FreeBSD/Linux Kernel Cross Reference
sys/contrib/openzfs/module/icp/asm-x86_64/aes/aesopt.h

     /*
      * ---------------------------------------------------------------------------
      * Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.
      *
      * LICENSE TERMS
      *
      * The free distribution and use of this software is allowed (with or without
      * changes) provided that:
      *
     *  1. source code distributions include the above copyright notice, this
     *      list of conditions and the following disclaimer;
     *
     *  2. binary distributions include the above copyright notice, this list
     *      of conditions and the following disclaimer in their documentation;
     *
     *  3. the name of the copyright holder is not used to endorse products
     *      built using this software without specific written permission.
     *
     * DISCLAIMER
     *
     * This software is provided 'as is' with no explicit or implied warranties
     * in respect of its properties, including, but not limited to, correctness
     * and/or fitness for purpose.
     * ---------------------------------------------------------------------------
     * Issue Date: 20/12/2007
     *
     * This file contains the compilation options for AES (Rijndael) and code
     * that is common across encryption, key scheduling and table generation.
     *
     * OPERATION
     *
     * These source code files implement the AES algorithm Rijndael designed by
     * Joan Daemen and Vincent Rijmen. This version is designed for the standard
     * block size of 16 bytes and for key sizes of 128, 192 and 256 bits (16, 24
     * and 32 bytes).
     *
     * This version is designed for flexibility and speed using operations on
     * 32-bit words rather than operations on bytes.  It can be compiled with
     * either big or little endian internal byte order but is faster when the
     * native byte order for the processor is used.
     *
     * THE CIPHER INTERFACE
     *
     * The cipher interface is implemented as an array of bytes in which lower
     * AES bit sequence indexes map to higher numeric significance within bytes.
     */
    
    /*
     * OpenSolaris changes
     * 1. Added __cplusplus and _AESTAB_H header guards
     * 2. Added header files sys/types.h and aes_impl.h
     * 3. Added defines for AES_ENCRYPT, AES_DECRYPT, AES_REV_DKS, and ASM_AMD64_C
     * 4. Moved defines for IS_BIG_ENDIAN, IS_LITTLE_ENDIAN, PLATFORM_BYTE_ORDER
     *    from brg_endian.h
     * 5. Undefined VIA_ACE_POSSIBLE and ASSUME_VIA_ACE_PRESENT
     * 6. Changed uint_8t and uint_32t to uint8_t and uint32_t
     * 7. Defined aes_sw32 as htonl() for byte swapping
     * 8. Cstyled and hdrchk code
     *
     */
    
    #ifndef _AESOPT_H
    #define _AESOPT_H
    
    #ifdef  __cplusplus
    extern "C" {
    #endif
    
    #include <sys/zfs_context.h>
    #include <aes/aes_impl.h>
    
    /*  SUPPORT FEATURES */
    #define AES_ENCRYPT /* if support for encryption is needed */
    #define AES_DECRYPT /* if support for decryption is needed */
    
    /*  PLATFORM-SPECIFIC FEATURES */
    #define IS_BIG_ENDIAN           4321 /* byte 0 is most significant (mc68k) */
    #define IS_LITTLE_ENDIAN        1234 /* byte 0 is least significant (i386) */
    #define PLATFORM_BYTE_ORDER     IS_LITTLE_ENDIAN
    #define AES_REV_DKS /* define to reverse decryption key schedule */
    
    
    /*
     *  CONFIGURATION - THE USE OF DEFINES
     *      Later in this section there are a number of defines that control the
     *      operation of the code.  In each section, the purpose of each define is
     *      explained so that the relevant form can be included or excluded by
     *      setting either 1's or 0's respectively on the branches of the related
     *      #if clauses.  The following local defines should not be changed.
     */
    
    #define ENCRYPTION_IN_C 1
    #define DECRYPTION_IN_C 2
    #define ENC_KEYING_IN_C 4
    #define DEC_KEYING_IN_C 8
    
    #define NO_TABLES       0
    #define ONE_TABLE       1
    #define FOUR_TABLES     4
   #define NONE            0
   #define PARTIAL         1
   #define FULL            2
   
   /*  --- START OF USER CONFIGURED OPTIONS --- */
   
   /*
    *  1. BYTE ORDER WITHIN 32 BIT WORDS
    *
    *      The fundamental data processing units in Rijndael are 8-bit bytes. The
    *      input, output and key input are all enumerated arrays of bytes in which
    *      bytes are numbered starting at zero and increasing to one less than the
    *      number of bytes in the array in question. This enumeration is only used
    *      for naming bytes and does not imply any adjacency or order relationship
    *      from one byte to another. When these inputs and outputs are considered
    *      as bit sequences, bits 8*n to 8*n+7 of the bit sequence are mapped to
    *      byte[n] with bit 8n+i in the sequence mapped to bit 7-i within the byte.
    *      In this implementation bits are numbered from 0 to 7 starting at the
    *      numerically least significant end of each byte.  Bit n represents 2^n.
    *
    *      However, Rijndael can be implemented more efficiently using 32-bit
    *      words by packing bytes into words so that bytes 4*n to 4*n+3 are placed
    *      into word[n]. While in principle these bytes can be assembled into words
    *      in any positions, this implementation only supports the two formats in
    *      which bytes in adjacent positions within words also have adjacent byte
    *      numbers. This order is called big-endian if the lowest numbered bytes
    *      in words have the highest numeric significance and little-endian if the
    *      opposite applies.
    *
    *      This code can work in either order irrespective of the order used by the
    *      machine on which it runs. Normally the internal byte order will be set
    *      to the order of the processor on which the code is to be run but this
    *      define  can be used to reverse this in special situations
    *
    *      WARNING: Assembler code versions rely on PLATFORM_BYTE_ORDER being set.
    *      This define will hence be redefined later (in section 4) if necessary
    */
   
   #if 1
   #define ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
   #elif 0
   #define ALGORITHM_BYTE_ORDER IS_LITTLE_ENDIAN
   #elif 0
   #define ALGORITHM_BYTE_ORDER IS_BIG_ENDIAN
   #else
   #error The algorithm byte order is not defined
   #endif
   
   /*  2. VIA ACE SUPPORT */
   
   #if defined(__GNUC__) && defined(__i386__) || \
           defined(_WIN32) && defined(_M_IX86) && \
           !(defined(_WIN64) || defined(_WIN32_WCE) || \
           defined(_MSC_VER) && (_MSC_VER <= 800))
   #define VIA_ACE_POSSIBLE
   #endif
   
   /*
    *  Define this option if support for the VIA ACE is required. This uses
    *  inline assembler instructions and is only implemented for the Microsoft,
    *  Intel and GCC compilers.  If VIA ACE is known to be present, then defining
    *  ASSUME_VIA_ACE_PRESENT will remove the ordinary encryption/decryption
    *  code.  If USE_VIA_ACE_IF_PRESENT is defined then VIA ACE will be used if
    *  it is detected (both present and enabled) but the normal AES code will
    *  also be present.
    *
    *  When VIA ACE is to be used, all AES encryption contexts MUST be 16 byte
    *  aligned; other input/output buffers do not need to be 16 byte aligned
    *  but there are very large performance gains if this can be arranged.
    *  VIA ACE also requires the decryption key schedule to be in reverse
    *  order (which later checks below ensure).
    */
   
   /*  VIA ACE is not used here for OpenSolaris: */
   #undef  VIA_ACE_POSSIBLE
   #undef  ASSUME_VIA_ACE_PRESENT
   
   #if 0 && defined(VIA_ACE_POSSIBLE) && !defined(USE_VIA_ACE_IF_PRESENT)
   #define USE_VIA_ACE_IF_PRESENT
   #endif
   
   #if 0 && defined(VIA_ACE_POSSIBLE) && !defined(ASSUME_VIA_ACE_PRESENT)
   #define ASSUME_VIA_ACE_PRESENT
   #endif
   
   
   /*
    *  3. ASSEMBLER SUPPORT
    *
    *      This define (which can be on the command line) enables the use of the
    *      assembler code routines for encryption, decryption and key scheduling
    *      as follows:
    *
    *      ASM_X86_V1C uses the assembler (aes_x86_v1.asm) with large tables for
    *              encryption and decryption and but with key scheduling in C
    *      ASM_X86_V2  uses assembler (aes_x86_v2.asm) with compressed tables for
    *              encryption, decryption and key scheduling
    *      ASM_X86_V2C uses assembler (aes_x86_v2.asm) with compressed tables for
    *              encryption and decryption and but with key scheduling in C
    *      ASM_AMD64_C uses assembler (aes_amd64.asm) with compressed tables for
    *              encryption and decryption and but with key scheduling in C
    *
    *      Change one 'if 0' below to 'if 1' to select the version or define
    *      as a compilation option.
    */
   
   #if 0 && !defined(ASM_X86_V1C)
   #define ASM_X86_V1C
   #elif 0 && !defined(ASM_X86_V2)
   #define ASM_X86_V2
   #elif 0 && !defined(ASM_X86_V2C)
   #define ASM_X86_V2C
   #elif 1 && !defined(ASM_AMD64_C)
   #define ASM_AMD64_C
   #endif
   
   #if (defined(ASM_X86_V1C) || defined(ASM_X86_V2) || defined(ASM_X86_V2C)) && \
           !defined(_M_IX86) || defined(ASM_AMD64_C) && !defined(_M_X64) && \
           !defined(__amd64)
   #error Assembler code is only available for x86 and AMD64 systems
   #endif
   
   /*
    *  4. FAST INPUT/OUTPUT OPERATIONS.
    *
    *      On some machines it is possible to improve speed by transferring the
    *      bytes in the input and output arrays to and from the internal 32-bit
    *      variables by addressing these arrays as if they are arrays of 32-bit
    *      words.  On some machines this will always be possible but there may
    *      be a large performance penalty if the byte arrays are not aligned on
    *      the normal word boundaries. On other machines this technique will
    *      lead to memory access errors when such 32-bit word accesses are not
    *      properly aligned. The option SAFE_IO avoids such problems but will
    *      often be slower on those machines that support misaligned access
    *      (especially so if care is taken to align the input  and output byte
    *      arrays on 32-bit word boundaries). If SAFE_IO is not defined it is
    *      assumed that access to byte arrays as if they are arrays of 32-bit
    *      words will not cause problems when such accesses are misaligned.
    */
   #if 1 && !defined(_MSC_VER)
   #define SAFE_IO
   #endif
   
   /*
    *  5. LOOP UNROLLING
    *
    *      The code for encryption and decryption cycles through a number of rounds
    *      that can be implemented either in a loop or by expanding the code into a
    *      long sequence of instructions, the latter producing a larger program but
    *      one that will often be much faster. The latter is called loop unrolling.
    *      There are also potential speed advantages in expanding two iterations in
    *      a loop with half the number of iterations, which is called partial loop
    *      unrolling.  The following options allow partial or full loop unrolling
    *      to be set independently for encryption and decryption
    */
   #if 1
   #define ENC_UNROLL  FULL
   #elif 0
   #define ENC_UNROLL  PARTIAL
   #else
   #define ENC_UNROLL  NONE
   #endif
   
   #if 1
   #define DEC_UNROLL  FULL
   #elif 0
   #define DEC_UNROLL  PARTIAL
   #else
   #define DEC_UNROLL  NONE
   #endif
   
   #if 1
   #define ENC_KS_UNROLL
   #endif
   
   #if 1
   #define DEC_KS_UNROLL
   #endif
   
   /*
    *  6. FAST FINITE FIELD OPERATIONS
    *
    *      If this section is included, tables are used to provide faster finite
    *      field arithmetic.  This has no effect if FIXED_TABLES is defined.
    */
   #if 1
   #define FF_TABLES
   #endif
   
   /*
    *  7. INTERNAL STATE VARIABLE FORMAT
    *
    *      The internal state of Rijndael is stored in a number of local 32-bit
    *      word variables which can be defined either as an array or as individual
    *      names variables. Include this section if you want to store these local
    *      variables in arrays. Otherwise individual local variables will be used.
    */
   #if 1
   #define ARRAYS
   #endif
   
   /*
    *  8. FIXED OR DYNAMIC TABLES
    *
    *      When this section is included the tables used by the code are compiled
    *      statically into the binary file.  Otherwise the subroutine aes_init()
    *      must be called to compute them before the code is first used.
    */
   #if 1 && !(defined(_MSC_VER) && (_MSC_VER <= 800))
   #define FIXED_TABLES
   #endif
   
   /*
    *  9. MASKING OR CASTING FROM LONGER VALUES TO BYTES
    *
    *      In some systems it is better to mask longer values to extract bytes
    *      rather than using a cast. This option allows this choice.
    */
   #if 0
   #define to_byte(x)  ((uint8_t)(x))
   #else
   #define to_byte(x)  ((x) & 0xff)
   #endif
   
   /*
    *  10. TABLE ALIGNMENT
    *
    *      On some systems speed will be improved by aligning the AES large lookup
    *      tables on particular boundaries. This define should be set to a power of
    *      two giving the desired alignment. It can be left undefined if alignment
    *      is not needed.  This option is specific to the Microsoft VC++ compiler -
    *      it seems to sometimes cause trouble for the VC++ version 6 compiler.
    */
   
   #if 1 && defined(_MSC_VER) && (_MSC_VER >= 1300)
   #define TABLE_ALIGN 32
   #endif
   
   /*
    *  11.  REDUCE CODE AND TABLE SIZE
    *
    *      This replaces some expanded macros with function calls if AES_ASM_V2 or
    *      AES_ASM_V2C are defined
    */
   
   #if 1 && (defined(ASM_X86_V2) || defined(ASM_X86_V2C))
   #define REDUCE_CODE_SIZE
   #endif
   
   /*
    *  12. TABLE OPTIONS
    *
    *      This cipher proceeds by repeating in a number of cycles known as rounds
    *      which are implemented by a round function which is optionally be speeded
    *      up using tables.  The basic tables are 256 32-bit words, with either
    *      one or four tables being required for each round function depending on
    *      how much speed is required. Encryption and decryption round functions
    *      are different and the last encryption and decryption round functions are
    *      different again making four different round functions in all.
    *
    *      This means that:
    *      1. Normal encryption and decryption rounds can each use either 0, 1
    *              or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
    *      2. The last encryption and decryption rounds can also use either 0, 1
    *              or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
    *
    *      Include or exclude the appropriate definitions below to set the number
    *      of tables used by this implementation.
    */
   
   #if 1   /* set tables for the normal encryption round */
   #define ENC_ROUND   FOUR_TABLES
   #elif 0
   #define ENC_ROUND   ONE_TABLE
   #else
   #define ENC_ROUND   NO_TABLES
   #endif
   
   #if 1   /* set tables for the last encryption round */
   #define LAST_ENC_ROUND  FOUR_TABLES
   #elif 0
   #define LAST_ENC_ROUND  ONE_TABLE
   #else
   #define LAST_ENC_ROUND  NO_TABLES
   #endif
   
   #if 1   /* set tables for the normal decryption round */
   #define DEC_ROUND   FOUR_TABLES
   #elif 0
   #define DEC_ROUND   ONE_TABLE
   #else
   #define DEC_ROUND   NO_TABLES
   #endif
   
   #if 1   /* set tables for the last decryption round */
   #define LAST_DEC_ROUND  FOUR_TABLES
   #elif 0
   #define LAST_DEC_ROUND  ONE_TABLE
   #else
   #define LAST_DEC_ROUND  NO_TABLES
   #endif
   
   /*
    *  The decryption key schedule can be speeded up with tables in the same
    *      way that the round functions can.  Include or exclude the following
    *      defines to set this requirement.
    */
   #if 1
   #define KEY_SCHED   FOUR_TABLES
   #elif 0
   #define KEY_SCHED   ONE_TABLE
   #else
   #define KEY_SCHED   NO_TABLES
   #endif
   
   /*  ---- END OF USER CONFIGURED OPTIONS ---- */
   
   /* VIA ACE support is only available for VC++ and GCC */
   
   #if !defined(_MSC_VER) && !defined(__GNUC__)
   #if defined(ASSUME_VIA_ACE_PRESENT)
   #undef ASSUME_VIA_ACE_PRESENT
   #endif
   #if defined(USE_VIA_ACE_IF_PRESENT)
   #undef USE_VIA_ACE_IF_PRESENT
   #endif
   #endif
   
   #if defined(ASSUME_VIA_ACE_PRESENT) && !defined(USE_VIA_ACE_IF_PRESENT)
   #define USE_VIA_ACE_IF_PRESENT
   #endif
   
   #if defined(USE_VIA_ACE_IF_PRESENT) && !defined(AES_REV_DKS)
   #define AES_REV_DKS
   #endif
   
   /* Assembler support requires the use of platform byte order */
   
   #if (defined(ASM_X86_V1C) || defined(ASM_X86_V2C) || defined(ASM_AMD64_C)) && \
           (ALGORITHM_BYTE_ORDER != PLATFORM_BYTE_ORDER)
   #undef  ALGORITHM_BYTE_ORDER
   #define ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
   #endif
   
   /*
    * In this implementation the columns of the state array are each held in
    *      32-bit words. The state array can be held in various ways: in an array
    *      of words, in a number of individual word variables or in a number of
    *      processor registers. The following define maps a variable name x and
    *      a column number c to the way the state array variable is to be held.
    *      The first define below maps the state into an array x[c] whereas the
    *      second form maps the state into a number of individual variables x0,
    *      x1, etc.  Another form could map individual state columns to machine
    *      register names.
    */
   
   #if defined(ARRAYS)
   #define s(x, c) x[c]
   #else
   #define s(x, c) x##c
   #endif
   
   /*
    *  This implementation provides subroutines for encryption, decryption
    *      and for setting the three key lengths (separately) for encryption
    *      and decryption. Since not all functions are needed, masks are set
    *      up here to determine which will be implemented in C
    */
   
   #if !defined(AES_ENCRYPT)
   #define EFUNCS_IN_C   0
   #elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
           defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
   #define EFUNCS_IN_C   ENC_KEYING_IN_C
   #elif !defined(ASM_X86_V2)
   #define EFUNCS_IN_C   (ENCRYPTION_IN_C | ENC_KEYING_IN_C)
   #else
   #define EFUNCS_IN_C   0
   #endif
   
   #if !defined(AES_DECRYPT)
   #define DFUNCS_IN_C   0
   #elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
           defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
   #define DFUNCS_IN_C   DEC_KEYING_IN_C
   #elif !defined(ASM_X86_V2)
   #define DFUNCS_IN_C   (DECRYPTION_IN_C | DEC_KEYING_IN_C)
   #else
   #define DFUNCS_IN_C   0
   #endif
   
   #define FUNCS_IN_C  (EFUNCS_IN_C | DFUNCS_IN_C)
   
   /* END OF CONFIGURATION OPTIONS */
   
   /* Disable or report errors on some combinations of options */
   
   #if ENC_ROUND == NO_TABLES && LAST_ENC_ROUND != NO_TABLES
   #undef  LAST_ENC_ROUND
   #define LAST_ENC_ROUND  NO_TABLES
   #elif ENC_ROUND == ONE_TABLE && LAST_ENC_ROUND == FOUR_TABLES
   #undef  LAST_ENC_ROUND
   #define LAST_ENC_ROUND  ONE_TABLE
   #endif
   
   #if ENC_ROUND == NO_TABLES && ENC_UNROLL != NONE
   #undef  ENC_UNROLL
   #define ENC_UNROLL  NONE
   #endif
   
   #if DEC_ROUND == NO_TABLES && LAST_DEC_ROUND != NO_TABLES
   #undef  LAST_DEC_ROUND
   #define LAST_DEC_ROUND  NO_TABLES
   #elif DEC_ROUND == ONE_TABLE && LAST_DEC_ROUND == FOUR_TABLES
   #undef  LAST_DEC_ROUND
   #define LAST_DEC_ROUND  ONE_TABLE
   #endif
   
   #if DEC_ROUND == NO_TABLES && DEC_UNROLL != NONE
   #undef  DEC_UNROLL
   #define DEC_UNROLL  NONE
   #endif
   
   #if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
   #define aes_sw32        htonl
   #elif defined(bswap32)
   #define aes_sw32        bswap32
   #elif defined(bswap_32)
   #define aes_sw32        bswap_32
   #else
   #define brot(x, n)  (((uint32_t)(x) << (n)) | ((uint32_t)(x) >> (32 - (n))))
   #define aes_sw32(x) ((brot((x), 8) & 0x00ff00ff) | (brot((x), 24) & 0xff00ff00))
   #endif
   
   
   /*
    *      upr(x, n):  rotates bytes within words by n positions, moving bytes to
    *              higher index positions with wrap around into low positions
    *      ups(x, n):  moves bytes by n positions to higher index positions in
    *              words but without wrap around
    *      bval(x, n): extracts a byte from a word
    *
    *      WARNING:   The definitions given here are intended only for use with
    *              unsigned variables and with shift counts that are compile
    *              time constants
    */
   
   #if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
   #define upr(x, n)       (((uint32_t)(x) << (8 * (n))) | \
                           ((uint32_t)(x) >> (32 - 8 * (n))))
   #define ups(x, n)       ((uint32_t)(x) << (8 * (n)))
   #define bval(x, n)      to_byte((x) >> (8 * (n)))
   #define bytes2word(b0, b1, b2, b3)  \
                   (((uint32_t)(b3) << 24) | ((uint32_t)(b2) << 16) | \
                   ((uint32_t)(b1) << 8) | (b0))
   #endif
   
   #if (ALGORITHM_BYTE_ORDER == IS_BIG_ENDIAN)
   #define upr(x, n)       (((uint32_t)(x) >> (8 * (n))) | \
                           ((uint32_t)(x) << (32 - 8 * (n))))
   #define ups(x, n)       ((uint32_t)(x) >> (8 * (n)))
   #define bval(x, n)      to_byte((x) >> (24 - 8 * (n)))
   #define bytes2word(b0, b1, b2, b3)  \
                   (((uint32_t)(b0) << 24) | ((uint32_t)(b1) << 16) | \
                   ((uint32_t)(b2) << 8) | (b3))
   #endif
   
   #if defined(SAFE_IO)
   #define word_in(x, c)   bytes2word(((const uint8_t *)(x) + 4 * c)[0], \
                                   ((const uint8_t *)(x) + 4 * c)[1], \
                                   ((const uint8_t *)(x) + 4 * c)[2], \
                                   ((const uint8_t *)(x) + 4 * c)[3])
   #define word_out(x, c, v) { ((uint8_t *)(x) + 4 * c)[0] = bval(v, 0); \
                           ((uint8_t *)(x) + 4 * c)[1] = bval(v, 1); \
                           ((uint8_t *)(x) + 4 * c)[2] = bval(v, 2); \
                           ((uint8_t *)(x) + 4 * c)[3] = bval(v, 3); }
   #elif (ALGORITHM_BYTE_ORDER == PLATFORM_BYTE_ORDER)
   #define word_in(x, c)   (*((uint32_t *)(x) + (c)))
   #define word_out(x, c, v) (*((uint32_t *)(x) + (c)) = (v))
   #else
   #define word_in(x, c)   aes_sw32(*((uint32_t *)(x) + (c)))
   #define word_out(x, c, v) (*((uint32_t *)(x) + (c)) = aes_sw32(v))
   #endif
   
   /* the finite field modular polynomial and elements */
   
   #define WPOLY   0x011b
   #define BPOLY   0x1b
   
   /* multiply four bytes in GF(2^8) by 'x' {02} in parallel */
   
   #define m1  0x80808080
   #define m2  0x7f7f7f7f
   #define gf_mulx(x)  ((((x) & m2) << 1) ^ ((((x) & m1) >> 7) * BPOLY))
   
   /*
    * The following defines provide alternative definitions of gf_mulx that might
    * give improved performance if a fast 32-bit multiply is not available. Note
    * that a temporary variable u needs to be defined where gf_mulx is used.
    *
    * #define      gf_mulx(x) (u = (x) & m1, u |= (u >> 1), ((x) & m2) << 1) ^ \
    *                      ((u >> 3) | (u >> 6))
    * #define      m4  (0x01010101 * BPOLY)
    * #define      gf_mulx(x) (u = (x) & m1, ((x) & m2) << 1) ^ ((u - (u >> 7)) \
    *                      & m4)
    */
   
   /* Work out which tables are needed for the different options   */
   
   #if defined(ASM_X86_V1C)
   #if defined(ENC_ROUND)
   #undef  ENC_ROUND
   #endif
   #define ENC_ROUND   FOUR_TABLES
   #if defined(LAST_ENC_ROUND)
   #undef  LAST_ENC_ROUND
   #endif
   #define LAST_ENC_ROUND  FOUR_TABLES
   #if defined(DEC_ROUND)
   #undef  DEC_ROUND
   #endif
   #define DEC_ROUND   FOUR_TABLES
   #if defined(LAST_DEC_ROUND)
   #undef  LAST_DEC_ROUND
   #endif
   #define LAST_DEC_ROUND  FOUR_TABLES
   #if defined(KEY_SCHED)
   #undef  KEY_SCHED
   #define KEY_SCHED   FOUR_TABLES
   #endif
   #endif
   
   #if (FUNCS_IN_C & ENCRYPTION_IN_C) || defined(ASM_X86_V1C)
   #if ENC_ROUND == ONE_TABLE
   #define FT1_SET
   #elif ENC_ROUND == FOUR_TABLES
   #define FT4_SET
   #else
   #define SBX_SET
   #endif
   #if LAST_ENC_ROUND == ONE_TABLE
   #define FL1_SET
   #elif LAST_ENC_ROUND == FOUR_TABLES
   #define FL4_SET
   #elif !defined(SBX_SET)
   #define SBX_SET
   #endif
   #endif
   
   #if (FUNCS_IN_C & DECRYPTION_IN_C) || defined(ASM_X86_V1C)
   #if DEC_ROUND == ONE_TABLE
   #define IT1_SET
   #elif DEC_ROUND == FOUR_TABLES
   #define IT4_SET
   #else
   #define ISB_SET
   #endif
   #if LAST_DEC_ROUND == ONE_TABLE
   #define IL1_SET
   #elif LAST_DEC_ROUND == FOUR_TABLES
   #define IL4_SET
   #elif !defined(ISB_SET)
   #define ISB_SET
   #endif
   #endif
   
   
   #if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
           defined(ASM_X86_V2C)))
   #if ((FUNCS_IN_C & ENC_KEYING_IN_C) || (FUNCS_IN_C & DEC_KEYING_IN_C))
   #if KEY_SCHED == ONE_TABLE
   #if !defined(FL1_SET) && !defined(FL4_SET)
   #define LS1_SET
   #endif
   #elif KEY_SCHED == FOUR_TABLES
   #if !defined(FL4_SET)
   #define LS4_SET
   #endif
   #elif !defined(SBX_SET)
   #define SBX_SET
   #endif
   #endif
   #if (FUNCS_IN_C & DEC_KEYING_IN_C)
   #if KEY_SCHED == ONE_TABLE
   #define IM1_SET
   #elif KEY_SCHED == FOUR_TABLES
   #define IM4_SET
   #elif !defined(SBX_SET)
   #define SBX_SET
   #endif
   #endif
   #endif
   
   /* generic definitions of Rijndael macros that use tables */
   
   #define no_table(x, box, vf, rf, c) bytes2word(\
           box[bval(vf(x, 0, c), rf(0, c))], \
           box[bval(vf(x, 1, c), rf(1, c))], \
           box[bval(vf(x, 2, c), rf(2, c))], \
           box[bval(vf(x, 3, c), rf(3, c))])
   
   #define one_table(x, op, tab, vf, rf, c) \
           (tab[bval(vf(x, 0, c), rf(0, c))] \
           ^ op(tab[bval(vf(x, 1, c), rf(1, c))], 1) \
           ^ op(tab[bval(vf(x, 2, c), rf(2, c))], 2) \
           ^ op(tab[bval(vf(x, 3, c), rf(3, c))], 3))
   
   #define four_tables(x, tab, vf, rf, c) \
           (tab[0][bval(vf(x, 0, c), rf(0, c))] \
           ^ tab[1][bval(vf(x, 1, c), rf(1, c))] \
           ^ tab[2][bval(vf(x, 2, c), rf(2, c))] \
           ^ tab[3][bval(vf(x, 3, c), rf(3, c))])
   
   #define vf1(x, r, c)    (x)
   #define rf1(r, c)       (r)
   #define rf2(r, c)       ((8+r-c)&3)
   
   /*
    * Perform forward and inverse column mix operation on four bytes in long word
    * x in parallel. NOTE: x must be a simple variable, NOT an expression in
    * these macros.
    */
   
   #if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
           defined(ASM_X86_V2C)))
   
   #if defined(FM4_SET)    /* not currently used */
   #define fwd_mcol(x)     four_tables(x, t_use(f, m), vf1, rf1, 0)
   #elif defined(FM1_SET)  /* not currently used */
   #define fwd_mcol(x)     one_table(x, upr, t_use(f, m), vf1, rf1, 0)
   #else
   #define dec_fmvars      uint32_t g2
   #define fwd_mcol(x)     (g2 = gf_mulx(x), g2 ^ upr((x) ^ g2, 3) ^ \
                                   upr((x), 2) ^ upr((x), 1))
   #endif
   
   #if defined(IM4_SET)
   #define inv_mcol(x)     four_tables(x, t_use(i, m), vf1, rf1, 0)
   #elif defined(IM1_SET)
   #define inv_mcol(x)     one_table(x, upr, t_use(i, m), vf1, rf1, 0)
   #else
   #define dec_imvars      uint32_t g2, g4, g9
   #define inv_mcol(x)     (g2 = gf_mulx(x), g4 = gf_mulx(g2), g9 = \
                                   (x) ^ gf_mulx(g4), g4 ^= g9, \
                                   (x) ^ g2 ^ g4 ^ upr(g2 ^ g9, 3) ^ \
                                   upr(g4, 2) ^ upr(g9, 1))
   #endif
   
   #if defined(FL4_SET)
   #define ls_box(x, c)    four_tables(x, t_use(f, l), vf1, rf2, c)
   #elif defined(LS4_SET)
   #define ls_box(x, c)    four_tables(x, t_use(l, s), vf1, rf2, c)
   #elif defined(FL1_SET)
   #define ls_box(x, c)    one_table(x, upr, t_use(f, l), vf1, rf2, c)
   #elif defined(LS1_SET)
   #define ls_box(x, c)    one_table(x, upr, t_use(l, s), vf1, rf2, c)
   #else
   #define ls_box(x, c)    no_table(x, t_use(s, box), vf1, rf2, c)
   #endif
   
   #endif
   
   #if defined(ASM_X86_V1C) && defined(AES_DECRYPT) && !defined(ISB_SET)
   #define ISB_SET
   #endif
   
   #ifdef  __cplusplus
   }
   #endif
   
   #endif  /* _AESOPT_H */

Cache object: 438c2ae5d3195ca7215b29f09e98fa0d