9d9d9d9dU, 0x38383838U, 0xf5f5f5f5U,
   5.351 +    0xbcbcbcbcU, 0xb6b6b6b6U, 0xdadadadaU, 0x21212121U,
   5.352 +    0x10101010U, 0xffffffffU, 0xf3f3f3f3U, 0xd2d2d2d2U,
   5.353 +    0xcdcdcdcdU, 0x0c0c0c0cU, 0x13131313U, 0xececececU,
   5.354 +    0x5f5f5f5fU, 0x97979797U, 0x44444444U, 0x17171717U,
   5.355 +    0xc4c4c4c4U, 0xa7a7a7a7U, 0x7e7e7e7eU, 0x3d3d3d3dU,
   5.356 +    0x64646464U, 0x5d5d5d5dU, 0x19191919U, 0x73737373U,
   5.357 +    0x60606060U, 0x81818181U, 0x4f4f4f4fU, 0xdcdcdcdcU,
   5.358 +    0x22222222U, 0x2a2a2a2aU, 0x90909090U, 0x88888888U,
   5.359 +    0x46464646U, 0xeeeeeeeeU, 0xb8b8b8b8U, 0x14141414U,
   5.360 +    0xdedededeU, 0x5e5e5e5eU, 0x0b0b0b0bU, 0xdbdbdbdbU,
   5.361 +    0xe0e0e0e0U, 0x32323232U, 0x3a3a3a3aU, 0x0a0a0a0aU,
   5.362 +    0x49494949U, 0x06060606U, 0x24242424U, 0x5c5c5c5cU,
   5.363 +    0xc2c2c2c2U, 0xd3d3d3d3U, 0xacacacacU, 0x62626262U,
   5.364 +    0x91919191U, 0x95959595U, 0xe4e4e4e4U, 0x79797979U,
   5.365 +    0xe7e7e7e7U, 0xc8c8c8c8U, 0x37373737U, 0x6d6d6d6dU,
   5.366 +    0x8d8d8d8dU, 0xd5d5d5d5U, 0x4e4e4e4eU, 0xa9a9a9a9U,
   5.367 +    0x6c6c6c6cU, 0x56565656U, 0xf4f4f4f4U, 0xeaeaeaeaU,
   5.368 +    0x65656565U, 0x7a7a7a7aU, 0xaeaeaeaeU, 0x08080808U,
   5.369 +    0xbabababaU, 0x78787878U, 0x25252525U, 0x2e2e2e2eU,
   5.370 +    0x1c1c1c1cU, 0xa6a6a6a6U, 0xb4b4b4b4U, 0xc6c6c6c6U,
   5.371 +    0xe8e8e8e8U, 0xddddddddU, 0x74747474U, 0x1f1f1f1fU,
   5.372 +    0x4b4b4b4bU, 0xbdbdbdbdU, 0x8b8b8b8bU, 0x8a8a8a8aU,
   5.373 +    0x70707070U, 0x3e3e3e3eU, 0xb5b5b5b5U, 0x66666666U,
   5.374 +    0x48484848U, 0x03030303U, 0xf6f6f6f6U, 0x0e0e0e0eU,
   5.375 +    0x61616161U, 0x35353535U, 0x57575757U, 0xb9b9b9b9U,
   5.376 +    0x86868686U, 0xc1c1c1c1U, 0x1d1d1d1dU, 0x9e9e9e9eU,
   5.377 +    0xe1e1e1e1U, 0xf8f8f8f8U, 0x98989898U, 0x11111111U,
   5.378 +    0x69696969U, 0xd9d9d9d9U, 0x8e8e8e8eU, 0x94949494U,
   5.379 +    0x9b9b9b9bU, 0x1e1e1e1eU, 0x87878787U, 0xe9e9e9e9U,
   5.380 +    0xcecececeU, 0x55555555U, 0x28282828U, 0xdfdfdfdfU,
   5.381 +    0x8c8c8c8cU, 0xa1a1a1a1U, 0x89898989U, 0x0d0d0d0dU,
   5.382 +    0xbfbfbfbfU, 0xe6e6e6e6U, 0x42424242U, 0x68686868U,
   5.383 +    0x41414141U, 0x99999999U, 0x2d2d2d2dU, 0x0f0f0f0fU,
   5.384 +    0xb0b0b0b0U, 0x54545454U, 0xbbbbbbbbU, 0x16161616U,
   5.385 +};
   5.386 +static const u32 Td0[256] = {
   5.387 +    0x51f4a750U, 0x7e416553U, 0x1a17a4c3U, 0x3a275e96U,
   5.388 +    0x3bab6bcbU, 0x1f9d45f1U, 0xacfa58abU, 0x4be30393U,
   5.389 +    0x2030fa55U, 0xad766df6U, 0x88cc7691U, 0xf5024c25U,
   5.390 +    0x4fe5d7fcU, 0xc52acbd7U, 0x26354480U, 0xb562a38fU,
   5.391 +    0xdeb15a49U, 0x25ba1b67U, 0x45ea0e98U, 0x5dfec0e1U,
   5.392 +    0xc32f7502U, 0x814cf012U, 0x8d4697a3U, 0x6bd3f9c6U,
   5.393 +    0x038f5fe7U, 0x15929c95U, 0xbf6d7aebU, 0x955259daU,
   5.394 +    0xd4be832dU, 0x587421d3U, 0x49e06929U, 0x8ec9c844U,
   5.395 +    0x75c2896aU, 0xf48e7978U, 0x99583e6bU, 0x27b971ddU,
   5.396 +    0xbee14fb6U, 0xf088ad17U, 0xc920ac66U, 0x7dce3ab4U,
   5.397 +    0x63df4a18U, 0xe51a3182U, 0x97513360U, 0x62537f45U,
   5.398 +    0xb16477e0U, 0xbb6bae84U, 0xfe81a01cU, 0xf9082b94U,
   5.399 +    0x70486858U, 0x8f45fd19U, 0x94de6c87U, 0x527bf8b7U,
   5.400 +    0xab73d323U, 0x724b02e2U, 0xe31f8f57U, 0x6655ab2aU,
   5.401 +    0xb2eb2807U, 0x2fb5c203U, 0x86c57b9aU, 0xd33708a5U,
   5.402 +    0x302887f2U, 0x23bfa5b2U, 0x02036abaU, 0xed16825cU,
   5.403 +    0x8acf1c2bU, 0xa779b492U, 0xf307f2f0U, 0x4e69e2a1U,
   5.404 +    0x65daf4cdU, 0x0605bed5U, 0xd134621fU, 0xc4a6fe8aU,
   5.405 +    0x342e539dU, 0xa2f355a0U, 0x058ae132U, 0xa4f6eb75U,
   5.406 +    0x0b83ec39U, 0x4060efaaU, 0x5e719f06U, 0xbd6e1051U,
   5.407 +    0x3e218af9U, 0x96dd063dU, 0xdd3e05aeU, 0x4de6bd46U,
   5.408 +    0x91548db5U, 0x71c45d05U, 0x0406d46fU, 0x605015ffU,
   5.409 +    0x1998fb24U, 0xd6bde997U, 0x894043ccU, 0x67d99e77U,
   5.410 +    0xb0e842bdU, 0x07898b88U, 0xe7195b38U, 0x79c8eedbU,
   5.411 +    0xa17c0a47U, 0x7c420fe9U, 0xf8841ec9U, 0x00000000U,
   5.412 +    0x09808683U, 0x322bed48U, 0x1e1170acU, 0x6c5a724eU,
   5.413 +    0xfd0efffbU, 0x0f853856U, 0x3daed51eU, 0x362d3927U,
   5.414 +    0x0a0fd964U, 0x685ca621U, 0x9b5b54d1U, 0x24362e3aU,
   5.415 +    0x0c0a67b1U, 0x9357e70fU, 0xb4ee96d2U, 0x1b9b919eU,
   5.416 +    0x80c0c54fU, 0x61dc20a2U, 0x5a774b69U, 0x1c121a16U,
   5.417 +    0xe293ba0aU, 0xc0a02ae5U, 0x3c22e043U, 0x121b171dU,
   5.418 +    0x0e090d0bU, 0xf28bc7adU, 0x2db6a8b9U, 0x141ea9c8U,
   5.419 +    0x57f11985U, 0xaf75074cU, 0xee99ddbbU, 0xa37f60fdU,
   5.420 +    0xf701269fU, 0x5c72f5bcU, 0x44663bc5U, 0x5bfb7e34U,
   5.421 +    0x8b432976U, 0xcb23c6dcU, 0xb6edfc68U, 0xb8e4f163U,
   5.422 +    0xd731dccaU, 0x42638510U, 0x13972240U, 0x84c61120U,
   5.423 +    0x854a247dU, 0xd2bb3df8U, 0xaef93211U, 0xc729a16dU,
   5.424 +    0x1d9e2f4bU, 0xdcb230f3U, 0x0d8652ecU, 0x77c1e3d0U,
   5.425 +    0x2bb3166cU, 0xa970b999U, 0x119448faU, 0x47e96422U,
   5.426 +    0xa8fc8cc4U, 0xa0f03f1aU, 0x567d2cd8U, 0x223390efU,
   5.427 +    0x87494ec7U, 0xd938d1c1U, 0x8ccaa2feU, 0x98d40b36U,
   5.428 +    0xa6f581cfU, 0xa57ade28U, 0xdab78e26U, 0x3fadbfa4U,
   5.429 +    0x2c3a9de4U, 0x5078920dU, 0x6a5fcc9bU, 0x547e4662U,
   5.430 +    0xf68d13c2U, 0x90d8b8e8U, 0x2e39f75eU, 0x82c3aff5U,
   5.431 +    0x9f5d80beU, 0x69d0937cU, 0x6fd52da9U, 0xcf2512b3U,
   5.432 +    0xc8ac993bU, 0x10187da7U, 0xe89c636eU, 0xdb3bbb7bU,
   5.433 +    0xcd267809U, 0x6e5918f4U, 0xec9ab701U, 0x834f9aa8U,
   5.434 +    0xe6956e65U, 0xaaffe67eU, 0x21bccf08U, 0xef15e8e6U,
   5.435 +    0xbae79bd9U, 0x4a6f36ceU, 0xea9f09d4U, 0x29b07cd6U,
   5.436 +    0x31a4b2afU, 0x2a3f2331U, 0xc6a59430U, 0x35a266c0U,
   5.437 +    0x744ebc37U, 0xfc82caa6U, 0xe090d0b0U, 0x33a7d815U,
   5.438 +    0xf104984aU, 0x41ecdaf7U, 0x7fcd500eU, 0x1791f62fU,
   5.439 +    0x764dd68dU, 0x43efb04dU, 0xccaa4d54U, 0xe49604dfU,
   5.440 +    0x9ed1b5e3U, 0x4c6a881bU, 0xc12c1fb8U, 0x4665517fU,
   5.441 +    0x9d5eea04U, 0x018c355dU, 0xfa877473U, 0xfb0b412eU,
   5.442 +    0xb3671d5aU, 0x92dbd252U, 0xe9105633U, 0x6dd64713U,
   5.443 +    0x9ad7618cU, 0x37a10c7aU, 0x59f8148eU, 0xeb133c89U,
   5.444 +    0xcea927eeU, 0xb761c935U, 0xe11ce5edU, 0x7a47b13cU,
   5.445 +    0x9cd2df59U, 0x55f2733fU, 0x1814ce79U, 0x73c737bfU,
   5.446 +    0x53f7cdeaU, 0x5ffdaa5bU, 0xdf3d6f14U, 0x7844db86U,
   5.447 +    0xcaaff381U, 0xb968c43eU, 0x3824342cU, 0xc2a3405fU,
   5.448 +    0x161dc372U, 0xbce2250cU, 0x283c498bU, 0xff0d9541U,
   5.449 +    0x39a80171U, 0x080cb3deU, 0xd8b4e49cU, 0x6456c190U,
   5.450 +    0x7bcb8461U, 0xd532b670U, 0x486c5c74U, 0xd0b85742U,
   5.451 +};
   5.452 +static const u32 Td1[256] = {
   5.453 +    0x5051f4a7U, 0x537e4165U, 0xc31a17a4U, 0x963a275eU,
   5.454 +    0xcb3bab6bU, 0xf11f9d45U, 0xabacfa58U, 0x934be303U,
   5.455 +    0x552030faU, 0xf6ad766dU, 0x9188cc76U, 0x25f5024cU,
   5.456 +    0xfc4fe5d7U, 0xd7c52acbU, 0x80263544U, 0x8fb562a3U,
   5.457 +    0x49deb15aU, 0x6725ba1bU, 0x9845ea0eU, 0xe15dfec0U,
   5.458 +    0x02c32f75U, 0x12814cf0U, 0xa38d4697U, 0xc66bd3f9U,
   5.459 +    0xe7038f5fU, 0x9515929cU, 0xebbf6d7aU, 0xda955259U,
   5.460 +    0x2dd4be83U, 0xd3587421U, 0x2949e069U, 0x448ec9c8U,
   5.461 +    0x6a75c289U, 0x78f48e79U, 0x6b99583eU, 0xdd27b971U,
   5.462 +    0xb6bee14fU, 0x17f088adU, 0x66c920acU, 0xb47dce3aU,
   5.463 +    0x1863df4aU, 0x82e51a31U, 0x60975133U, 0x4562537fU,
   5.464 +    0xe0b16477U, 0x84bb6baeU, 0x1cfe81a0U, 0x94f9082bU,
   5.465 +    0x58704868U, 0x198f45fdU, 0x8794de6cU, 0xb7527bf8U,
   5.466 +    0x23ab73d3U, 0xe2724b02U, 0x57e31f8fU, 0x2a6655abU,
   5.467 +    0x07b2eb28U, 0x032fb5c2U, 0x9a86c57bU, 0xa5d33708U,
   5.468 +    0xf2302887U, 0xb223bfa5U, 0xba02036aU, 0x5ced1682U,
   5.469 +    0x2b8acf1cU, 0x92a779b4U, 0xf0f307f2U, 0xa14e69e2U,
   5.470 +    0xcd65daf4U, 0xd50605beU, 0x1fd13462U, 0x8ac4a6feU,
   5.471 +    0x9d342e53U, 0xa0a2f355U, 0x32058ae1U, 0x75a4f6ebU,
   5.472 +    0x390b83ecU, 0xaa4060efU, 0x065e719fU, 0x51bd6e10U,
   5.473 +    0xf93e218aU, 0x3d96dd06U, 0xaedd3e05U, 0x464de6bdU,
   5.474 +    0xb591548dU, 0x0571c45dU, 0x6f0406d4U, 0xff605015U,
   5.475 +    0x241998fbU, 0x97d6bde9U, 0xcc894043U, 0x7767d99eU,
   5.476 +    0xbdb0e842U, 0x8807898bU, 0x38e7195bU, 0xdb79c8eeU,
   5.477 +    0x47a17c0aU, 0xe97c420fU, 0xc9f8841eU, 0x00000000U,
   5.478 +    0x83098086U, 0x48322bedU, 0xac1e1170U, 0x4e6c5a72U,
   5.479 +    0xfbfd0effU, 0x560f8538U, 0x1e3daed5U, 0x27362d39U,
   5.480 +    0x640a0fd9U, 0x21685ca6U, 0xd19b5b54U, 0x3a24362eU,
   5.481 +    0xb10c0a67U, 0x0f9357e7U, 0xd2b4ee96U, 0x9e1b9b91U,
   5.482 +    0x4f80c0c5U, 0xa261dc20U, 0x695a774bU, 0x161c121aU,
   5.483 +    0x0ae293baU, 0xe5c0a02aU, 0x433c22e0U, 0x1d121b17U,
   5.484 +    0x0b0e090dU, 0xadf28bc7U, 0xb92db6a8U, 0xc8141ea9U,
   5.485 +    0x8557f119U, 0x4caf7507U, 0xbbee99ddU, 0xfda37f60U,
   5.486 +    0x9ff70126U, 0xbc5c72f5U, 0xc544663bU, 0x345bfb7eU,
   5.487 +    0x768b4329U, 0xdccb23c6U, 0x68b6edfcU, 0x63b8e4f1U,
   5.488 +    0xcad731dcU, 0x10426385U, 0x40139722U, 0x2084c611U,
   5.489 +    0x7d854a24U, 0xf8d2bb3dU, 0x11aef932U, 0x6dc729a1U,
   5.490 +    0x4b1d9e2fU, 0xf3dcb230U, 0xec0d8652U, 0xd077c1e3U,
   5.491 +    0x6c2bb316U, 0x99a970b9U, 0xfa119448U, 0x2247e964U,
   5.492 +    0xc4a8fc8cU, 0x1aa0f03fU, 0xd8567d2cU, 0xef223390U,
   5.493 +    0xc787494eU, 0xc1d938d1U, 0xfe8ccaa2U, 0x3698d40bU,
   5.494 +    0xcfa6f581U, 0x28a57adeU, 0x26dab78eU, 0xa43fadbfU,
   5.495 +    0xe42c3a9dU, 0x0d507892U, 0x9b6a5fccU, 0x62547e46U,
   5.496 +    0xc2f68d13U, 0xe890d8b8U, 0x5e2e39f7U, 0xf582c3afU,
   5.497 +    0xbe9f5d80U, 0x7c69d093U, 0xa96fd52dU, 0xb3cf2512U,
   5.498 +    0x3bc8ac99U, 0xa710187dU, 0x6ee89c63U, 0x7bdb3bbbU,
   5.499 +    0x09cd2678U, 0xf46e5918U, 0x01ec9ab7U, 0xa8834f9aU,
   5.500 +    0x65e6956eU, 0x7eaaffe6U, 0x0821bccfU, 0xe6ef15e8U,
   5.501 +    0xd9bae79bU, 0xce4a6f36U, 0xd4ea9f09U, 0xd629b07cU,
   5.502 +    0xaf31a4b2U, 0x312a3f23U, 0x30c6a594U, 0xc035a266U,
   5.503 +    0x37744ebcU, 0xa6fc82caU, 0xb0e090d0U, 0x1533a7d8U,
   5.504 +    0x4af10498U, 0xf741ecdaU, 0x0e7fcd50U, 0x2f1791f6U,
   5.505 +    0x8d764dd6U, 0x4d43efb0U, 0x54ccaa4dU, 0xdfe49604U,
   5.506 +    0xe39ed1b5U, 0x1b4c6a88U, 0xb8c12c1fU, 0x7f466551U,
   5.507 +    0x049d5eeaU, 0x5d018c35U, 0x73fa8774U, 0x2efb0b41U,
   5.508 +    0x5ab3671dU, 0x5292dbd2U, 0x33e91056U, 0x136dd647U,
   5.509 +    0x8c9ad761U, 0x7a37a10cU, 0x8e59f814U, 0x89eb133cU,
   5.510 +    0xeecea927U, 0x35b761c9U, 0xede11ce5U, 0x3c7a47b1U,
   5.511 +    0x599cd2dfU, 0x3f55f273U, 0x791814ceU, 0xbf73c737U,
   5.512 +    0xea53f7cdU, 0x5b5ffdaaU, 0x14df3d6fU, 0x867844dbU,
   5.513 +    0x81caaff3U, 0x3eb968c4U, 0x2c382434U, 0x5fc2a340U,
   5.514 +    0x72161dc3U, 0x0cbce225U, 0x8b283c49U, 0x41ff0d95U,
   5.515 +    0x7139a801U, 0xde080cb3U, 0x9cd8b4e4U, 0x906456c1U,
   5.516 +    0x617bcb84U, 0x70d532b6U, 0x74486c5cU, 0x42d0b857U,
   5.517 +};
   5.518 +static const u32 Td2[256] = {
   5.519 +    0xa75051f4U, 0x65537e41U, 0xa4c31a17U, 0x5e963a27U,
   5.520 +    0x6bcb3babU, 0x45f11f9dU, 0x58abacfaU, 0x03934be3U,
   5.521 +    0xfa552030U, 0x6df6ad76U, 0x769188ccU, 0x4c25f502U,
   5.522 +    0xd7fc4fe5U, 0xcbd7c52aU, 0x44802635U, 0xa38fb562U,
   5.523 +    0x5a49deb1U, 0x1b6725baU, 0x0e9845eaU, 0xc0e15dfeU,
   5.524 +    0x7502c32fU, 0xf012814cU, 0x97a38d46U, 0xf9c66bd3U,
   5.525 +    0x5fe7038fU, 0x9c951592U, 0x7aebbf6dU, 0x59da9552U,
   5.526 +    0x832dd4beU, 0x21d35874U, 0x692949e0U, 0xc8448ec9U,
   5.527 +    0x896a75c2U, 0x7978f48eU, 0x3e6b9958U, 0x71dd27b9U,
   5.528 +    0x4fb6bee1U, 0xad17f088U, 0xac66c920U, 0x3ab47dceU,
   5.529 +    0x4a1863dfU, 0x3182e51aU, 0x33609751U, 0x7f456253U,
   5.530 +    0x77e0b164U, 0xae84bb6bU, 0xa01cfe81U, 0x2b94f908U,
   5.531 +    0x68587048U, 0xfd198f45U, 0x6c8794deU, 0xf8b7527bU,
   5.532 +    0xd323ab73U, 0x02e2724bU, 0x8f57e31fU, 0xab2a6655U,
   5.533 +    0x2807b2ebU, 0xc2032fb5U, 0x7b9a86c5U, 0x08a5d337U,
   5.534 +    0x87f23028U, 0xa5b223bfU, 0x6aba0203U, 0x825ced16U,
   5.535 +    0x1c2b8acfU, 0xb492a779U, 0xf2f0f307U, 0xe2a14e69U,
   5.536 +    0xf4cd65daU, 0xbed50605U, 0x621fd134U, 0xfe8ac4a6U,
   5.537 +    0x539d342eU, 0x55a0a2f3U, 0xe132058aU, 0xeb75a4f6U,
   5.538 +    0xec390b83U, 0xefaa4060U, 0x9f065e71U, 0x1051bd6eU,
   5.539 +    0x8af93e21U, 0x063d96ddU, 0x05aedd3eU, 0xbd464de6U,
   5.540 +    0x8db59154U, 0x5d0571c4U, 0xd46f0406U, 0x15ff6050U,
   5.541 +    0xfb241998U, 0xe997d6bdU, 0x43cc8940U, 0x9e7767d9U,
   5.542 +    0x42bdb0e8U, 0x8b880789U, 0x5b38e719U, 0xeedb79c8U,
   5.543 +    0x0a47a17cU, 0x0fe97c42U, 0x1ec9f884U, 0x00000000U,
   5.544 +    0x86830980U, 0xed48322bU, 0x70ac1e11U, 0x724e6c5aU,
   5.545 +    0xfffbfd0eU, 0x38560f85U, 0xd51e3daeU, 0x3927362dU,
   5.546 +    0xd9640a0fU, 0xa621685cU, 0x54d19b5bU, 0x2e3a2436U,
   5.547 +    0x67b10c0aU, 0xe70f9357U, 0x96d2b4eeU, 0x919e1b9bU,
   5.548 +    0xc54f80c0U, 0x20a261dcU, 0x4b695a77U, 0x1a161c12U,
   5.549 +    0xba0ae293U, 0x2ae5c0a0U, 0xe0433c22U, 0x171d121bU,
   5.550 +    0x0d0b0e09U, 0xc7adf28bU, 0xa8b92db6U, 0xa9c8141eU,
   5.551 +    0x198557f1U, 0x074caf75U, 0xddbbee99U, 0x60fda37fU,
   5.552 +    0x269ff701U, 0xf5bc5c72U, 0x3bc54466U, 0x7e345bfbU,
   5.553 +    0x29768b43U, 0xc6dccb23U, 0xfc68b6edU, 0xf163b8e4U,
   5.554 +    0xdccad731U, 0x85104263U, 0x22401397U, 0x112084c6U,
   5.555 +    0x247d854aU, 0x3df8d2bbU, 0x3211aef9U, 0xa16dc729U,
   5.556 +    0x2f4b1d9eU, 0x30f3dcb2U, 0x52ec0d86U, 0xe3d077c1U,
   5.557 +    0x166c2bb3U, 0xb999a970U, 0x48fa1194U, 0x642247e9U,
   5.558 +    0x8cc4a8fcU, 0x3f1aa0f0U, 0x2cd8567dU, 0x90ef2233U,
   5.559 +    0x4ec78749U, 0xd1c1d938U, 0xa2fe8ccaU, 0x0b3698d4U,
   5.560 +    0x81cfa6f5U, 0xde28a57aU, 0x8e26dab7U, 0xbfa43fadU,
   5.561 +    0x9de42c3aU, 0x920d5078U, 0xcc9b6a5fU, 0x4662547eU,
   5.562 +    0x13c2f68dU, 0xb8e890d8U, 0xf75e2e39U, 0xaff582c3U,
   5.563 +    0x80be9f5dU, 0x937c69d0U, 0x2da96fd5U, 0x12b3cf25U,
   5.564 +    0x993bc8acU, 0x7da71018U, 0x636ee89cU, 0xbb7bdb3bU,
   5.565 +    0x7809cd26U, 0x18f46e59U, 0xb701ec9aU, 0x9aa8834fU,
   5.566 +    0x6e65e695U, 0xe67eaaffU, 0xcf0821bcU, 0xe8e6ef15U,
   5.567 +    0x9bd9bae7U, 0x36ce4a6fU, 0x09d4ea9fU, 0x7cd629b0U,
   5.568 +    0xb2af31a4U, 0x23312a3fU, 0x9430c6a5U, 0x66c035a2U,
   5.569 +    0xbc37744eU, 0xcaa6fc82U, 0xd0b0e090U, 0xd81533a7U,
   5.570 +    0x984af104U, 0xdaf741ecU, 0x500e7fcdU, 0xf62f1791U,
   5.571 +    0xd68d764dU, 0xb04d43efU, 0x4d54ccaaU, 0x04dfe496U,
   5.572 +    0xb5e39ed1U, 0x881b4c6aU, 0x1fb8c12cU, 0x517f4665U,
   5.573 +    0xea049d5eU, 0x355d018cU, 0x7473fa87U, 0x412efb0bU,
   5.574 +    0x1d5ab367U, 0xd25292dbU, 0x5633e910U, 0x47136dd6U,
   5.575 +    0x618c9ad7U, 0x0c7a37a1U, 0x148e59f8U, 0x3c89eb13U,
   5.576 +    0x27eecea9U, 0xc935b761U, 0xe5ede11cU, 0xb13c7a47U,
   5.577 +    0xdf599cd2U, 0x733f55f2U, 0xce791814U, 0x37bf73c7U,
   5.578 +    0xcdea53f7U, 0xaa5b5ffdU, 0x6f14df3dU, 0xdb867844U,
   5.579 +    0xf381caafU, 0xc43eb968U, 0x342c3824U, 0x405fc2a3U,
   5.580 +    0xc372161dU, 0x250cbce2U, 0x498b283cU, 0x9541ff0dU,
   5.581 +    0x017139a8U, 0xb3de080cU, 0xe49cd8b4U, 0xc1906456U,
   5.582 +    0x84617bcbU, 0xb670d532U, 0x5c74486cU, 0x5742d0b8U,
   5.583 +};
   5.584 +static const u32 Td3[256] = {
   5.585 +    0xf4a75051U, 0x4165537eU, 0x17a4c31aU, 0x275e963aU,
   5.586 +    0xab6bcb3bU, 0x9d45f11fU, 0xfa58abacU, 0xe303934bU,
   5.587 +    0x30fa5520U, 0x766df6adU, 0xcc769188U, 0x024c25f5U,
   5.588 +    0xe5d7fc4fU, 0x2acbd7c5U, 0x35448026U, 0x62a38fb5U,
   5.589 +    0xb15a49deU, 0xba1b6725U, 0xea0e9845U, 0xfec0e15dU,
   5.590 +    0x2f7502c3U, 0x4cf01281U, 0x4697a38dU, 0xd3f9c66bU,
   5.591 +    0x8f5fe703U, 0x929c9515U, 0x6d7aebbfU, 0x5259da95U,
   5.592 +    0xbe832dd4U, 0x7421d358U, 0xe0692949U, 0xc9c8448eU,
   5.593 +    0xc2896a75U, 0x8e7978f4U, 0x583e6b99U, 0xb971dd27U,
   5.594 +    0xe14fb6beU, 0x88ad17f0U, 0x20ac66c9U, 0xce3ab47dU,
   5.595 +    0xdf4a1863U, 0x1a3182e5U, 0x51336097U, 0x537f4562U,
   5.596 +    0x6477e0b1U, 0x6bae84bbU, 0x81a01cfeU, 0x082b94f9U,
   5.597 +    0x48685870U, 0x45fd198fU, 0xde6c8794U, 0x7bf8b752U,
   5.598 +    0x73d323abU, 0x4b02e272U, 0x1f8f57e3U, 0x55ab2a66U,
   5.599 +    0xeb2807b2U, 0xb5c2032fU, 0xc57b9a86U, 0x3708a5d3U,
   5.600 +    0x2887f230U, 0xbfa5b223U, 0x036aba02U, 0x16825cedU,
   5.601 +    0xcf1c2b8aU, 0x79b492a7U, 0x07f2f0f3U, 0x69e2a14eU,
   5.602 +    0xdaf4cd65U, 0x05bed506U, 0x34621fd1U, 0xa6fe8ac4U,
   5.603 +    0x2e539d34U, 0xf355a0a2U, 0x8ae13205U, 0xf6eb75a4U,
   5.604 +    0x83ec390bU, 0x60efaa40U, 0x719f065eU, 0x6e1051bdU,
   5.605 +    0x218af93eU, 0xdd063d96U, 0x3e05aeddU, 0xe6bd464dU,
   5.606 +    0x548db591U, 0xc45d0571U, 0x06d46f04U, 0x5015ff60U,
   5.607 +    0x98fb2419U, 0xbde997d6U, 0x4043cc89U, 0xd99e7767U,
   5.608 +    0xe842bdb0U, 0x898b8807U, 0x195b38e7U, 0xc8eedb79U,
   5.609 +    0x7c0a47a1U, 0x420fe97cU, 0x841ec9f8U, 0x00000000U,
   5.610 +    0x80868309U, 0x2bed4832U, 0x1170ac1eU, 0x5a724e6cU,
   5.611 +    0x0efffbfdU, 0x8538560fU, 0xaed51e3dU, 0x2d392736U,
   5.612 +    0x0fd9640aU, 0x5ca62168U, 0x5b54d19bU, 0x362e3a24U,
   5.613 +    0x0a67b10cU, 0x57e70f93U, 0xee96d2b4U, 0x9b919e1bU,
   5.614 +    0xc0c54f80U, 0xdc20a261U, 0x774b695aU, 0x121a161cU,
   5.615 +    0x93ba0ae2U, 0xa02ae5c0U, 0x22e0433cU, 0x1b171d12U,
   5.616 +    0x090d0b0eU, 0x8bc7adf2U, 0xb6a8b92dU, 0x1ea9c814U,
   5.617 +    0xf1198557U, 0x75074cafU, 0x99ddbbeeU, 0x7f60fda3U,
   5.618 +    0x01269ff7U, 0x72f5bc5cU, 0x663bc544U, 0xfb7e345bU,
   5.619 +    0x4329768bU, 0x23c6dccbU, 0xedfc68b6U, 0xe4f163b8U,
   5.620 +    0x31dccad7U, 0x63851042U, 0x97224013U, 0xc6112084U,
   5.621 +    0x4a247d85U, 0xbb3df8d2U, 0xf93211aeU, 0x29a16dc7U,
   5.622 +    0x9e2f4b1dU, 0xb230f3dcU, 0x8652ec0dU, 0xc1e3d077U,
   5.623 +    0xb3166c2bU, 0x70b999a9U, 0x9448fa11U, 0xe9642247U,
   5.624 +    0xfc8cc4a8U, 0xf03f1aa0U, 0x7d2cd856U, 0x3390ef22U,
   5.625 +    0x494ec787U, 0x38d1c1d9U, 0xcaa2fe8cU, 0xd40b3698U,
   5.626 +    0xf581cfa6U, 0x7ade28a5U, 0xb78e26daU, 0xadbfa43fU,
   5.627 +    0x3a9de42cU, 0x78920d50U, 0x5fcc9b6aU, 0x7e466254U,
   5.628 +    0x8d13c2f6U, 0xd8b8e890U, 0x39f75e2eU, 0xc3aff582U,
   5.629 +    0x5d80be9fU, 0xd0937c69U, 0xd52da96fU, 0x2512b3cfU,
   5.630 +    0xac993bc8U, 0x187da710U, 0x9c636ee8U, 0x3bbb7bdbU,
   5.631 +    0x267809cdU, 0x5918f46eU, 0x9ab701ecU, 0x4f9aa883U,
   5.632 +    0x956e65e6U, 0xffe67eaaU, 0xbccf0821U, 0x15e8e6efU,
   5.633 +    0xe79bd9baU, 0x6f36ce4aU, 0x9f09d4eaU, 0xb07cd629U,
   5.634 +    0xa4b2af31U, 0x3f23312aU, 0xa59430c6U, 0xa266c035U,
   5.635 +    0x4ebc3774U, 0x82caa6fcU, 0x90d0b0e0U, 0xa7d81533U,
   5.636 +    0x04984af1U, 0xecdaf741U, 0xcd500e7fU, 0x91f62f17U,
   5.637 +    0x4dd68d76U, 0xefb04d43U, 0xaa4d54ccU, 0x9604dfe4U,
   5.638 +    0xd1b5e39eU, 0x6a881b4cU, 0x2c1fb8c1U, 0x65517f46U,
   5.639 +    0x5eea049dU, 0x8c355d01U, 0x877473faU, 0x0b412efbU,
   5.640 +    0x671d5ab3U, 0xdbd25292U, 0x105633e9U, 0xd647136dU,
   5.641 +    0xd7618c9aU, 0xa10c7a37U, 0xf8148e59U, 0x133c89ebU,
   5.642 +    0xa927eeceU, 0x61c935b7U, 0x1ce5ede1U, 0x47b13c7aU,
   5.643 +    0xd2df599cU, 0xf2733f55U, 0x14ce7918U, 0xc737bf73U,
   5.644 +    0xf7cdea53U, 0xfdaa5b5fU, 0x3d6f14dfU, 0x44db8678U,
   5.645 +    0xaff381caU, 0x68c43eb9U, 0x24342c38U, 0xa3405fc2U,
   5.646 +    0x1dc37216U, 0xe2250cbcU, 0x3c498b28U, 0x0d9541ffU,
   5.647 +    0xa8017139U, 0x0cb3de08U, 0xb4e49cd8U, 0x56c19064U,
   5.648 +    0xcb84617bU, 0x32b670d5U, 0x6c5c7448U, 0xb85742d0U,
   5.649 +};
   5.650 +static const u32 Td4[256] = {
   5.651 +    0x52525252U, 0x09090909U, 0x6a6a6a6aU, 0xd5d5d5d5U,
   5.652 +    0x30303030U, 0x36363636U, 0xa5a5a5a5U, 0x38383838U,
   5.653 +    0xbfbfbfbfU, 0x40404040U, 0xa3a3a3a3U, 0x9e9e9e9eU,
   5.654 +    0x81818181U, 0xf3f3f3f3U, 0xd7d7d7d7U, 0xfbfbfbfbU,
   5.655 +    0x7c7c7c7cU, 0xe3e3e3e3U, 0x39393939U, 0x82828282U,
   5.656 +    0x9b9b9b9bU, 0x2f2f2f2fU, 0xffffffffU, 0x87878787U,
   5.657 +    0x34343434U, 0x8e8e8e8eU, 0x43434343U, 0x44444444U,
   5.658 +    0xc4c4c4c4U, 0xdedededeU, 0xe9e9e9e9U, 0xcbcbcbcbU,
   5.659 +    0x54545454U, 0x7b7b7b7bU, 0x94949494U, 0x32323232U,
   5.660 +    0xa6a6a6a6U, 0xc2c2c2c2U, 0x23232323U, 0x3d3d3d3dU,
   5.661 +    0xeeeeeeeeU, 0x4c4c4c4cU, 0x95959595U, 0x0b0b0b0bU,
   5.662 +    0x42424242U, 0xfafafafaU, 0xc3c3c3c3U, 0x4e4e4e4eU,
   5.663 +    0x08080808U, 0x2e2e2e2eU, 0xa1a1a1a1U, 0x66666666U,
   5.664 +    0x28282828U, 0xd9d9d9d9U, 0x24242424U, 0xb2b2b2b2U,
   5.665 +    0x76767676U, 0x5b5b5b5bU, 0xa2a2a2a2U, 0x49494949U,
   5.666 +    0x6d6d6d6dU, 0x8b8b8b8bU, 0xd1d1d1d1U, 0x25252525U,
   5.667 +    0x72727272U, 0xf8f8f8f8U, 0xf6f6f6f6U, 0x64646464U,
   5.668 +    0x86868686U, 0x68686868U, 0x98989898U, 0x16161616U,
   5.669 +    0xd4d4d4d4U, 0xa4a4a4a4U, 0x5c5c5c5cU, 0xccccccccU,
   5.670 +    0x5d5d5d5dU, 0x65656565U, 0xb6b6b6b6U, 0x92929292U,
   5.671 +    0x6c6c6c6cU, 0x70707070U, 0x48484848U, 0x50505050U,
   5.672 +    0xfdfdfdfdU, 0xededededU, 0xb9b9b9b9U, 0xdadadadaU,
   5.673 +    0x5e5e5e5eU, 0x15151515U, 0x46464646U, 0x57575757U,
   5.674 +    0xa7a7a7a7U, 0x8d8d8d8dU, 0x9d9d9d9dU, 0x84848484U,
   5.675 +    0x90909090U, 0xd8d8d8d8U, 0xababababU, 0x00000000U,
   5.676 +    0x8c8c8c8cU, 0xbcbcbcbcU, 0xd3d3d3d3U, 0x0a0a0a0aU,
   5.677 +    0xf7f7f7f7U, 0xe4e4e4e4U, 0x58585858U, 0x05050505U,
   5.678 +    0xb8b8b8b8U, 0xb3b3b3b3U, 0x45454545U, 0x06060606U,
   5.679 +    0xd0d0d0d0U, 0x2c2c2c2cU, 0x1e1e1e1eU, 0x8f8f8f8fU,
   5.680 +    0xcacacacaU, 0x3f3f3f3fU, 0x0f0f0f0fU, 0x02020202U,
   5.681 +    0xc1c1c1c1U, 0xafafafafU, 0xbdbdbdbdU, 0x03030303U,
   5.682 +    0x01010101U, 0x13131313U, 0x8a8a8a8aU, 0x6b6b6b6bU,
   5.683 +    0x3a3a3a3aU, 0x91919191U, 0x11111111U, 0x41414141U,
   5.684 +    0x4f4f4f4fU, 0x67676767U, 0xdcdcdcdcU, 0xeaeaeaeaU,
   5.685 +    0x97979797U, 0xf2f2f2f2U, 0xcfcfcfcfU, 0xcecececeU,
   5.686 +    0xf0f0f0f0U, 0xb4b4b4b4U, 0xe6e6e6e6U, 0x73737373U,
   5.687 +    0x96969696U, 0xacacacacU, 0x74747474U, 0x22222222U,
   5.688 +    0xe7e7e7e7U, 0xadadadadU, 0x35353535U, 0x85858585U,
   5.689 +    0xe2e2e2e2U, 0xf9f9f9f9U, 0x37373737U, 0xe8e8e8e8U,
   5.690 +    0x1c1c1c1cU, 0x75757575U, 0xdfdfdfdfU, 0x6e6e6e6eU,
   5.691 +    0x47474747U, 0xf1f1f1f1U, 0x1a1a1a1aU, 0x71717171U,
   5.692 +    0x1d1d1d1dU, 0x29292929U, 0xc5c5c5c5U, 0x89898989U,
   5.693 +    0x6f6f6f6fU, 0xb7b7b7b7U, 0x62626262U, 0x0e0e0e0eU,
   5.694 +    0xaaaaaaaaU, 0x18181818U, 0xbebebebeU, 0x1b1b1b1bU,
   5.695 +    0xfcfcfcfcU, 0x56565656U, 0x3e3e3e3eU, 0x4b4b4b4bU,
   5.696 +    0xc6c6c6c6U, 0xd2d2d2d2U, 0x79797979U, 0x20202020U,
   5.697 +    0x9a9a9a9aU, 0xdbdbdbdbU, 0xc0c0c0c0U, 0xfefefefeU,
   5.698 +    0x78787878U, 0xcdcdcdcdU, 0x5a5a5a5aU, 0xf4f4f4f4U,
   5.699 +    0x1f1f1f1fU, 0xddddddddU, 0xa8a8a8a8U, 0x33333333U,
   5.700 +    0x88888888U, 0x07070707U, 0xc7c7c7c7U, 0x31313131U,
   5.701 +    0xb1b1b1b1U, 0x12121212U, 0x10101010U, 0x59595959U,
   5.702 +    0x27272727U, 0x80808080U, 0xececececU, 0x5f5f5f5fU,
   5.703 +    0x60606060U, 0x51515151U, 0x7f7f7f7fU, 0xa9a9a9a9U,
   5.704 +    0x19191919U, 0xb5b5b5b5U, 0x4a4a4a4aU, 0x0d0d0d0dU,
   5.705 +    0x2d2d2d2dU, 0xe5e5e5e5U, 0x7a7a7a7aU, 0x9f9f9f9fU,
   5.706 +    0x93939393U, 0xc9c9c9c9U, 0x9c9c9c9cU, 0xefefefefU,
   5.707 +    0xa0a0a0a0U, 0xe0e0e0e0U, 0x3b3b3b3bU, 0x4d4d4d4dU,
   5.708 +    0xaeaeaeaeU, 0x2a2a2a2aU, 0xf5f5f5f5U, 0xb0b0b0b0U,
   5.709 +    0xc8c8c8c8U, 0xebebebebU, 0xbbbbbbbbU, 0x3c3c3c3cU,
   5.710 +    0x83838383U, 0x53535353U, 0x99999999U, 0x61616161U,
   5.711 +    0x17171717U, 0x2b2b2b2bU, 0x04040404U, 0x7e7e7e7eU,
   5.712 +    0xbabababaU, 0x77777777U, 0xd6d6d6d6U, 0x26262626U,
   5.713 +    0xe1e1e1e1U, 0x69696969U, 0x14141414U, 0x63636363U,
   5.714 +    0x55555555U, 0x21212121U, 0x0c0c0c0cU, 0x7d7d7d7dU,
   5.715 +};
   5.716 +static const u32 rcon[] = {
   5.717 +	0x01000000, 0x02000000, 0x04000000, 0x08000000,
   5.718 +	0x10000000, 0x20000000, 0x40000000, 0x80000000,
   5.719 +	0x1B000000, 0x36000000, /* for 128-bit blocks, Rijndael never uses more than 10 rcon values */
   5.720 +};
   5.721 +
   5.722 +#define GETU32(pt) (((u32)(pt)[0] << 24) ^ ((u32)(pt)[1] << 16) ^ ((u32)(pt)[2] <<  8) ^ ((u32)(pt)[3]))
   5.723 +#define PUTU32(ct, st) { (ct)[0] = (u8)((st) >> 24); (ct)[1] = (u8)((st) >> 16); (ct)[2] = (u8)((st) >>  8); (ct)[3] = (u8)(st); }
   5.724 +
   5.725 +/**
   5.726 + * Expand the cipher key into the encryption key schedule.
   5.727 + *
   5.728 + * @return	the number of rounds for the given cipher key size.
   5.729 + */
   5.730 +int
   5.731 +rijndaelKeySetupEnc(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits)
   5.732 +{
   5.733 +   	int i = 0;
   5.734 +	u32 temp;
   5.735 +
   5.736 +	rk[0] = GETU32(cipherKey     );
   5.737 +	rk[1] = GETU32(cipherKey +  4);
   5.738 +	rk[2] = GETU32(cipherKey +  8);
   5.739 +	rk[3] = GETU32(cipherKey + 12);
   5.740 +	if (keyBits == 128) {
   5.741 +		for (;;) {
   5.742 +			temp  = rk[3];
   5.743 +			rk[4] = rk[0] ^
   5.744 +				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
   5.745 +				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
   5.746 +				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
   5.747 +				(Te4[(temp >> 24)       ] & 0x000000ff) ^
   5.748 +				rcon[i];
   5.749 +			rk[5] = rk[1] ^ rk[4];
   5.750 +			rk[6] = rk[2] ^ rk[5];
   5.751 +			rk[7] = rk[3] ^ rk[6];
   5.752 +			if (++i == 10) {
   5.753 +				return 10;
   5.754 +			}
   5.755 +			rk += 4;
   5.756 +		}
   5.757 +	}
   5.758 +	rk[4] = GETU32(cipherKey + 16);
   5.759 +	rk[5] = GETU32(cipherKey + 20);
   5.760 +	if (keyBits == 192) {
   5.761 +		for (;;) {
   5.762 +			temp = rk[ 5];
   5.763 +			rk[ 6] = rk[ 0] ^
   5.764 +				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
   5.765 +				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
   5.766 +				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
   5.767 +				(Te4[(temp >> 24)       ] & 0x000000ff) ^
   5.768 +				rcon[i];
   5.769 +			rk[ 7] = rk[ 1] ^ rk[ 6];
   5.770 +			rk[ 8] = rk[ 2] ^ rk[ 7];
   5.771 +			rk[ 9] = rk[ 3] ^ rk[ 8];
   5.772 +			if (++i == 8) {
   5.773 +				return 12;
   5.774 +			}
   5.775 +			rk[10] = rk[ 4] ^ rk[ 9];
   5.776 +			rk[11] = rk[ 5] ^ rk[10];
   5.777 +			rk += 6;
   5.778 +		}
   5.779 +	}
   5.780 +	rk[6] = GETU32(cipherKey + 24);
   5.781 +	rk[7] = GETU32(cipherKey + 28);
   5.782 +	if (keyBits == 256) {
   5.783 +		for (;;) {
   5.784 +			temp = rk[ 7];
   5.785 +			rk[ 8] = rk[ 0] ^
   5.786 +				(Te4[(temp >> 16) & 0xff] & 0xff000000) ^
   5.787 +				(Te4[(temp >>  8) & 0xff] & 0x00ff0000) ^
   5.788 +				(Te4[(temp      ) & 0xff] & 0x0000ff00) ^
   5.789 +				(Te4[(temp >> 24)       ] & 0x000000ff) ^
   5.790 +				rcon[i];
   5.791 +			rk[ 9] = rk[ 1] ^ rk[ 8];
   5.792 +			rk[10] = rk[ 2] ^ rk[ 9];
   5.793 +			rk[11] = rk[ 3] ^ rk[10];
   5.794 +			if (++i == 7) {
   5.795 +				return 14;
   5.796 +			}
   5.797 +			temp = rk[11];
   5.798 +			rk[12] = rk[ 4] ^
   5.799 +				(Te4[(temp >> 24)       ] & 0xff000000) ^
   5.800 +				(Te4[(temp >> 16) & 0xff] & 0x00ff0000) ^
   5.801 +				(Te4[(temp >>  8) & 0xff] & 0x0000ff00) ^
   5.802 +				(Te4[(temp      ) & 0xff] & 0x000000ff);
   5.803 +			rk[13] = rk[ 5] ^ rk[12];
   5.804 +			rk[14] = rk[ 6] ^ rk[13];
   5.805 +		     	rk[15] = rk[ 7] ^ rk[14];
   5.806 +			rk += 8;
   5.807 +		}
   5.808 +	}
   5.809 +	return 0;
   5.810 +}
   5.811 +
   5.812 +/**
   5.813 + * Expand the cipher key into the decryption key schedule.
   5.814 + *
   5.815 + * @return	the number of rounds for the given cipher key size.
   5.816 + */
   5.817 +int
   5.818 +rijndaelKeySetupDec(u32 rk[/*4*(Nr + 1)*/], const u8 cipherKey[], int keyBits)
   5.819 +{
   5.820 +	int Nr, i, j;
   5.821 +	u32 temp;
   5.822 +
   5.823 +	/* expand the cipher key: */
   5.824 +	Nr = rijndaelKeySetupEnc(rk, cipherKey, keyBits);
   5.825 +
   5.826 +	/* invert the order of the round keys: */
   5.827 +	for (i = 0, j = 4*Nr; i < j; i += 4, j -= 4) {
   5.828 +		temp = rk[i    ]; rk[i    ] = rk[j    ]; rk[j    ] = temp;
   5.829 +		temp = rk[i + 1]; rk[i + 1] = rk[j + 1]; rk[j + 1] = temp;
   5.830 +		temp = rk[i + 2]; rk[i + 2] = rk[j + 2]; rk[j + 2] = temp;
   5.831 +		temp = rk[i + 3]; rk[i + 3] = rk[j + 3]; rk[j + 3] = temp;
   5.832 +	}
   5.833 +	/* apply the inverse MixColumn transform to all round keys but the first and the last: */
   5.834 +	for (i = 1; i < Nr; i++) {
   5.835 +		rk += 4;
   5.836 +		rk[0] =
   5.837 +			Td0[Te4[(rk[0] >> 24)       ] & 0xff] ^
   5.838 +			Td1[Te4[(rk[0] >> 16) & 0xff] & 0xff] ^
   5.839 +			Td2[Te4[(rk[0] >>  8) & 0xff] & 0xff] ^
   5.840 +			Td3[Te4[(rk[0]      ) & 0xff] & 0xff];
   5.841 +		rk[1] =
   5.842 +			Td0[Te4[(rk[1] >> 24)       ] & 0xff] ^
   5.843 +			Td1[Te4[(rk[1] >> 16) & 0xff] & 0xff] ^
   5.844 +			Td2[Te4[(rk[1] >>  8) & 0xff] & 0xff] ^
   5.845 +			Td3[Te4[(rk[1]      ) & 0xff] & 0xff];
   5.846 +		rk[2] =
   5.847 +			Td0[Te4[(rk[2] >> 24)       ] & 0xff] ^
   5.848 +			Td1[Te4[(rk[2] >> 16) & 0xff] & 0xff] ^
   5.849 +			Td2[Te4[(rk[2] >>  8) & 0xff] & 0xff] ^
   5.850 +			Td3[Te4[(rk[2]      ) & 0xff] & 0xff];
   5.851 +		rk[3] =
   5.852 +			Td0[Te4[(rk[3] >> 24)       ] & 0xff] ^
   5.853 +			Td1[Te4[(rk[3] >> 16) & 0xff] & 0xff] ^
   5.854 +			Td2[Te4[(rk[3] >>  8) & 0xff] & 0xff] ^
   5.855 +			Td3[Te4[(rk[3]      ) & 0xff] & 0xff];
   5.856 +	}
   5.857 +	return Nr;
   5.858 +}
   5.859 +
   5.860 +void
   5.861 +rijndaelEncrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 pt[16],
   5.862 +    u8 ct[16])
   5.863 +{
   5.864 +	u32 s0, s1, s2, s3, t0, t1, t2, t3;
   5.865 +#ifndef FULL_UNROLL
   5.866 +    int r;
   5.867 +#endif /* ?FULL_UNROLL */
   5.868 +
   5.869 +    /*
   5.870 +	 * map byte array block to cipher state
   5.871 +	 * and add initial round key:
   5.872 +	 */
   5.873 +	s0 = GETU32(pt     ) ^ rk[0];
   5.874 +	s1 = GETU32(pt +  4) ^ rk[1];
   5.875 +	s2 = GETU32(pt +  8) ^ rk[2];
   5.876 +	s3 = GETU32(pt + 12) ^ rk[3];
   5.877 +#ifdef FULL_UNROLL
   5.878 +    /* round 1: */
   5.879 +   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[ 4];
   5.880 +   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[ 5];
   5.881 +   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[ 6];
   5.882 +   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[ 7];
   5.883 +   	/* round 2: */
   5.884 +   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[ 8];
   5.885 +   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[ 9];
   5.886 +   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[10];
   5.887 +   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[11];
   5.888 +    /* round 3: */
   5.889 +   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[12];
   5.890 +   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[13];
   5.891 +   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[14];
   5.892 +   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[15];
   5.893 +   	/* round 4: */
   5.894 +   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[16];
   5.895 +   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[17];
   5.896 +   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[18];
   5.897 +   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[19];
   5.898 +    /* round 5: */
   5.899 +   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[20];
   5.900 +   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[21];
   5.901 +   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[22];
   5.902 +   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[23];
   5.903 +   	/* round 6: */
   5.904 +   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[24];
   5.905 +   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[25];
   5.906 +   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[26];
   5.907 +   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[27];
   5.908 +    /* round 7: */
   5.909 +   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[28];
   5.910 +   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[29];
   5.911 +   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[30];
   5.912 +   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[31];
   5.913 +   	/* round 8: */
   5.914 +   	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[32];
   5.915 +   	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[33];
   5.916 +   	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[34];
   5.917 +   	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[35];
   5.918 +    /* round 9: */
   5.919 +   	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[36];
   5.920 +   	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[37];
   5.921 +   	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[38];
   5.922 +   	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[39];
   5.923 +    if (Nr > 10) {
   5.924 +	/* round 10: */
   5.925 +	s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[40];
   5.926 +	s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[41];
   5.927 +	s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[42];
   5.928 +	s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[43];
   5.929 +	/* round 11: */
   5.930 +	t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[44];
   5.931 +	t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[45];
   5.932 +	t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[46];
   5.933 +	t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[47];
   5.934 +	if (Nr > 12) {
   5.935 +	    /* round 12: */
   5.936 +	    s0 = Te0[t0 >> 24] ^ Te1[(t1 >> 16) & 0xff] ^ Te2[(t2 >>  8) & 0xff] ^ Te3[t3 & 0xff] ^ rk[48];
   5.937 +	    s1 = Te0[t1 >> 24] ^ Te1[(t2 >> 16) & 0xff] ^ Te2[(t3 >>  8) & 0xff] ^ Te3[t0 & 0xff] ^ rk[49];
   5.938 +	    s2 = Te0[t2 >> 24] ^ Te1[(t3 >> 16) & 0xff] ^ Te2[(t0 >>  8) & 0xff] ^ Te3[t1 & 0xff] ^ rk[50];
   5.939 +	    s3 = Te0[t3 >> 24] ^ Te1[(t0 >> 16) & 0xff] ^ Te2[(t1 >>  8) & 0xff] ^ Te3[t2 & 0xff] ^ rk[51];
   5.940 +	    /* round 13: */
   5.941 +	    t0 = Te0[s0 >> 24] ^ Te1[(s1 >> 16) & 0xff] ^ Te2[(s2 >>  8) & 0xff] ^ Te3[s3 & 0xff] ^ rk[52];
   5.942 +	    t1 = Te0[s1 >> 24] ^ Te1[(s2 >> 16) & 0xff] ^ Te2[(s3 >>  8) & 0xff] ^ Te3[s0 & 0xff] ^ rk[53];
   5.943 +	    t2 = Te0[s2 >> 24] ^ Te1[(s3 >> 16) & 0xff] ^ Te2[(s0 >>  8) & 0xff] ^ Te3[s1 & 0xff] ^ rk[54];
   5.944 +	    t3 = Te0[s3 >> 24] ^ Te1[(s0 >> 16) & 0xff] ^ Te2[(s1 >>  8) & 0xff] ^ Te3[s2 & 0xff] ^ rk[55];
   5.945 +	}
   5.946 +    }
   5.947 +    rk += Nr << 2;
   5.948 +#else  /* !FULL_UNROLL */
   5.949 +    /*
   5.950 +	 * Nr - 1 full rounds:
   5.951 +	 */
   5.952 +    r = Nr >> 1;
   5.953 +    for (;;) {
   5.954 +	t0 =
   5.955 +	    Te0[(s0 >> 24)       ] ^
   5.956 +	    Te1[(s1 >> 16) & 0xff] ^
   5.957 +	    Te2[(s2 >>  8) & 0xff] ^
   5.958 +	    Te3[(s3      ) & 0xff] ^
   5.959 +	    rk[4];
   5.960 +	t1 =
   5.961 +	    Te0[(s1 >> 24)       ] ^
   5.962 +	    Te1[(s2 >> 16) & 0xff] ^
   5.963 +	    Te2[(s3 >>  8) & 0xff] ^
   5.964 +	    Te3[(s0      ) & 0xff] ^
   5.965 +	    rk[5];
   5.966 +	t2 =
   5.967 +	    Te0[(s2 >> 24)       ] ^
   5.968 +	    Te1[(s3 >> 16) & 0xff] ^
   5.969 +	    Te2[(s0 >>  8) & 0xff] ^
   5.970 +	    Te3[(s1      ) & 0xff] ^
   5.971 +	    rk[6];
   5.972 +	t3 =
   5.973 +	    Te0[(s3 >> 24)       ] ^
   5.974 +	    Te1[(s0 >> 16) & 0xff] ^
   5.975 +	    Te2[(s1 >>  8) & 0xff] ^
   5.976 +	    Te3[(s2      ) & 0xff] ^
   5.977 +	    rk[7];
   5.978 +
   5.979 +	rk += 8;
   5.980 +	if (--r == 0) {
   5.981 +	    break;
   5.982 +	}
   5.983 +
   5.984 +	s0 =
   5.985 +	    Te0[(t0 >> 24)       ] ^
   5.986 +	    Te1[(t1 >> 16) & 0xff] ^
   5.987 +	    Te2[(t2 >>  8) & 0xff] ^
   5.988 +	    Te3[(t3      ) & 0xff] ^
   5.989 +	    rk[0];
   5.990 +	s1 =
   5.991 +	    Te0[(t1 >> 24)       ] ^
   5.992 +	    Te1[(t2 >> 16) & 0xff] ^
   5.993 +	    Te2[(t3 >>  8) & 0xff] ^
   5.994 +	    Te3[(t0      ) & 0xff] ^
   5.995 +	    rk[1];
   5.996 +	s2 =
   5.997 +	    Te0[(t2 >> 24)       ] ^
   5.998 +	    Te1[(t3 >> 16) & 0xff] ^
   5.999 +	    Te2[(t0 >>  8) & 0xff] ^
  5.1000 +	    Te3[(t1      ) & 0xff] ^
  5.1001 +	    rk[2];
  5.1002 +	s3 =
  5.1003 +	    Te0[(t3 >> 24)       ] ^
  5.1004 +	    Te1[(t0 >> 16) & 0xff] ^
  5.1005 +	    Te2[(t1 >>  8) & 0xff] ^
  5.1006 +	    Te3[(t2      ) & 0xff] ^
  5.1007 +	    rk[3];
  5.1008 +    }
  5.1009 +#endif /* ?FULL_UNROLL */
  5.1010 +    /*
  5.1011 +	 * apply last round and
  5.1012 +	 * map cipher state to byte array block:
  5.1013 +	 */
  5.1014 +	s0 =
  5.1015 +		(Te4[(t0 >> 24)       ] & 0xff000000) ^
  5.1016 +		(Te4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
  5.1017 +		(Te4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
  5.1018 +		(Te4[(t3      ) & 0xff] & 0x000000ff) ^
  5.1019 +		rk[0];
  5.1020 +	PUTU32(ct     , s0);
  5.1021 +	s1 =
  5.1022 +		(Te4[(t1 >> 24)       ] & 0xff000000) ^
  5.1023 +		(Te4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
  5.1024 +		(Te4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
  5.1025 +		(Te4[(t0      ) & 0xff] & 0x000000ff) ^
  5.1026 +		rk[1];
  5.1027 +	PUTU32(ct +  4, s1);
  5.1028 +	s2 =
  5.1029 +		(Te4[(t2 >> 24)       ] & 0xff000000) ^
  5.1030 +		(Te4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
  5.1031 +		(Te4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
  5.1032 +		(Te4[(t1      ) & 0xff] & 0x000000ff) ^
  5.1033 +		rk[2];
  5.1034 +	PUTU32(ct +  8, s2);
  5.1035 +	s3 =
  5.1036 +		(Te4[(t3 >> 24)       ] & 0xff000000) ^
  5.1037 +		(Te4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
  5.1038 +		(Te4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
  5.1039 +		(Te4[(t2      ) & 0xff] & 0x000000ff) ^
  5.1040 +		rk[3];
  5.1041 +	PUTU32(ct + 12, s3);
  5.1042 +}
  5.1043 +
  5.1044 +static void
  5.1045 +rijndaelDecrypt(const u32 rk[/*4*(Nr + 1)*/], int Nr, const u8 ct[16],
  5.1046 +    u8 pt[16])
  5.1047 +{
  5.1048 +	u32 s0, s1, s2, s3, t0, t1, t2, t3;
  5.1049 +#ifndef FULL_UNROLL
  5.1050 +    int r;
  5.1051 +#endif /* ?FULL_UNROLL */
  5.1052 +
  5.1053 +    /*
  5.1054 +	 * map byte array block to cipher state
  5.1055 +	 * and add initial round key:
  5.1056 +	 */
  5.1057 +    s0 = GETU32(ct     ) ^ rk[0];
  5.1058 +    s1 = GETU32(ct +  4) ^ rk[1];
  5.1059 +    s2 = GETU32(ct +  8) ^ rk[2];
  5.1060 +    s3 = GETU32(ct + 12) ^ rk[3];
  5.1061 +#ifdef FULL_UNROLL
  5.1062 +    /* round 1: */
  5.1063 +    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[ 4];
  5.1064 +    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[ 5];
  5.1065 +    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[ 6];
  5.1066 +    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[ 7];
  5.1067 +    /* round 2: */
  5.1068 +    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[ 8];
  5.1069 +    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[ 9];
  5.1070 +    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[10];
  5.1071 +    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[11];
  5.1072 +    /* round 3: */
  5.1073 +    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[12];
  5.1074 +    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[13];
  5.1075 +    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[14];
  5.1076 +    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[15];
  5.1077 +    /* round 4: */
  5.1078 +    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[16];
  5.1079 +    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[17];
  5.1080 +    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[18];
  5.1081 +    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[19];
  5.1082 +    /* round 5: */
  5.1083 +    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[20];
  5.1084 +    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[21];
  5.1085 +    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[22];
  5.1086 +    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[23];
  5.1087 +    /* round 6: */
  5.1088 +    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[24];
  5.1089 +    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[25];
  5.1090 +    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[26];
  5.1091 +    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[27];
  5.1092 +    /* round 7: */
  5.1093 +    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[28];
  5.1094 +    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[29];
  5.1095 +    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[30];
  5.1096 +    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[31];
  5.1097 +    /* round 8: */
  5.1098 +    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[32];
  5.1099 +    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[33];
  5.1100 +    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[34];
  5.1101 +    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[35];
  5.1102 +    /* round 9: */
  5.1103 +    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[36];
  5.1104 +    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[37];
  5.1105 +    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[38];
  5.1106 +    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[39];
  5.1107 +    if (Nr > 10) {
  5.1108 +	/* round 10: */
  5.1109 +	s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[40];
  5.1110 +	s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[41];
  5.1111 +	s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[42];
  5.1112 +	s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[43];
  5.1113 +	/* round 11: */
  5.1114 +	t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[44];
  5.1115 +	t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[45];
  5.1116 +	t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[46];
  5.1117 +	t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[47];
  5.1118 +	if (Nr > 12) {
  5.1119 +	    /* round 12: */
  5.1120 +	    s0 = Td0[t0 >> 24] ^ Td1[(t3 >> 16) & 0xff] ^ Td2[(t2 >>  8) & 0xff] ^ Td3[t1 & 0xff] ^ rk[48];
  5.1121 +	    s1 = Td0[t1 >> 24] ^ Td1[(t0 >> 16) & 0xff] ^ Td2[(t3 >>  8) & 0xff] ^ Td3[t2 & 0xff] ^ rk[49];
  5.1122 +	    s2 = Td0[t2 >> 24] ^ Td1[(t1 >> 16) & 0xff] ^ Td2[(t0 >>  8) & 0xff] ^ Td3[t3 & 0xff] ^ rk[50];
  5.1123 +	    s3 = Td0[t3 >> 24] ^ Td1[(t2 >> 16) & 0xff] ^ Td2[(t1 >>  8) & 0xff] ^ Td3[t0 & 0xff] ^ rk[51];
  5.1124 +	    /* round 13: */
  5.1125 +	    t0 = Td0[s0 >> 24] ^ Td1[(s3 >> 16) & 0xff] ^ Td2[(s2 >>  8) & 0xff] ^ Td3[s1 & 0xff] ^ rk[52];
  5.1126 +	    t1 = Td0[s1 >> 24] ^ Td1[(s0 >> 16) & 0xff] ^ Td2[(s3 >>  8) & 0xff] ^ Td3[s2 & 0xff] ^ rk[53];
  5.1127 +	    t2 = Td0[s2 >> 24] ^ Td1[(s1 >> 16) & 0xff] ^ Td2[(s0 >>  8) & 0xff] ^ Td3[s3 & 0xff] ^ rk[54];
  5.1128 +	    t3 = Td0[s3 >> 24] ^ Td1[(s2 >> 16) & 0xff] ^ Td2[(s1 >>  8) & 0xff] ^ Td3[s0 & 0xff] ^ rk[55];
  5.1129 +	}
  5.1130 +    }
  5.1131 +	rk += Nr << 2;
  5.1132 +#else  /* !FULL_UNROLL */
  5.1133 +    /*
  5.1134 +     * Nr - 1 full rounds:
  5.1135 +     */
  5.1136 +    r = Nr >> 1;
  5.1137 +    for (;;) {
  5.1138 +	t0 =
  5.1139 +	    Td0[(s0 >> 24)       ] ^
  5.1140 +	    Td1[(s3 >> 16) & 0xff] ^
  5.1141 +	    Td2[(s2 >>  8) & 0xff] ^
  5.1142 +	    Td3[(s1      ) & 0xff] ^
  5.1143 +	    rk[4];
  5.1144 +	t1 =
  5.1145 +	    Td0[(s1 >> 24)       ] ^
  5.1146 +	    Td1[(s0 >> 16) & 0xff] ^
  5.1147 +	    Td2[(s3 >>  8) & 0xff] ^
  5.1148 +	    Td3[(s2      ) & 0xff] ^
  5.1149 +	    rk[5];
  5.1150 +	t2 =
  5.1151 +	    Td0[(s2 >> 24)       ] ^
  5.1152 +	    Td1[(s1 >> 16) & 0xff] ^
  5.1153 +	    Td2[(s0 >>  8) & 0xff] ^
  5.1154 +	    Td3[(s3      ) & 0xff] ^
  5.1155 +	    rk[6];
  5.1156 +	t3 =
  5.1157 +	    Td0[(s3 >> 24)       ] ^
  5.1158 +	    Td1[(s2 >> 16) & 0xff] ^
  5.1159 +	    Td2[(s1 >>  8) & 0xff] ^
  5.1160 +	    Td3[(s0      ) & 0xff] ^
  5.1161 +	    rk[7];
  5.1162 +
  5.1163 +	rk += 8;
  5.1164 +	if (--r == 0) {
  5.1165 +	    break;
  5.1166 +	}
  5.1167 +
  5.1168 +	s0 =
  5.1169 +	    Td0[(t0 >> 24)       ] ^
  5.1170 +	    Td1[(t3 >> 16) & 0xff] ^
  5.1171 +	    Td2[(t2 >>  8) & 0xff] ^
  5.1172 +	    Td3[(t1      ) & 0xff] ^
  5.1173 +	    rk[0];
  5.1174 +	s1 =
  5.1175 +	    Td0[(t1 >> 24)       ] ^
  5.1176 +	    Td1[(t0 >> 16) & 0xff] ^
  5.1177 +	    Td2[(t3 >>  8) & 0xff] ^
  5.1178 +	    Td3[(t2      ) & 0xff] ^
  5.1179 +	    rk[1];
  5.1180 +	s2 =
  5.1181 +	    Td0[(t2 >> 24)       ] ^
  5.1182 +	    Td1[(t1 >> 16) & 0xff] ^
  5.1183 +	    Td2[(t0 >>  8) & 0xff] ^
  5.1184 +	    Td3[(t3      ) & 0xff] ^
  5.1185 +	    rk[2];
  5.1186 +	s3 =
  5.1187 +	    Td0[(t3 >> 24)       ] ^
  5.1188 +	    Td1[(t2 >> 16) & 0xff] ^
  5.1189 +	    Td2[(t1 >>  8) & 0xff] ^
  5.1190 +	    Td3[(t0      ) & 0xff] ^
  5.1191 +	    rk[3];
  5.1192 +    }
  5.1193 +#endif /* ?FULL_UNROLL */
  5.1194 +    /*
  5.1195 +	 * apply last round and
  5.1196 +	 * map cipher state to byte array block:
  5.1197 +	 */
  5.1198 +   	s0 =
  5.1199 +   		(Td4[(t0 >> 24)       ] & 0xff000000) ^
  5.1200 +   		(Td4[(t3 >> 16) & 0xff] & 0x00ff0000) ^
  5.1201 +   		(Td4[(t2 >>  8) & 0xff] & 0x0000ff00) ^
  5.1202 +   		(Td4[(t1      ) & 0xff] & 0x000000ff) ^
  5.1203 +   		rk[0];
  5.1204 +	PUTU32(pt     , s0);
  5.1205 +   	s1 =
  5.1206 +   		(Td4[(t1 >> 24)       ] & 0xff000000) ^
  5.1207 +   		(Td4[(t0 >> 16) & 0xff] & 0x00ff0000) ^
  5.1208 +   		(Td4[(t3 >>  8) & 0xff] & 0x0000ff00) ^
  5.1209 +   		(Td4[(t2      ) & 0xff] & 0x000000ff) ^
  5.1210 +   		rk[1];
  5.1211 +	PUTU32(pt +  4, s1);
  5.1212 +   	s2 =
  5.1213 +   		(Td4[(t2 >> 24)       ] & 0xff000000) ^
  5.1214 +   		(Td4[(t1 >> 16) & 0xff] & 0x00ff0000) ^
  5.1215 +   		(Td4[(t0 >>  8) & 0xff] & 0x0000ff00) ^
  5.1216 +   		(Td4[(t3      ) & 0xff] & 0x000000ff) ^
  5.1217 +   		rk[2];
  5.1218 +	PUTU32(pt +  8, s2);
  5.1219 +   	s3 =
  5.1220 +   		(Td4[(t3 >> 24)       ] & 0xff000000) ^
  5.1221 +   		(Td4[(t2 >> 16) & 0xff] & 0x00ff0000) ^
  5.1222 +   		(Td4[(t1 >>  8) & 0xff] & 0x0000ff00) ^
  5.1223 +   		(Td4[(t0      ) & 0xff] & 0x000000ff) ^
  5.1224 +   		rk[3];
  5.1225 +	PUTU32(pt + 12, s3);
  5.1226 +}
  5.1227 +
  5.1228 +/* setup key context for encryption only */
  5.1229 +int
  5.1230 +rijndael_set_key_enc_only(rijndael_ctx *ctx, const u_char *key, int bits)
  5.1231 +{
  5.1232 +	int rounds;
  5.1233 +
  5.1234 +	rounds = rijndaelKeySetupEnc(ctx->ek, key, bits);
  5.1235 +	if (rounds == 0)
  5.1236 +		return -1;
  5.1237 +
  5.1238 +	ctx->Nr = rounds;
  5.1239 +	ctx->enc_only = 1;
  5.1240 +
  5.1241 +	return 0;
  5.1242 +}
  5.1243 +
  5.1244 +/* setup key context for both encryption and decryption */
  5.1245 +int
  5.1246 +rijndael_set_key(rijndael_ctx *ctx, const u_char *key, int bits)
  5.1247 +{
  5.1248 +	int rounds;
  5.1249 +
  5.1250 +	rounds = rijndaelKeySetupEnc(ctx->ek, key, bits);
  5.1251 +	if (rounds == 0)
  5.1252 +		return -1;
  5.1253 +	if (rijndaelKeySetupDec(ctx->dk, key, bits) != rounds)
  5.1254 +		return -1;
  5.1255 +
  5.1256 +	ctx->Nr = rounds;
  5.1257 +	ctx->enc_only = 0;
  5.1258 +
  5.1259 +	return 0;
  5.1260 +}
  5.1261 +
  5.1262 +void
  5.1263 +rijndael_decrypt(rijndael_ctx *ctx, const u_char *src, u_char *dst)
  5.1264 +{
  5.1265 +	rijndaelDecrypt(ctx->dk, ctx->Nr, src, dst);
  5.1266 +}
  5.1267 +
  5.1268 +void
  5.1269 +rijndael_encrypt(rijndael_ctx *ctx, const u_char *src, u_char *dst)
  5.1270 +{
  5.1271 +	rijndaelEncrypt(ctx->ek, ctx->Nr, src, dst);
  5.1272 +}
     6.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     6.2 +++ b/xen/crypto/vmac.c	Tue Mar 03 12:48:16 2009 +0000
     6.3 @@ -0,0 +1,1220 @@
     6.4 +/* --------------------------------------------------------------------------
     6.5 + * VMAC and VHASH Implementation by Ted Krovetz (tdk@acm.org) and Wei Dai.
     6.6 + * This implementation is herby placed in the public domain.
     6.7 + * The authors offers no warranty. Use at your own risk.
     6.8 + * Please send bug reports to the authors.
     6.9 + * Last modified: 17 APR 08, 1700 PDT
    6.10 + * ----------------------------------------------------------------------- */
    6.11 +
    6.12 +/* start for Xen */
    6.13 +#include <xen/config.h>
    6.14 +#include <xen/init.h>
    6.15 +#include <xen/types.h>
    6.16 +#include <xen/lib.h>
    6.17 +#include <crypto/vmac.h>
    6.18 +#define UINT64_C(x)  x##ULL
    6.19 +/* end for Xen */
    6.20 +
    6.21 +/* Enable code tuned for 64-bit registers; otherwise tuned for 32-bit */
    6.22 +#ifndef VMAC_ARCH_64
    6.23 +#define VMAC_ARCH_64 (__x86_64__ || __ppc64__ || _M_X64)
    6.24 +#endif
    6.25 +
    6.26 +/* Enable code tuned for Intel SSE2 instruction set                   */
    6.27 +#if ((__SSE2__ || (_M_IX86_FP >= 2)) && ( ! VMAC_ARCH_64))
    6.28 +#define VMAC_USE_SSE2    1
    6.29 +#include <emmintrin.h>
    6.30 +#endif
    6.31 +
    6.32 +/* Native word reads. Update (or define via compiler) if incorrect */
    6.33 +#ifndef VMAC_ARCH_BIG_ENDIAN       /* Assume big-endian unless on the list */
    6.34 +#define VMAC_ARCH_BIG_ENDIAN \
    6.35 +    (!(__x86_64__ || __i386__ || _M_IX86 || \
    6.36 +       _M_X64 || __ARMEL__ || __MIPSEL__))
    6.37 +#endif
    6.38 +
    6.39 +/* ----------------------------------------------------------------------- */
    6.40 +/* Constants and masks                                                     */
    6.41 +
    6.42 +const uint64_t p64   = UINT64_C(0xfffffffffffffeff);  /* 2^64 - 257 prime  */
    6.43 +const uint64_t m62   = UINT64_C(0x3fffffffffffffff);  /* 62-bit mask       */
    6.44 +const uint64_t m63   = UINT64_C(0x7fffffffffffffff);  /* 63-bit mask       */
    6.45 +const uint64_t m64   = UINT64_C(0xffffffffffffffff);  /* 64-bit mask       */
    6.46 +const uint64_t mpoly = UINT64_C(0x1fffffff1fffffff);  /* Poly key mask     */
    6.47 +
    6.48 +/* ----------------------------------------------------------------------- *
    6.49 + * The following routines are used in this implementation. They are
    6.50 + * written via macros to simulate zero-overhead call-by-reference.
    6.51 + * All have default implemantations for when they are not defined in an
    6.52 + * architecture-specific manner.
    6.53 + *
    6.54 + * MUL64: 64x64->128-bit multiplication
    6.55 + * PMUL64: assumes top bits cleared on inputs
    6.56 + * ADD128: 128x128->128-bit addition
    6.57 + * GET_REVERSED_64: load and byte-reverse 64-bit word  
    6.58 + * ----------------------------------------------------------------------- */
    6.59 +
    6.60 +/* ----------------------------------------------------------------------- */
    6.61 +#if (__GNUC__ && (__x86_64__ || __amd64__))
    6.62 +/* ----------------------------------------------------------------------- */
    6.63 +
    6.64 +#define ADD128(rh,rl,ih,il)                                               \
    6.65 +    asm ("addq %3, %1 \n\t"                                               \
    6.66 +         "adcq %2, %0"                                                    \
    6.67 +    : "+r"(rh),"+r"(rl)                                                   \
    6.68 +    : "r"(ih),"r"(il) : "cc");
    6.69 +
    6.70 +#define MUL64(rh,rl,i1,i2)                                                \
    6.71 +    asm ("mulq %3" : "=a"(rl), "=d"(rh) : "a"(i1), "r"(i2) : "cc")
    6.72 +
    6.73 +#define PMUL64 MUL64
    6.74 +
    6.75 +#define GET_REVERSED_64(p)                                                \
    6.76 +    ({uint64_t x;                                                         \
    6.77 +     asm ("bswapq %0" : "=r" (x) : "0"(*(uint64_t *)(p))); x;})
    6.78 +
    6.79 +/* ----------------------------------------------------------------------- */
    6.80 +#elif (__GNUC__ && __i386__)
    6.81 +/* ----------------------------------------------------------------------- */
    6.82 +
    6.83 +#define GET_REVERSED_64(p)                                                \
    6.84 +    ({ uint64_t x;                                                        \
    6.85 +    uint32_t *tp = (uint32_t *)(p);                                       \
    6.86 +    asm  ("bswap %%edx\n\t"                                               \
    6.87 +          "bswap %%eax"                                                   \
    6.88 +    : "=A"(x)                                                             \
    6.89 +    : "a"(tp[1]), "d"(tp[0]));                                            \
    6.90 +    x; })
    6.91 +
    6.92 +/* ----------------------------------------------------------------------- */
    6.93 +#elif (__GNUC__ && __ppc64__)
    6.94 +/* ----------------------------------------------------------------------- */
    6.95 +
    6.96 +#define ADD128(rh,rl,ih,il)                                               \
    6.97 +    asm volatile (  "addc %1, %1, %3 \n\t"                                \
    6.98 +                    "adde %0, %0, %2"                                     \
    6.99 +    : "+r"(rh),"+r"(rl)                                                   \
   6.100 +    : "r"(ih),"r"(il));
   6.101 +
   6.102 +#define MUL64(rh,rl,i1,i2)                                                \
   6.103 +{ uint64_t _i1 = (i1), _i2 = (i2);                                        \
   6.104 +    rl = _i1 * _i2;                                                       \
   6.105 +    asm volatile ("mulhdu %0, %1, %2" : "=r" (rh) : "r" (_i1), "r" (_i2));\
   6.106 +}
   6.107 +
   6.108 +#define PMUL64 MUL64
   6.109 +
   6.110 +#define GET_REVERSED_64(p)                                                \
   6.111 +    ({ uint32_t hi, lo, *_p = (uint32_t *)(p);                            \
   6.112 +       asm volatile ("lwbrx %0, %1, %2" : "=r"(lo) : "b%"(0), "r"(_p) );  \
   6.113 +       asm volatile ("lwbrx %0, %1, %2" : "=r"(hi) : "b%"(4), "r"(_p) );  \
   6.114 +       ((uint64_t)hi << 32) | (uint64_t)lo; } )
   6.115 +
   6.116 +/* ----------------------------------------------------------------------- */
   6.117 +#elif (__GNUC__ && (__ppc__ || __PPC__))
   6.118 +/* ----------------------------------------------------------------------- */
   6.119 +
   6.120 +#define GET_REVERSED_64(p)                                                \
   6.121 +    ({ uint32_t hi, lo, *_p = (uint32_t *)(p);                            \
   6.122 +       asm volatile ("lwbrx %0, %1, %2" : "=r"(lo) : "b%"(0), "r"(_p) );  \
   6.123 +       asm volatile ("lwbrx %0, %1, %2" : "=r"(hi) : "b%"(4), "r"(_p) );  \
   6.124 +       ((uint64_t)hi << 32) | (uint64_t)lo; } )
   6.125 +
   6.126 +/* ----------------------------------------------------------------------- */
   6.127 +#elif (__GNUC__ && (__ARMEL__ || __ARM__))
   6.128 +/* ----------------------------------------------------------------------- */
   6.129 +
   6.130 +#define bswap32(v)                                                        \
   6.131 +({ uint32_t tmp,out;                                                      \
   6.132 +    asm volatile(                                                         \
   6.133 +        "eor    %1, %2, %2, ror #16\n"                                    \
   6.134 +        "bic    %1, %1, #0x00ff0000\n"                                    \
   6.135 +        "mov    %0, %2, ror #8\n"                                         \
   6.136 +        "eor    %0, %0, %1, lsr #8"                                       \
   6.137 +    : "=r" (out), "=&r" (tmp)                                             \
   6.138 +    : "r" (v));                                                           \
   6.139 +    out;})
   6.140 +
   6.141 +/* ----------------------------------------------------------------------- */
   6.142 +#elif _MSC_VER
   6.143 +/* ----------------------------------------------------------------------- */
   6.144 +
   6.145 +#include <intrin.h>
   6.146 +
   6.147 +#if (_M_IA64 || _M_X64) && \
   6.148 +    (!defined(__INTEL_COMPILER) || __INTEL_COMPILER >= 1000)
   6.149 +#define MUL64(rh,rl,i1,i2)   (rl) = _umul128(i1,i2,&(rh));
   6.150 +#pragma intrinsic(_umul128)
   6.151 +#define PMUL64 MUL64
   6.152 +#endif
   6.153 +
   6.154 +/* MSVC uses add, adc in this version */
   6.155 +#define ADD128(rh,rl,ih,il)                                          \
   6.156 +    {   uint64_t _il = (il);                                         \
   6.157 +        (rl) += (_il);                                               \
   6.158 +        (rh) += (ih) + ((rl) < (_il));                               \
   6.159 +    }
   6.160 +
   6.161 +#if _MSC_VER >= 1300
   6.162 +#define GET_REVERSED_64(p) _byteswap_uint64(*(uint64_t *)(p))
   6.163 +#pragma intrinsic(_byteswap_uint64)
   6.164 +#endif
   6.165 +
   6.166 +#if _MSC_VER >= 1400 && \
   6.167 +    (!defined(__INTEL_COMPILER) || __INTEL_COMPILER >= 1000)
   6.168 +#define MUL32(i1,i2)    (__emulu((uint32_t)(i1),(uint32_t)(i2)))
   6.169 +#pragma intrinsic(__emulu)
   6.170 +#endif
   6.171 +
   6.172 +/* ----------------------------------------------------------------------- */
   6.173 +#endif
   6.174 +/* ----------------------------------------------------------------------- */
   6.175 +
   6.176 +#if __GNUC__
   6.177 +#define ALIGN(n)      __attribute__ ((aligned(n))) 
   6.178 +#define NOINLINE      __attribute__ ((noinline))
   6.179 +#define FASTCALL
   6.180 +#elif _MSC_VER
   6.181 +#define ALIGN(n)      __declspec(align(n))
   6.182 +#define NOINLINE      __declspec(noinline)
   6.183 +#define FASTCALL      __fastcall
   6.184 +#else
   6.185 +#define ALIGN(n)
   6.186 +#define NOINLINE
   6.187 +#define FASTCALL
   6.188 +#endif
   6.189 +
   6.190 +/* ----------------------------------------------------------------------- */
   6.191 +/* Default implementations, if not defined above                           */
   6.192 +/* ----------------------------------------------------------------------- */
   6.193 +
   6.194 +#ifndef ADD128
   6.195 +#define ADD128(rh,rl,ih,il)                                              \
   6.196 +    {   uint64_t _il = (il);                                             \
   6.197 +        (rl) += (_il);                                                   \
   6.198 +        if ((rl) < (_il)) (rh)++;                                        \
   6.199 +        (rh) += (ih);                                                    \
   6.200 +    }
   6.201 +#endif
   6.202 +
   6.203 +#ifndef MUL32
   6.204 +#define MUL32(i1,i2)    ((uint64_t)(uint32_t)(i1)*(uint32_t)(i2))
   6.205 +#endif
   6.206 +
   6.207 +#ifndef PMUL64              /* rh may not be same as i1 or i2 */
   6.208 +#define PMUL64(rh,rl,i1,i2) /* Assumes m doesn't overflow     */         \
   6.209 +    {   uint64_t _i1 = (i1), _i2 = (i2);                                 \
   6.210 +        uint64_t m = MUL32(_i1,_i2>>32) + MUL32(_i1>>32,_i2);            \
   6.211 +        rh         = MUL32(_i1>>32,_i2>>32);                             \
   6.212 +        rl         = MUL32(_i1,_i2);                                     \
   6.213 +        ADD128(rh,rl,(m >> 32),(m << 32));                               \
   6.214 +    }
   6.215 +#endif
   6.216 +
   6.217 +#ifndef MUL64
   6.218 +#define MUL64(rh,rl,i1,i2)                                               \
   6.219 +    {   uint64_t _i1 = (i1), _i2 = (i2);                                 \
   6.220 +        uint64_t m1= MUL32(_i1,_i2>>32);                                 \
   6.221 +        uint64_t m2= MUL32(_i1>>32,_i2);                                 \
   6.222 +        rh         = MUL32(_i1>>32,_i2>>32);                             \
   6.223 +        rl         = MUL32(_i1,_i2);                                     \
   6.224 +        ADD128(rh,rl,(m1 >> 32),(m1 << 32));                             \
   6.225 +        ADD128(rh,rl,(m2 >> 32),(m2 << 32));                             \
   6.226 +    }
   6.227 +#endif
   6.228 +
   6.229 +#ifndef GET_REVERSED_64
   6.230 +#ifndef bswap64
   6.231 +#ifndef bswap32
   6.232 +#define bswap32(x)                                                        \
   6.233 +  ({ uint32_t bsx = (x);                                                  \
   6.234 +      ((((bsx) & 0xff000000u) >> 24) | (((bsx) & 0x00ff0000u) >>  8) |    \
   6.235 +       (((bsx) & 0x0000ff00u) <<  8) | (((bsx) & 0x000000ffu) << 24)); })
   6.236 +#endif
   6.237 +#define bswap64(x)                                                        \
   6.238 +     ({ union { uint64_t ll; uint32_t l[2]; } w, r;                       \
   6.239 +         w.ll = (x);                                                      \
   6.240 +         r.l[0] = bswap32 (w.l[1]);                                       \
   6.241 +         r.l[1] = bswap32 (w.l[0]);                                       \
   6.242 +         r.ll; })
   6.243 +#endif
   6.244 +#define GET_REVERSED_64(p) bswap64(*(uint64_t *)(p)) 
   6.245 +#endif
   6.246 +
   6.247 +/* ----------------------------------------------------------------------- */
   6.248 +
   6.249 +#if (VMAC_PREFER_BIG_ENDIAN)
   6.250 +#  define get64PE get64BE
   6.251 +#else
   6.252 +#  define get64PE get64LE
   6.253 +#endif
   6.254 +
   6.255 +#if (VMAC_ARCH_BIG_ENDIAN)
   6.256 +#  define get64BE(ptr) (*(uint64_t *)(ptr))
   6.257 +#  define get64LE(ptr) GET_REVERSED_64(ptr)
   6.258 +#else /* assume little-endian */
   6.259 +#  define get64BE(ptr) GET_REVERSED_64(ptr)
   6.260 +#  define get64LE(ptr) (*(uint64_t *)(ptr))
   6.261 +#endif
   6.262 +
   6.263 +
   6.264 +/* --------------------------------------------------------------------- *
   6.265 + * For highest performance the L1 NH and L2 polynomial hashes should be
   6.266 + * carefully implemented to take advantage of one's target architechture.
   6.267 + * Here these two hash functions are defined multiple time; once for
   6.268 + * 64-bit architectures, once for 32-bit SSE2 architectures, and once
   6.269 + * for the rest (32-bit) architectures.
   6.270 + * For each, nh_16 *must* be defined (works on multiples of 16 bytes).
   6.271 + * Optionally, nh_vmac_nhbytes can be defined (for multiples of
   6.272 + * VMAC_NHBYTES), and nh_16_2 and nh_vmac_nhbytes_2 (versions that do two
   6.273 + * NH computations at once).
   6.274 + * --------------------------------------------------------------------- */
   6.275 +
   6.276 +/* ----------------------------------------------------------------------- */
   6.277 +#if VMAC_ARCH_64
   6.278 +/* ----------------------------------------------------------------------- */
   6.279 +
   6.280 +#define nh_16(mp, kp, nw, rh, rl)                                            \
   6.281 +{   int i; uint64_t th, tl;                                                  \
   6.282 +    rh = rl = 0;                                                             \
   6.283 +    for (i = 0; i < nw; i+= 2) {                                             \
   6.284 +        MUL64(th,tl,get64PE((mp)+i  )+(kp)[i  ],get64PE((mp)+i+1)+(kp)[i+1]);\
   6.285 +        ADD128(rh,rl,th,tl);                                                 \
   6.286 +    }                                                                        \
   6.287 +}
   6.288 +#define nh_16_2(mp, kp, nw, rh, rl, rh1, rl1)                                \
   6.289 +{   int i; uint64_t th, tl;                                                  \
   6.290 +    rh1 = rl1 = rh = rl = 0;                                                 \
   6.291 +    for (i = 0; i < nw; i+= 2) {                                             \
   6.292 +        MUL64(th,tl,get64PE((mp)+i  )+(kp)[i  ],get64PE((mp)+i+1)+(kp)[i+1]);\
   6.293 +        ADD128(rh,rl,th,tl);                                                 \
   6.294 +        MUL64(th,tl,get64PE((mp)+i  )+(kp)[i+2],get64PE((mp)+i+1)+(kp)[i+3]);\
   6.295 +        ADD128(rh1,rl1,th,tl);                                               \
   6.296 +    }                                                                        \
   6.297 +}
   6.298 +
   6.299 +#if (VMAC_NHBYTES >= 64) /* These versions do 64-bytes of message at a time */
   6.300 +#define nh_vmac_nhbytes(mp, kp, nw, rh, rl)                                  \
   6.301 +{   int i; uint64_t th, tl;                                                  \
   6.302 +    rh = rl = 0;                                                             \
   6.303 +    for (i = 0; i < nw; i+= 8) {                                             \
   6.304 +        MUL64(th,tl,get64PE((mp)+i  )+(kp)[i  ],get64PE((mp)+i+1)+(kp)[i+1]);\
   6.305 +        ADD128(rh,rl,th,tl);                                                 \
   6.306 +        MUL64(th,tl,get64PE((mp)+i+2)+(kp)[i+2],get64PE((mp)+i+3)+(kp)[i+3]);\
   6.307 +        ADD128(rh,rl,th,tl);                                                 \
   6.308 +        MUL64(th,tl,get64PE((mp)+i+4)+(kp)[i+4],get64PE((mp)+i+5)+(kp)[i+5]);\
   6.309 +        ADD128(rh,rl,th,tl);                                                 \
   6.310 +        MUL64(th,tl,get64PE((mp)+i+6)+(kp)[i+6],get64PE((mp)+i+7)+(kp)[i+7]);\
   6.311 +        ADD128(rh,rl,th,tl);                                                 \
   6.312 +    }                                                                        \
   6.313 +}
   6.314 +#define nh_vmac_nhbytes_2(mp, kp, nw, rh, rl, rh1, rl1)                      \
   6.315 +{   int i; uint64_t th, tl;                                                  \
   6.316 +    rh1 = rl1 = rh = rl = 0;                                                 \
   6.317 +    for (i = 0; i < nw; i+= 8) {                                             \
   6.318 +        MUL64(th,tl,get64PE((mp)+i  )+(kp)[i  ],get64PE((mp)+i+1)+(kp)[i+1]);\
   6.319 +        ADD128(rh,rl,th,tl);                                                 \
   6.320 +        MUL64(th,tl,get64PE((mp)+i  )+(kp)[i+2],get64PE((mp)+i+1)+(kp)[i+3]);\
   6.321 +        ADD128(rh1,rl1,th,tl);                                               \
   6.322 +        MUL64(th,tl,get64PE((mp)+i+2)+(kp)[i+2],get64PE((mp)+i+3)+(kp)[i+3]);\
   6.323 +        ADD128(rh,rl,th,tl);                                                 \
   6.324 +        MUL64(th,tl,get64PE((mp)+i+2)+(kp)[i+4],get64PE((mp)+i+3)+(kp)[i+5]);\
   6.325 +        ADD128(rh1,rl1,th,tl);                                               \
   6.326 +        MUL64(th,tl,get64PE((mp)+i+4)+(kp)[i+4],get64PE((mp)+i+5)+(kp)[i+5]);\
   6.327 +        ADD128(rh,rl,th,tl);                                                 \
   6.328 +        MUL64(th,tl,get64PE((mp)+i+4)+(kp)[i+6],get64PE((mp)+i+5)+(kp)[i+7]);\
   6.329 +        ADD128(rh1,rl1,th,tl);                                               \
   6.330 +        MUL64(th,tl,get64PE((mp)+i+6)+(kp)[i+6],get64PE((mp)+i+7)+(kp)[i+7]);\
   6.331 +        ADD128(rh,rl,th,tl);                                                 \
   6.332 +        MUL64(th,tl,get64PE((mp)+i+6)+(kp)[i+8],get64PE((mp)+i+7)+(kp)[i+9]);\
   6.333 +        ADD128(rh1,rl1,th,tl);                                               \
   6.334 +    }                                                                        \
   6.335 +}
   6.336 +#endif
   6.337 +
   6.338 +#define poly_step(ah, al, kh, kl, mh, ml)                   \
   6.339 +{   uint64_t t1h, t1l, t2h, t2l, t3h, t3l, z=0;             \
   6.340 +    /* compute ab*cd, put bd into result registers */       \
   6.341 +    PMUL64(t3h,t3l,al,kh);                                  \
   6.342 +    PMUL64(t2h,t2l,ah,kl);                                  \
   6.343 +    PMUL64(t1h,t1l,ah,2*kh);                                \
   6.344 +    PMUL64(ah,al,al,kl);                                    \
   6.345 +    /* add 2 * ac to result */                              \
   6.346 +    ADD128(ah,al,t1h,t1l);                                  \
   6.347 +    /* add together ad + bc */                              \
   6.348 +    ADD128(t2h,t2l,t3h,t3l);                                \
   6.349 +    /* now (ah,al), (t2l,2*t2h) need summing */             \
   6.350 +    /* first add the high registers, carrying into t2h */   \
   6.351 +    ADD128(t2h,ah,z,t2l);                                   \
   6.352 +    /* double t2h and add top bit of ah */                  \
   6.353 +    t2h = 2 * t2h + (ah >> 63);                             \
   6.354 +    ah &= m63;                                              \
   6.355 +    /* now add the low registers */                         \
   6.356 +    ADD128(ah,al,mh,ml);                                    \
   6.357 +    ADD128(ah,al,z,t2h);                                    \
   6.358 +}
   6.359 +
   6.360 +/* ----------------------------------------------------------------------- */
   6.361 +#elif VMAC_USE_SSE2
   6.362 +/* ----------------------------------------------------------------------- */
   6.363 +
   6.364 +// macros from Crypto++ for sharing inline assembly code between MSVC and GNU C
   6.365 +#if defined(__GNUC__)
   6.366 +	// define these in two steps to allow arguments to be expanded
   6.367 +	#define GNU_AS2(x, y) #x ", " #y ";"
   6.368 +	#define GNU_AS3(x, y, z) #x ", " #y ", " #z ";"
   6.369 +	#define GNU_ASL(x) "\n" #x ":"
   6.370 +	#define GNU_ASJ(x, y, z) #x " " #y #z ";"
   6.371 +	#define AS2(x, y) GNU_AS2(x, y)
   6.372 +	#define AS3(x, y, z) GNU_AS3(x, y, z)
   6.373 +	#define ASS(x, y, a, b, c, d) #x ", " #y ", " #a "*64+" #b "*16+" #c "*4+" #d ";"
   6.374 +	#define ASL(x) GNU_ASL(x)
   6.375 +	#define ASJ(x, y, z) GNU_ASJ(x, y, z)
   6.376 +#else
   6.377 +	#define AS2(x, y) __asm {x, y}
   6.378 +	#define AS3(x, y, z) __asm {x, y, z}
   6.379 +	#define ASS(x, y, a, b, c, d) __asm {x, y, _MM_SHUFFLE(a, b, c, d)}
   6.380 +	#define ASL(x) __asm {label##x:}
   6.381 +	#define ASJ(x, y, z) __asm {x label##y}
   6.382 +#endif
   6.383 +
   6.384 +static void NOINLINE nh_16_func(const uint64_t *mp, const uint64_t *kp, size_t nw, uint64_t *rh, uint64_t *rl)
   6.385 +{
   6.386 +	// This assembly version, using MMX registers, is just as fast as the
   6.387 +	// intrinsics version (which uses XMM registers) on the Intel Core 2,
   6.388 +	// but is much faster on the Pentium 4. In order to schedule multiplies
   6.389 +	// as early as possible, the loop interleaves operations for the current
   6.390 +	// block and the next block. To mask out high 32-bits, we use "movd"
   6.391 +	// to move the lower 32-bits to the stack and then back. Surprisingly,
   6.392 +	// this is faster than any other method.
   6.393 +#ifdef __GNUC__
   6.394 +	__asm__ __volatile__
   6.395 +	(
   6.396 +		".intel_syntax noprefix;"
   6.397 +#else
   6.398 +		AS2(	mov		esi, mp)
   6.399 +		AS2(	mov		edi, kp)
   6.400 +		AS2(	mov		ecx, nw)
   6.401 +		AS2(	mov		eax, rl)
   6.402 +		AS2(	mov		edx, rh)
   6.403 +#endif
   6.404 +		AS2(	sub		esp, 12)
   6.405 +		AS2(	movq	mm6, [esi])
   6.406 +		AS2(	paddq	mm6, [edi])
   6.407 +		AS2(	movq	mm5, [esi+8])
   6.408 +		AS2(	paddq	mm5, [edi+8])
   6.409 +		AS2(	add		esi, 16)
   6.410 +		AS2(	add		edi, 16)
   6.411 +		AS2(	movq	mm4, mm6)
   6.412 +		ASS(	pshufw	mm2, mm6, 1, 0, 3, 2)
   6.413 +		AS2(	pmuludq	mm6, mm5)
   6.414 +		ASS(	pshufw	mm3, mm5, 1, 0, 3, 2)
   6.415 +		AS2(	pmuludq	mm5, mm2)
   6.416 +		AS2(	pmuludq	mm2, mm3)
   6.417 +		AS2(	pmuludq	mm3, mm4)
   6.418 +		AS2(	pxor	mm7, mm7)
   6.419 +		AS2(	movd	[esp], mm6)
   6.420 +		AS2(	psrlq	mm6, 32)
   6.421 +		AS2(	movd	[esp+4], mm5)
   6.422 +		AS2(	psrlq	mm5, 32)
   6.423 +		AS2(	sub		ecx, 2)
   6.424 +		ASJ(	jz,		1, f)
   6.425 +		ASL(0)
   6.426 +		AS2(	movq	mm0, [esi])
   6.427 +		AS2(	paddq	mm0, [edi])
   6.428 +		AS2(	movq	mm1, [esi+8])
   6.429 +		AS2(	paddq	mm1, [edi+8])
   6.430 +		AS2(	add		esi, 16)
   6.431 +		AS2(	add		edi, 16)
   6.432 +		AS2(	movq	mm4, mm0)
   6.433 +		AS2(	paddq	mm5, mm2)
   6.434 +		ASS(	pshufw	mm2, mm0, 1, 0, 3, 2)
   6.435 +		AS2(	pmuludq	mm0, mm1)
   6.436 +		AS2(	movd	[esp+8], mm3)
   6.437 +		AS2(	psrlq	mm3, 32)
   6.438 +		AS2(	paddq	mm5, mm3)
   6.439 +		ASS(	pshufw	mm3, mm1, 1, 0, 3, 2)
   6.440 +		AS2(	pmuludq	mm1, mm2)
   6.441 +		AS2(	pmuludq	mm2, mm3)
   6.442 +		AS2(	pmuludq	mm3, mm4)
   6.443 +		AS2(	movd	mm4, [esp])
   6.444 +		AS2(	paddq	mm7, mm4)
   6.445 +		AS2(	movd	mm4, [esp+4])
   6.446 +		AS2(	paddq	mm6, mm4)
   6.447 +		AS2(	movd	mm4, [esp+8])
   6.448 +		AS2(	paddq	mm6, mm4)
   6.449 +		AS2(	movd	[esp], mm0)
   6.450 +		AS2(	psrlq	mm0, 32)
   6.451 +		AS2(	paddq	mm6, mm0)
   6.452 +		AS2(	movd	[esp+4], mm1)
   6.453 +		AS2(	psrlq	mm1, 32)
   6.454 +		AS2(	paddq	mm5, mm1)
   6.455 +		AS2(	sub		ecx, 2)
   6.456 +		ASJ(	jnz,	0, b)
   6.457 +		ASL(1)
   6.458 +		AS2(	paddq	mm5, mm2)
   6.459 +		AS2(	movd	[esp+8], mm3)
   6.460 +		AS2(	psrlq	mm3, 32)
   6.461 +		AS2(	paddq	mm5, mm3)
   6.462 +		AS2(	movd	mm4, [esp])
   6.463 +		AS2(	paddq	mm7, mm4)
   6.464 +		AS2(	movd	mm4, [esp+4])
   6.465 +		AS2(	paddq	mm6, mm4)
   6.466 +		AS2(	movd	mm4, [esp+8])
   6.467 +		AS2(	paddq	mm6, mm4)
   6.468 +
   6.469 +		ASS(	pshufw	mm0, mm7, 3, 2, 1, 0)
   6.470 +		AS2(	psrlq	mm7, 32)
   6.471 +		AS2(	paddq	mm6, mm7)
   6.472 +		AS2(	punpckldq	mm0, mm6)
   6.473 +		AS2(	psrlq	mm6, 32)
   6.474 +		AS2(	paddq	mm5, mm6)
   6.475 +		AS2(	movq	[eax], mm0)
   6.476 +		AS2(	movq	[edx], mm5)
   6.477 +		AS2(	add		esp, 12)
   6.478 +#ifdef __GNUC__
   6.479 +		".att_syntax prefix;"
   6.480 +		:
   6.481 +		: "S" (mp), "D" (kp), "c" (nw), "a" (rl), "d" (rh)
   6.482 +		: "memory", "cc"
   6.483 +	);
   6.484 +#endif
   6.485 +}
   6.486 +#define nh_16(mp, kp, nw, rh, rl)   nh_16_func(mp, kp, nw, &(rh), &(rl));
   6.487 +
   6.488 +static void poly_step_func(uint64_t *ahi, uint64_t *alo, const uint64_t *kh,
   6.489 +               const uint64_t *kl, const uint64_t *mh, const uint64_t *ml)                  
   6.490 +{
   6.491 +	// This code tries to schedule the multiplies as early as possible to overcome
   6.492 +	// the long latencies on the Pentium 4. It also minimizes "movq" instructions
   6.493 +	// which are very expensive on the P4.
   6.494 +
   6.495 +#define a0 [eax+0]
   6.496 +#define a1 [eax+4]
   6.497 +#define a2 [ebx+0]
   6.498 +#define a3 [ebx+4]
   6.499 +#define k0 [ecx+0]
   6.500 +#define k1 [ecx+4]
   6.501 +#define k2 [edx+0]
   6.502 +#define k3 [edx+4]
   6.503 +
   6.504 +#ifdef __GNUC__
   6.505 +	uint32_t temp;
   6.506 +	__asm__ __volatile__
   6.507 +	(
   6.508 +		"mov %%ebx, %0;"
   6.509 +		"mov %1, %%ebx;"
   6.510 +		".intel_syntax noprefix;"
   6.511 +#else
   6.512 +		AS2(	mov		ebx, ahi)
   6.513 +		AS2(	mov		edx, kh)
   6.514 +		AS2(	mov		eax, alo)
   6.515 +		AS2(	mov		ecx, kl)
   6.516 +		AS2(	mov		esi, mh)
   6.517 +		AS2(	mov		edi, ml)
   6.518 +#endif
   6.519 +
   6.520 +		AS2(	movd	mm0, a3)
   6.521 +		AS2(	movq	mm4, mm0)
   6.522 +		AS2(	pmuludq	mm0, k3)		// a3*k3
   6.523 +		AS2(	movd	mm1, a0)
   6.524 +		AS2(	pmuludq	mm1, k2)		// a0*k2
   6.525 +		AS2(	movd	mm2, a1)
   6.526 +		AS2(	movd	mm6, k1)
   6.527 +		AS2(	pmuludq	mm2, mm6)		// a1*k1
   6.528 +		AS2(	movd	mm3, a2)
   6.529 +		AS2(	movq	mm5, mm3)
   6.530 +		AS2(	movd	mm7, k0)
   6.531 +		AS2(	pmuludq	mm3, mm7)		// a2*k0
   6.532 +		AS2(	pmuludq	mm4, mm7)		// a3*k0
   6.533 +		AS2(	pmuludq	mm5, mm6)		// a2*k1
   6.534 +		AS2(	psllq	mm0, 1)
   6.535 +		AS2(	paddq	mm0, [esi])
   6.536 +		AS2(	paddq	mm0, mm1)
   6.537 +		AS2(	movd	mm1, a1)
   6.538 +		AS2(	paddq	mm4, mm5)
   6.539 +		AS2(	movq	mm5, mm1)
   6.540 +		AS2(	pmuludq	mm1, k2)		// a1*k2
   6.541 +		AS2(	paddq	mm0, mm2)
   6.542 +		AS2(	movd	mm2, a0)
   6.543 +		AS2(	paddq	mm0, mm3)
   6.544 +		AS2(	movq	mm3, mm2)
   6.545 +		AS2(	pmuludq	mm2, k3)		// a0*k3
   6.546 +		AS2(	pmuludq	mm3, mm7)		// a0*k0
   6.547 +		AS2(	movd	esi, mm0)
   6.548 +		AS2(	psrlq	mm0, 32)
   6.549 +		AS2(	pmuludq	mm7, mm5)		// a1*k0
   6.550 +		AS2(	pmuludq	mm5, k3)		// a1*k3
   6.551 +		AS2(	paddq	mm0, mm1)
   6.552 +		AS2(	movd	mm1, a2)
   6.553 +		AS2(	pmuludq	mm1, k2)		// a2*k2
   6.554 +		AS2(	paddq	mm0, mm2)
   6.555 +		AS2(	paddq	mm0, mm4)
   6.556 +		AS2(	movq	mm4, mm0)
   6.557 +		AS2(	movd	mm2, a3)
   6.558 +		AS2(	pmuludq	mm2, mm6)		// a3*k1
   6.559 +		AS2(	pmuludq	mm6, a0)		// a0*k1
   6.560 +		AS2(	psrlq	mm0, 31)
   6.561 +		AS2(	paddq	mm0, mm3)
   6.562 +		AS2(	movd	mm3, [edi])
   6.563 +		AS2(	paddq	mm0, mm3)
   6.564 +		AS2(	movd	mm3, a2)
   6.565 +		AS2(	pmuludq	mm3, k3)		// a2*k3
   6.566 +		AS2(	paddq	mm5, mm1)
   6.567 +		AS2(	movd	mm1, a3)
   6.568 +		AS2(	pmuludq	mm1, k2)		// a3*k2
   6.569 +		AS2(	paddq	mm5, mm2)
   6.570 +		AS2(	movd	mm2, [edi+4])
   6.571 +		AS2(	psllq	mm5, 1)
   6.572 +		AS2(	paddq	mm0, mm5)
   6.573 +		AS2(	movq	mm5, mm0)
   6.574 +		AS2(	psllq	mm4, 33)
   6.575 +		AS2(	psrlq	mm0, 32)
   6.576 +		AS2(	paddq	mm6, mm7)
   6.577 +		AS2(	movd	mm7, esi)
   6.578 +		AS2(	paddq	mm0, mm6)
   6.579 +		AS2(	paddq	mm0, mm2)
   6.580 +		AS2(	paddq	mm3, mm1)
   6.581 +		AS2(	psllq	mm3, 1)
   6.582 +		AS2(	paddq	mm0, mm3)
   6.583 +		AS2(	psrlq	mm4, 1)
   6.584 +		AS2(	punpckldq	mm5, mm0)
   6.585 +		AS2(	psrlq	mm0, 32)
   6.586 +		AS2(	por		mm4, mm7)
   6.587 +		AS2(	paddq	mm0, mm4)
   6.588 +		AS2(	movq	a0, mm5)
   6.589 +		AS2(	movq	a2, mm0)
   6.590 +#ifdef __GNUC__
   6.591 +		".att_syntax prefix;"
   6.592 +		"mov %0, %%ebx;"
   6.593 +		: "=m" (temp)
   6.594 +		: "m" (ahi), "D" (ml), "d" (kh), "a" (alo), "S" (mh), "c" (kl)
   6.595 +		: "memory", "cc"
   6.596 +	);
   6.597 +#endif
   6.598 +
   6.599 +
   6.600 +#undef a0
   6.601 +#undef a1
   6.602 +#undef a2
   6.603 +#undef a3
   6.604 +#undef k0
   6.605 +#undef k1
   6.606 +#undef k2
   6.607 +#undef k3
   6.608 +}
   6.609 +
   6.610 +#define poly_step(ah, al, kh, kl, mh, ml)   \
   6.611 +        poly_step_func(&(ah), &(al), &(kh), &(kl), &(mh), &(ml))
   6.612 +
   6.613 +/* ----------------------------------------------------------------------- */
   6.614 +#else /* not VMAC_ARCH_64 and not SSE2 */
   6.615 +/* ----------------------------------------------------------------------- */
   6.616 +
   6.617 +#ifndef nh_16
   6.618 +#define nh_16(mp, kp, nw, rh, rl)                                       \
   6.619 +{   uint64_t t1,t2,m1,m2,t;                                             \
   6.620 +    int i;                                                              \
   6.621 +    rh = rl = t = 0;                                                    \
   6.622 +    for (i = 0; i < nw; i+=2)  {                                        \
   6.623 +        t1  = get64PE(mp+i) + kp[i];                                    \
   6.624 +        t2  = get64PE(mp+i+1) + kp[i+1];                                \
   6.625 +        m2  = MUL32(t1 >> 32, t2);                                      \
   6.626 +        m1  = MUL32(t1, t2 >> 32);                                      \
   6.627 +        ADD128(rh,rl,MUL32(t1 >> 32,t2 >> 32),MUL32(t1,t2));            \
   6.628 +        rh += (uint64_t)(uint32_t)(m1 >> 32) + (uint32_t)(m2 >> 32);    \
   6.629 +        t  += (uint64_t)(uint32_t)m1 + (uint32_t)m2;                    \
   6.630 +    }                                                                   \
   6.631 +    ADD128(rh,rl,(t >> 32),(t << 32));                                  \
   6.632 +}
   6.633 +#endif
   6.634 +
   6.635 +static void poly_step_func(uint64_t *ahi, uint64_t *alo, const uint64_t *kh,
   6.636 +               const uint64_t *kl, const uint64_t *mh, const uint64_t *ml)                  
   6.637 +{
   6.638 +
   6.639 +#if VMAC_ARCH_BIG_ENDIAN
   6.640 +#define INDEX_HIGH 0
   6.641 +#define INDEX_LOW 1
   6.642 +#else
   6.643 +#define INDEX_HIGH 1
   6.644 +#define INDEX_LOW 0
   6.645 +#endif
   6.646 +
   6.647 +#define a0 *(((uint32_t*)alo)+INDEX_LOW)
   6.648 +#define a1 *(((uint32_t*)alo)+INDEX_HIGH)
   6.649 +#define a2 *(((uint32_t*)ahi)+INDEX_LOW)
   6.650 +#define a3 *(((uint32_t*)ahi)+INDEX_HIGH)
   6.651 +#define k0 *(((uint32_t*)kl)+INDEX_LOW)
   6.652 +#define k1 *(((uint32_t*)kl)+INDEX_HIGH)
   6.653 +#define k2 *(((uint32_t*)kh)+INDEX_LOW)
   6.654 +#define k3 *(((uint32_t*)kh)+INDEX_HIGH)
   6.655 +
   6.656 +    uint64_t p, q, t;
   6.657 +    uint32_t t2;
   6.658 +
   6.659 +    p = MUL32(a3, k3);
   6.660 +    p += p;
   6.661 +	p += *(uint64_t *)mh;
   6.662 +    p += MUL32(a0, k2);
   6.663 +    p += MUL32(a1, k1);
   6.664 +    p += MUL32(a2, k0);
   6.665 +    t = (uint32_t)(p);
   6.666 +    p >>= 32;
   6.667 +    p += MUL32(a0, k3);
   6.668 +    p += MUL32(a1, k2);
   6.669 +    p += MUL32(a2, k1);
   6.670 +    p += MUL32(a3, k0);
   6.671 +    t |= ((uint64_t)((uint32_t)p & 0x7fffffff)) << 32;
   6.672 +    p >>= 31;
   6.673 +    p += (uint64_t)(((uint32_t*)ml)[INDEX_LOW]);
   6.674 +    p += MUL32(a0, k0);
   6.675 +    q =  MUL32(a1, k3);
   6.676 +    q += MUL32(a2, k2);
   6.677 +    q += MUL32(a3, k1);
   6.678 +    q += q;
   6.679 +    p += q;
   6.680 +    t2 = (uint32_t)(p);
   6.681 +    p >>= 32;
   6.682 +    p += (uint64_t)(((uint32_t*)ml)[INDEX_HIGH]);
   6.683 +    p += MUL32(a0, k1);
   6.684 +    p += MUL32(a1, k0);
   6.685 +    q =  MUL32(a2, k3);
   6.686 +    q += MUL32(a3, k2);
   6.687 +    q += q;
   6.688 +    p += q;
   6.689 +    *(uint64_t *)(alo) = (p << 32) | t2;
   6.690 +    p >>= 32;
   6.691 +    *(uint64_t *)(ahi) = p + t;
   6.692 +
   6.693 +#undef a0
   6.694 +#undef a1
   6.695 +#undef a2
   6.696 +#undef a3
   6.697 +#undef k0
   6.698 +#undef k1
   6.699 +#undef k2
   6.700 +#undef k3
   6.701 +}
   6.702 +
   6.703 +#define poly_step(ah, al, kh, kl, mh, ml)   \
   6.704 +        poly_step_func(&(ah), &(al), &(kh), &(kl), &(mh), &(ml))
   6.705 +
   6.706 +/* ----------------------------------------------------------------------- */
   6.707 +#endif  /* end of specialized NH and poly definitions */
   6.708 +/* ----------------------------------------------------------------------- */
   6.709 +
   6.710 +/* At least nh_16 is defined. Defined others as needed  here               */
   6.711 +#ifndef nh_16_2
   6.712 +#define nh_16_2(mp, kp, nw, rh, rl, rh2, rl2)                           \
   6.713 +    nh_16(mp, kp, nw, rh, rl);                                          \
   6.714 +    nh_16(mp, ((kp)+2), nw, rh2, rl2);
   6.715 +#endif
   6.716 +#ifndef nh_vmac_nhbytes
   6.717 +#define nh_vmac_nhbytes(mp, kp, nw, rh, rl)                             \
   6.718 +    nh_16(mp, kp, nw, rh, rl)
   6.719 +#endif
   6.720 +#ifndef nh_vmac_nhbytes_2
   6.721 +#define nh_vmac_nhbytes_2(mp, kp, nw, rh, rl, rh2, rl2)                 \
   6.722 +    nh_vmac_nhbytes(mp, kp, nw, rh, rl);                                \
   6.723 +    nh_vmac_nhbytes(mp, ((kp)+2), nw, rh2, rl2);
   6.724 +#endif
   6.725 +
   6.726 +/* ----------------------------------------------------------------------- */
   6.727 +
   6.728 +void vhash_abort(vmac_ctx_t *ctx)
   6.729 +{
   6.730 +    ctx->polytmp[0] = ctx->polykey[0] ;
   6.731 +    ctx->polytmp[1] = ctx->polykey[1] ;
   6.732 +    #if (VMAC_TAG_LEN == 128)
   6.733 +    ctx->polytmp[2] = ctx->polykey[2] ;
   6.734 +    ctx->polytmp[3] = ctx->polykey[3] ;
   6.735 +    #endif
   6.736 +    ctx->first_block_processed = 0;
   6.737 +}
   6.738 +
   6.739 +/* ----------------------------------------------------------------------- */
   6.740 +static uint64_t l3hash(uint64_t p1, uint64_t p2,
   6.741 +                       uint64_t k1, uint64_t k2, uint64_t len)
   6.742 +{
   6.743 +    uint64_t rh, rl, t, z=0;
   6.744 +
   6.745 +    /* fully reduce (p1,p2)+(len,0) mod p127 */
   6.746 +    t = p1 >> 63;
   6.747 +    p1 &= m63;
   6.748 +    ADD128(p1, p2, len, t);
   6.749 +    /* At this point, (p1,p2) is at most 2^127+(len<<64) */
   6.750 +    t = (p1 > m63) + ((p1 == m63) && (p2 == m64));
   6.751 +    ADD128(p1, p2, z, t);
   6.752 +    p1 &= m63;
   6.753 +
   6.754 +    /* compute (p1,p2)/(2^64-2^32) and (p1,p2)%(2^64-2^32) */
   6.755 +    t = p1 + (p2 >> 32);
   6.756 +    t += (t >> 32);
   6.757 +    t += (uint32_t)t > 0xfffffffeu;
   6.758 +    p1 += (t >> 32);
   6.759 +    p2 += (p1 << 32);
   6.760 +
   6.761 +    /* compute (p1+k1)%p64 and (p2+k2)%p64 */
   6.762 +    p1 += k1;
   6.763 +    p1 += (0 - (p1 < k1)) & 257;
   6.764 +    p2 += k2;
   6.765 +    p2 += (0 - (p2 < k2)) & 257;
   6.766 +
   6.767 +    /* compute (p1+k1)*(p2+k2)%p64 */
   6.768 +    MUL64(rh, rl, p1, p2);
   6.769 +    t = rh >> 56;
   6.770 +    ADD128(t, rl, z, rh);
   6.771 +    rh <<= 8;
   6.772 +    ADD128(t, rl, z, rh);
   6.773 +    t += t << 8;
   6.774 +    rl += t;
   6.775 +    rl += (0 - (rl < t)) & 257;
   6.776 +    rl += (0 - (rl > p64-1)) & 257;
   6.777 +    return rl;
   6.778 +}
   6.779 +
   6.780 +/* ----------------------------------------------------------------------- */
   6.781 +
   6.782 +void vhash_update(unsigned char *m,
   6.783 +                  unsigned int   mbytes, /* Pos multiple of VMAC_NHBYTES */
   6.784 +                  vmac_ctx_t    *ctx)
   6.785 +{
   6.786 +    uint64_t rh, rl, *mptr;
   6.787 +    const uint64_t *kptr = (uint64_t *)ctx->nhkey;
   6.788 +    int i;
   6.789 +    uint64_t ch, cl;
   6.790 +    uint64_t pkh = ctx->polykey[0];
   6.791 +    uint64_t pkl = ctx->polykey[1];
   6.792 +    #if (VMAC_TAG_LEN == 128)
   6.793 +    uint64_t ch2, cl2, rh2, rl2;
   6.794 +    uint64_t pkh2 = ctx->polykey[2];
   6.795 +    uint64_t pkl2 = ctx->polykey[3];
   6.796 +    #endif
   6.797 +
   6.798 +    mptr = (uint64_t *)m;
   6.799 +    i = mbytes / VMAC_NHBYTES;  /* Must be non-zero */
   6.800 +
   6.801 +    ch = ctx->polytmp[0];
   6.802 +    cl = ctx->polytmp[1];
   6.803 +    #if (VMAC_TAG_LEN == 128)
   6.804 +    ch2 = ctx->polytmp[2];
   6.805 +    cl2 = ctx->polytmp[3];
   6.806 +    #endif
   6.807 +    
   6.808 +    if ( ! ctx->first_block_processed) {
   6.809 +        ctx->first_block_processed = 1;
   6.810 +        #if (VMAC_TAG_LEN == 64)
   6.811 +        nh_vmac_nhbytes(mptr,kptr,VMAC_NHBYTES/8,rh,rl);
   6.812 +        #else
   6.813 +        nh_vmac_nhbytes_2(mptr,kptr,VMAC_NHBYTES/8,rh,rl,rh2,rl2);
   6.814 +        rh2 &= m62;
   6.815 +        ADD128(ch2,cl2,rh2,rl2);
   6.816 +        #endif
   6.817 +        rh &= m62;
   6.818 +        ADD128(ch,cl,rh,rl);
   6.819 +        mptr += (VMAC_NHBYTES/sizeof(uint64_t));
   6.820 +        i--;
   6.821 +    }
   6.822 +
   6.823 +    while (i--) {
   6.824 +        #if (VMAC_TAG_LEN == 64)
   6.825 +        nh_vmac_nhbytes(mptr,kptr,VMAC_NHBYTES/8,rh,rl);
   6.826 +        #else
   6.827 +        nh_vmac_nhbytes_2(mptr,kptr,VMAC_NHBYTES/8,rh,rl,rh2,rl2);
   6.828 +        rh2 &= m62;
   6.829 +        poly_step(ch2,cl2,pkh2,pkl2,rh2,rl2);
   6.830 +        #endif
   6.831 +        rh &= m62;
   6.832 +        poly_step(ch,cl,pkh,pkl,rh,rl);
   6.833 +        mptr += (VMAC_NHBYTES/sizeof(uint64_t));
   6.834 +    }
   6.835 +
   6.836 +    ctx->polytmp[0] = ch;
   6.837 +    ctx->polytmp[1] = cl;
   6.838 +    #if (VMAC_TAG_LEN == 128)
   6.839 +    ctx->polytmp[2] = ch2;
   6.840 +    ctx->polytmp[3] = cl2;
   6.841 +    #endif
   6.842 +    #if VMAC_USE_SSE2
   6.843 +    _mm_empty(); /* SSE2 version of poly_step uses mmx instructions */
   6.844 +    #endif
   6.845 +}
   6.846 +
   6.847 +/* ----------------------------------------------------------------------- */
   6.848 +
   6.849 +uint64_t xvhash(unsigned char m[],
   6.850 +          unsigned int mbytes,
   6.851 +          uint64_t *tagl,
   6.852 +          vmac_ctx_t *ctx)
   6.853 +{
   6.854 +    uint64_t ch, cl, rh, rl, *mptr;
   6.855 +    #if (VMAC_TAG_LEN == 128)
   6.856 +    uint64_t ch2, cl2, rh2, rl2;
   6.857 +    #endif
   6.858 +    const uint64_t *kptr = (uint64_t *)ctx->nhkey;
   6.859 +    int i, remaining;
   6.860 +
   6.861 +    remaining = mbytes % VMAC_NHBYTES;
   6.862 +    i = mbytes-remaining;
   6.863 +    mptr = (uint64_t *)(m+i);
   6.864 +    if (i) vhash_update(m,i,ctx);
   6.865 +
   6.866 +    ch = ctx->polytmp[0];
   6.867 +    cl = ctx->polytmp[1];
   6.868 +    #if (VMAC_TAG_LEN == 128)
   6.869 +    ch2 = ctx->polytmp[2];
   6.870 +    cl2 = ctx->polytmp[3];
   6.871 +    #endif
   6.872 +
   6.873 +    if (remaining) {
   6.874 +        #if (VMAC_TAG_LEN == 128)
   6.875 +        nh_16_2(mptr,kptr,2*((remaining+15)/16),rh,rl,rh2,rl2);
   6.876 +        rh2 &= m62;
   6.877 +        #else
   6.878 +        nh_16(mptr,kptr,2*((remaining+15)/16),rh,rl);
   6.879 +        #endif
   6.880 +        rh &= m62;
   6.881 +        if (i) {
   6.882 +            poly_step(ch,cl,ctx->polykey[0],ctx->polykey[1],rh,rl);
   6.883 +            #if (VMAC_TAG_LEN == 128)
   6.884 +            poly_step(ch2,cl2,ctx->polykey[2],ctx->polykey[3],rh2,rl2);
   6.885 +            #endif
   6.886 +        } else {
   6.887 +            ADD128(ch,cl,rh,rl);
   6.888 +            #if (VMAC_TAG_LEN == 128)
   6.889 +            ADD128(ch2,cl2,rh2,rl2);
   6.890 +            #endif
   6.891 +        }
   6.892 +    }
   6.893 +
   6.894 +    #if VMAC_USE_SSE2
   6.895 +    _mm_empty(); /* SSE2 version of poly_step uses mmx instructions */
   6.896 +    #endif
   6.897 +    vhash_abort(ctx);
   6.898 +    remaining *= 8;
   6.899 +#if (VMAC_TAG_LEN == 128)
   6.900 +    *tagl = l3hash(ch2, cl2, ctx->l3key[2], ctx->l3key[3],remaining);
   6.901 +#endif
   6.902 +    return l3hash(ch, cl, ctx->l3key[0], ctx->l3key[1],remaining);
   6.903 +}
   6.904 +
   6.905 +uint64_t vhash(unsigned char m[],
   6.906 +          unsigned int mbytes,
   6.907 +          uint64_t *tagl,
   6.908 +          vmac_ctx_t *ctx)
   6.909 +{
   6.910 +    uint64_t rh, rl, *mptr;
   6.911 +    const uint64_t *kptr = (uint64_t *)ctx->nhkey;
   6.912 +    int i, remaining;
   6.913 +    uint64_t ch, cl;
   6.914 +    uint64_t pkh = ctx->polykey[0];
   6.915 +    uint64_t pkl = ctx->polykey[1];
   6.916 +    #if (VMAC_TAG_LEN == 128)
   6.917 +        uint64_t ch2, cl2, rh2, rl2;
   6.918 +        uint64_t pkh2 = ctx->polykey[2];
   6.919 +        uint64_t pkl2 = ctx->polykey[3];
   6.920 +    #endif
   6.921 +
   6.922 +    mptr = (uint64_t *)m;
   6.923 +    i = mbytes / VMAC_NHBYTES;
   6.924 +    remaining = mbytes % VMAC_NHBYTES;
   6.925 +
   6.926 +    if (ctx->first_block_processed)
   6.927 +    {
   6.928 +        ch = ctx->polytmp[0];
   6.929 +        cl = ctx->polytmp[1];
   6.930 +        #if (VMAC_TAG_LEN == 128)
   6.931 +        ch2 = ctx->polytmp[2];
   6.932 +        cl2 = ctx->polytmp[3];
   6.933 +        #endif
   6.934 +    }
   6.935 +    else if (i)
   6.936 +    {
   6.937 +        #if (VMAC_TAG_LEN == 64)
   6.938 +        nh_vmac_nhbytes(mptr,kptr,VMAC_NHBYTES/8,ch,cl);
   6.939 +        #else
   6.940 +        nh_vmac_nhbytes_2(mptr,kptr,VMAC_NHBYTES/8,ch,cl,ch2,cl2);
   6.941 +        ch2 &= m62;
   6.942 +        ADD128(ch2,cl2,pkh2,pkl2);
   6.943 +        #endif
   6.944 +        ch &= m62;
   6.945 +        ADD128(ch,cl,pkh,pkl);
   6.946 +        mptr += (VMAC_NHBYTES/sizeof(uint64_t));
   6.947 +        i--;
   6.948 +    }
   6.949 +    else if (remaining)
   6.950 +    {
   6.951 +        #if (VMAC_TAG_LEN == 64)
   6.952 +        nh_16(mptr,kptr,2*((remaining+15)/16),ch,cl);
   6.953 +        #else
   6.954 +        nh_16_2(mptr,kptr,2*((remaining+15)/16),ch,cl,ch2,cl2);
   6.955 +        ch2 &= m62;
   6.956 +        ADD128(ch2,cl2,pkh2,pkl2);
   6.957 +        #endif
   6.958 +        ch &= m62;
   6.959 +        ADD128(ch,cl,pkh,pkl);
   6.960 +        mptr += (VMAC_NHBYTES/sizeof(uint64_t));
   6.961 +        goto do_l3;
   6.962 +    }
   6.963 +    else /* Empty String */
   6.964 +    {
   6.965 +        ch = pkh; cl = pkl;
   6.966 +        #if (VMAC_TAG_LEN == 128)
   6.967 +        ch2 = pkh2; cl2 = pkl2;
   6.968 +        #endif
   6.969 +        goto do_l3;
   6.970 +    }
   6.971 +
   6.972 +    while (i--) {
   6.973 +        #if (VMAC_TAG_LEN == 64)
   6.974 +        nh_vmac_nhbytes(mptr,kptr,VMAC_NHBYTES/8,rh,rl);
   6.975 +        #else
   6.976 +        nh_vmac_nhbytes_2(mptr,kptr,VMAC_NHBYTES/8,rh,rl,rh2,rl2);
   6.977 +        rh2 &= m62;
   6.978 +        poly_step(ch2,cl2,pkh2,pkl2,rh2,rl2);
   6.979 +        #endif
   6.980 +        rh &= m62;
   6.981 +        poly_step(ch,cl,pkh,pkl,rh,rl);
   6.982 +        mptr += (VMAC_NHBYTES/sizeof(uint64_t));
   6.983 +    }
   6.984 +    if (remaining) {
   6.985 +        #if (VMAC_TAG_LEN == 64)
   6.986 +        nh_16(mptr,kptr,2*((remaining+15)/16),rh,rl);
   6.987 +        #else
   6.988 +        nh_16_2(mptr,kptr,2*((remaining+15)/16),rh,rl,rh2,rl2);
   6.989 +        rh2 &= m62;
   6.990 +        poly_step(ch2,cl2,pkh2,pkl2,rh2,rl2);
   6.991 +        #endif
   6.992 +        rh &= m62;
   6.993 +        poly_step(ch,cl,pkh,pkl,rh,rl);
   6.994 +    }
   6.995 +
   6.996 +do_l3:
   6.997 +    #if VMAC_USE_SSE2
   6.998 +    _mm_empty(); /* SSE2 version of poly_step uses mmx instructions */
   6.999 +    #endif
  6.1000 +    vhash_abort(ctx);
  6.1001 +    remaining *= 8;
  6.1002 +#if (VMAC_TAG_LEN == 128)
  6.1003 +    *tagl = l3hash(ch2, cl2, ctx->l3key[2], ctx->l3key[3],remaining);
  6.1004 +#endif
  6.1005 +    return l3hash(ch, cl, ctx->l3key[0], ctx->l3key[1],remaining);
  6.1006 +}
  6.1007 +
  6.1008 +/* ----------------------------------------------------------------------- */
  6.1009 +
  6.1010 +uint64_t vmac(unsigned char m[],
  6.1011 +         unsigned int mbytes,
  6.1012 +         unsigned char n[16],
  6.1013 +         uint64_t *tagl,
  6.1014 +         vmac_ctx_t *ctx)
  6.1015 +{
  6.1016 +#if (VMAC_TAG_LEN == 64)
  6.1017 +    uint64_t *in_n, *out_p;
  6.1018 +    uint64_t p, h;
  6.1019 +    int i;
  6.1020 +    
  6.1021 +    #if VMAC_CACHE_NONCES
  6.1022 +    in_n = ctx->cached_nonce;
  6.1023 +    out_p = ctx->cached_aes;
  6.1024 +    #else
  6.1025 +    uint64_t tmp[2];
  6.1026 +    in_n = out_p = tmp;
  6.1027 +    #endif
  6.1028 +
  6.1029 +    i = n[15] & 1;
  6.1030 +    #if VMAC_CACHE_NONCES
  6.1031 +    if ((*(uint64_t *)(n+8) != in_n[1]) ||
  6.1032 +        (*(uint64_t *)(n  ) != in_n[0])) {
  6.1033 +    #endif
  6.1034 +    
  6.1035 +        in_n[0] = *(uint64_t *)(n  );
  6.1036 +        in_n[1] = *(uint64_t *)(n+8);
  6.1037 +        ((unsigned char *)in_n)[15] &= 0xFE;
  6.1038 +        aes_encryption(in_n, out_p, &ctx->cipher_key);
  6.1039 +
  6.1040 +    #if VMAC_CACHE_NONCES
  6.1041 +        ((unsigned char *)in_n)[15] |= (unsigned char)(1-i);
  6.1042 +    }
  6.1043 +    #endif
  6.1044 +    p = get64BE(out_p + i);
  6.1045 +    h = vhash(m, mbytes, (uint64_t *)0, ctx);
  6.1046 +    return p + h;
  6.1047 +#else
  6.1048 +    uint64_t tmp[2];
  6.1049 +    uint64_t th,tl;
  6.1050 +    aes_encryption(n, (unsigned char *)tmp, &ctx->cipher_key);
  6.1051 +    th = vhash(m, mbytes, &tl, ctx);
  6.1052 +    th += get64BE(tmp);
  6.1053 +    *tagl = tl + get64BE(tmp+1);
  6.1054 +    return th;
  6.1055 +#endif
  6.1056 +}
  6.1057 +
  6.1058 +/* ----------------------------------------------------------------------- */
  6.1059 +
  6.1060 +void vmac_set_key(unsigned char user_key[], vmac_ctx_t *ctx)
  6.1061 +{
  6.1062 +    uint64_t in[2] = {0}, out[2];
  6.1063 +    unsigned i;
  6.1064 +    aes_key_setup(user_key, &ctx->cipher_key);
  6.1065 +    
  6.1066 +    /* Fill nh key */
  6.1067 +    ((unsigned char *)in)[0] = 0x80; 
  6.1068 +    for (i = 0; i < sizeof(ctx->nhkey)/8; i+=2) {
  6.1069 +        aes_encryption((unsigned char *)in, (unsigned char *)out,
  6.1070 +                                                         &ctx->cipher_key);
  6.1071 +        ctx->nhkey[i  ] = get64BE(out);
  6.1072 +        ctx->nhkey[i+1] = get64BE(out+1);
  6.1073 +        ((unsigned char *)in)[15] += 1;
  6.1074 +    }
  6.1075 +
  6.1076 +    /* Fill poly key */
  6.1077 +    ((unsigned char *)in)[0] = 0xC0; 
  6.1078 +    in[1] = 0;
  6.1079 +    for (i = 0; i < sizeof(ctx->polykey)/8; i+=2) {
  6.1080 +        aes_encryption((unsigned char *)in, (unsigned char *)out,
  6.1081 +                                                         &ctx->cipher_key);
  6.1082 +        ctx->polytmp[i  ] = ctx->polykey[i  ] = get64BE(out) & mpoly;
  6.1083 +        ctx->polytmp[i+1] = ctx->polykey[i+1] = get64BE(out+1) & mpoly;
  6.1084 +        ((unsigned char *)in)[15] += 1;
  6.1085 +    }
  6.1086 +
  6.1087 +    /* Fill ip key */
  6.1088 +    ((unsigned char *)in)[0] = 0xE0;
  6.1089 +    in[1] = 0;
  6.1090 +    for (i = 0; i < sizeof(ctx->l3key)/8; i+=2) {
  6.1091 +        do {
  6.1092 +            aes_encryption((unsigned char *)in, (unsigned char *)out,
  6.1093 +                                                         &ctx->cipher_key);
  6.1094 +            ctx->l3key[i  ] = get64BE(out);
  6.1095 +            ctx->l3key[i+1] = get64BE(out+1);
  6.1096 +            ((unsigned char *)in)[15] += 1;
  6.1097 +        } while (ctx->l3key[i] >= p64 || ctx->l3key[i+1] >= p64);
  6.1098 +    }
  6.1099 +    
  6.1100 +    /* Invalidate nonce/aes cache and reset other elements */
  6.1101 +    #if (VMAC_TAG_LEN == 64) && (VMAC_CACHE_NONCES)
  6.1102 +    ctx->cached_nonce[0] = (uint64_t)-1; /* Ensure illegal nonce */
  6.1103 +    ctx->cached_nonce[1] = (uint64_t)0;  /* Ensure illegal nonce */
  6.1104 +    #endif
  6.1105 +    ctx->first_block_processed = 0;
  6.1106 +}
  6.1107 +
  6.1108 +/* ----------------------------------------------------------------------- */
  6.1109 +
  6.1110 +
  6.1111 +#if VMAC_RUN_TESTS
  6.1112 +
  6.1113 +#include <stdlib.h>
  6.1114 +#include <stdio.h>
  6.1115 +#include <time.h>
  6.1116 +#include <string.h>
  6.1117 +
  6.1118 +unsigned prime(void)  /* Wake variable speed cpu, get rough speed estimate */
  6.1119 +{
  6.1120 +    volatile uint64_t i;
  6.1121 +    volatile uint64_t j=1;
  6.1122 +    unsigned cnt=0;
  6.1123 +    volatile clock_t ticks = clock();
  6.1124 +    do {
  6.1125 +        for (i = 0; i < 500000; i++) {
  6.1126 +            uint64_t x = get64PE(&j);
  6.1127 +            j = x * x + (uint64_t)ticks;
  6.1128 +        }
  6.1129 +        cnt++;
  6.1130 +    } while (clock() - ticks < (CLOCKS_PER_SEC/2));
  6.1131 +    return cnt;  /* cnt is millions of iterations per second */
  6.1132 +}
  6.1133 +
  6.1134 +int main(void)
  6.1135 +{
  6.1136 +    ALIGN(16) vmac_ctx_t ctx, ctx_aio, ctx_inc1, ctx_inc2;
  6.1137 +    uint64_t res, tagl;
  6.1138 +    void *p;
  6.1139 +    unsigned char *m;
  6.1140 +    ALIGN(4) unsigned char key[] = "abcdefghijklmnop";
  6.1141 +    ALIGN(4) unsigned char nonce[] = "\0\0\0\0\0\0\0\0bcdefghi";
  6.1142 +    unsigned int  vector_lengths[] = {0,3,48,300,3000000};
  6.1143 +    #if (VMAC_TAG_LEN == 64)
  6.1144 +    ALIGN(4) char *should_be[] = {"2576BE1C56D8B81B","2D376CF5B1813CE5",
  6.1145 +                        "E8421F61D573D298","4492DF6C5CAC1BBE",
  6.1146 +                        "09BA597DD7601113"};
  6.1147 +    #else
  6.1148 +    ALIGN(4) char *should_be[] = {"472766C70F74ED23481D6D7DE4E80DAC",
  6.1149 +                         "4EE815A06A1D71EDD36FC75D51188A42",
  6.1150 +                         "09F2C80C8E1007A0C12FAE19FE4504AE",
  6.1151 +                         "66438817154850C61D8A412164803BCB",
  6.1152 +                         "2B6B02288FFC461B75485DE893C629DC"};
  6.1153 +    #endif
  6.1154 +    unsigned speed_lengths[] = {16, 32, 64, 128, 256, 512, 1024, 2048, 4096};
  6.1155 +    unsigned i, j, *speed_iters;
  6.1156 +    clock_t ticks;
  6.1157 +    double cpb;
  6.1158 +    const unsigned int buf_len = 3 * (1 << 20);
  6.1159 +    
  6.1160 +    j = prime();
  6.1161 +    i = sizeof(speed_lengths)/sizeof(speed_lengths[0]);
  6.1162 +    speed_iters = (unsigned *)malloc(i*sizeof(speed_iters[0]));
  6.1163 +    speed_iters[i-1] = j * (1 << 12);
  6.1164 +    while (--i) speed_iters[i-1] = (unsigned)(1.3 * speed_iters[i]);
  6.1165 +    
  6.1166 +    /* Initialize context and message buffer, all 16-byte aligned */
  6.1167 +    p = malloc(buf_len + 32);
  6.1168 +    m = (unsigned char *)(((size_t)p + 16) & ~((size_t)15));
  6.1169 +    memset(m, 0, buf_len + 16);
  6.1170 +    vmac_set_key(key, &ctx);
  6.1171 +    
  6.1172 +    /* Test incremental and all-in-one interfaces for correctness */
  6.1173 +    vmac_set_key(key, &ctx_aio);
  6.1174 +    vmac_set_key(key, &ctx_inc1);
  6.1175 +    vmac_set_key(key, &ctx_inc2);
  6.1176 +    
  6.1177 +    
  6.1178 +    /*
  6.1179 +    for (i = 0; i <= 512; i++) {
  6.1180 +        vhash_update(m,(i/VMAC_NHBYTES)*VMAC_NHBYTES,&ctx_inc1);
  6.1181 +        tagh = vmac(m+(i/VMAC_NHBYTES)*VMAC_NHBYTES, i%VMAC_NHBYTES,
  6.1182 +                                                      nonce, &tagl, &ctx);
  6.1183 +        vhash_update(m,(i/VMAC_NHBYTES)*VMAC_NHBYTES,&ctx_inc1);
  6.1184 +        for (j = 0; j < vector_lengths[i]; j++)
  6.1185 +            m[j] = (unsigned char)('a'+j%3);
  6.1186 +        
  6.1187 +    }
  6.1188 +    */
  6.1189 +    
  6.1190 +    /* Generate vectors */
  6.1191 +    for (i = 0; i < sizeof(vector_lengths)/sizeof(unsigned int); i++) {
  6.1192 +        for (j = 0; j < vector_lengths[i]; j++)
  6.1193 +            m[j] = (unsigned char)('a'+j%3);
  6.1194 +        res = vmac(m, vector_lengths[i], nonce, &tagl, &ctx);
  6.1195 +        #if (VMAC_TAG_LEN == 64)
  6.1196 +        printf("\'abc\' * %7u: %016llX Should be: %s\n",
  6.1197 +              vector_lengths[i]/3,res,should_be[i]);
  6.1198 +        #else
  6.1199 +        printf("\'abc\' * %7u: %016llX%016llX\nShould be      : %s\n",
  6.1200 +              vector_lengths[i]/3,res,tagl,should_be[i]);
  6.1201 +        #endif
  6.1202 +    }
  6.1203 +
  6.1204 +    /* Speed test */
  6.1205 +    for (i = 0; i < sizeof(speed_lengths)/sizeof(unsigned int); i++) {
  6.1206 +        ticks = clock();
  6.1207 +        for (j = 0; j < speed_iters[i]; j++) {
  6.1208 +            #if HASH_ONLY
  6.1209 +            res = vhash(m, speed_lengths[i], &tagl, &ctx);
  6.1210 +            #else
  6.1211 +            res = vmac(m, speed_lengths[i], nonce, &tagl, &ctx);
  6.1212 +            nonce[7]++;
  6.1213 +            #endif
  6.1214 +        }
  6.1215 +        ticks = clock() - ticks;
  6.1216 +        cpb = ((ticks*VMAC_HZ)/
  6.1217 +              ((double)CLOCKS_PER_SEC*speed_lengths[i]*speed_iters[i]));
  6.1218 +        printf("%4u bytes, %2.2f cpb\n", speed_lengths[i], cpb);
  6.1219 +    }
  6.1220 +    return 1;
  6.1221 +}
  6.1222 +
  6.1223 +#endif
     7.1 --- a/xen/include/asm-x86/tboot.h	Tue Mar 03 11:52:44 2009 +0000
     7.2 +++ b/xen/include/asm-x86/tboot.h	Tue Mar 03 12:48:16 2009 +0000
     7.3 @@ -53,10 +53,12 @@ typedef struct __packed {
     7.4  
     7.5  /* used to communicate between tboot and the launched kernel (i.e. Xen) */
     7.6  
     7.7 +#define TB_KEY_SIZE             64   /* 512 bits */
     7.8 +
     7.9  #define MAX_TB_MAC_REGIONS      32
    7.10  typedef struct __packed {
    7.11 -    uint64_t  start;
    7.12 -    uint64_t  end;
    7.13 +    uint64_t  start;         /* must be 64 byte -aligned */
    7.14 +    uint32_t  size;          /* must be 64 byte -granular */
    7.15  } tboot_mac_region_t;
    7.16  
    7.17  /* GAS - Generic Address Structure (ACPI 2.0+) */
    7.18 @@ -83,7 +85,7 @@ typedef struct __packed {
    7.19  typedef struct __packed {
    7.20      /* version 3+ fields: */
    7.21      uuid_t    uuid;              /* {663C8DFF-E8B3-4b82-AABF-19EA4D057A08} */
    7.22 -    uint32_t  version;           /* Version number; currently supports 0.3 */
    7.23 +    uint32_t  version;           /* Version number; currently supports 0.4 */
    7.24      uint32_t  log_addr;          /* physical addr of tb_log_t log */
    7.25      uint32_t  shutdown_entry;    /* entry point for tboot shutdown */
    7.26      uint32_t  shutdown_type;     /* type of shutdown (TB_SHUTDOWN_*) */
    7.27 @@ -94,6 +96,9 @@ typedef struct __packed {
    7.28      uint8_t   num_mac_regions;   /* number mem regions to MAC on S3 */
    7.29                                   /* contig regions memory to MAC on S3 */
    7.30      tboot_mac_region_t mac_regions[MAX_TB_MAC_REGIONS];
    7.31 +    /* version 4+ fields: */
    7.32 +                                 /* populated by tboot; will be encrypted */
    7.33 +    uint8_t   s3_key[TB_KEY_SIZE];
    7.34  } tboot_shared_t;
    7.35  
    7.36  #define TB_SHUTDOWN_REBOOT      0
    7.37 @@ -113,6 +118,7 @@ void tboot_shutdown(uint32_t shutdown_ty
    7.38  int tboot_in_measured_env(void);
    7.39  int tboot_protect_mem_regions(void);
    7.40  int tboot_parse_dmar_table(acpi_table_handler dmar_handler);
    7.41 +int tboot_s3_resume(void);
    7.42  
    7.43  #endif /* __TBOOT_H__ */
    7.44  
     8.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     8.2 +++ b/xen/include/crypto/rijndael.h	Tue Mar 03 12:48:16 2009 +0000
     8.3 @@ -0,0 +1,58 @@
     8.4 +/*	$OpenBSD: rijndael.h,v 1.13 2008/06/09 07:49:45 djm Exp $ */
     8.5 +
     8.6 +/**
     8.7 + * rijndael-alg-fst.h
     8.8 + *
     8.9 + * @version 3.0 (December 2000)
    8.10 + *
    8.11 + * Optimised ANSI C code for the Rijndael cipher (now AES)
    8.12 + *
    8.13 + * @author Vincent Rijmen <vincent.rijmen@esat.kuleuven.ac.be>
    8.14 + * @author Antoon Bosselaers <antoon.bosselaers@esat.kuleuven.ac.be>
    8.15 + * @author Paulo Barreto <paulo.barreto@terra.com.br>
    8.16 + *
    8.17 + * This code is hereby placed in the public domain.
    8.18 + *
    8.19 + * THIS SOFTWARE IS PROVIDED BY THE AUTHORS ''AS IS'' AND ANY EXPRESS
    8.20 + * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
    8.21 + * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
    8.22 + * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE
    8.23 + * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
    8.24 + * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
    8.25 + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
    8.26 + * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
    8.27 + * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE
    8.28 + * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,
    8.29 + * EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
    8.30 + */
    8.31 +#ifndef __RIJNDAEL_H
    8.32 +#define __RIJNDAEL_H
    8.33 +
    8.34 +#define AES_MAXKEYBITS	(256)
    8.35 +#define AES_MAXKEYBYTES	(AES_MAXKEYBITS/8)
    8.36 +/* for 256-bit keys, fewer for less */
    8.37 +#define AES_MAXROUNDS	14
    8.38 +
    8.39 +//typedef unsigned char	u8;
    8.40 +//typedef unsigned short	u16;
    8.41 +//typedef unsigned int	u32;
    8.42 +
    8.43 +/*  The structure for key information */
    8.44 +typedef struct {
    8.45 +	int	enc_only;		/* context contains only encrypt schedule */
    8.46 +	int	Nr;			/* key-length-dependent number of rounds */
    8.47 +	u32	ek[4*(AES_MAXROUNDS + 1)];	/* encrypt key schedule */
    8.48 +	u32	dk[4*(AES_MAXROUNDS + 1)];	/* decrypt key schedule */
    8.49 +} rijndael_ctx;
    8.50 +
    8.51 +int	 rijndael_set_key(rijndael_ctx *, const u_char *, int);
    8.52 +int	 rijndael_set_key_enc_only(rijndael_ctx *, const u_char *, int);
    8.53 +void	 rijndael_decrypt(rijndael_ctx *, const u_char *, u_char *);
    8.54 +void	 rijndael_encrypt(rijndael_ctx *, const u_char *, u_char *);
    8.55 +
    8.56 +int	rijndaelKeySetupEnc(unsigned int [], const unsigned char [], int);
    8.57 +int	rijndaelKeySetupDec(unsigned int [], const unsigned char [], int);
    8.58 +void	rijndaelEncrypt(const unsigned int [], int, const unsigned char [],
    8.59 +	    unsigned char []);
    8.60 +
    8.61 +#endif /* __RIJNDAEL_H */
     9.1 --- /dev/null	Thu Jan 01 00:00:00 1970 +0000
     9.2 +++ b/xen/include/crypto/vmac.h	Tue Mar 03 12:48:16 2009 +0000
     9.3 @@ -0,0 +1,178 @@
     9.4 +#ifndef HEADER_VMAC_H
     9.5 +#define HEADER_VMAC_H
     9.6 +
     9.7 +/* --------------------------------------------------------------------------
     9.8 + * VMAC and VHASH Implementation by Ted Krovetz (tdk@acm.org) and Wei Dai.
     9.9 + * This implementation is herby placed in the public domain.
    9.10 + * The authors offers no warranty. Use at your own risk.
    9.11 + * Please send bug reports to the authors.
    9.12 + * Last modified: 17 APR 08, 1700 PDT
    9.13 + * ----------------------------------------------------------------------- */
    9.14 +
    9.15 +/* --------------------------------------------------------------------------
    9.16 + * User definable settings.
    9.17 + * ----------------------------------------------------------------------- */
    9.18 +#define VMAC_TAG_LEN   64 /* Must be 64 or 128 - 64 sufficient for most    */
    9.19 +#define VMAC_KEY_LEN  128 /* Must be 128, 192 or 256                       */
    9.20 +#define VMAC_NHBYTES  128 /* Must 2^i for any 3 < i < 13. Standard = 128   */
    9.21 +#define VMAC_PREFER_BIG_ENDIAN  0  /* Prefer non-x86 */
    9.22 +
    9.23 +#define VMAC_USE_OPENSSL  0 /* Set to non-zero to use OpenSSL's AES        */
    9.24 +#define VMAC_CACHE_NONCES 1 /* Set to non-zero to cause caching            */
    9.25 +                            /* of consecutive nonces on 64-bit tags        */
    9.26 +
    9.27 +#define VMAC_RUN_TESTS 0  /* Set to non-zero to check vectors and speed    */
    9.28 +#define VMAC_HZ (448e6)  /* Set to hz of host machine to get speed        */
    9.29 +#define VMAC_HASH_ONLY 0  /* Set to non-zero to time hash only (not-mac)   */
    9.30 +/* Speeds of cpus I have access to
    9.31 +#define hz (2400e6)  glyme Core 2 "Conroe"
    9.32 +#define hz (2000e6)  jupiter G5
    9.33 +#define hz (1592e6)  titan
    9.34 +#define hz (2793e6)  athena/gaia
    9.35 +#define hz (1250e6)  isis G4
    9.36 +#define hz (2160e6)  imac Core 2 "Merom"
    9.37 +#define hz (266e6)   ppc/arm
    9.38 +#define hz (400e6)   mips
    9.39 +*/
    9.40 +
    9.41 +/* --------------------------------------------------------------------------
    9.42 + * This implementation uses uint32_t and uint64_t as names for unsigned 32-
    9.43 + * and 64-bit integer types. These are defined in C99 stdint.h. The
    9.44 + * following may need adaptation if you are not running a C99 or
    9.45 + * Microsoft C environment.
    9.46 + * ----------------------------------------------------------------------- */
    9.47 +#define VMAC_USE_STDINT 1  /* Set to zero if system has no stdint.h        */
    9.48 + 
    9.49 +#if VMAC_USE_STDINT && !_MSC_VER /* Try stdint.h if non-Microsoft          */
    9.50 +#ifdef  __cplusplus
    9.51 +#define __STDC_CONSTANT_MACROS
    9.52 +#endif
    9.53 +//#include <stdint.h>
    9.54 +#elif (_MSC_VER)                  /* Microsoft C does not have stdint.h    */
    9.55 +typedef unsigned __int32 uint32_t;
    9.56 +typedef unsigned __int64 uint64_t;
    9.57 +#define UINT64_C(v) v ## UI64
    9.58 +#else                             /* Guess sensibly - may need adaptation  */
    9.59 +typedef unsigned int uint32_t;
    9.60 +typedef unsigned long long uint64_t;
    9.61 +#define UINT64_C(v) v ## ULL
    9.62 +#endif
    9.63 +
    9.64 +/* --------------------------------------------------------------------------
    9.65 + * This implementation supports two free AES implementations: OpenSSL's and
    9.66 + * Paulo Barreto's. To use OpenSSL's, you will need to include the OpenSSL
    9.67 + * crypto library (eg, gcc -lcrypto foo.c). For Barreto's, you will need
    9.68 + * to compile rijndael-alg-fst.c, last seen at http://www.iaik.tu-graz.ac.at/
    9.69 + * research/krypto/AES/old/~rijmen/rijndael/rijndael-fst-3.0.zip and
    9.70 + * http://homes.esat.kuleuven.be/~rijmen/rijndael/rijndael-fst-3.0.zip.
    9.71 + * To use a different implementation, use these definitions as a model.
    9.72 + * ----------------------------------------------------------------------- */
    9.73 +#if VMAC_USE_OPENSSL
    9.74 +
    9.75 +#include <openssl/aes.h>
    9.76 +typedef AES_KEY aes_int_key;
    9.77 +
    9.78 +#define aes_encryption(in,out,int_key)                  \
    9.79 +	    	AES_encrypt((unsigned char *)(in),(unsigned char *)(out),(int_key))
    9.80 +#define aes_key_setup(key,int_key)                      \
    9.81 +	    	AES_set_encrypt_key((key),VMAC_KEY_LEN,(int_key))
    9.82 +
    9.83 +#else
    9.84 +
    9.85 +//#include "rijndael-alg-fst.h"
    9.86 +typedef uint64_t  vmac_t;
    9.87 +#include "rijndael.h"
    9.88 +typedef u32 aes_int_key[4*(VMAC_KEY_LEN/32+7)];
    9.89 +
    9.90 +#define aes_encryption(in,out,int_key)                  \
    9.91 +	    	rijndaelEncrypt((u32 *)(int_key),           \
    9.92 +	                        ((VMAC_KEY_LEN/32)+6),      \
    9.93 +	    				    (u8 *)(in), (u8 *)(out))
    9.94 +#define aes_key_setup(user_key,int_key)                 \
    9.95 +	    	rijndaelKeySetupEnc((u32 *)(int_key),       \
    9.96 +	    	                    (u8 *)(user_key), \
    9.97 +	    	                    VMAC_KEY_LEN)
    9.98 +#endif
    9.99 +
   9.100 +/* --------------------------------------------------------------------- */
   9.101 +
   9.102 +typedef struct {
   9.103 +	uint64_t nhkey  [(VMAC_NHBYTES/8)+2*(VMAC_TAG_LEN/64-1)];
   9.104 +	uint64_t polykey[2*VMAC_TAG_LEN/64];
   9.105 +	uint64_t l3key  [2*VMAC_TAG_LEN/64];
   9.106 +	uint64_t polytmp[2*VMAC_TAG_LEN/64];
   9.107 +	aes_int_key cipher_key;
   9.108 +	#if (VMAC_TAG_LEN == 64) && (VMAC_CACHE_NONCES)
   9.109 +	uint64_t cached_nonce[2];
   9.110 +	uint64_t cached_aes[2];
   9.111 +	#endif
   9.112 +	int first_block_processed;
   9.113 +} vmac_ctx_t;
   9.114 +
   9.115 +/* --------------------------------------------------------------------- */
   9.116 +#ifdef  __cplusplus
   9.117 +extern "C" {
   9.118 +#endif
   9.119 +/* --------------------------------------------------------------------------
   9.120 + *                        <<<<< USAGE NOTES >>>>>
   9.121 + *
   9.122 + * Given msg m (mbytes in length) and nonce buffer n
   9.123 + * this function returns a tag as its output. The tag is returned as
   9.124 + * a number. When VMAC_TAG_LEN == 64, the 'return'ed integer is the tag,
   9.125 + * and *tagl is meaningless. When VMAC_TAG_LEN == 128 the tag is the
   9.126 + * number y * 2^64 + *tagl where y is the function's return value.
   9.127 + * If you want to consider tags to be strings, then you must do so with
   9.128 + * an agreed upon endian orientation for interoperability, and convert
   9.129 + * the results appropriately. VHASH hashes m without creating any tag.
   9.130 + * Consecutive substrings forming a prefix of a message may be passed
   9.131 + * to vhash_update, with vhash or vmac being called with the remainder
   9.132 + * to produce the output.
   9.133 + *
   9.134 + * Requirements:
   9.135 + * - On 32-bit architectures with SSE2 instructions, ctx and m MUST be
   9.136 + *   begin on 16-byte memory boundaries.
   9.137 + * - m MUST be your message followed by zeroes to the nearest 16-byte
   9.138 + *   boundary. If m is a length multiple of 16 bytes, then it is already
   9.139 + *   at a 16-byte boundary and needs no padding. mbytes should be your
   9.140 + *   message length without any padding. 
   9.141 + * - The first bit of the nonce buffer n must be 0. An i byte nonce, is made
   9.142 + *   as the first 16-i bytes of n being zero, and the final i the nonce.
   9.143 + * - vhash_update MUST have mbytes be a positive multiple of VMAC_NHBYTES
   9.144 + * ----------------------------------------------------------------------- */
   9.145 +
   9.146 +#define vmac_update vhash_update
   9.147 +
   9.148 +void vhash_update(unsigned char m[],
   9.149 +          unsigned int mbytes,
   9.150 +          vmac_ctx_t *ctx);
   9.151 +
   9.152 +uint64_t vmac(unsigned char m[],
   9.153 +         unsigned int mbytes,
   9.154 +         unsigned char n[16],
   9.155 +         uint64_t *tagl,
   9.156 +         vmac_ctx_t *ctx);
   9.157 +
   9.158 +uint64_t vhash(unsigned char m[],
   9.159 +          unsigned int mbytes,
   9.160 +          uint64_t *tagl,
   9.161 +          vmac_ctx_t *ctx);
   9.162 +
   9.163 +/* --------------------------------------------------------------------------
   9.164 + * When passed a VMAC_KEY_LEN bit user_key, this function initialazies ctx.
   9.165 + * ----------------------------------------------------------------------- */
   9.166 +
   9.167 +void vmac_set_key(unsigned char user_key[], vmac_ctx_t *ctx);
   9.168 +
   9.169 +/* --------------------------------------------------------------------------
   9.170 + * This function aborts current hash and resets ctx, ready for a new message.
   9.171 + * ----------------------------------------------------------------------- */
   9.172 +
   9.173 +void vhash_abort(vmac_ctx_t *ctx);
   9.174 +
   9.175 +/* --------------------------------------------------------------------- */
   9.176 +
   9.177 +#ifdef  __cplusplus
   9.178 +}
   9.179 +#endif
   9.180 +
   9.181 +#endif /* HEADER_AES_H */