Skip to contentSkip to conversation

camellia: cleanup, de-unrolling, and 64bit-ization

PATCH0/5 In review Denys Vlasenko 5 participants 40 messages Oct 25, 2007 – Nov 21, 2007 Crypto API

lore
Share & tools
lore

Denys Vlasenko

author
#0 lore raw

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia1.diff:
Move code blocks around so that related pieces are closer together:
e.g. CAMELLIA_ROUNDSM macro does not need to be separated from the rest of the code by huge array of constants.

Remove unused macros (COPY4WORD, SWAP4WORD, XOR4WORD[2])

Drop SUBL(), SUBR() macros which only obscure things. Same for CAMELLIA_SP1110() macro and KEY_TABLE_TYPE typedef.

Remove useless comments:
/* encryption */ -- well it's obvious enough already! void camellia_encrypt128(...)

Combine swap with copying at the beginning/end of encrypt/decrypt.

camellia2.diff
Rename some macros to shorter names: CAMELLIA_RR8 -> ROR8, making it easier to understand that it is just a right rotation, nothing camellia-specific in it.
CAMELLIA_SUBKEY_L() -> SUBKEY_L() - just shorter.

Move be32 <-> cpu conversions out of en/decrypt128/256 and into camellia_en/decrypt - no reason to have that code duplicated twice.

camellia3.diff
Optimize GETU32 to use 4-byte memcpy (modern gcc will convert such memcpy to single move instruction on i386). Original GETU32 did four byte fetches, and shifted/XORed those.

camellia4.diff
Move huge unrolled pieces of code (3 screenfuls) at the end of 128/256 key setup routines into common camellia_setup_tail(), convert it to loop there.
Loop is still unrolled six times, so performance hit is very small, code size win is big.

camellia5.diff
Use alternative key setup implementation with mostly 64-bit ops if BITS_PER_LONG >= 64. Both much smaller and much faster.

Unify camellia_en/decrypt128/256 into camellia_do_en/decrypt. Code was similar, with just one additional if() we can use came code.

If CONFIG_CC_OPTIMIZE_FOR_SIZE is defined,
use loop in camellia_do_en/decrypt instead of unrolled code. ~5% encrypt/decrypt slowdown.

Replace (x & 0xff) with (u8)x, gcc is not smart enough to realize that it can do (x & 0xff) this way (which is smaller at least on i386).

Don't do (x & 0xff) in a few places where x cannot be > 255 anyway:
t0 = il >> 16; v = camellia_sp0222[(t1 >> 8) & 0xff];
il16 is u32, (thus t1 >> 8) is one byte!

Benchmarking was done in userspace (see attached tarball for code). All times are in microseconds. Two runs give some idea of test variability. "Setup NN: NNNNNN NNNNNN" - time taken by 100000 key setups (two runs). "Encrypt: NNNNNN NNNNNN" - time taken by 1000 encryptions of 8K buffer. "Decrypt: NNNNNN NNNNNN" - time taken by 1000 decryptions of 8K buffer. "(matches)" - encrypt/decrypt cycle produced non corrupted plaintext.

CONFIG_CC_OPTIMIZE_FOR_SIZE is not set:

$ ./camellia
Setup 16:32779 33169 Encrypt:153582 153740 Decrypt:150985 149811 (matches)
Setup 24:49333 48987 Encrypt:197973 198853 Decrypt:201240 197585 (matches)
Setup 32:46700 47680 Encrypt:195650 195800 Decrypt:195450 195469 (matches)
$ ./camellia5
Setup 16:33417 32968 Encrypt:149195 149095 Decrypt:148593 148661 (matches)
Setup 24:50082 50064 Encrypt:201214 199204 Decrypt:197078 197579 (matches)
Setup 32:48938 48824 Encrypt:200231 199545 Decrypt:198954 198996 (matches)
$ ./camellia_64
Setup 16:22247 22473 Encrypt:152321 149860 Decrypt:149058 148451 (matches)
Setup 24:33832 34017 Encrypt:200428 202969 Decrypt:196789 195524 (matches)
Setup 32:32884 32821 Encrypt:200414 200640 Decrypt:197857 195987 (matches)
$ size camellia.o camellia7.o camellia_64.o
   text    data     bss     dec     hex filename
  24586       0       0   24586    600a camellia.o
  21714       0       0   21714    54d2 camellia5.o
  18666       0       0   18666    48ea camellia_64.o

Very small speed loss in camellia -> camellia5, noticeably smaller size. Big key setup speedup in 64-bit camellia_64, and it is even smaller.

CONFIG_CC_OPTIMIZE_FOR_SIZE is set:

$ ./camellia_Os
Setup 16:32573 34985 Encrypt:151825 152011 Decrypt:147581 147630 (matches)
Setup 24:48528 49250 Encrypt:196223 199056 Decrypt:198811 196394 (matches)
Setup 32:46650 47538 Encrypt:197466 196412 Decrypt:196290 196550 (matches)
$ ./camellia5_Os
Setup 16:33360 34487 Encrypt:154718 154499 Decrypt:157432 157135 (matches)
Setup 24:53969 54304 Encrypt:205184 205818 Decrypt:210675 208552 (matches)
Setup 32:53064 52904 Encrypt:205350 205439 Decrypt:211654 208468 (matches)
$ ./camellia_64_Os
Setup 16:24696 25894 Encrypt:155903 155747 Decrypt:157385 155696 (matches)
Setup 24:33873 33230 Encrypt:206111 206385 Decrypt:208111 207650 (matches)
Setup 32:32799 32325 Encrypt:209715 205973 Decrypt:207578 207644 (matches)
$ size camellia_Os.o camellia7_Os.o camellia_64_Os.o
   text    data     bss     dec     hex filename
  24586       0       0   24586    600a camellia_Os.o
  15906       0       0   15906    3e22 camellia5_Os.o
  13098       0       0   13098    332a camellia_64_Os.o

Some speed loss in camellia -> camellia5, much smaller size. Big key setup speedup in 64-bit camellia_64, and it is even smaller still.

Above sizes are for userspace test programs. Kernel sizes are similar. For example, kernel module sizes with CONFIG_CC_OPTIMIZE_FOR_SIZE set, AMD64:

$ size */camellia.o
   text    data     bss     dec     hex filename
  23208     272       0   23480    5bb8 crypto.org/camellia.o
  11328     272       0   11600    2d50 crypto/camellia.o
Signed-off-by Denys Vlasenko <[email protected]>

--
vda

author
#1 lore raw

PATCH 1/5 camellia: cleanup

Quoted 11 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia1.diff:
Move code blocks around so that related pieces are closer together:
e.g. CAMELLIA_ROUNDSM macro does not need to be separated from the rest of the code by huge array of constants.

Remove unused macros (COPY4WORD, SWAP4WORD, XOR4WORD[2])

Quoted 8 lines

Drop SUBL(), SUBR() macros which only obscure things. Same for CAMELLIA_SP1110() macro and KEY_TABLE_TYPE typedef.

Remove useless comments:
/* encryption */ -- well it's obvious enough already! void camellia_encrypt128(...)

Combine swap with copying at the beginning/end of encrypt/decrypt.

Signed-off-by Denys Vlasenko <[email protected]>

--
vda

crypto/camellia.c renamed from crypto/camellia0.c +426 -540
@@ -36,176 +36,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
-
-#define CAMELLIA_MIN_KEY_SIZE        16
-#define CAMELLIA_MAX_KEY_SIZE        32
-#define CAMELLIA_BLOCK_SIZE 16
-#define CAMELLIA_TABLE_BYTE_LEN 272
-#define CAMELLIA_TABLE_WORD_LEN (CAMELLIA_TABLE_BYTE_LEN / 4)
-
-typedef u32 KEY_TABLE_TYPE[CAMELLIA_TABLE_WORD_LEN];
-
-
-/* key constants */
-
-#define CAMELLIA_SIGMA1L (0xA09E667FL)
-#define CAMELLIA_SIGMA1R (0x3BCC908BL)
-#define CAMELLIA_SIGMA2L (0xB67AE858L)
-#define CAMELLIA_SIGMA2R (0x4CAA73B2L)
-#define CAMELLIA_SIGMA3L (0xC6EF372FL)
-#define CAMELLIA_SIGMA3R (0xE94F82BEL)
-#define CAMELLIA_SIGMA4L (0x54FF53A5L)
-#define CAMELLIA_SIGMA4R (0xF1D36F1CL)
-#define CAMELLIA_SIGMA5L (0x10E527FAL)
-#define CAMELLIA_SIGMA5R (0xDE682D1DL)
-#define CAMELLIA_SIGMA6L (0xB05688C2L)
-#define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
-
-struct camellia_ctx {
-	int key_length;
-	KEY_TABLE_TYPE key_table;
-};
-
-
-/*
- *  macros
- */
-
-
-# define GETU32(pt) (((u32)(pt)[0] << 24)	\
-		     ^ ((u32)(pt)[1] << 16)	\
-		     ^ ((u32)(pt)[2] <<  8)	\
-		     ^ ((u32)(pt)[3]))
-
-#define COPY4WORD(dst, src)			\
-    do {					\
-	(dst)[0]=(src)[0];			\
-	(dst)[1]=(src)[1];			\
-	(dst)[2]=(src)[2];			\
-	(dst)[3]=(src)[3];			\
-    }while(0)
-
-#define SWAP4WORD(word)				\
-    do {					\
-	CAMELLIA_SWAP4((word)[0]);		\
-	CAMELLIA_SWAP4((word)[1]);		\
-	CAMELLIA_SWAP4((word)[2]);		\
-	CAMELLIA_SWAP4((word)[3]);		\
-    }while(0)
-
-#define XOR4WORD(a, b)/* a = a ^ b */		\
-    do {					\
-	(a)[0]^=(b)[0];				\
-	(a)[1]^=(b)[1];				\
-	(a)[2]^=(b)[2];				\
-	(a)[3]^=(b)[3];				\
-    }while(0)
-
-#define XOR4WORD2(a, b, c)/* a = b ^ c */	\
-    do {					\
-	(a)[0]=(b)[0]^(c)[0];			\
-	(a)[1]=(b)[1]^(c)[1];			\
-	(a)[2]=(b)[2]^(c)[2];			\
-	(a)[3]=(b)[3]^(c)[3];			\
-    }while(0)
-
-#define CAMELLIA_SUBKEY_L(INDEX) (subkey[(INDEX)*2])
-#define CAMELLIA_SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
-
-/* rotation right shift 1byte */
-#define CAMELLIA_RR8(x) (((x) >> 8) + ((x) << 24))
-/* rotation left shift 1bit */
-#define CAMELLIA_RL1(x) (((x) << 1) + ((x) >> 31))
-/* rotation left shift 1byte */
-#define CAMELLIA_RL8(x) (((x) << 8) + ((x) >> 24))
-
-#define CAMELLIA_ROLDQ(ll, lr, rl, rr, w0, w1, bits)	\
-    do {						\
-	w0 = ll;					\
-	ll = (ll << bits) + (lr >> (32 - bits));	\
-	lr = (lr << bits) + (rl >> (32 - bits));	\
-	rl = (rl << bits) + (rr >> (32 - bits));	\
-	rr = (rr << bits) + (w0 >> (32 - bits));	\
-    } while(0)
-
-#define CAMELLIA_ROLDQo32(ll, lr, rl, rr, w0, w1, bits)	\
-    do {						\
-	w0 = ll;					\
-	w1 = lr;					\
-	ll = (lr << (bits - 32)) + (rl >> (64 - bits));	\
-	lr = (rl << (bits - 32)) + (rr >> (64 - bits));	\
-	rl = (rr << (bits - 32)) + (w0 >> (64 - bits));	\
-	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
-    } while(0)
-
-#define CAMELLIA_SP1110(INDEX) (camellia_sp1110[(INDEX)])
-#define CAMELLIA_SP0222(INDEX) (camellia_sp0222[(INDEX)])
-#define CAMELLIA_SP3033(INDEX) (camellia_sp3033[(INDEX)])
-#define CAMELLIA_SP4404(INDEX) (camellia_sp4404[(INDEX)])
-
-#define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {							\
-	il = xl ^ kl;						\
-	ir = xr ^ kr;						\
-	t0 = il >> 16;						\
-	t1 = ir >> 16;						\
-	yl = CAMELLIA_SP1110(ir & 0xff)				\
-	    ^ CAMELLIA_SP0222((t1 >> 8) & 0xff)			\
-	    ^ CAMELLIA_SP3033(t1 & 0xff)			\
-	    ^ CAMELLIA_SP4404((ir >> 8) & 0xff);		\
-	yr = CAMELLIA_SP1110((t0 >> 8) & 0xff)			\
-	    ^ CAMELLIA_SP0222(t0 & 0xff)			\
-	    ^ CAMELLIA_SP3033((il >> 8) & 0xff)			\
-	    ^ CAMELLIA_SP4404(il & 0xff);			\
-	yl ^= yr;						\
-	yr = CAMELLIA_RR8(yr);					\
-	yr ^= yl;						\
-    } while(0)
-
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
-    do {								\
-	t0 = kll;							\
-	t2 = krr;							\
-	t0 &= ll;							\
-	t2 |= rr;							\
-	rl ^= t2;							\
-	lr ^= CAMELLIA_RL1(t0);						\
-	t3 = krl;							\
-	t1 = klr;							\
-	t3 &= rl;							\
-	t1 |= lr;							\
-	ll ^= t1;							\
-	rr ^= CAMELLIA_RL1(t3);						\
-    } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {								\
-	ir =  CAMELLIA_SP1110(xr & 0xff);				\
-	il =  CAMELLIA_SP1110((xl>>24) & 0xff);				\
-	ir ^= CAMELLIA_SP0222((xr>>24) & 0xff);				\
-	il ^= CAMELLIA_SP0222((xl>>16) & 0xff);				\
-	ir ^= CAMELLIA_SP3033((xr>>16) & 0xff);				\
-	il ^= CAMELLIA_SP3033((xl>>8) & 0xff);				\
-	ir ^= CAMELLIA_SP4404((xr>>8) & 0xff);				\
-	il ^= CAMELLIA_SP4404(xl & 0xff);				\
-	il ^= kl;							\
-	ir ^= il ^ kr;							\
-	yl ^= ir;							\
-	yr ^= CAMELLIA_RR8(il) ^ ir;					\
-    } while(0)
-
-/**
- * Stuff related to the Camellia key schedule
- */
-#define SUBL(x) subL[(x)]
-#define SUBR(x) subR[(x)]
-
-
 static const u32 camellia_sp1110[256] = {
 	0x70707000,0x82828200,0x2c2c2c00,0xececec00,
 	0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,

@@ -475,6 +305,122 @@ static const u32 camellia_sp4404[256] = 
 };
 
 
+#define CAMELLIA_MIN_KEY_SIZE        16
+#define CAMELLIA_MAX_KEY_SIZE        32
+#define CAMELLIA_BLOCK_SIZE          16
+#define CAMELLIA_TABLE_BYTE_LEN     272
+
+
+/* key constants */
+
+#define CAMELLIA_SIGMA1L (0xA09E667FL)
+#define CAMELLIA_SIGMA1R (0x3BCC908BL)
+#define CAMELLIA_SIGMA2L (0xB67AE858L)
+#define CAMELLIA_SIGMA2R (0x4CAA73B2L)
+#define CAMELLIA_SIGMA3L (0xC6EF372FL)
+#define CAMELLIA_SIGMA3R (0xE94F82BEL)
+#define CAMELLIA_SIGMA4L (0x54FF53A5L)
+#define CAMELLIA_SIGMA4R (0xF1D36F1CL)
+#define CAMELLIA_SIGMA5L (0x10E527FAL)
+#define CAMELLIA_SIGMA5R (0xDE682D1DL)
+#define CAMELLIA_SIGMA6L (0xB05688C2L)
+#define CAMELLIA_SIGMA6R (0xB3E6C1FDL)
+
+/*
+ *  macros
+ */
+
+# define GETU32(pt) (((u32)(pt)[0] << 24)	\
+		     ^ ((u32)(pt)[1] << 16)	\
+		     ^ ((u32)(pt)[2] <<  8)	\
+		     ^ ((u32)(pt)[3]))
+
+/* rotation right shift 1byte */
+#define CAMELLIA_RR8(x) (((x) >> 8) + ((x) << 24))
+/* rotation left shift 1bit */
+#define CAMELLIA_RL1(x) (((x) << 1) + ((x) >> 31))
+/* rotation left shift 1byte */
+#define CAMELLIA_RL8(x) (((x) << 8) + ((x) >> 24))
+
+#define CAMELLIA_ROLDQ(ll, lr, rl, rr, w0, w1, bits)	\
+    do {						\
+	w0 = ll;					\
+	ll = (ll << bits) + (lr >> (32 - bits));	\
+	lr = (lr << bits) + (rl >> (32 - bits));	\
+	rl = (rl << bits) + (rr >> (32 - bits));	\
+	rr = (rr << bits) + (w0 >> (32 - bits));	\
+    } while(0)
+
+#define CAMELLIA_ROLDQo32(ll, lr, rl, rr, w0, w1, bits)	\
+    do {						\
+	w0 = ll;					\
+	w1 = lr;					\
+	ll = (lr << (bits - 32)) + (rl >> (64 - bits));	\
+	lr = (rl << (bits - 32)) + (rr >> (64 - bits));	\
+	rl = (rr << (bits - 32)) + (w0 >> (64 - bits));	\
+	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
+    } while(0)
+
+
+#define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
+    do {							\
+	il = xl ^ kl;						\
+	ir = xr ^ kr;						\
+	t0 = il >> 16;						\
+	t1 = ir >> 16;						\
+	yl = camellia_sp1110[ir & 0xff]				\
+	   ^ camellia_sp0222[(t1 >> 8) & 0xff]			\
+	   ^ camellia_sp3033[t1 & 0xff]				\
+	   ^ camellia_sp4404[(ir >> 8) & 0xff];			\
+	yr = camellia_sp1110[(t0 >> 8) & 0xff]			\
+	   ^ camellia_sp0222[t0 & 0xff]				\
+	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
+	   ^ camellia_sp4404[il & 0xff];			\
+	yl ^= yr;						\
+	yr = CAMELLIA_RR8(yr);					\
+	yr ^= yl;						\
+    } while(0)
+
+
+/*
+ * for speed up
+ *
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+    do {								\
+	t0 = kll;							\
+	t2 = krr;							\
+	t0 &= ll;							\
+	t2 |= rr;							\
+	rl ^= t2;							\
+	lr ^= CAMELLIA_RL1(t0);						\
+	t3 = krl;							\
+	t1 = klr;							\
+	t3 &= rl;							\
+	t1 |= lr;							\
+	ll ^= t1;							\
+	rr ^= CAMELLIA_RL1(t3);						\
+    } while(0)
+
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
+    do {								\
+	ir =  camellia_sp1110[xr & 0xff];				\
+	il =  camellia_sp1110[(xl>>24) & 0xff];				\
+	ir ^= camellia_sp0222[(xr>>24) & 0xff];				\
+	il ^= camellia_sp0222[(xl>>16) & 0xff];				\
+	ir ^= camellia_sp3033[(xr>>16) & 0xff];				\
+	il ^= camellia_sp3033[(xl>>8) & 0xff];				\
+	ir ^= camellia_sp4404[(xr>>8) & 0xff];				\
+	il ^= camellia_sp4404[xl & 0xff];				\
+	il ^= kl;							\
+	ir ^= il ^ kr;							\
+	yl ^= ir;							\
+	yr ^= CAMELLIA_RR8(il) ^ ir;					\
+    } while(0)
+
+
+#define CAMELLIA_SUBKEY_L(INDEX) (subkey[(INDEX)*2])
+#define CAMELLIA_SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 
 static void camellia_setup128(const unsigned char *key, u32 *subkey)
 {

@@ -495,47 +441,47 @@ static void camellia_setup128(const unsi
 	 * generate KL dependent subkeys
 	 */
 	/* kw1 */
-	SUBL(0) = kll; SUBR(0) = klr;
+	subL[0] = kll; subR[0] = klr;
 	/* kw2 */
-	SUBL(1) = krl; SUBR(1) = krr;
+	subL[1] = krl; subR[1] = krr;
 	/* rotation left shift 15bit */
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k3 */
-	SUBL(4) = kll; SUBR(4) = klr;
+	subL[4] = kll; subR[4] = klr;
 	/* k4 */
-	SUBL(5) = krl; SUBR(5) = krr;
+	subL[5] = krl; subR[5] = krr;
 	/* rotation left shift 15+30bit */
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 	/* k7 */
-	SUBL(10) = kll; SUBR(10) = klr;
+	subL[10] = kll; subR[10] = klr;
 	/* k8 */
-	SUBL(11) = krl; SUBR(11) = krr;
+	subL[11] = krl; subR[11] = krr;
 	/* rotation left shift 15+30+15bit */
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k10 */
-	SUBL(13) = krl; SUBR(13) = krr;
+	subL[13] = krl; subR[13] = krr;
 	/* rotation left shift 15+30+15+17 bit */
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* kl3 */
-	SUBL(16) = kll; SUBR(16) = klr;
+	subL[16] = kll; subR[16] = klr;
 	/* kl4 */
-	SUBL(17) = krl; SUBR(17) = krr;
+	subL[17] = krl; subR[17] = krr;
 	/* rotation left shift 15+30+15+17+17 bit */
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* k13 */
-	SUBL(18) = kll; SUBR(18) = klr;
+	subL[18] = kll; subR[18] = klr;
 	/* k14 */
-	SUBL(19) = krl; SUBR(19) = krr;
+	subL[19] = krl; subR[19] = krr;
 	/* rotation left shift 15+30+15+17+17+17 bit */
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* k17 */
-	SUBL(22) = kll; SUBR(22) = klr;
+	subL[22] = kll; subR[22] = klr;
 	/* k18 */
-	SUBL(23) = krl; SUBR(23) = krr;
+	subL[23] = krl; subR[23] = krr;
 
 	/* generate KA */
-	kll = SUBL(0); klr = SUBR(0);
-	krl = SUBL(1); krr = SUBR(1);
+	kll = subL[0]; klr = subR[0];
+	krl = subL[1]; krr = subR[1];
 	CAMELLIA_F(kll, klr,
 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 		   w0, w1, il, ir, t0, t1);

@@ -555,152 +501,150 @@ static void camellia_setup128(const unsi
 
 	/* generate KA dependent subkeys */
 	/* k1, k2 */
-	SUBL(2) = kll; SUBR(2) = klr;
-	SUBL(3) = krl; SUBR(3) = krr;
+	subL[2] = kll; subR[2] = klr;
+	subL[3] = krl; subR[3] = krr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k5,k6 */
-	SUBL(6) = kll; SUBR(6) = klr;
-	SUBL(7) = krl; SUBR(7) = krr;
+	subL[6] = kll; subR[6] = klr;
+	subL[7] = krl; subR[7] = krr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* kl1, kl2 */
-	SUBL(8) = kll; SUBR(8) = klr;
-	SUBL(9) = krl; SUBR(9) = krr;
+	subL[8] = kll; subR[8] = klr;
+	subL[9] = krl; subR[9] = krr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k9 */
-	SUBL(12) = kll; SUBR(12) = klr;
+	subL[12] = kll; subR[12] = klr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k11, k12 */
-	SUBL(14) = kll; SUBR(14) = klr;
-	SUBL(15) = krl; SUBR(15) = krr;
+	subL[14] = kll; subR[14] = klr;
+	subL[15] = krl; subR[15] = krr;
 	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 	/* k15, k16 */
-	SUBL(20) = kll; SUBR(20) = klr;
-	SUBL(21) = krl; SUBR(21) = krr;
+	subL[20] = kll; subR[20] = klr;
+	subL[21] = krl; subR[21] = krr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* kw3, kw4 */
-	SUBL(24) = kll; SUBR(24) = klr;
-	SUBL(25) = krl; SUBR(25) = krr;
-
+	subL[24] = kll; subR[24] = klr;
+	subL[25] = krl; subR[25] = krr;
 
 	/* absorb kw2 to other subkeys */
 	/* round 2 */
-	SUBL(3) ^= SUBL(1); SUBR(3) ^= SUBR(1);
+	subL[3] ^= subL[1]; subR[3] ^= subR[1];
 	/* round 4 */
-	SUBL(5) ^= SUBL(1); SUBR(5) ^= SUBR(1);
+	subL[5] ^= subL[1]; subR[5] ^= subR[1];
 	/* round 6 */
-	SUBL(7) ^= SUBL(1); SUBR(7) ^= SUBR(1);
-	SUBL(1) ^= SUBR(1) & ~SUBR(9);
-	dw = SUBL(1) & SUBL(9),
-		SUBR(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
+	subL[7] ^= subL[1]; subR[7] ^= subR[1];
+	subL[1] ^= subR[1] & ~subR[9];
+	dw = subL[1] & subL[9],
+		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
 	/* round 8 */
-	SUBL(11) ^= SUBL(1); SUBR(11) ^= SUBR(1);
+	subL[11] ^= subL[1]; subR[11] ^= subR[1];
 	/* round 10 */
-	SUBL(13) ^= SUBL(1); SUBR(13) ^= SUBR(1);
+	subL[13] ^= subL[1]; subR[13] ^= subR[1];
 	/* round 12 */
-	SUBL(15) ^= SUBL(1); SUBR(15) ^= SUBR(1);
-	SUBL(1) ^= SUBR(1) & ~SUBR(17);
-	dw = SUBL(1) & SUBL(17),
-		SUBR(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
+	subL[15] ^= subL[1]; subR[15] ^= subR[1];
+	subL[1] ^= subR[1] & ~subR[17];
+	dw = subL[1] & subL[17],
+		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
 	/* round 14 */
-	SUBL(19) ^= SUBL(1); SUBR(19) ^= SUBR(1);
+	subL[19] ^= subL[1]; subR[19] ^= subR[1];
 	/* round 16 */
-	SUBL(21) ^= SUBL(1); SUBR(21) ^= SUBR(1);
+	subL[21] ^= subL[1]; subR[21] ^= subR[1];
 	/* round 18 */
-	SUBL(23) ^= SUBL(1); SUBR(23) ^= SUBR(1);
+	subL[23] ^= subL[1]; subR[23] ^= subR[1];
 	/* kw3 */
-	SUBL(24) ^= SUBL(1); SUBR(24) ^= SUBR(1);
+	subL[24] ^= subL[1]; subR[24] ^= subR[1];
 
 	/* absorb kw4 to other subkeys */
-	kw4l = SUBL(25); kw4r = SUBR(25);
+	kw4l = subL[25]; kw4r = subR[25];
 	/* round 17 */
-	SUBL(22) ^= kw4l; SUBR(22) ^= kw4r;
+	subL[22] ^= kw4l; subR[22] ^= kw4r;
 	/* round 15 */
-	SUBL(20) ^= kw4l; SUBR(20) ^= kw4r;
+	subL[20] ^= kw4l; subR[20] ^= kw4r;
 	/* round 13 */
-	SUBL(18) ^= kw4l; SUBR(18) ^= kw4r;
-	kw4l ^= kw4r & ~SUBR(16);
-	dw = kw4l & SUBL(16),
+	subL[18] ^= kw4l; subR[18] ^= kw4r;
+	kw4l ^= kw4r & ~subR[16];
+	dw = kw4l & subL[16],
 		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl3) */
 	/* round 11 */
-	SUBL(14) ^= kw4l; SUBR(14) ^= kw4r;
+	subL[14] ^= kw4l; subR[14] ^= kw4r;
 	/* round 9 */
-	SUBL(12) ^= kw4l; SUBR(12) ^= kw4r;
+	subL[12] ^= kw4l; subR[12] ^= kw4r;
 	/* round 7 */
-	SUBL(10) ^= kw4l; SUBR(10) ^= kw4r;
-	kw4l ^= kw4r & ~SUBR(8);
-	dw = kw4l & SUBL(8),
+	subL[10] ^= kw4l; subR[10] ^= kw4r;
+	kw4l ^= kw4r & ~subR[8];
+	dw = kw4l & subL[8],
 		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl1) */
 	/* round 5 */
-	SUBL(6) ^= kw4l; SUBR(6) ^= kw4r;
+	subL[6] ^= kw4l; subR[6] ^= kw4r;
 	/* round 3 */
-	SUBL(4) ^= kw4l; SUBR(4) ^= kw4r;
+	subL[4] ^= kw4l; subR[4] ^= kw4r;
 	/* round 1 */
-	SUBL(2) ^= kw4l; SUBR(2) ^= kw4r;
+	subL[2] ^= kw4l; subR[2] ^= kw4r;
 	/* kw1 */
-	SUBL(0) ^= kw4l; SUBR(0) ^= kw4r;
-
+	subL[0] ^= kw4l; subR[0] ^= kw4r;
 
 	/* key XOR is end of F-function */
-	CAMELLIA_SUBKEY_L(0) = SUBL(0) ^ SUBL(2);/* kw1 */
-	CAMELLIA_SUBKEY_R(0) = SUBR(0) ^ SUBR(2);
-	CAMELLIA_SUBKEY_L(2) = SUBL(3);       /* round 1 */
-	CAMELLIA_SUBKEY_R(2) = SUBR(3);
-	CAMELLIA_SUBKEY_L(3) = SUBL(2) ^ SUBL(4); /* round 2 */
-	CAMELLIA_SUBKEY_R(3) = SUBR(2) ^ SUBR(4);
-	CAMELLIA_SUBKEY_L(4) = SUBL(3) ^ SUBL(5); /* round 3 */
-	CAMELLIA_SUBKEY_R(4) = SUBR(3) ^ SUBR(5);
-	CAMELLIA_SUBKEY_L(5) = SUBL(4) ^ SUBL(6); /* round 4 */
-	CAMELLIA_SUBKEY_R(5) = SUBR(4) ^ SUBR(6);
-	CAMELLIA_SUBKEY_L(6) = SUBL(5) ^ SUBL(7); /* round 5 */
-	CAMELLIA_SUBKEY_R(6) = SUBR(5) ^ SUBR(7);
-	tl = SUBL(10) ^ (SUBR(10) & ~SUBR(8));
-	dw = tl & SUBL(8),  /* FL(kl1) */
-		tr = SUBR(10) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(7) = SUBL(6) ^ tl; /* round 6 */
-	CAMELLIA_SUBKEY_R(7) = SUBR(6) ^ tr;
-	CAMELLIA_SUBKEY_L(8) = SUBL(8);       /* FL(kl1) */
-	CAMELLIA_SUBKEY_R(8) = SUBR(8);
-	CAMELLIA_SUBKEY_L(9) = SUBL(9);       /* FLinv(kl2) */
-	CAMELLIA_SUBKEY_R(9) = SUBR(9);
-	tl = SUBL(7) ^ (SUBR(7) & ~SUBR(9));
-	dw = tl & SUBL(9),  /* FLinv(kl2) */
-		tr = SUBR(7) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(10) = tl ^ SUBL(11); /* round 7 */
-	CAMELLIA_SUBKEY_R(10) = tr ^ SUBR(11);
-	CAMELLIA_SUBKEY_L(11) = SUBL(10) ^ SUBL(12); /* round 8 */
-	CAMELLIA_SUBKEY_R(11) = SUBR(10) ^ SUBR(12);
-	CAMELLIA_SUBKEY_L(12) = SUBL(11) ^ SUBL(13); /* round 9 */
-	CAMELLIA_SUBKEY_R(12) = SUBR(11) ^ SUBR(13);
-	CAMELLIA_SUBKEY_L(13) = SUBL(12) ^ SUBL(14); /* round 10 */
-	CAMELLIA_SUBKEY_R(13) = SUBR(12) ^ SUBR(14);
-	CAMELLIA_SUBKEY_L(14) = SUBL(13) ^ SUBL(15); /* round 11 */
-	CAMELLIA_SUBKEY_R(14) = SUBR(13) ^ SUBR(15);
-	tl = SUBL(18) ^ (SUBR(18) & ~SUBR(16));
-	dw = tl & SUBL(16), /* FL(kl3) */
-		tr = SUBR(18) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(15) = SUBL(14) ^ tl; /* round 12 */
-	CAMELLIA_SUBKEY_R(15) = SUBR(14) ^ tr;
-	CAMELLIA_SUBKEY_L(16) = SUBL(16);     /* FL(kl3) */
-	CAMELLIA_SUBKEY_R(16) = SUBR(16);
-	CAMELLIA_SUBKEY_L(17) = SUBL(17);     /* FLinv(kl4) */
-	CAMELLIA_SUBKEY_R(17) = SUBR(17);
-	tl = SUBL(15) ^ (SUBR(15) & ~SUBR(17));
-	dw = tl & SUBL(17), /* FLinv(kl4) */
-		tr = SUBR(15) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(18) = tl ^ SUBL(19); /* round 13 */
-	CAMELLIA_SUBKEY_R(18) = tr ^ SUBR(19);
-	CAMELLIA_SUBKEY_L(19) = SUBL(18) ^ SUBL(20); /* round 14 */
-	CAMELLIA_SUBKEY_R(19) = SUBR(18) ^ SUBR(20);
-	CAMELLIA_SUBKEY_L(20) = SUBL(19) ^ SUBL(21); /* round 15 */
-	CAMELLIA_SUBKEY_R(20) = SUBR(19) ^ SUBR(21);
-	CAMELLIA_SUBKEY_L(21) = SUBL(20) ^ SUBL(22); /* round 16 */
-	CAMELLIA_SUBKEY_R(21) = SUBR(20) ^ SUBR(22);
-	CAMELLIA_SUBKEY_L(22) = SUBL(21) ^ SUBL(23); /* round 17 */
-	CAMELLIA_SUBKEY_R(22) = SUBR(21) ^ SUBR(23);
-	CAMELLIA_SUBKEY_L(23) = SUBL(22);     /* round 18 */
-	CAMELLIA_SUBKEY_R(23) = SUBR(22);
-	CAMELLIA_SUBKEY_L(24) = SUBL(24) ^ SUBL(23); /* kw3 */
-	CAMELLIA_SUBKEY_R(24) = SUBR(24) ^ SUBR(23);
+	CAMELLIA_SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
+	CAMELLIA_SUBKEY_R(0) = subR[0] ^ subR[2];
+	CAMELLIA_SUBKEY_L(2) = subL[3];       /* round 1 */
+	CAMELLIA_SUBKEY_R(2) = subR[3];
+	CAMELLIA_SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
+	CAMELLIA_SUBKEY_R(3) = subR[2] ^ subR[4];
+	CAMELLIA_SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
+	CAMELLIA_SUBKEY_R(4) = subR[3] ^ subR[5];
+	CAMELLIA_SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
+	CAMELLIA_SUBKEY_R(5) = subR[4] ^ subR[6];
+	CAMELLIA_SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
+	CAMELLIA_SUBKEY_R(6) = subR[5] ^ subR[7];
+	tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = tl & subL[8],  /* FL(kl1) */
+		tr = subR[10] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
+	CAMELLIA_SUBKEY_R(7) = subR[6] ^ tr;
+	CAMELLIA_SUBKEY_L(8) = subL[8];       /* FL(kl1) */
+	CAMELLIA_SUBKEY_R(8) = subR[8];
+	CAMELLIA_SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
+	CAMELLIA_SUBKEY_R(9) = subR[9];
+	tl = subL[7] ^ (subR[7] & ~subR[9]);
+	dw = tl & subL[9],  /* FLinv(kl2) */
+		tr = subR[7] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
+	CAMELLIA_SUBKEY_R(10) = tr ^ subR[11];
+	CAMELLIA_SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
+	CAMELLIA_SUBKEY_R(11) = subR[10] ^ subR[12];
+	CAMELLIA_SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
+	CAMELLIA_SUBKEY_R(12) = subR[11] ^ subR[13];
+	CAMELLIA_SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
+	CAMELLIA_SUBKEY_R(13) = subR[12] ^ subR[14];
+	CAMELLIA_SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
+	CAMELLIA_SUBKEY_R(14) = subR[13] ^ subR[15];
+	tl = subL[18] ^ (subR[18] & ~subR[16]);
+	dw = tl & subL[16], /* FL(kl3) */
+		tr = subR[18] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
+	CAMELLIA_SUBKEY_R(15) = subR[14] ^ tr;
+	CAMELLIA_SUBKEY_L(16) = subL[16];     /* FL(kl3) */
+	CAMELLIA_SUBKEY_R(16) = subR[16];
+	CAMELLIA_SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
+	CAMELLIA_SUBKEY_R(17) = subR[17];
+	tl = subL[15] ^ (subR[15] & ~subR[17]);
+	dw = tl & subL[17], /* FLinv(kl4) */
+		tr = subR[15] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
+	CAMELLIA_SUBKEY_R(18) = tr ^ subR[19];
+	CAMELLIA_SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
+	CAMELLIA_SUBKEY_R(19) = subR[18] ^ subR[20];
+	CAMELLIA_SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
+	CAMELLIA_SUBKEY_R(20) = subR[19] ^ subR[21];
+	CAMELLIA_SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
+	CAMELLIA_SUBKEY_R(21) = subR[20] ^ subR[22];
+	CAMELLIA_SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
+	CAMELLIA_SUBKEY_R(22) = subR[21] ^ subR[23];
+	CAMELLIA_SUBKEY_L(23) = subL[22];     /* round 18 */
+	CAMELLIA_SUBKEY_R(23) = subR[22];
+	CAMELLIA_SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
+	CAMELLIA_SUBKEY_R(24) = subR[24] ^ subR[23];
 
 	/* apply the inverse of the last half of P-function */
 	dw = CAMELLIA_SUBKEY_L(2) ^ CAMELLIA_SUBKEY_R(2),

@@ -775,11 +719,8 @@ static void camellia_setup128(const unsi
 		dw = CAMELLIA_RL8(dw);/* round 18 */
 	CAMELLIA_SUBKEY_R(23) = CAMELLIA_SUBKEY_L(23) ^ dw,
 		CAMELLIA_SUBKEY_L(23) = dw;
-
-	return;
 }
 
-
 static void camellia_setup256(const unsigned char *key, u32 *subkey)
 {
 	u32 kll,klr,krl,krr;           /* left half of key */

@@ -805,56 +746,56 @@ static void camellia_setup256(const unsi
 
 	/* generate KL dependent subkeys */
 	/* kw1 */
-	SUBL(0) = kll; SUBR(0) = klr;
+	subL[0] = kll; subR[0] = klr;
 	/* kw2 */
-	SUBL(1) = krl; SUBR(1) = krr;
+	subL[1] = krl; subR[1] = krr;
 	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
 	/* k9 */
-	SUBL(12) = kll; SUBR(12) = klr;
+	subL[12] = kll; subR[12] = klr;
 	/* k10 */
-	SUBL(13) = krl; SUBR(13) = krr;
+	subL[13] = krl; subR[13] = krr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* kl3 */
-	SUBL(16) = kll; SUBR(16) = klr;
+	subL[16] = kll; subR[16] = klr;
 	/* kl4 */
-	SUBL(17) = krl; SUBR(17) = krr;
+	subL[17] = krl; subR[17] = krr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* k17 */
-	SUBL(22) = kll; SUBR(22) = klr;
+	subL[22] = kll; subR[22] = klr;
 	/* k18 */
-	SUBL(23) = krl; SUBR(23) = krr;
+	subL[23] = krl; subR[23] = krr;
 	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 	/* k23 */
-	SUBL(30) = kll; SUBR(30) = klr;
+	subL[30] = kll; subR[30] = klr;
 	/* k24 */
-	SUBL(31) = krl; SUBR(31) = krr;
+	subL[31] = krl; subR[31] = krr;
 
 	/* generate KR dependent subkeys */
 	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 	/* k3 */
-	SUBL(4) = krll; SUBR(4) = krlr;
+	subL[4] = krll; subR[4] = krlr;
 	/* k4 */
-	SUBL(5) = krrl; SUBR(5) = krrr;
+	subL[5] = krrl; subR[5] = krrr;
 	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 	/* kl1 */
-	SUBL(8) = krll; SUBR(8) = krlr;
+	subL[8] = krll; subR[8] = krlr;
 	/* kl2 */
-	SUBL(9) = krrl; SUBR(9) = krrr;
+	subL[9] = krrl; subR[9] = krrr;
 	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 	/* k13 */
-	SUBL(18) = krll; SUBR(18) = krlr;
+	subL[18] = krll; subR[18] = krlr;
 	/* k14 */
-	SUBL(19) = krrl; SUBR(19) = krrr;
+	subL[19] = krrl; subR[19] = krrr;
 	CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 	/* k19 */
-	SUBL(26) = krll; SUBR(26) = krlr;
+	subL[26] = krll; subR[26] = krlr;
 	/* k20 */
-	SUBL(27) = krrl; SUBR(27) = krrr;
+	subL[27] = krrl; subR[27] = krrr;
 	CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 
 	/* generate KA */
-	kll = SUBL(0) ^ krll; klr = SUBR(0) ^ krlr;
-	krl = SUBL(1) ^ krrl; krr = SUBR(1) ^ krrr;
+	kll = subL[0] ^ krll; klr = subR[0] ^ krlr;
+	krl = subL[1] ^ krrl; krr = subR[1] ^ krrr;
 	CAMELLIA_F(kll, klr,
 		   CAMELLIA_SIGMA1L, CAMELLIA_SIGMA1R,
 		   w0, w1, il, ir, t0, t1);

@@ -887,208 +828,207 @@ static void camellia_setup256(const unsi
 	/* generate KA dependent subkeys */
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k5 */
-	SUBL(6) = kll; SUBR(6) = klr;
+	subL[6] = kll; subR[6] = klr;
 	/* k6 */
-	SUBL(7) = krl; SUBR(7) = krr;
+	subL[7] = krl; subR[7] = krr;
 	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 	/* k11 */
-	SUBL(14) = kll; SUBR(14) = klr;
+	subL[14] = kll; subR[14] = klr;
 	/* k12 */
-	SUBL(15) = krl; SUBR(15) = krr;
+	subL[15] = krl; subR[15] = krr;
 	/* rotation left shift 32bit */
 	/* kl5 */
-	SUBL(24) = klr; SUBR(24) = krl;
+	subL[24] = klr; subR[24] = krl;
 	/* kl6 */
-	SUBL(25) = krr; SUBR(25) = kll;
+	subL[25] = krr; subR[25] = kll;
 	/* rotation left shift 49 from k11,k12 -> k21,k22 */
 	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
 	/* k21 */
-	SUBL(28) = kll; SUBR(28) = klr;
+	subL[28] = kll; subR[28] = klr;
 	/* k22 */
-	SUBL(29) = krl; SUBR(29) = krr;
+	subL[29] = krl; subR[29] = krr;
 
 	/* generate KB dependent subkeys */
 	/* k1 */
-	SUBL(2) = krll; SUBR(2) = krlr;
+	subL[2] = krll; subR[2] = krlr;
 	/* k2 */
-	SUBL(3) = krrl; SUBR(3) = krrr;
+	subL[3] = krrl; subR[3] = krrr;
 	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 	/* k7 */
-	SUBL(10) = krll; SUBR(10) = krlr;
+	subL[10] = krll; subR[10] = krlr;
 	/* k8 */
-	SUBL(11) = krrl; SUBR(11) = krrr;
+	subL[11] = krrl; subR[11] = krrr;
 	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 	/* k15 */
-	SUBL(20) = krll; SUBR(20) = krlr;
+	subL[20] = krll; subR[20] = krlr;
 	/* k16 */
-	SUBL(21) = krrl; SUBR(21) = krrr;
+	subL[21] = krrl; subR[21] = krrr;
 	CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
 	/* kw3 */
-	SUBL(32) = krll; SUBR(32) = krlr;
+	subL[32] = krll; subR[32] = krlr;
 	/* kw4 */
-	SUBL(33) = krrl; SUBR(33) = krrr;
+	subL[33] = krrl; subR[33] = krrr;
 
 	/* absorb kw2 to other subkeys */
 	/* round 2 */
-	SUBL(3) ^= SUBL(1); SUBR(3) ^= SUBR(1);
+	subL[3] ^= subL[1]; subR[3] ^= subR[1];
 	/* round 4 */
-	SUBL(5) ^= SUBL(1); SUBR(5) ^= SUBR(1);
+	subL[5] ^= subL[1]; subR[5] ^= subR[1];
 	/* round 6 */
-	SUBL(7) ^= SUBL(1); SUBR(7) ^= SUBR(1);
-	SUBL(1) ^= SUBR(1) & ~SUBR(9);
-	dw = SUBL(1) & SUBL(9),
-		SUBR(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
+	subL[7] ^= subL[1]; subR[7] ^= subR[1];
+	subL[1] ^= subR[1] & ~subR[9];
+	dw = subL[1] & subL[9],
+		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
 	/* round 8 */
-	SUBL(11) ^= SUBL(1); SUBR(11) ^= SUBR(1);
+	subL[11] ^= subL[1]; subR[11] ^= subR[1];
 	/* round 10 */
-	SUBL(13) ^= SUBL(1); SUBR(13) ^= SUBR(1);
+	subL[13] ^= subL[1]; subR[13] ^= subR[1];
 	/* round 12 */
-	SUBL(15) ^= SUBL(1); SUBR(15) ^= SUBR(1);
-	SUBL(1) ^= SUBR(1) & ~SUBR(17);
-	dw = SUBL(1) & SUBL(17),
-		SUBR(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
+	subL[15] ^= subL[1]; subR[15] ^= subR[1];
+	subL[1] ^= subR[1] & ~subR[17];
+	dw = subL[1] & subL[17],
+		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
 	/* round 14 */
-	SUBL(19) ^= SUBL(1); SUBR(19) ^= SUBR(1);
+	subL[19] ^= subL[1]; subR[19] ^= subR[1];
 	/* round 16 */
-	SUBL(21) ^= SUBL(1); SUBR(21) ^= SUBR(1);
+	subL[21] ^= subL[1]; subR[21] ^= subR[1];
 	/* round 18 */
-	SUBL(23) ^= SUBL(1); SUBR(23) ^= SUBR(1);
-	SUBL(1) ^= SUBR(1) & ~SUBR(25);
-	dw = SUBL(1) & SUBL(25),
-		SUBR(1) ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl6) */
+	subL[23] ^= subL[1]; subR[23] ^= subR[1];
+	subL[1] ^= subR[1] & ~subR[25];
+	dw = subL[1] & subL[25],
+		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl6) */
 	/* round 20 */
-	SUBL(27) ^= SUBL(1); SUBR(27) ^= SUBR(1);
+	subL[27] ^= subL[1]; subR[27] ^= subR[1];
 	/* round 22 */
-	SUBL(29) ^= SUBL(1); SUBR(29) ^= SUBR(1);
+	subL[29] ^= subL[1]; subR[29] ^= subR[1];
 	/* round 24 */
-	SUBL(31) ^= SUBL(1); SUBR(31) ^= SUBR(1);
+	subL[31] ^= subL[1]; subR[31] ^= subR[1];
 	/* kw3 */
-	SUBL(32) ^= SUBL(1); SUBR(32) ^= SUBR(1);
-
+	subL[32] ^= subL[1]; subR[32] ^= subR[1];
 
 	/* absorb kw4 to other subkeys */
-	kw4l = SUBL(33); kw4r = SUBR(33);
+	kw4l = subL[33]; kw4r = subR[33];
 	/* round 23 */
-	SUBL(30) ^= kw4l; SUBR(30) ^= kw4r;
+	subL[30] ^= kw4l; subR[30] ^= kw4r;
 	/* round 21 */
-	SUBL(28) ^= kw4l; SUBR(28) ^= kw4r;
+	subL[28] ^= kw4l; subR[28] ^= kw4r;
 	/* round 19 */
-	SUBL(26) ^= kw4l; SUBR(26) ^= kw4r;
-	kw4l ^= kw4r & ~SUBR(24);
-	dw = kw4l & SUBL(24),
+	subL[26] ^= kw4l; subR[26] ^= kw4r;
+	kw4l ^= kw4r & ~subR[24];
+	dw = kw4l & subL[24],
 		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl5) */
 	/* round 17 */
-	SUBL(22) ^= kw4l; SUBR(22) ^= kw4r;
+	subL[22] ^= kw4l; subR[22] ^= kw4r;
 	/* round 15 */
-	SUBL(20) ^= kw4l; SUBR(20) ^= kw4r;
+	subL[20] ^= kw4l; subR[20] ^= kw4r;
 	/* round 13 */
-	SUBL(18) ^= kw4l; SUBR(18) ^= kw4r;
-	kw4l ^= kw4r & ~SUBR(16);
-	dw = kw4l & SUBL(16),
+	subL[18] ^= kw4l; subR[18] ^= kw4r;
+	kw4l ^= kw4r & ~subR[16];
+	dw = kw4l & subL[16],
 		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl3) */
 	/* round 11 */
-	SUBL(14) ^= kw4l; SUBR(14) ^= kw4r;
+	subL[14] ^= kw4l; subR[14] ^= kw4r;
 	/* round 9 */
-	SUBL(12) ^= kw4l; SUBR(12) ^= kw4r;
+	subL[12] ^= kw4l; subR[12] ^= kw4r;
 	/* round 7 */
-	SUBL(10) ^= kw4l; SUBR(10) ^= kw4r;
-	kw4l ^= kw4r & ~SUBR(8);
-	dw = kw4l & SUBL(8),
+	subL[10] ^= kw4l; subR[10] ^= kw4r;
+	kw4l ^= kw4r & ~subR[8];
+	dw = kw4l & subL[8],
 		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl1) */
 	/* round 5 */
-	SUBL(6) ^= kw4l; SUBR(6) ^= kw4r;
+	subL[6] ^= kw4l; subR[6] ^= kw4r;
 	/* round 3 */
-	SUBL(4) ^= kw4l; SUBR(4) ^= kw4r;
+	subL[4] ^= kw4l; subR[4] ^= kw4r;
 	/* round 1 */
-	SUBL(2) ^= kw4l; SUBR(2) ^= kw4r;
+	subL[2] ^= kw4l; subR[2] ^= kw4r;
 	/* kw1 */
-	SUBL(0) ^= kw4l; SUBR(0) ^= kw4r;
+	subL[0] ^= kw4l; subR[0] ^= kw4r;
 
 	/* key XOR is end of F-function */
-	CAMELLIA_SUBKEY_L(0) = SUBL(0) ^ SUBL(2);/* kw1 */
-	CAMELLIA_SUBKEY_R(0) = SUBR(0) ^ SUBR(2);
-	CAMELLIA_SUBKEY_L(2) = SUBL(3);       /* round 1 */
-	CAMELLIA_SUBKEY_R(2) = SUBR(3);
-	CAMELLIA_SUBKEY_L(3) = SUBL(2) ^ SUBL(4); /* round 2 */
-	CAMELLIA_SUBKEY_R(3) = SUBR(2) ^ SUBR(4);
-	CAMELLIA_SUBKEY_L(4) = SUBL(3) ^ SUBL(5); /* round 3 */
-	CAMELLIA_SUBKEY_R(4) = SUBR(3) ^ SUBR(5);
-	CAMELLIA_SUBKEY_L(5) = SUBL(4) ^ SUBL(6); /* round 4 */
-	CAMELLIA_SUBKEY_R(5) = SUBR(4) ^ SUBR(6);
-	CAMELLIA_SUBKEY_L(6) = SUBL(5) ^ SUBL(7); /* round 5 */
-	CAMELLIA_SUBKEY_R(6) = SUBR(5) ^ SUBR(7);
-	tl = SUBL(10) ^ (SUBR(10) & ~SUBR(8));
-	dw = tl & SUBL(8),  /* FL(kl1) */
-		tr = SUBR(10) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(7) = SUBL(6) ^ tl; /* round 6 */
-	CAMELLIA_SUBKEY_R(7) = SUBR(6) ^ tr;
-	CAMELLIA_SUBKEY_L(8) = SUBL(8);       /* FL(kl1) */
-	CAMELLIA_SUBKEY_R(8) = SUBR(8);
-	CAMELLIA_SUBKEY_L(9) = SUBL(9);       /* FLinv(kl2) */
-	CAMELLIA_SUBKEY_R(9) = SUBR(9);
-	tl = SUBL(7) ^ (SUBR(7) & ~SUBR(9));
-	dw = tl & SUBL(9),  /* FLinv(kl2) */
-		tr = SUBR(7) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(10) = tl ^ SUBL(11); /* round 7 */
-	CAMELLIA_SUBKEY_R(10) = tr ^ SUBR(11);
-	CAMELLIA_SUBKEY_L(11) = SUBL(10) ^ SUBL(12); /* round 8 */
-	CAMELLIA_SUBKEY_R(11) = SUBR(10) ^ SUBR(12);
-	CAMELLIA_SUBKEY_L(12) = SUBL(11) ^ SUBL(13); /* round 9 */
-	CAMELLIA_SUBKEY_R(12) = SUBR(11) ^ SUBR(13);
-	CAMELLIA_SUBKEY_L(13) = SUBL(12) ^ SUBL(14); /* round 10 */
-	CAMELLIA_SUBKEY_R(13) = SUBR(12) ^ SUBR(14);
-	CAMELLIA_SUBKEY_L(14) = SUBL(13) ^ SUBL(15); /* round 11 */
-	CAMELLIA_SUBKEY_R(14) = SUBR(13) ^ SUBR(15);
-	tl = SUBL(18) ^ (SUBR(18) & ~SUBR(16));
-	dw = tl & SUBL(16), /* FL(kl3) */
-		tr = SUBR(18) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(15) = SUBL(14) ^ tl; /* round 12 */
-	CAMELLIA_SUBKEY_R(15) = SUBR(14) ^ tr;
-	CAMELLIA_SUBKEY_L(16) = SUBL(16);     /* FL(kl3) */
-	CAMELLIA_SUBKEY_R(16) = SUBR(16);
-	CAMELLIA_SUBKEY_L(17) = SUBL(17);     /* FLinv(kl4) */
-	CAMELLIA_SUBKEY_R(17) = SUBR(17);
-	tl = SUBL(15) ^ (SUBR(15) & ~SUBR(17));
-	dw = tl & SUBL(17), /* FLinv(kl4) */
-		tr = SUBR(15) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(18) = tl ^ SUBL(19); /* round 13 */
-	CAMELLIA_SUBKEY_R(18) = tr ^ SUBR(19);
-	CAMELLIA_SUBKEY_L(19) = SUBL(18) ^ SUBL(20); /* round 14 */
-	CAMELLIA_SUBKEY_R(19) = SUBR(18) ^ SUBR(20);
-	CAMELLIA_SUBKEY_L(20) = SUBL(19) ^ SUBL(21); /* round 15 */
-	CAMELLIA_SUBKEY_R(20) = SUBR(19) ^ SUBR(21);
-	CAMELLIA_SUBKEY_L(21) = SUBL(20) ^ SUBL(22); /* round 16 */
-	CAMELLIA_SUBKEY_R(21) = SUBR(20) ^ SUBR(22);
-	CAMELLIA_SUBKEY_L(22) = SUBL(21) ^ SUBL(23); /* round 17 */
-	CAMELLIA_SUBKEY_R(22) = SUBR(21) ^ SUBR(23);
-	tl = SUBL(26) ^ (SUBR(26)
-			 & ~SUBR(24));
-	dw = tl & SUBL(24), /* FL(kl5) */
-		tr = SUBR(26) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(23) = SUBL(22) ^ tl; /* round 18 */
-	CAMELLIA_SUBKEY_R(23) = SUBR(22) ^ tr;
-	CAMELLIA_SUBKEY_L(24) = SUBL(24);     /* FL(kl5) */
-	CAMELLIA_SUBKEY_R(24) = SUBR(24);
-	CAMELLIA_SUBKEY_L(25) = SUBL(25);     /* FLinv(kl6) */
-	CAMELLIA_SUBKEY_R(25) = SUBR(25);
-	tl = SUBL(23) ^ (SUBR(23) &
-			 ~SUBR(25));
-	dw = tl & SUBL(25), /* FLinv(kl6) */
-		tr = SUBR(23) ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(26) = tl ^ SUBL(27); /* round 19 */
-	CAMELLIA_SUBKEY_R(26) = tr ^ SUBR(27);
-	CAMELLIA_SUBKEY_L(27) = SUBL(26) ^ SUBL(28); /* round 20 */
-	CAMELLIA_SUBKEY_R(27) = SUBR(26) ^ SUBR(28);
-	CAMELLIA_SUBKEY_L(28) = SUBL(27) ^ SUBL(29); /* round 21 */
-	CAMELLIA_SUBKEY_R(28) = SUBR(27) ^ SUBR(29);
-	CAMELLIA_SUBKEY_L(29) = SUBL(28) ^ SUBL(30); /* round 22 */
-	CAMELLIA_SUBKEY_R(29) = SUBR(28) ^ SUBR(30);
-	CAMELLIA_SUBKEY_L(30) = SUBL(29) ^ SUBL(31); /* round 23 */
-	CAMELLIA_SUBKEY_R(30) = SUBR(29) ^ SUBR(31);
-	CAMELLIA_SUBKEY_L(31) = SUBL(30);     /* round 24 */
-	CAMELLIA_SUBKEY_R(31) = SUBR(30);
-	CAMELLIA_SUBKEY_L(32) = SUBL(32) ^ SUBL(31); /* kw3 */
-	CAMELLIA_SUBKEY_R(32) = SUBR(32) ^ SUBR(31);
+	CAMELLIA_SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
+	CAMELLIA_SUBKEY_R(0) = subR[0] ^ subR[2];
+	CAMELLIA_SUBKEY_L(2) = subL[3];       /* round 1 */
+	CAMELLIA_SUBKEY_R(2) = subR[3];
+	CAMELLIA_SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
+	CAMELLIA_SUBKEY_R(3) = subR[2] ^ subR[4];
+	CAMELLIA_SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
+	CAMELLIA_SUBKEY_R(4) = subR[3] ^ subR[5];
+	CAMELLIA_SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
+	CAMELLIA_SUBKEY_R(5) = subR[4] ^ subR[6];
+	CAMELLIA_SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
+	CAMELLIA_SUBKEY_R(6) = subR[5] ^ subR[7];
+	tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = tl & subL[8],  /* FL(kl1) */
+		tr = subR[10] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
+	CAMELLIA_SUBKEY_R(7) = subR[6] ^ tr;
+	CAMELLIA_SUBKEY_L(8) = subL[8];       /* FL(kl1) */
+	CAMELLIA_SUBKEY_R(8) = subR[8];
+	CAMELLIA_SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
+	CAMELLIA_SUBKEY_R(9) = subR[9];
+	tl = subL[7] ^ (subR[7] & ~subR[9]);
+	dw = tl & subL[9],  /* FLinv(kl2) */
+		tr = subR[7] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
+	CAMELLIA_SUBKEY_R(10) = tr ^ subR[11];
+	CAMELLIA_SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
+	CAMELLIA_SUBKEY_R(11) = subR[10] ^ subR[12];
+	CAMELLIA_SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
+	CAMELLIA_SUBKEY_R(12) = subR[11] ^ subR[13];
+	CAMELLIA_SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
+	CAMELLIA_SUBKEY_R(13) = subR[12] ^ subR[14];
+	CAMELLIA_SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
+	CAMELLIA_SUBKEY_R(14) = subR[13] ^ subR[15];
+	tl = subL[18] ^ (subR[18] & ~subR[16]);
+	dw = tl & subL[16], /* FL(kl3) */
+		tr = subR[18] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
+	CAMELLIA_SUBKEY_R(15) = subR[14] ^ tr;
+	CAMELLIA_SUBKEY_L(16) = subL[16];     /* FL(kl3) */
+	CAMELLIA_SUBKEY_R(16) = subR[16];
+	CAMELLIA_SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
+	CAMELLIA_SUBKEY_R(17) = subR[17];
+	tl = subL[15] ^ (subR[15] & ~subR[17]);
+	dw = tl & subL[17], /* FLinv(kl4) */
+		tr = subR[15] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
+	CAMELLIA_SUBKEY_R(18) = tr ^ subR[19];
+	CAMELLIA_SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
+	CAMELLIA_SUBKEY_R(19) = subR[18] ^ subR[20];
+	CAMELLIA_SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
+	CAMELLIA_SUBKEY_R(20) = subR[19] ^ subR[21];
+	CAMELLIA_SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
+	CAMELLIA_SUBKEY_R(21) = subR[20] ^ subR[22];
+	CAMELLIA_SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
+	CAMELLIA_SUBKEY_R(22) = subR[21] ^ subR[23];
+	tl = subL[26] ^ (subR[26]
+			 & ~subR[24]);
+	dw = tl & subL[24], /* FL(kl5) */
+		tr = subR[26] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
+	CAMELLIA_SUBKEY_R(23) = subR[22] ^ tr;
+	CAMELLIA_SUBKEY_L(24) = subL[24];     /* FL(kl5) */
+	CAMELLIA_SUBKEY_R(24) = subR[24];
+	CAMELLIA_SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
+	CAMELLIA_SUBKEY_R(25) = subR[25];
+	tl = subL[23] ^ (subR[23] &
+			 ~subR[25]);
+	dw = tl & subL[25], /* FLinv(kl6) */
+		tr = subR[23] ^ CAMELLIA_RL1(dw);
+	CAMELLIA_SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
+	CAMELLIA_SUBKEY_R(26) = tr ^ subR[27];
+	CAMELLIA_SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
+	CAMELLIA_SUBKEY_R(27) = subR[26] ^ subR[28];
+	CAMELLIA_SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
+	CAMELLIA_SUBKEY_R(28) = subR[27] ^ subR[29];
+	CAMELLIA_SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
+	CAMELLIA_SUBKEY_R(29) = subR[28] ^ subR[30];
+	CAMELLIA_SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
+	CAMELLIA_SUBKEY_R(30) = subR[29] ^ subR[31];
+	CAMELLIA_SUBKEY_L(31) = subL[30];     /* round 24 */
+	CAMELLIA_SUBKEY_R(31) = subR[30];
+	CAMELLIA_SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
+	CAMELLIA_SUBKEY_R(32) = subR[32] ^ subR[31];
 
 	/* apply the inverse of the last half of P-function */
 	dw = CAMELLIA_SUBKEY_L(2) ^ CAMELLIA_SUBKEY_R(2),

@@ -1187,8 +1127,6 @@ static void camellia_setup256(const unsi
 		dw = CAMELLIA_RL8(dw);/* round 24 */
 	CAMELLIA_SUBKEY_R(31) = CAMELLIA_SUBKEY_L(31) ^ dw,
 		CAMELLIA_SUBKEY_L(31) = dw;
-
-	return;
 }
 
 static void camellia_setup192(const unsigned char *key, u32 *subkey)

@@ -1197,20 +1135,16 @@ static void camellia_setup192(const unsi
 	u32 krll, krlr, krrl,krrr;
 
 	memcpy(kk, key, 24);
-	memcpy((unsigned char *)&krll, key+16,4);
-	memcpy((unsigned char *)&krlr, key+20,4);
+	memcpy((unsigned char *)&krll, key+16, 4);
+	memcpy((unsigned char *)&krlr, key+20, 4);
 	krrl = ~krll;
 	krrr = ~krlr;
 	memcpy(kk+24, (unsigned char *)&krrl, 4);
 	memcpy(kk+28, (unsigned char *)&krrr, 4);
 	camellia_setup256(kk, subkey);
-	return;
 }
 
 
-/**
- * Stuff related to camellia encryption/decryption
- */
 static void camellia_encrypt128(const u32 *subkey, __be32 *io_text)
 {
 	u32 il,ir,t0,t1;               /* temporary valiables */

@@ -1222,11 +1156,11 @@ static void camellia_encrypt128(const u3
 	io[2] = be32_to_cpu(io_text[2]);
 	io[3] = be32_to_cpu(io_text[3]);
 
-	/* pre whitening but absorb kw2*/
+	/* pre whitening but absorb kw2 */
 	io[0] ^= CAMELLIA_SUBKEY_L(0);
 	io[1] ^= CAMELLIA_SUBKEY_R(0);
-	/* main iteration */
 
+	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 CAMELLIA_SUBKEY_L(2),CAMELLIA_SUBKEY_R(2),
 			 io[2],io[3],il,ir,t0,t1);

@@ -1298,19 +1232,10 @@ static void camellia_encrypt128(const u3
 	io[2] ^= CAMELLIA_SUBKEY_L(24);
 	io[3] ^= CAMELLIA_SUBKEY_R(24);
 
-	t0 = io[0];
-	t1 = io[1];
-	io[0] = io[2];
-	io[1] = io[3];
-	io[2] = t0;
-	io[3] = t1;
-
-	io_text[0] = cpu_to_be32(io[0]);
-	io_text[1] = cpu_to_be32(io[1]);
-	io_text[2] = cpu_to_be32(io[2]);
-	io_text[3] = cpu_to_be32(io[3]);
-
-	return;
+	io_text[0] = cpu_to_be32(io[2]);
+	io_text[1] = cpu_to_be32(io[3]);
+	io_text[2] = cpu_to_be32(io[0]);
+	io_text[3] = cpu_to_be32(io[1]);
 }
 
 static void camellia_decrypt128(const u32 *subkey, __be32 *io_text)

@@ -1324,7 +1249,7 @@ static void camellia_decrypt128(const u3
 	io[2] = be32_to_cpu(io_text[2]);
 	io[3] = be32_to_cpu(io_text[3]);
 
-	/* pre whitening but absorb kw2*/
+	/* pre whitening but absorb kw2 */
 	io[0] ^= CAMELLIA_SUBKEY_L(24);
 	io[1] ^= CAMELLIA_SUBKEY_R(24);
 

@@ -1400,25 +1325,12 @@ static void camellia_decrypt128(const u3
 	io[2] ^= CAMELLIA_SUBKEY_L(0);
 	io[3] ^= CAMELLIA_SUBKEY_R(0);
 
-	t0 = io[0];
-	t1 = io[1];
-	io[0] = io[2];
-	io[1] = io[3];
-	io[2] = t0;
-	io[3] = t1;
-
-	io_text[0] = cpu_to_be32(io[0]);
-	io_text[1] = cpu_to_be32(io[1]);
-	io_text[2] = cpu_to_be32(io[2]);
-	io_text[3] = cpu_to_be32(io[3]);
-
-	return;
+	io_text[0] = cpu_to_be32(io[2]);
+	io_text[1] = cpu_to_be32(io[3]);
+	io_text[2] = cpu_to_be32(io[0]);
+	io_text[3] = cpu_to_be32(io[1]);
 }
 
-
-/**
- * stuff for 192 and 256bit encryption/decryption
- */
 static void camellia_encrypt256(const u32 *subkey, __be32 *io_text)
 {
 	u32 il,ir,t0,t1;           /* temporary valiables */

@@ -1430,7 +1342,7 @@ static void camellia_encrypt256(const u3
 	io[2] = be32_to_cpu(io_text[2]);
 	io[3] = be32_to_cpu(io_text[3]);
 
-	/* pre whitening but absorb kw2*/
+	/* pre whitening but absorb kw2 */
 	io[0] ^= CAMELLIA_SUBKEY_L(0);
 	io[1] ^= CAMELLIA_SUBKEY_R(0);
 

@@ -1530,22 +1442,12 @@ static void camellia_encrypt256(const u3
 	io[2] ^= CAMELLIA_SUBKEY_L(32);
 	io[3] ^= CAMELLIA_SUBKEY_R(32);
 
-	t0 = io[0];
-	t1 = io[1];
-	io[0] = io[2];
-	io[1] = io[3];
-	io[2] = t0;
-	io[3] = t1;
-
-	io_text[0] = cpu_to_be32(io[0]);
-	io_text[1] = cpu_to_be32(io[1]);
-	io_text[2] = cpu_to_be32(io[2]);
-	io_text[3] = cpu_to_be32(io[3]);
-
-	return;
+	io_text[0] = cpu_to_be32(io[2]);
+	io_text[1] = cpu_to_be32(io[3]);
+	io_text[2] = cpu_to_be32(io[0]);
+	io_text[3] = cpu_to_be32(io[1]);
 }
 
-
 static void camellia_decrypt256(const u32 *subkey, __be32 *io_text)
 {
 	u32 il,ir,t0,t1;           /* temporary valiables */

@@ -1557,7 +1459,7 @@ static void camellia_decrypt256(const u3
 	io[2] = be32_to_cpu(io_text[2]);
 	io[3] = be32_to_cpu(io_text[3]);
 
-	/* pre whitening but absorb kw2*/
+	/* pre whitening but absorb kw2 */
 	io[0] ^= CAMELLIA_SUBKEY_L(32);
 	io[1] ^= CAMELLIA_SUBKEY_R(32);
 

@@ -1657,22 +1559,18 @@ static void camellia_decrypt256(const u3
 	io[2] ^= CAMELLIA_SUBKEY_L(0);
 	io[3] ^= CAMELLIA_SUBKEY_R(0);
 
-	t0 = io[0];
-	t1 = io[1];
-	io[0] = io[2];
-	io[1] = io[3];
-	io[2] = t0;
-	io[3] = t1;
-
-	io_text[0] = cpu_to_be32(io[0]);
-	io_text[1] = cpu_to_be32(io[1]);
-	io_text[2] = cpu_to_be32(io[2]);
-	io_text[3] = cpu_to_be32(io[3]);
-
-	return;
+	io_text[0] = cpu_to_be32(io[2]);
+	io_text[1] = cpu_to_be32(io[3]);
+	io_text[2] = cpu_to_be32(io[0]);
+	io_text[3] = cpu_to_be32(io[1]);
 }
 
 
+struct camellia_ctx {
+	int key_length;
+	u32 key_table[CAMELLIA_TABLE_BYTE_LEN / 4];
+};
+
 static int
 camellia_set_key(struct crypto_tfm *tfm, const u8 *in_key,
 		 unsigned int key_len)

@@ -1688,7 +1586,7 @@ camellia_set_key(struct crypto_tfm *tfm,
 
 	cctx->key_length = key_len;
 
-	switch(key_len) {
+	switch (key_len) {
 	case 16:
 		camellia_setup128(key, cctx->key_table);
 		break;

@@ -1698,14 +1596,11 @@ camellia_set_key(struct crypto_tfm *tfm,
 	case 32:
 		camellia_setup256(key, cctx->key_table);
 		break;
-	default:
-		break;
 	}
 
 	return 0;
 }
 
-
 static void camellia_encrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 {
 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);

@@ -1725,14 +1620,11 @@ static void camellia_encrypt(struct cryp
 	case 32:
 		camellia_encrypt256(cctx->key_table, tmp);
 		break;
-	default:
-		break;
 	}
 
 	memcpy(dst, tmp, CAMELLIA_BLOCK_SIZE);
 }
 
-
 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)
 {
 	const struct camellia_ctx *cctx = crypto_tfm_ctx(tfm);

@@ -1752,14 +1644,11 @@ static void camellia_decrypt(struct cryp
 	case 32:
 		camellia_decrypt256(cctx->key_table, tmp);
 		break;
-	default:
-		break;
 	}
 
 	memcpy(dst, tmp, CAMELLIA_BLOCK_SIZE);
 }
 
-
 static struct crypto_alg camellia_alg = {
 	.cra_name		=	"camellia",
 	.cra_driver_name	=	"camellia-generic",

@@ -1786,16 +1675,13 @@ static int __init camellia_init(void)
 	return crypto_register_alg(&camellia_alg);
 }
 
-
 static void __exit camellia_fini(void)
 {
 	crypto_unregister_alg(&camellia_alg);
 }
 
-
 module_init(camellia_init);
 module_exit(camellia_fini);
 
-
 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
 MODULE_LICENSE("GPL");
Acked-by on v1 1/5
#2 lore raw

Re: [PATCH 1/5] camellia: cleanup

Hi,

Quoted 19 lines
Quoted 3 lines

Thu, 25 Oct 2007 12:45:04 +0100
[Subject: [PATCH 1/5] camellia: cleanup] Denys Vlasenko <[email protected]> wrote...

Quoted 14 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia1.diff:
Move code blocks around so that related pieces are closer together:
e.g. CAMELLIA_ROUNDSM macro does not need to be separated from the rest of the code by huge array of constants.

Remove unused macros (COPY4WORD, SWAP4WORD, XOR4WORD[2])

Drop SUBL(), SUBR() macros which only obscure things. Same for CAMELLIA_SP1110() macro and KEY_TABLE_TYPE typedef.

Quoted 7 lines
Quoted 5 lines

Remove useless comments:
/* encryption */ -- well it's obvious enough already! void camellia_encrypt128(...)

Combine swap with copying at the beginning/end of encrypt/decrypt.

Signed-off-by Denys Vlasenko <[email protected]>
Acked-by Noriaki TAKAMIYA <[email protected]>

--
Noriaki TAKAMIYA

maintainer
#3 lore raw

Re: [PATCH 1/5] camellia: cleanup

In reply to Denys Vlasenko
Quoted 15 lines · Denys Vlasenko
Quoted 14 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia1.diff:
Move code blocks around so that related pieces are closer together:
e.g. CAMELLIA_ROUNDSM macro does not need to be separated from the rest of the code by huge array of constants.

Remove unused macros (COPY4WORD, SWAP4WORD, XOR4WORD[2])

Drop SUBL(), SUBR() macros which only obscure things. Same for CAMELLIA_SP1110() macro and KEY_TABLE_TYPE typedef.

Quoted 7 lines
Quoted 5 lines

Remove useless comments:
/* encryption */ -- well it's obvious enough already! void camellia_encrypt128(...)

Combine swap with copying at the beginning/end of encrypt/decrypt.

Signed-off-by Denys Vlasenko <[email protected]>

Patch applied. Thanks Denis!

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#4 lore raw

PATCH 2/5 camellia: cleanup

In reply to Denys Vlasenko
Quoted 4 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

Quoted 8 lines

camellia2.diff
Rename some macros to shorter names: CAMELLIA_RR8 -> ROR8, making it easier to understand that it is just a right rotation, nothing camellia-specific in it.
CAMELLIA_SUBKEY_L() -> SUBKEY_L() - just shorter.

Move be32 <-> cpu conversions out of en/decrypt128/256 and into camellia_en/decrypt - no reason to have that code duplicated twice.

Signed-off-by Denys Vlasenko <[email protected]>

--
vda

crypto/camellia.c renamed from crypto/camellia1.c +418 -517
@@ -336,13 +336,13 @@ static const u32 camellia_sp4404[256] = 
 		     ^ ((u32)(pt)[3]))
 
 /* rotation right shift 1byte */
-#define CAMELLIA_RR8(x) (((x) >> 8) + ((x) << 24))
+#define ROR8(x) (((x) >> 8) + ((x) << 24))
 /* rotation left shift 1bit */
-#define CAMELLIA_RL1(x) (((x) << 1) + ((x) >> 31))
+#define ROL1(x) (((x) << 1) + ((x) >> 31))
 /* rotation left shift 1byte */
-#define CAMELLIA_RL8(x) (((x) << 8) + ((x) >> 24))
+#define ROL8(x) (((x) << 8) + ((x) >> 24))
 
-#define CAMELLIA_ROLDQ(ll, lr, rl, rr, w0, w1, bits)	\
+#define ROLDQ(ll, lr, rl, rr, w0, w1, bits)		\
     do {						\
 	w0 = ll;					\
 	ll = (ll << bits) + (lr >> (32 - bits));	\

@@ -351,7 +351,7 @@ static const u32 camellia_sp4404[256] = 
 	rr = (rr << bits) + (w0 >> (32 - bits));	\
     } while(0)
 
-#define CAMELLIA_ROLDQo32(ll, lr, rl, rr, w0, w1, bits)	\
+#define ROLDQo32(ll, lr, rl, rr, w0, w1, bits)		\
     do {						\
 	w0 = ll;					\
 	w1 = lr;					\

@@ -377,7 +377,7 @@ static const u32 camellia_sp4404[256] = 
 	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
 	   ^ camellia_sp4404[il & 0xff];			\
 	yl ^= yr;						\
-	yr = CAMELLIA_RR8(yr);					\
+	yr = ROR8(yr);						\
 	yr ^= yl;						\
     } while(0)
 

@@ -393,13 +393,13 @@ static const u32 camellia_sp4404[256] = 
 	t0 &= ll;							\
 	t2 |= rr;							\
 	rl ^= t2;							\
-	lr ^= CAMELLIA_RL1(t0);						\
+	lr ^= ROL1(t0);							\
 	t3 = krl;							\
 	t1 = klr;							\
 	t3 &= rl;							\
 	t1 |= lr;							\
 	ll ^= t1;							\
-	rr ^= CAMELLIA_RL1(t3);						\
+	rr ^= ROL1(t3);							\
     } while(0)
 
 #define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\

@@ -415,12 +415,12 @@ static const u32 camellia_sp4404[256] = 
 	il ^= kl;							\
 	ir ^= il ^ kr;							\
 	yl ^= ir;							\
-	yr ^= CAMELLIA_RR8(il) ^ ir;					\
+	yr ^= ROR8(il) ^ ir;						\
     } while(0)
 
 
-#define CAMELLIA_SUBKEY_L(INDEX) (subkey[(INDEX)*2])
-#define CAMELLIA_SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
+#define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
+#define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 
 static void camellia_setup128(const unsigned char *key, u32 *subkey)
 {

@@ -445,35 +445,35 @@ static void camellia_setup128(const unsi
 	/* kw2 */
 	subL[1] = krl; subR[1] = krr;
 	/* rotation left shift 15bit */
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k3 */
 	subL[4] = kll; subR[4] = klr;
 	/* k4 */
 	subL[5] = krl; subR[5] = krr;
 	/* rotation left shift 15+30bit */
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 	/* k7 */
 	subL[10] = kll; subR[10] = klr;
 	/* k8 */
 	subL[11] = krl; subR[11] = krr;
 	/* rotation left shift 15+30+15bit */
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k10 */
 	subL[13] = krl; subR[13] = krr;
 	/* rotation left shift 15+30+15+17 bit */
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* kl3 */
 	subL[16] = kll; subR[16] = klr;
 	/* kl4 */
 	subL[17] = krl; subR[17] = krr;
 	/* rotation left shift 15+30+15+17+17 bit */
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* k13 */
 	subL[18] = kll; subR[18] = klr;
 	/* k14 */
 	subL[19] = krl; subR[19] = krr;
 	/* rotation left shift 15+30+15+17+17+17 bit */
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* k17 */
 	subL[22] = kll; subR[22] = klr;
 	/* k18 */

@@ -503,26 +503,26 @@ static void camellia_setup128(const unsi
 	/* k1, k2 */
 	subL[2] = kll; subR[2] = klr;
 	subL[3] = krl; subR[3] = krr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k5,k6 */
 	subL[6] = kll; subR[6] = klr;
 	subL[7] = krl; subR[7] = krr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* kl1, kl2 */
 	subL[8] = kll; subR[8] = klr;
 	subL[9] = krl; subR[9] = krr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k9 */
 	subL[12] = kll; subR[12] = klr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k11, k12 */
 	subL[14] = kll; subR[14] = klr;
 	subL[15] = krl; subR[15] = krr;
-	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
+	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 	/* k15, k16 */
 	subL[20] = kll; subR[20] = klr;
 	subL[21] = krl; subR[21] = krr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* kw3, kw4 */
 	subL[24] = kll; subR[24] = klr;
 	subL[25] = krl; subR[25] = krr;

@@ -536,7 +536,7 @@ static void camellia_setup128(const unsi
 	subL[7] ^= subL[1]; subR[7] ^= subR[1];
 	subL[1] ^= subR[1] & ~subR[9];
 	dw = subL[1] & subL[9],
-		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
+		subR[1] ^= ROL1(dw); /* modified for FLinv(kl2) */
 	/* round 8 */
 	subL[11] ^= subL[1]; subR[11] ^= subR[1];
 	/* round 10 */

@@ -545,7 +545,7 @@ static void camellia_setup128(const unsi
 	subL[15] ^= subL[1]; subR[15] ^= subR[1];
 	subL[1] ^= subR[1] & ~subR[17];
 	dw = subL[1] & subL[17],
-		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
+		subR[1] ^= ROL1(dw); /* modified for FLinv(kl4) */
 	/* round 14 */
 	subL[19] ^= subL[1]; subR[19] ^= subR[1];
 	/* round 16 */

@@ -565,7 +565,7 @@ static void camellia_setup128(const unsi
 	subL[18] ^= kw4l; subR[18] ^= kw4r;
 	kw4l ^= kw4r & ~subR[16];
 	dw = kw4l & subL[16],
-		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl3) */
+		kw4r ^= ROL1(dw); /* modified for FL(kl3) */
 	/* round 11 */
 	subL[14] ^= kw4l; subR[14] ^= kw4r;
 	/* round 9 */

@@ -574,7 +574,7 @@ static void camellia_setup128(const unsi
 	subL[10] ^= kw4l; subR[10] ^= kw4r;
 	kw4l ^= kw4r & ~subR[8];
 	dw = kw4l & subL[8],
-		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl1) */
+		kw4r ^= ROL1(dw); /* modified for FL(kl1) */
 	/* round 5 */
 	subL[6] ^= kw4l; subR[6] ^= kw4r;
 	/* round 3 */

@@ -585,140 +585,104 @@ static void camellia_setup128(const unsi
 	subL[0] ^= kw4l; subR[0] ^= kw4r;
 
 	/* key XOR is end of F-function */
-	CAMELLIA_SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
-	CAMELLIA_SUBKEY_R(0) = subR[0] ^ subR[2];
-	CAMELLIA_SUBKEY_L(2) = subL[3];       /* round 1 */
-	CAMELLIA_SUBKEY_R(2) = subR[3];
-	CAMELLIA_SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
-	CAMELLIA_SUBKEY_R(3) = subR[2] ^ subR[4];
-	CAMELLIA_SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
-	CAMELLIA_SUBKEY_R(4) = subR[3] ^ subR[5];
-	CAMELLIA_SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
-	CAMELLIA_SUBKEY_R(5) = subR[4] ^ subR[6];
-	CAMELLIA_SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
-	CAMELLIA_SUBKEY_R(6) = subR[5] ^ subR[7];
+	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
+	SUBKEY_R(0) = subR[0] ^ subR[2];
+	SUBKEY_L(2) = subL[3];       /* round 1 */
+	SUBKEY_R(2) = subR[3];
+	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
+	SUBKEY_R(3) = subR[2] ^ subR[4];
+	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
+	SUBKEY_R(4) = subR[3] ^ subR[5];
+	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
+	SUBKEY_R(5) = subR[4] ^ subR[6];
+	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
+	SUBKEY_R(6) = subR[5] ^ subR[7];
 	tl = subL[10] ^ (subR[10] & ~subR[8]);
 	dw = tl & subL[8],  /* FL(kl1) */
-		tr = subR[10] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
-	CAMELLIA_SUBKEY_R(7) = subR[6] ^ tr;
-	CAMELLIA_SUBKEY_L(8) = subL[8];       /* FL(kl1) */
-	CAMELLIA_SUBKEY_R(8) = subR[8];
-	CAMELLIA_SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
-	CAMELLIA_SUBKEY_R(9) = subR[9];
+		tr = subR[10] ^ ROL1(dw);
+	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
+	SUBKEY_R(7) = subR[6] ^ tr;
+	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
+	SUBKEY_R(8) = subR[8];
+	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
+	SUBKEY_R(9) = subR[9];
 	tl = subL[7] ^ (subR[7] & ~subR[9]);
 	dw = tl & subL[9],  /* FLinv(kl2) */
-		tr = subR[7] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
-	CAMELLIA_SUBKEY_R(10) = tr ^ subR[11];
-	CAMELLIA_SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
-	CAMELLIA_SUBKEY_R(11) = subR[10] ^ subR[12];
-	CAMELLIA_SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
-	CAMELLIA_SUBKEY_R(12) = subR[11] ^ subR[13];
-	CAMELLIA_SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
-	CAMELLIA_SUBKEY_R(13) = subR[12] ^ subR[14];
-	CAMELLIA_SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
-	CAMELLIA_SUBKEY_R(14) = subR[13] ^ subR[15];
+		tr = subR[7] ^ ROL1(dw);
+	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
+	SUBKEY_R(10) = tr ^ subR[11];
+	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
+	SUBKEY_R(11) = subR[10] ^ subR[12];
+	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
+	SUBKEY_R(12) = subR[11] ^ subR[13];
+	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
+	SUBKEY_R(13) = subR[12] ^ subR[14];
+	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
+	SUBKEY_R(14) = subR[13] ^ subR[15];
 	tl = subL[18] ^ (subR[18] & ~subR[16]);
 	dw = tl & subL[16], /* FL(kl3) */
-		tr = subR[18] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
-	CAMELLIA_SUBKEY_R(15) = subR[14] ^ tr;
-	CAMELLIA_SUBKEY_L(16) = subL[16];     /* FL(kl3) */
-	CAMELLIA_SUBKEY_R(16) = subR[16];
-	CAMELLIA_SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
-	CAMELLIA_SUBKEY_R(17) = subR[17];
+		tr = subR[18] ^ ROL1(dw);
+	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
+	SUBKEY_R(15) = subR[14] ^ tr;
+	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
+	SUBKEY_R(16) = subR[16];
+	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
+	SUBKEY_R(17) = subR[17];
 	tl = subL[15] ^ (subR[15] & ~subR[17]);
 	dw = tl & subL[17], /* FLinv(kl4) */
-		tr = subR[15] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
-	CAMELLIA_SUBKEY_R(18) = tr ^ subR[19];
-	CAMELLIA_SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
-	CAMELLIA_SUBKEY_R(19) = subR[18] ^ subR[20];
-	CAMELLIA_SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
-	CAMELLIA_SUBKEY_R(20) = subR[19] ^ subR[21];
-	CAMELLIA_SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
-	CAMELLIA_SUBKEY_R(21) = subR[20] ^ subR[22];
-	CAMELLIA_SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
-	CAMELLIA_SUBKEY_R(22) = subR[21] ^ subR[23];
-	CAMELLIA_SUBKEY_L(23) = subL[22];     /* round 18 */
-	CAMELLIA_SUBKEY_R(23) = subR[22];
-	CAMELLIA_SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
-	CAMELLIA_SUBKEY_R(24) = subR[24] ^ subR[23];
+		tr = subR[15] ^ ROL1(dw);
+	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
+	SUBKEY_R(18) = tr ^ subR[19];
+	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
+	SUBKEY_R(19) = subR[18] ^ subR[20];
+	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
+	SUBKEY_R(20) = subR[19] ^ subR[21];
+	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
+	SUBKEY_R(21) = subR[20] ^ subR[22];
+	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
+	SUBKEY_R(22) = subR[21] ^ subR[23];
+	SUBKEY_L(23) = subL[22];     /* round 18 */
+	SUBKEY_R(23) = subR[22];
+	SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
+	SUBKEY_R(24) = subR[24] ^ subR[23];
 
 	/* apply the inverse of the last half of P-function */
-	dw = CAMELLIA_SUBKEY_L(2) ^ CAMELLIA_SUBKEY_R(2),
-		dw = CAMELLIA_RL8(dw);/* round 1 */
-	CAMELLIA_SUBKEY_R(2) = CAMELLIA_SUBKEY_L(2) ^ dw,
-		CAMELLIA_SUBKEY_L(2) = dw;
-	dw = CAMELLIA_SUBKEY_L(3) ^ CAMELLIA_SUBKEY_R(3),
-		dw = CAMELLIA_RL8(dw);/* round 2 */
-	CAMELLIA_SUBKEY_R(3) = CAMELLIA_SUBKEY_L(3) ^ dw,
-		CAMELLIA_SUBKEY_L(3) = dw;
-	dw = CAMELLIA_SUBKEY_L(4) ^ CAMELLIA_SUBKEY_R(4),
-		dw = CAMELLIA_RL8(dw);/* round 3 */
-	CAMELLIA_SUBKEY_R(4) = CAMELLIA_SUBKEY_L(4) ^ dw,
-		CAMELLIA_SUBKEY_L(4) = dw;
-	dw = CAMELLIA_SUBKEY_L(5) ^ CAMELLIA_SUBKEY_R(5),
-		dw = CAMELLIA_RL8(dw);/* round 4 */
-	CAMELLIA_SUBKEY_R(5) = CAMELLIA_SUBKEY_L(5) ^ dw,
-		CAMELLIA_SUBKEY_L(5) = dw;
-	dw = CAMELLIA_SUBKEY_L(6) ^ CAMELLIA_SUBKEY_R(6),
-		dw = CAMELLIA_RL8(dw);/* round 5 */
-	CAMELLIA_SUBKEY_R(6) = CAMELLIA_SUBKEY_L(6) ^ dw,
-		CAMELLIA_SUBKEY_L(6) = dw;
-	dw = CAMELLIA_SUBKEY_L(7) ^ CAMELLIA_SUBKEY_R(7),
-		dw = CAMELLIA_RL8(dw);/* round 6 */
-	CAMELLIA_SUBKEY_R(7) = CAMELLIA_SUBKEY_L(7) ^ dw,
-		CAMELLIA_SUBKEY_L(7) = dw;
-	dw = CAMELLIA_SUBKEY_L(10) ^ CAMELLIA_SUBKEY_R(10),
-		dw = CAMELLIA_RL8(dw);/* round 7 */
-	CAMELLIA_SUBKEY_R(10) = CAMELLIA_SUBKEY_L(10) ^ dw,
-		CAMELLIA_SUBKEY_L(10) = dw;
-	dw = CAMELLIA_SUBKEY_L(11) ^ CAMELLIA_SUBKEY_R(11),
-		dw = CAMELLIA_RL8(dw);/* round 8 */
-	CAMELLIA_SUBKEY_R(11) = CAMELLIA_SUBKEY_L(11) ^ dw,
-		CAMELLIA_SUBKEY_L(11) = dw;
-	dw = CAMELLIA_SUBKEY_L(12) ^ CAMELLIA_SUBKEY_R(12),
-		dw = CAMELLIA_RL8(dw);/* round 9 */
-	CAMELLIA_SUBKEY_R(12) = CAMELLIA_SUBKEY_L(12) ^ dw,
-		CAMELLIA_SUBKEY_L(12) = dw;
-	dw = CAMELLIA_SUBKEY_L(13) ^ CAMELLIA_SUBKEY_R(13),
-		dw = CAMELLIA_RL8(dw);/* round 10 */
-	CAMELLIA_SUBKEY_R(13) = CAMELLIA_SUBKEY_L(13) ^ dw,
-		CAMELLIA_SUBKEY_L(13) = dw;
-	dw = CAMELLIA_SUBKEY_L(14) ^ CAMELLIA_SUBKEY_R(14),
-		dw = CAMELLIA_RL8(dw);/* round 11 */
-	CAMELLIA_SUBKEY_R(14) = CAMELLIA_SUBKEY_L(14) ^ dw,
-		CAMELLIA_SUBKEY_L(14) = dw;
-	dw = CAMELLIA_SUBKEY_L(15) ^ CAMELLIA_SUBKEY_R(15),
-		dw = CAMELLIA_RL8(dw);/* round 12 */
-	CAMELLIA_SUBKEY_R(15) = CAMELLIA_SUBKEY_L(15) ^ dw,
-		CAMELLIA_SUBKEY_L(15) = dw;
-	dw = CAMELLIA_SUBKEY_L(18) ^ CAMELLIA_SUBKEY_R(18),
-		dw = CAMELLIA_RL8(dw);/* round 13 */
-	CAMELLIA_SUBKEY_R(18) = CAMELLIA_SUBKEY_L(18) ^ dw,
-		CAMELLIA_SUBKEY_L(18) = dw;
-	dw = CAMELLIA_SUBKEY_L(19) ^ CAMELLIA_SUBKEY_R(19),
-		dw = CAMELLIA_RL8(dw);/* round 14 */
-	CAMELLIA_SUBKEY_R(19) = CAMELLIA_SUBKEY_L(19) ^ dw,
-		CAMELLIA_SUBKEY_L(19) = dw;
-	dw = CAMELLIA_SUBKEY_L(20) ^ CAMELLIA_SUBKEY_R(20),
-		dw = CAMELLIA_RL8(dw);/* round 15 */
-	CAMELLIA_SUBKEY_R(20) = CAMELLIA_SUBKEY_L(20) ^ dw,
-		CAMELLIA_SUBKEY_L(20) = dw;
-	dw = CAMELLIA_SUBKEY_L(21) ^ CAMELLIA_SUBKEY_R(21),
-		dw = CAMELLIA_RL8(dw);/* round 16 */
-	CAMELLIA_SUBKEY_R(21) = CAMELLIA_SUBKEY_L(21) ^ dw,
-		CAMELLIA_SUBKEY_L(21) = dw;
-	dw = CAMELLIA_SUBKEY_L(22) ^ CAMELLIA_SUBKEY_R(22),
-		dw = CAMELLIA_RL8(dw);/* round 17 */
-	CAMELLIA_SUBKEY_R(22) = CAMELLIA_SUBKEY_L(22) ^ dw,
-		CAMELLIA_SUBKEY_L(22) = dw;
-	dw = CAMELLIA_SUBKEY_L(23) ^ CAMELLIA_SUBKEY_R(23),
-		dw = CAMELLIA_RL8(dw);/* round 18 */
-	CAMELLIA_SUBKEY_R(23) = CAMELLIA_SUBKEY_L(23) ^ dw,
-		CAMELLIA_SUBKEY_L(23) = dw;
+	dw = SUBKEY_L(2) ^ SUBKEY_R(2); dw = ROL8(dw);/* round 1 */
+	SUBKEY_R(2) = SUBKEY_L(2) ^ dw; SUBKEY_L(2) = dw;
+	dw = SUBKEY_L(3) ^ SUBKEY_R(3); dw = ROL8(dw);/* round 2 */
+	SUBKEY_R(3) = SUBKEY_L(3) ^ dw; SUBKEY_L(3) = dw;
+	dw = SUBKEY_L(4) ^ SUBKEY_R(4); dw = ROL8(dw);/* round 3 */
+	SUBKEY_R(4) = SUBKEY_L(4) ^ dw; SUBKEY_L(4) = dw;
+	dw = SUBKEY_L(5) ^ SUBKEY_R(5); dw = ROL8(dw);/* round 4 */
+	SUBKEY_R(5) = SUBKEY_L(5) ^ dw; SUBKEY_L(5) = dw;
+	dw = SUBKEY_L(6) ^ SUBKEY_R(6); dw = ROL8(dw);/* round 5 */
+	SUBKEY_R(6) = SUBKEY_L(6) ^ dw; SUBKEY_L(6) = dw;
+	dw = SUBKEY_L(7) ^ SUBKEY_R(7); dw = ROL8(dw);/* round 6 */
+	SUBKEY_R(7) = SUBKEY_L(7) ^ dw; SUBKEY_L(7) = dw;
+	dw = SUBKEY_L(10) ^ SUBKEY_R(10); dw = ROL8(dw);/* round 7 */
+	SUBKEY_R(10) = SUBKEY_L(10) ^ dw; SUBKEY_L(10) = dw;
+	dw = SUBKEY_L(11) ^ SUBKEY_R(11); dw = ROL8(dw);/* round 8 */
+	SUBKEY_R(11) = SUBKEY_L(11) ^ dw; SUBKEY_L(11) = dw;
+	dw = SUBKEY_L(12) ^ SUBKEY_R(12); dw = ROL8(dw);/* round 9 */
+	SUBKEY_R(12) = SUBKEY_L(12) ^ dw; SUBKEY_L(12) = dw;
+	dw = SUBKEY_L(13) ^ SUBKEY_R(13); dw = ROL8(dw);/* round 10 */
+	SUBKEY_R(13) = SUBKEY_L(13) ^ dw; SUBKEY_L(13) = dw;
+	dw = SUBKEY_L(14) ^ SUBKEY_R(14); dw = ROL8(dw);/* round 11 */
+	SUBKEY_R(14) = SUBKEY_L(14) ^ dw; SUBKEY_L(14) = dw;
+	dw = SUBKEY_L(15) ^ SUBKEY_R(15); dw = ROL8(dw);/* round 12 */
+	SUBKEY_R(15) = SUBKEY_L(15) ^ dw; SUBKEY_L(15) = dw;
+	dw = SUBKEY_L(18) ^ SUBKEY_R(18); dw = ROL8(dw);/* round 13 */
+	SUBKEY_R(18) = SUBKEY_L(18) ^ dw; SUBKEY_L(18) = dw;
+	dw = SUBKEY_L(19) ^ SUBKEY_R(19); dw = ROL8(dw);/* round 14 */
+	SUBKEY_R(19) = SUBKEY_L(19) ^ dw; SUBKEY_L(19) = dw;
+	dw = SUBKEY_L(20) ^ SUBKEY_R(20); dw = ROL8(dw);/* round 15 */
+	SUBKEY_R(20) = SUBKEY_L(20) ^ dw; SUBKEY_L(20) = dw;
+	dw = SUBKEY_L(21) ^ SUBKEY_R(21); dw = ROL8(dw);/* round 16 */
+	SUBKEY_R(21) = SUBKEY_L(21) ^ dw; SUBKEY_L(21) = dw;
+	dw = SUBKEY_L(22) ^ SUBKEY_R(22); dw = ROL8(dw);/* round 17 */
+	SUBKEY_R(22) = SUBKEY_L(22) ^ dw; SUBKEY_L(22) = dw;
+	dw = SUBKEY_L(23) ^ SUBKEY_R(23); dw = ROL8(dw);/* round 18 */
+	SUBKEY_R(23) = SUBKEY_L(23) ^ dw; SUBKEY_L(23) = dw;
 }
 
 static void camellia_setup256(const unsigned char *key, u32 *subkey)

@@ -734,7 +698,6 @@ static void camellia_setup256(const unsi
 	 *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
 	 *  (|| is concatination)
 	 */
-
 	kll  = GETU32(key     );
 	klr  = GETU32(key +  4);
 	krl  = GETU32(key +  8);

@@ -749,49 +712,49 @@ static void camellia_setup256(const unsi
 	subL[0] = kll; subR[0] = klr;
 	/* kw2 */
 	subL[1] = krl; subR[1] = krr;
-	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
+	ROLDQo32(kll, klr, krl, krr, w0, w1, 45);
 	/* k9 */
 	subL[12] = kll; subR[12] = klr;
 	/* k10 */
 	subL[13] = krl; subR[13] = krr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* kl3 */
 	subL[16] = kll; subR[16] = klr;
 	/* kl4 */
 	subL[17] = krl; subR[17] = krr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 17);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 17);
 	/* k17 */
 	subL[22] = kll; subR[22] = klr;
 	/* k18 */
 	subL[23] = krl; subR[23] = krr;
-	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
+	ROLDQo32(kll, klr, krl, krr, w0, w1, 34);
 	/* k23 */
 	subL[30] = kll; subR[30] = klr;
 	/* k24 */
 	subL[31] = krl; subR[31] = krr;
 
 	/* generate KR dependent subkeys */
-	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
+	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 	/* k3 */
 	subL[4] = krll; subR[4] = krlr;
 	/* k4 */
 	subL[5] = krrl; subR[5] = krrr;
-	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
+	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 15);
 	/* kl1 */
 	subL[8] = krll; subR[8] = krlr;
 	/* kl2 */
 	subL[9] = krrl; subR[9] = krrr;
-	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
+	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 	/* k13 */
 	subL[18] = krll; subR[18] = krlr;
 	/* k14 */
 	subL[19] = krrl; subR[19] = krrr;
-	CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
+	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 	/* k19 */
 	subL[26] = krll; subR[26] = krlr;
 	/* k20 */
 	subL[27] = krrl; subR[27] = krrr;
-	CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
+	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 34);
 
 	/* generate KA */
 	kll = subL[0] ^ krll; klr = subR[0] ^ krlr;

@@ -826,12 +789,12 @@ static void camellia_setup256(const unsi
 	krll ^= w0; krlr ^= w1;
 
 	/* generate KA dependent subkeys */
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 15);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 15);
 	/* k5 */
 	subL[6] = kll; subR[6] = klr;
 	/* k6 */
 	subL[7] = krl; subR[7] = krr;
-	CAMELLIA_ROLDQ(kll, klr, krl, krr, w0, w1, 30);
+	ROLDQ(kll, klr, krl, krr, w0, w1, 30);
 	/* k11 */
 	subL[14] = kll; subR[14] = klr;
 	/* k12 */

@@ -842,7 +805,7 @@ static void camellia_setup256(const unsi
 	/* kl6 */
 	subL[25] = krr; subR[25] = kll;
 	/* rotation left shift 49 from k11,k12 -> k21,k22 */
-	CAMELLIA_ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
+	ROLDQo32(kll, klr, krl, krr, w0, w1, 49);
 	/* k21 */
 	subL[28] = kll; subR[28] = klr;
 	/* k22 */

@@ -853,17 +816,17 @@ static void camellia_setup256(const unsi
 	subL[2] = krll; subR[2] = krlr;
 	/* k2 */
 	subL[3] = krrl; subR[3] = krrr;
-	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
+	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 	/* k7 */
 	subL[10] = krll; subR[10] = krlr;
 	/* k8 */
 	subL[11] = krrl; subR[11] = krrr;
-	CAMELLIA_ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
+	ROLDQ(krll, krlr, krrl, krrr, w0, w1, 30);
 	/* k15 */
 	subL[20] = krll; subR[20] = krlr;
 	/* k16 */
 	subL[21] = krrl; subR[21] = krrr;
-	CAMELLIA_ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
+	ROLDQo32(krll, krlr, krrl, krrr, w0, w1, 51);
 	/* kw3 */
 	subL[32] = krll; subR[32] = krlr;
 	/* kw4 */

@@ -878,7 +841,7 @@ static void camellia_setup256(const unsi
 	subL[7] ^= subL[1]; subR[7] ^= subR[1];
 	subL[1] ^= subR[1] & ~subR[9];
 	dw = subL[1] & subL[9],
-		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl2) */
+		subR[1] ^= ROL1(dw); /* modified for FLinv(kl2) */
 	/* round 8 */
 	subL[11] ^= subL[1]; subR[11] ^= subR[1];
 	/* round 10 */

@@ -887,7 +850,7 @@ static void camellia_setup256(const unsi
 	subL[15] ^= subL[1]; subR[15] ^= subR[1];
 	subL[1] ^= subR[1] & ~subR[17];
 	dw = subL[1] & subL[17],
-		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl4) */
+		subR[1] ^= ROL1(dw); /* modified for FLinv(kl4) */
 	/* round 14 */
 	subL[19] ^= subL[1]; subR[19] ^= subR[1];
 	/* round 16 */

@@ -896,7 +859,7 @@ static void camellia_setup256(const unsi
 	subL[23] ^= subL[1]; subR[23] ^= subR[1];
 	subL[1] ^= subR[1] & ~subR[25];
 	dw = subL[1] & subL[25],
-		subR[1] ^= CAMELLIA_RL1(dw); /* modified for FLinv(kl6) */
+		subR[1] ^= ROL1(dw); /* modified for FLinv(kl6) */
 	/* round 20 */
 	subL[27] ^= subL[1]; subR[27] ^= subR[1];
 	/* round 22 */

@@ -916,7 +879,7 @@ static void camellia_setup256(const unsi
 	subL[26] ^= kw4l; subR[26] ^= kw4r;
 	kw4l ^= kw4r & ~subR[24];
 	dw = kw4l & subL[24],
-		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl5) */
+		kw4r ^= ROL1(dw); /* modified for FL(kl5) */
 	/* round 17 */
 	subL[22] ^= kw4l; subR[22] ^= kw4r;
 	/* round 15 */

@@ -925,7 +888,7 @@ static void camellia_setup256(const unsi
 	subL[18] ^= kw4l; subR[18] ^= kw4r;
 	kw4l ^= kw4r & ~subR[16];
 	dw = kw4l & subL[16],
-		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl3) */
+		kw4r ^= ROL1(dw); /* modified for FL(kl3) */
 	/* round 11 */
 	subL[14] ^= kw4l; subR[14] ^= kw4r;
 	/* round 9 */

@@ -934,7 +897,7 @@ static void camellia_setup256(const unsi
 	subL[10] ^= kw4l; subR[10] ^= kw4r;
 	kw4l ^= kw4r & ~subR[8];
 	dw = kw4l & subL[8],
-		kw4r ^= CAMELLIA_RL1(dw); /* modified for FL(kl1) */
+		kw4r ^= ROL1(dw); /* modified for FL(kl1) */
 	/* round 5 */
 	subL[6] ^= kw4l; subR[6] ^= kw4r;
 	/* round 3 */

@@ -945,188 +908,138 @@ static void camellia_setup256(const unsi
 	subL[0] ^= kw4l; subR[0] ^= kw4r;
 
 	/* key XOR is end of F-function */
-	CAMELLIA_SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
-	CAMELLIA_SUBKEY_R(0) = subR[0] ^ subR[2];
-	CAMELLIA_SUBKEY_L(2) = subL[3];       /* round 1 */
-	CAMELLIA_SUBKEY_R(2) = subR[3];
-	CAMELLIA_SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
-	CAMELLIA_SUBKEY_R(3) = subR[2] ^ subR[4];
-	CAMELLIA_SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
-	CAMELLIA_SUBKEY_R(4) = subR[3] ^ subR[5];
-	CAMELLIA_SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
-	CAMELLIA_SUBKEY_R(5) = subR[4] ^ subR[6];
-	CAMELLIA_SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
-	CAMELLIA_SUBKEY_R(6) = subR[5] ^ subR[7];
+	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
+	SUBKEY_R(0) = subR[0] ^ subR[2];
+	SUBKEY_L(2) = subL[3];       /* round 1 */
+	SUBKEY_R(2) = subR[3];
+	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
+	SUBKEY_R(3) = subR[2] ^ subR[4];
+	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
+	SUBKEY_R(4) = subR[3] ^ subR[5];
+	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
+	SUBKEY_R(5) = subR[4] ^ subR[6];
+	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
+	SUBKEY_R(6) = subR[5] ^ subR[7];
 	tl = subL[10] ^ (subR[10] & ~subR[8]);
 	dw = tl & subL[8],  /* FL(kl1) */
-		tr = subR[10] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
-	CAMELLIA_SUBKEY_R(7) = subR[6] ^ tr;
-	CAMELLIA_SUBKEY_L(8) = subL[8];       /* FL(kl1) */
-	CAMELLIA_SUBKEY_R(8) = subR[8];
-	CAMELLIA_SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
-	CAMELLIA_SUBKEY_R(9) = subR[9];
+		tr = subR[10] ^ ROL1(dw);
+	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
+	SUBKEY_R(7) = subR[6] ^ tr;
+	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
+	SUBKEY_R(8) = subR[8];
+	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
+	SUBKEY_R(9) = subR[9];
 	tl = subL[7] ^ (subR[7] & ~subR[9]);
 	dw = tl & subL[9],  /* FLinv(kl2) */
-		tr = subR[7] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
-	CAMELLIA_SUBKEY_R(10) = tr ^ subR[11];
-	CAMELLIA_SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
-	CAMELLIA_SUBKEY_R(11) = subR[10] ^ subR[12];
-	CAMELLIA_SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
-	CAMELLIA_SUBKEY_R(12) = subR[11] ^ subR[13];
-	CAMELLIA_SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
-	CAMELLIA_SUBKEY_R(13) = subR[12] ^ subR[14];
-	CAMELLIA_SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
-	CAMELLIA_SUBKEY_R(14) = subR[13] ^ subR[15];
+		tr = subR[7] ^ ROL1(dw);
+	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
+	SUBKEY_R(10) = tr ^ subR[11];
+	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
+	SUBKEY_R(11) = subR[10] ^ subR[12];
+	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
+	SUBKEY_R(12) = subR[11] ^ subR[13];
+	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
+	SUBKEY_R(13) = subR[12] ^ subR[14];
+	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
+	SUBKEY_R(14) = subR[13] ^ subR[15];
 	tl = subL[18] ^ (subR[18] & ~subR[16]);
 	dw = tl & subL[16], /* FL(kl3) */
-		tr = subR[18] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
-	CAMELLIA_SUBKEY_R(15) = subR[14] ^ tr;
-	CAMELLIA_SUBKEY_L(16) = subL[16];     /* FL(kl3) */
-	CAMELLIA_SUBKEY_R(16) = subR[16];
-	CAMELLIA_SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
-	CAMELLIA_SUBKEY_R(17) = subR[17];
+		tr = subR[18] ^ ROL1(dw);
+	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
+	SUBKEY_R(15) = subR[14] ^ tr;
+	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
+	SUBKEY_R(16) = subR[16];
+	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
+	SUBKEY_R(17) = subR[17];
 	tl = subL[15] ^ (subR[15] & ~subR[17]);
 	dw = tl & subL[17], /* FLinv(kl4) */
-		tr = subR[15] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
-	CAMELLIA_SUBKEY_R(18) = tr ^ subR[19];
-	CAMELLIA_SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
-	CAMELLIA_SUBKEY_R(19) = subR[18] ^ subR[20];
-	CAMELLIA_SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
-	CAMELLIA_SUBKEY_R(20) = subR[19] ^ subR[21];
-	CAMELLIA_SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
-	CAMELLIA_SUBKEY_R(21) = subR[20] ^ subR[22];
-	CAMELLIA_SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
-	CAMELLIA_SUBKEY_R(22) = subR[21] ^ subR[23];
-	tl = subL[26] ^ (subR[26]
-			 & ~subR[24]);
+		tr = subR[15] ^ ROL1(dw);
+	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
+	SUBKEY_R(18) = tr ^ subR[19];
+	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
+	SUBKEY_R(19) = subR[18] ^ subR[20];
+	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
+	SUBKEY_R(20) = subR[19] ^ subR[21];
+	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
+	SUBKEY_R(21) = subR[20] ^ subR[22];
+	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
+	SUBKEY_R(22) = subR[21] ^ subR[23];
+	tl = subL[26] ^ (subR[26] & ~subR[24]);
 	dw = tl & subL[24], /* FL(kl5) */
-		tr = subR[26] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
-	CAMELLIA_SUBKEY_R(23) = subR[22] ^ tr;
-	CAMELLIA_SUBKEY_L(24) = subL[24];     /* FL(kl5) */
-	CAMELLIA_SUBKEY_R(24) = subR[24];
-	CAMELLIA_SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
-	CAMELLIA_SUBKEY_R(25) = subR[25];
-	tl = subL[23] ^ (subR[23] &
-			 ~subR[25]);
+		tr = subR[26] ^ ROL1(dw);
+	SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
+	SUBKEY_R(23) = subR[22] ^ tr;
+	SUBKEY_L(24) = subL[24];     /* FL(kl5) */
+	SUBKEY_R(24) = subR[24];
+	SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
+	SUBKEY_R(25) = subR[25];
+	tl = subL[23] ^ (subR[23] & ~subR[25]);
 	dw = tl & subL[25], /* FLinv(kl6) */
-		tr = subR[23] ^ CAMELLIA_RL1(dw);
-	CAMELLIA_SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
-	CAMELLIA_SUBKEY_R(26) = tr ^ subR[27];
-	CAMELLIA_SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
-	CAMELLIA_SUBKEY_R(27) = subR[26] ^ subR[28];
-	CAMELLIA_SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
-	CAMELLIA_SUBKEY_R(28) = subR[27] ^ subR[29];
-	CAMELLIA_SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
-	CAMELLIA_SUBKEY_R(29) = subR[28] ^ subR[30];
-	CAMELLIA_SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
-	CAMELLIA_SUBKEY_R(30) = subR[29] ^ subR[31];
-	CAMELLIA_SUBKEY_L(31) = subL[30];     /* round 24 */
-	CAMELLIA_SUBKEY_R(31) = subR[30];
-	CAMELLIA_SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
-	CAMELLIA_SUBKEY_R(32) = subR[32] ^ subR[31];
+		tr = subR[23] ^ ROL1(dw);
+	SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
+	SUBKEY_R(26) = tr ^ subR[27];
+	SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
+	SUBKEY_R(27) = subR[26] ^ subR[28];
+	SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
+	SUBKEY_R(28) = subR[27] ^ subR[29];
+	SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
+	SUBKEY_R(29) = subR[28] ^ subR[30];
+	SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
+	SUBKEY_R(30) = subR[29] ^ subR[31];
+	SUBKEY_L(31) = subL[30];     /* round 24 */
+	SUBKEY_R(31) = subR[30];
+	SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
+	SUBKEY_R(32) = subR[32] ^ subR[31];
 
 	/* apply the inverse of the last half of P-function */
-	dw = CAMELLIA_SUBKEY_L(2) ^ CAMELLIA_SUBKEY_R(2),
-		dw = CAMELLIA_RL8(dw);/* round 1 */
-	CAMELLIA_SUBKEY_R(2) = CAMELLIA_SUBKEY_L(2) ^ dw,
-		CAMELLIA_SUBKEY_L(2) = dw;
-	dw = CAMELLIA_SUBKEY_L(3) ^ CAMELLIA_SUBKEY_R(3),
-		dw = CAMELLIA_RL8(dw);/* round 2 */
-	CAMELLIA_SUBKEY_R(3) = CAMELLIA_SUBKEY_L(3) ^ dw,
-		CAMELLIA_SUBKEY_L(3) = dw;
-	dw = CAMELLIA_SUBKEY_L(4) ^ CAMELLIA_SUBKEY_R(4),
-		dw = CAMELLIA_RL8(dw);/* round 3 */
-	CAMELLIA_SUBKEY_R(4) = CAMELLIA_SUBKEY_L(4) ^ dw,
-		CAMELLIA_SUBKEY_L(4) = dw;
-	dw = CAMELLIA_SUBKEY_L(5) ^ CAMELLIA_SUBKEY_R(5),
-		dw = CAMELLIA_RL8(dw);/* round 4 */
-	CAMELLIA_SUBKEY_R(5) = CAMELLIA_SUBKEY_L(5) ^ dw,
-	CAMELLIA_SUBKEY_L(5) = dw;
-	dw = CAMELLIA_SUBKEY_L(6) ^ CAMELLIA_SUBKEY_R(6),
-		dw = CAMELLIA_RL8(dw);/* round 5 */
-	CAMELLIA_SUBKEY_R(6) = CAMELLIA_SUBKEY_L(6) ^ dw,
-		CAMELLIA_SUBKEY_L(6) = dw;
-	dw = CAMELLIA_SUBKEY_L(7) ^ CAMELLIA_SUBKEY_R(7),
-		dw = CAMELLIA_RL8(dw);/* round 6 */
-	CAMELLIA_SUBKEY_R(7) = CAMELLIA_SUBKEY_L(7) ^ dw,
-		CAMELLIA_SUBKEY_L(7) = dw;
-	dw = CAMELLIA_SUBKEY_L(10) ^ CAMELLIA_SUBKEY_R(10),
-		dw = CAMELLIA_RL8(dw);/* round 7 */
-	CAMELLIA_SUBKEY_R(10) = CAMELLIA_SUBKEY_L(10) ^ dw,
-		CAMELLIA_SUBKEY_L(10) = dw;
-	dw = CAMELLIA_SUBKEY_L(11) ^ CAMELLIA_SUBKEY_R(11),
-	    dw = CAMELLIA_RL8(dw);/* round 8 */
-	CAMELLIA_SUBKEY_R(11) = CAMELLIA_SUBKEY_L(11) ^ dw,
-		CAMELLIA_SUBKEY_L(11) = dw;
-	dw = CAMELLIA_SUBKEY_L(12) ^ CAMELLIA_SUBKEY_R(12),
-		dw = CAMELLIA_RL8(dw);/* round 9 */
-	CAMELLIA_SUBKEY_R(12) = CAMELLIA_SUBKEY_L(12) ^ dw,
-		CAMELLIA_SUBKEY_L(12) = dw;
-	dw = CAMELLIA_SUBKEY_L(13) ^ CAMELLIA_SUBKEY_R(13),
-		dw = CAMELLIA_RL8(dw);/* round 10 */
-	CAMELLIA_SUBKEY_R(13) = CAMELLIA_SUBKEY_L(13) ^ dw,
-		CAMELLIA_SUBKEY_L(13) = dw;
-	dw = CAMELLIA_SUBKEY_L(14) ^ CAMELLIA_SUBKEY_R(14),
-		dw = CAMELLIA_RL8(dw);/* round 11 */
-	CAMELLIA_SUBKEY_R(14) = CAMELLIA_SUBKEY_L(14) ^ dw,
-		CAMELLIA_SUBKEY_L(14) = dw;
-	dw = CAMELLIA_SUBKEY_L(15) ^ CAMELLIA_SUBKEY_R(15),
-		dw = CAMELLIA_RL8(dw);/* round 12 */
-	CAMELLIA_SUBKEY_R(15) = CAMELLIA_SUBKEY_L(15) ^ dw,
-		CAMELLIA_SUBKEY_L(15) = dw;
-	dw = CAMELLIA_SUBKEY_L(18) ^ CAMELLIA_SUBKEY_R(18),
-		dw = CAMELLIA_RL8(dw);/* round 13 */
-	CAMELLIA_SUBKEY_R(18) = CAMELLIA_SUBKEY_L(18) ^ dw,
-		CAMELLIA_SUBKEY_L(18) = dw;
-	dw = CAMELLIA_SUBKEY_L(19) ^ CAMELLIA_SUBKEY_R(19),
-		dw = CAMELLIA_RL8(dw);/* round 14 */
-	CAMELLIA_SUBKEY_R(19) = CAMELLIA_SUBKEY_L(19) ^ dw,
-		CAMELLIA_SUBKEY_L(19) = dw;
-	dw = CAMELLIA_SUBKEY_L(20) ^ CAMELLIA_SUBKEY_R(20),
-		dw = CAMELLIA_RL8(dw);/* round 15 */
-	CAMELLIA_SUBKEY_R(20) = CAMELLIA_SUBKEY_L(20) ^ dw,
-		CAMELLIA_SUBKEY_L(20) = dw;
-	dw = CAMELLIA_SUBKEY_L(21) ^ CAMELLIA_SUBKEY_R(21),
-		dw = CAMELLIA_RL8(dw);/* round 16 */
-	CAMELLIA_SUBKEY_R(21) = CAMELLIA_SUBKEY_L(21) ^ dw,
-		CAMELLIA_SUBKEY_L(21) = dw;
-	dw = CAMELLIA_SUBKEY_L(22) ^ CAMELLIA_SUBKEY_R(22),
-		dw = CAMELLIA_RL8(dw);/* round 17 */
-	CAMELLIA_SUBKEY_R(22) = CAMELLIA_SUBKEY_L(22) ^ dw,
-		CAMELLIA_SUBKEY_L(22) = dw;
-	dw = CAMELLIA_SUBKEY_L(23) ^ CAMELLIA_SUBKEY_R(23),
-		dw = CAMELLIA_RL8(dw);/* round 18 */
-	CAMELLIA_SUBKEY_R(23) = CAMELLIA_SUBKEY_L(23) ^ dw,
-		CAMELLIA_SUBKEY_L(23) = dw;
-	dw = CAMELLIA_SUBKEY_L(26) ^ CAMELLIA_SUBKEY_R(26),
-		dw = CAMELLIA_RL8(dw);/* round 19 */
-	CAMELLIA_SUBKEY_R(26) = CAMELLIA_SUBKEY_L(26) ^ dw,
-		CAMELLIA_SUBKEY_L(26) = dw;
-	dw = CAMELLIA_SUBKEY_L(27) ^ CAMELLIA_SUBKEY_R(27),
-		dw = CAMELLIA_RL8(dw);/* round 20 */
-	CAMELLIA_SUBKEY_R(27) = CAMELLIA_SUBKEY_L(27) ^ dw,
-		CAMELLIA_SUBKEY_L(27) = dw;
-	dw = CAMELLIA_SUBKEY_L(28) ^ CAMELLIA_SUBKEY_R(28),
-		dw = CAMELLIA_RL8(dw);/* round 21 */
-	CAMELLIA_SUBKEY_R(28) = CAMELLIA_SUBKEY_L(28) ^ dw,
-		CAMELLIA_SUBKEY_L(28) = dw;
-	dw = CAMELLIA_SUBKEY_L(29) ^ CAMELLIA_SUBKEY_R(29),
-		dw = CAMELLIA_RL8(dw);/* round 22 */
-	CAMELLIA_SUBKEY_R(29) = CAMELLIA_SUBKEY_L(29) ^ dw,
-		CAMELLIA_SUBKEY_L(29) = dw;
-	dw = CAMELLIA_SUBKEY_L(30) ^ CAMELLIA_SUBKEY_R(30),
-		dw = CAMELLIA_RL8(dw);/* round 23 */
-	CAMELLIA_SUBKEY_R(30) = CAMELLIA_SUBKEY_L(30) ^ dw,
-		CAMELLIA_SUBKEY_L(30) = dw;
-	dw = CAMELLIA_SUBKEY_L(31) ^ CAMELLIA_SUBKEY_R(31),
-		dw = CAMELLIA_RL8(dw);/* round 24 */
-	CAMELLIA_SUBKEY_R(31) = CAMELLIA_SUBKEY_L(31) ^ dw,
-		CAMELLIA_SUBKEY_L(31) = dw;
+	dw = SUBKEY_L(2) ^ SUBKEY_R(2); dw = ROL8(dw);/* round 1 */
+	SUBKEY_R(2) = SUBKEY_L(2) ^ dw; SUBKEY_L(2) = dw;
+	dw = SUBKEY_L(3) ^ SUBKEY_R(3); dw = ROL8(dw);/* round 2 */
+	SUBKEY_R(3) = SUBKEY_L(3) ^ dw; SUBKEY_L(3) = dw;
+	dw = SUBKEY_L(4) ^ SUBKEY_R(4); dw = ROL8(dw);/* round 3 */
+	SUBKEY_R(4) = SUBKEY_L(4) ^ dw; SUBKEY_L(4) = dw;
+	dw = SUBKEY_L(5) ^ SUBKEY_R(5); dw = ROL8(dw);/* round 4 */
+	SUBKEY_R(5) = SUBKEY_L(5) ^ dw; SUBKEY_L(5) = dw;
+	dw = SUBKEY_L(6) ^ SUBKEY_R(6); dw = ROL8(dw);/* round 5 */
+	SUBKEY_R(6) = SUBKEY_L(6) ^ dw; SUBKEY_L(6) = dw;
+	dw = SUBKEY_L(7) ^ SUBKEY_R(7); dw = ROL8(dw);/* round 6 */
+	SUBKEY_R(7) = SUBKEY_L(7) ^ dw; SUBKEY_L(7) = dw;
+	dw = SUBKEY_L(10) ^ SUBKEY_R(10); dw = ROL8(dw);/* round 7 */
+	SUBKEY_R(10) = SUBKEY_L(10) ^ dw; SUBKEY_L(10) = dw;
+	dw = SUBKEY_L(11) ^ SUBKEY_R(11); dw = ROL8(dw);/* round 8 */
+	SUBKEY_R(11) = SUBKEY_L(11) ^ dw; SUBKEY_L(11) = dw;
+	dw = SUBKEY_L(12) ^ SUBKEY_R(12); dw = ROL8(dw);/* round 9 */
+	SUBKEY_R(12) = SUBKEY_L(12) ^ dw; SUBKEY_L(12) = dw;
+	dw = SUBKEY_L(13) ^ SUBKEY_R(13); dw = ROL8(dw);/* round 10 */
+	SUBKEY_R(13) = SUBKEY_L(13) ^ dw; SUBKEY_L(13) = dw;
+	dw = SUBKEY_L(14) ^ SUBKEY_R(14); dw = ROL8(dw);/* round 11 */
+	SUBKEY_R(14) = SUBKEY_L(14) ^ dw; SUBKEY_L(14) = dw;
+	dw = SUBKEY_L(15) ^ SUBKEY_R(15); dw = ROL8(dw);/* round 12 */
+	SUBKEY_R(15) = SUBKEY_L(15) ^ dw; SUBKEY_L(15) = dw;
+	dw = SUBKEY_L(18) ^ SUBKEY_R(18); dw = ROL8(dw);/* round 13 */
+	SUBKEY_R(18) = SUBKEY_L(18) ^ dw; SUBKEY_L(18) = dw;
+	dw = SUBKEY_L(19) ^ SUBKEY_R(19); dw = ROL8(dw);/* round 14 */
+	SUBKEY_R(19) = SUBKEY_L(19) ^ dw; SUBKEY_L(19) = dw;
+	dw = SUBKEY_L(20) ^ SUBKEY_R(20); dw = ROL8(dw);/* round 15 */
+	SUBKEY_R(20) = SUBKEY_L(20) ^ dw; SUBKEY_L(20) = dw;
+	dw = SUBKEY_L(21) ^ SUBKEY_R(21); dw = ROL8(dw);/* round 16 */
+	SUBKEY_R(21) = SUBKEY_L(21) ^ dw; SUBKEY_L(21) = dw;
+	dw = SUBKEY_L(22) ^ SUBKEY_R(22); dw = ROL8(dw);/* round 17 */
+	SUBKEY_R(22) = SUBKEY_L(22) ^ dw; SUBKEY_L(22) = dw;
+	dw = SUBKEY_L(23) ^ SUBKEY_R(23); dw = ROL8(dw);/* round 18 */
+	SUBKEY_R(23) = SUBKEY_L(23) ^ dw; SUBKEY_L(23) = dw;
+	dw = SUBKEY_L(26) ^ SUBKEY_R(26); dw = ROL8(dw);/* round 19 */
+	SUBKEY_R(26) = SUBKEY_L(26) ^ dw; SUBKEY_L(26) = dw;
+	dw = SUBKEY_L(27) ^ SUBKEY_R(27); dw = ROL8(dw);/* round 20 */
+	SUBKEY_R(27) = SUBKEY_L(27) ^ dw; SUBKEY_L(27) = dw;
+	dw = SUBKEY_L(28) ^ SUBKEY_R(28); dw = ROL8(dw);/* round 21 */
+	SUBKEY_R(28) = SUBKEY_L(28) ^ dw; SUBKEY_L(28) = dw;
+	dw = SUBKEY_L(29) ^ SUBKEY_R(29); dw = ROL8(dw);/* round 22 */
+	SUBKEY_R(29) = SUBKEY_L(29) ^ dw; SUBKEY_L(29) = dw;
+	dw = SUBKEY_L(30) ^ SUBKEY_R(30); dw = ROL8(dw);/* round 23 */
+	SUBKEY_R(30) = SUBKEY_L(30) ^ dw; SUBKEY_L(30) = dw;
+	dw = SUBKEY_L(31) ^ SUBKEY_R(31); dw = ROL8(dw);/* round 24 */
+	SUBKEY_R(31) = SUBKEY_L(31) ^ dw; SUBKEY_L(31) = dw;
 }
 
 static void camellia_setup192(const unsigned char *key, u32 *subkey)

@@ -1145,424 +1058,400 @@ static void camellia_setup192(const unsi
 }
 
 
-static void camellia_encrypt128(const u32 *subkey, __be32 *io_text)
+static void camellia_encrypt128(const u32 *subkey, u32 *io_text)
 {
-	u32 il,ir,t0,t1;               /* temporary valiables */
+	u32 il,ir,t0,t1;               /* temporary variables */
 
 	u32 io[4];
 
-	io[0] = be32_to_cpu(io_text[0]);
-	io[1] = be32_to_cpu(io_text[1]);
-	io[2] = be32_to_cpu(io_text[2]);
-	io[3] = be32_to_cpu(io_text[3]);
-
 	/* pre whitening but absorb kw2 */
-	io[0] ^= CAMELLIA_SUBKEY_L(0);
-	io[1] ^= CAMELLIA_SUBKEY_R(0);
+	io[0] = io_text[0] ^ SUBKEY_L(0);
+	io[1] = io_text[1] ^ SUBKEY_R(0);
+	io[2] = io_text[2];
+	io[3] = io_text[3];
 
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(2),CAMELLIA_SUBKEY_R(2),
+			 SUBKEY_L(2),SUBKEY_R(2),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(3),CAMELLIA_SUBKEY_R(3),
+			 SUBKEY_L(3),SUBKEY_R(3),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(4),CAMELLIA_SUBKEY_R(4),
+			 SUBKEY_L(4),SUBKEY_R(4),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(5),CAMELLIA_SUBKEY_R(5),
+			 SUBKEY_L(5),SUBKEY_R(5),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(6),CAMELLIA_SUBKEY_R(6),
+			 SUBKEY_L(6),SUBKEY_R(6),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(7),CAMELLIA_SUBKEY_R(7),
+			 SUBKEY_L(7),SUBKEY_R(7),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(8),CAMELLIA_SUBKEY_R(8),
-		     CAMELLIA_SUBKEY_L(9),CAMELLIA_SUBKEY_R(9),
+		     SUBKEY_L(8),SUBKEY_R(8),
+		     SUBKEY_L(9),SUBKEY_R(9),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(10),CAMELLIA_SUBKEY_R(10),
+			 SUBKEY_L(10),SUBKEY_R(10),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(11),CAMELLIA_SUBKEY_R(11),
+			 SUBKEY_L(11),SUBKEY_R(11),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(12),CAMELLIA_SUBKEY_R(12),
+			 SUBKEY_L(12),SUBKEY_R(12),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(13),CAMELLIA_SUBKEY_R(13),
+			 SUBKEY_L(13),SUBKEY_R(13),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(14),CAMELLIA_SUBKEY_R(14),
+			 SUBKEY_L(14),SUBKEY_R(14),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(15),CAMELLIA_SUBKEY_R(15),
+			 SUBKEY_L(15),SUBKEY_R(15),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(16),CAMELLIA_SUBKEY_R(16),
-		     CAMELLIA_SUBKEY_L(17),CAMELLIA_SUBKEY_R(17),
+		     SUBKEY_L(16),SUBKEY_R(16),
+		     SUBKEY_L(17),SUBKEY_R(17),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(18),CAMELLIA_SUBKEY_R(18),
+			 SUBKEY_L(18),SUBKEY_R(18),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(19),CAMELLIA_SUBKEY_R(19),
+			 SUBKEY_L(19),SUBKEY_R(19),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(20),CAMELLIA_SUBKEY_R(20),
+			 SUBKEY_L(20),SUBKEY_R(20),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(21),CAMELLIA_SUBKEY_R(21),
+			 SUBKEY_L(21),SUBKEY_R(21),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(22),CAMELLIA_SUBKEY_R(22),
+			 SUBKEY_L(22),SUBKEY_R(22),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(23),CAMELLIA_SUBKEY_R(23),
+			 SUBKEY_L(23),SUBKEY_R(23),
 			 io[0],io[1],il,ir,t0,t1);
 
 	/* post whitening but kw4 */
-	io[2] ^= CAMELLIA_SUBKEY_L(24);
-	io[3] ^= CAMELLIA_SUBKEY_R(24);
-
-	io_text[0] = cpu_to_be32(io[2]);
-	io_text[1] = cpu_to_be32(io[3]);
-	io_text[2] = cpu_to_be32(io[0]);
-	io_text[3] = cpu_to_be32(io[1]);
+	io_text[0] = io[2] ^ SUBKEY_L(24);
+	io_text[1] = io[3] ^ SUBKEY_R(24);
+	io_text[2] = io[0];
+	io_text[3] = io[1];
 }
 
-static void camellia_decrypt128(const u32 *subkey, __be32 *io_text)
+static void camellia_decrypt128(const u32 *subkey, u32 *io_text)
 {
-	u32 il,ir,t0,t1;               /* temporary valiables */
+	u32 il,ir,t0,t1;               /* temporary variables */
 
 	u32 io[4];
 
-	io[0] = be32_to_cpu(io_text[0]);
-	io[1] = be32_to_cpu(io_text[1]);
-	io[2] = be32_to_cpu(io_text[2]);
-	io[3] = be32_to_cpu(io_text[3]);
-
 	/* pre whitening but absorb kw2 */
-	io[0] ^= CAMELLIA_SUBKEY_L(24);
-	io[1] ^= CAMELLIA_SUBKEY_R(24);
+	io[0] = io_text[0] ^ SUBKEY_L(24);
+	io[1] = io_text[1] ^ SUBKEY_R(24);
+	io[2] = io_text[2];
+	io[3] = io_text[3];
 
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(23),CAMELLIA_SUBKEY_R(23),
+			 SUBKEY_L(23),SUBKEY_R(23),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(22),CAMELLIA_SUBKEY_R(22),
+			 SUBKEY_L(22),SUBKEY_R(22),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(21),CAMELLIA_SUBKEY_R(21),
+			 SUBKEY_L(21),SUBKEY_R(21),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(20),CAMELLIA_SUBKEY_R(20),
+			 SUBKEY_L(20),SUBKEY_R(20),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(19),CAMELLIA_SUBKEY_R(19),
+			 SUBKEY_L(19),SUBKEY_R(19),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(18),CAMELLIA_SUBKEY_R(18),
+			 SUBKEY_L(18),SUBKEY_R(18),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(17),CAMELLIA_SUBKEY_R(17),
-		     CAMELLIA_SUBKEY_L(16),CAMELLIA_SUBKEY_R(16),
+		     SUBKEY_L(17),SUBKEY_R(17),
+		     SUBKEY_L(16),SUBKEY_R(16),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(15),CAMELLIA_SUBKEY_R(15),
+			 SUBKEY_L(15),SUBKEY_R(15),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(14),CAMELLIA_SUBKEY_R(14),
+			 SUBKEY_L(14),SUBKEY_R(14),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(13),CAMELLIA_SUBKEY_R(13),
+			 SUBKEY_L(13),SUBKEY_R(13),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(12),CAMELLIA_SUBKEY_R(12),
+			 SUBKEY_L(12),SUBKEY_R(12),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(11),CAMELLIA_SUBKEY_R(11),
+			 SUBKEY_L(11),SUBKEY_R(11),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(10),CAMELLIA_SUBKEY_R(10),
+			 SUBKEY_L(10),SUBKEY_R(10),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(9),CAMELLIA_SUBKEY_R(9),
-		     CAMELLIA_SUBKEY_L(8),CAMELLIA_SUBKEY_R(8),
+		     SUBKEY_L(9),SUBKEY_R(9),
+		     SUBKEY_L(8),SUBKEY_R(8),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(7),CAMELLIA_SUBKEY_R(7),
+			 SUBKEY_L(7),SUBKEY_R(7),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(6),CAMELLIA_SUBKEY_R(6),
+			 SUBKEY_L(6),SUBKEY_R(6),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(5),CAMELLIA_SUBKEY_R(5),
+			 SUBKEY_L(5),SUBKEY_R(5),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(4),CAMELLIA_SUBKEY_R(4),
+			 SUBKEY_L(4),SUBKEY_R(4),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(3),CAMELLIA_SUBKEY_R(3),
+			 SUBKEY_L(3),SUBKEY_R(3),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(2),CAMELLIA_SUBKEY_R(2),
+			 SUBKEY_L(2),SUBKEY_R(2),
 			 io[0],io[1],il,ir,t0,t1);
 
 	/* post whitening but kw4 */
-	io[2] ^= CAMELLIA_SUBKEY_L(0);
-	io[3] ^= CAMELLIA_SUBKEY_R(0);
-
-	io_text[0] = cpu_to_be32(io[2]);
-	io_text[1] = cpu_to_be32(io[3]);
-	io_text[2] = cpu_to_be32(io[0]);
-	io_text[3] = cpu_to_be32(io[1]);
+	io_text[0] = io[2] ^ SUBKEY_L(0);
+	io_text[1] = io[3] ^ SUBKEY_R(0);
+	io_text[2] = io[0];
+	io_text[3] = io[1];
 }
 
-static void camellia_encrypt256(const u32 *subkey, __be32 *io_text)
+static void camellia_encrypt256(const u32 *subkey, u32 *io_text)
 {
-	u32 il,ir,t0,t1;           /* temporary valiables */
+	u32 il,ir,t0,t1;           /* temporary variables */
 
 	u32 io[4];
 
-	io[0] = be32_to_cpu(io_text[0]);
-	io[1] = be32_to_cpu(io_text[1]);
-	io[2] = be32_to_cpu(io_text[2]);
-	io[3] = be32_to_cpu(io_text[3]);
-
 	/* pre whitening but absorb kw2 */
-	io[0] ^= CAMELLIA_SUBKEY_L(0);
-	io[1] ^= CAMELLIA_SUBKEY_R(0);
+	io[0] = io_text[0] ^ SUBKEY_L(0);
+	io[1] = io_text[1] ^ SUBKEY_R(0);
+	io[2] = io_text[2];
+	io[3] = io_text[3];
 
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(2),CAMELLIA_SUBKEY_R(2),
+			 SUBKEY_L(2),SUBKEY_R(2),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(3),CAMELLIA_SUBKEY_R(3),
+			 SUBKEY_L(3),SUBKEY_R(3),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(4),CAMELLIA_SUBKEY_R(4),
+			 SUBKEY_L(4),SUBKEY_R(4),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(5),CAMELLIA_SUBKEY_R(5),
+			 SUBKEY_L(5),SUBKEY_R(5),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(6),CAMELLIA_SUBKEY_R(6),
+			 SUBKEY_L(6),SUBKEY_R(6),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(7),CAMELLIA_SUBKEY_R(7),
+			 SUBKEY_L(7),SUBKEY_R(7),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(8),CAMELLIA_SUBKEY_R(8),
-		     CAMELLIA_SUBKEY_L(9),CAMELLIA_SUBKEY_R(9),
+		     SUBKEY_L(8),SUBKEY_R(8),
+		     SUBKEY_L(9),SUBKEY_R(9),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(10),CAMELLIA_SUBKEY_R(10),
+			 SUBKEY_L(10),SUBKEY_R(10),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(11),CAMELLIA_SUBKEY_R(11),
+			 SUBKEY_L(11),SUBKEY_R(11),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(12),CAMELLIA_SUBKEY_R(12),
+			 SUBKEY_L(12),SUBKEY_R(12),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(13),CAMELLIA_SUBKEY_R(13),
+			 SUBKEY_L(13),SUBKEY_R(13),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(14),CAMELLIA_SUBKEY_R(14),
+			 SUBKEY_L(14),SUBKEY_R(14),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(15),CAMELLIA_SUBKEY_R(15),
+			 SUBKEY_L(15),SUBKEY_R(15),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(16),CAMELLIA_SUBKEY_R(16),
-		     CAMELLIA_SUBKEY_L(17),CAMELLIA_SUBKEY_R(17),
+		     SUBKEY_L(16),SUBKEY_R(16),
+		     SUBKEY_L(17),SUBKEY_R(17),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(18),CAMELLIA_SUBKEY_R(18),
+			 SUBKEY_L(18),SUBKEY_R(18),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(19),CAMELLIA_SUBKEY_R(19),
+			 SUBKEY_L(19),SUBKEY_R(19),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(20),CAMELLIA_SUBKEY_R(20),
+			 SUBKEY_L(20),SUBKEY_R(20),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(21),CAMELLIA_SUBKEY_R(21),
+			 SUBKEY_L(21),SUBKEY_R(21),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(22),CAMELLIA_SUBKEY_R(22),
+			 SUBKEY_L(22),SUBKEY_R(22),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(23),CAMELLIA_SUBKEY_R(23),
+			 SUBKEY_L(23),SUBKEY_R(23),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(24),CAMELLIA_SUBKEY_R(24),
-		     CAMELLIA_SUBKEY_L(25),CAMELLIA_SUBKEY_R(25),
+		     SUBKEY_L(24),SUBKEY_R(24),
+		     SUBKEY_L(25),SUBKEY_R(25),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(26),CAMELLIA_SUBKEY_R(26),
+			 SUBKEY_L(26),SUBKEY_R(26),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(27),CAMELLIA_SUBKEY_R(27),
+			 SUBKEY_L(27),SUBKEY_R(27),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(28),CAMELLIA_SUBKEY_R(28),
+			 SUBKEY_L(28),SUBKEY_R(28),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(29),CAMELLIA_SUBKEY_R(29),
+			 SUBKEY_L(29),SUBKEY_R(29),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(30),CAMELLIA_SUBKEY_R(30),
+			 SUBKEY_L(30),SUBKEY_R(30),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(31),CAMELLIA_SUBKEY_R(31),
+			 SUBKEY_L(31),SUBKEY_R(31),
 			 io[0],io[1],il,ir,t0,t1);
 
 	/* post whitening but kw4 */
-	io[2] ^= CAMELLIA_SUBKEY_L(32);
-	io[3] ^= CAMELLIA_SUBKEY_R(32);
-
-	io_text[0] = cpu_to_be32(io[2]);
-	io_text[1] = cpu_to_be32(io[3]);
-	io_text[2] = cpu_to_be32(io[0]);
-	io_text[3] = cpu_to_be32(io[1]);
+	io_text[0] = io[2] ^ SUBKEY_L(32);
+	io_text[1] = io[3] ^ SUBKEY_R(32);
+	io_text[2] = io[0];
+	io_text[3] = io[1];
 }
 
-static void camellia_decrypt256(const u32 *subkey, __be32 *io_text)
+static void camellia_decrypt256(const u32 *subkey, u32 *io_text)
 {
-	u32 il,ir,t0,t1;           /* temporary valiables */
+	u32 il,ir,t0,t1;           /* temporary variables */
 
 	u32 io[4];
 
-	io[0] = be32_to_cpu(io_text[0]);
-	io[1] = be32_to_cpu(io_text[1]);
-	io[2] = be32_to_cpu(io_text[2]);
-	io[3] = be32_to_cpu(io_text[3]);
-
 	/* pre whitening but absorb kw2 */
-	io[0] ^= CAMELLIA_SUBKEY_L(32);
-	io[1] ^= CAMELLIA_SUBKEY_R(32);
+	io[0] = io_text[0] ^ SUBKEY_L(32);
+	io[1] = io_text[1] ^ SUBKEY_R(32);
+	io[2] = io_text[2];
+	io[3] = io_text[3];
 
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(31),CAMELLIA_SUBKEY_R(31),
+			 SUBKEY_L(31),SUBKEY_R(31),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(30),CAMELLIA_SUBKEY_R(30),
+			 SUBKEY_L(30),SUBKEY_R(30),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(29),CAMELLIA_SUBKEY_R(29),
+			 SUBKEY_L(29),SUBKEY_R(29),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(28),CAMELLIA_SUBKEY_R(28),
+			 SUBKEY_L(28),SUBKEY_R(28),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(27),CAMELLIA_SUBKEY_R(27),
+			 SUBKEY_L(27),SUBKEY_R(27),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(26),CAMELLIA_SUBKEY_R(26),
+			 SUBKEY_L(26),SUBKEY_R(26),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(25),CAMELLIA_SUBKEY_R(25),
-		     CAMELLIA_SUBKEY_L(24),CAMELLIA_SUBKEY_R(24),
+		     SUBKEY_L(25),SUBKEY_R(25),
+		     SUBKEY_L(24),SUBKEY_R(24),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(23),CAMELLIA_SUBKEY_R(23),
+			 SUBKEY_L(23),SUBKEY_R(23),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(22),CAMELLIA_SUBKEY_R(22),
+			 SUBKEY_L(22),SUBKEY_R(22),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(21),CAMELLIA_SUBKEY_R(21),
+			 SUBKEY_L(21),SUBKEY_R(21),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(20),CAMELLIA_SUBKEY_R(20),
+			 SUBKEY_L(20),SUBKEY_R(20),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(19),CAMELLIA_SUBKEY_R(19),
+			 SUBKEY_L(19),SUBKEY_R(19),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(18),CAMELLIA_SUBKEY_R(18),
+			 SUBKEY_L(18),SUBKEY_R(18),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(17),CAMELLIA_SUBKEY_R(17),
-		     CAMELLIA_SUBKEY_L(16),CAMELLIA_SUBKEY_R(16),
+		     SUBKEY_L(17),SUBKEY_R(17),
+		     SUBKEY_L(16),SUBKEY_R(16),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(15),CAMELLIA_SUBKEY_R(15),
+			 SUBKEY_L(15),SUBKEY_R(15),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(14),CAMELLIA_SUBKEY_R(14),
+			 SUBKEY_L(14),SUBKEY_R(14),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(13),CAMELLIA_SUBKEY_R(13),
+			 SUBKEY_L(13),SUBKEY_R(13),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(12),CAMELLIA_SUBKEY_R(12),
+			 SUBKEY_L(12),SUBKEY_R(12),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(11),CAMELLIA_SUBKEY_R(11),
+			 SUBKEY_L(11),SUBKEY_R(11),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(10),CAMELLIA_SUBKEY_R(10),
+			 SUBKEY_L(10),SUBKEY_R(10),
 			 io[0],io[1],il,ir,t0,t1);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     CAMELLIA_SUBKEY_L(9),CAMELLIA_SUBKEY_R(9),
-		     CAMELLIA_SUBKEY_L(8),CAMELLIA_SUBKEY_R(8),
+		     SUBKEY_L(9),SUBKEY_R(9),
+		     SUBKEY_L(8),SUBKEY_R(8),
 		     t0,t1,il,ir);
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(7),CAMELLIA_SUBKEY_R(7),
+			 SUBKEY_L(7),SUBKEY_R(7),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(6),CAMELLIA_SUBKEY_R(6),
+			 SUBKEY_L(6),SUBKEY_R(6),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(5),CAMELLIA_SUBKEY_R(5),
+			 SUBKEY_L(5),SUBKEY_R(5),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(4),CAMELLIA_SUBKEY_R(4),
+			 SUBKEY_L(4),SUBKEY_R(4),
 			 io[0],io[1],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[0],io[1],
-			 CAMELLIA_SUBKEY_L(3),CAMELLIA_SUBKEY_R(3),
+			 SUBKEY_L(3),SUBKEY_R(3),
 			 io[2],io[3],il,ir,t0,t1);
 	CAMELLIA_ROUNDSM(io[2],io[3],
-			 CAMELLIA_SUBKEY_L(2),CAMELLIA_SUBKEY_R(2),
+			 SUBKEY_L(2),SUBKEY_R(2),
 			 io[0],io[1],il,ir,t0,t1);
 
 	/* post whitening but kw4 */
-	io[2] ^= CAMELLIA_SUBKEY_L(0);
-	io[3] ^= CAMELLIA_SUBKEY_R(0);
-
-	io_text[0] = cpu_to_be32(io[2]);
-	io_text[1] = cpu_to_be32(io[3]);
-	io_text[2] = cpu_to_be32(io[0]);
-	io_text[3] = cpu_to_be32(io[1]);
+	io_text[0] = io[2] ^ SUBKEY_L(0);
+	io_text[1] = io[3] ^ SUBKEY_R(0);
+	io_text[2] = io[0];
+	io_text[3] = io[1];
 }
 
 

@@ -1607,9 +1496,12 @@ static void camellia_encrypt(struct cryp
 	const __be32 *src = (const __be32 *)in;
 	__be32 *dst = (__be32 *)out;
 
-	__be32 tmp[4];
+	u32 tmp[4];
 
-	memcpy(tmp, src, CAMELLIA_BLOCK_SIZE);
+	tmp[0] = be32_to_cpu(src[0]);
+	tmp[1] = be32_to_cpu(src[1]);
+	tmp[2] = be32_to_cpu(src[2]);
+	tmp[3] = be32_to_cpu(src[3]);
 
 	switch (cctx->key_length) {
 	case 16:

@@ -1622,7 +1514,10 @@ static void camellia_encrypt(struct cryp
 		break;
 	}
 
-	memcpy(dst, tmp, CAMELLIA_BLOCK_SIZE);
+	dst[0] = cpu_to_be32(tmp[0]);
+	dst[1] = cpu_to_be32(tmp[1]);
+	dst[2] = cpu_to_be32(tmp[2]);
+	dst[3] = cpu_to_be32(tmp[3]);
 }
 
 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)

@@ -1631,9 +1526,12 @@ static void camellia_decrypt(struct cryp
 	const __be32 *src = (const __be32 *)in;
 	__be32 *dst = (__be32 *)out;
 
-	__be32 tmp[4];
+	u32 tmp[4];
 
-	memcpy(tmp, src, CAMELLIA_BLOCK_SIZE);
+	tmp[0] = be32_to_cpu(src[0]);
+	tmp[1] = be32_to_cpu(src[1]);
+	tmp[2] = be32_to_cpu(src[2]);
+	tmp[3] = be32_to_cpu(src[3]);
 
 	switch (cctx->key_length) {
 	case 16:

@@ -1646,7 +1544,10 @@ static void camellia_decrypt(struct cryp
 		break;
 	}
 
-	memcpy(dst, tmp, CAMELLIA_BLOCK_SIZE);
+	dst[0] = cpu_to_be32(tmp[0]);
+	dst[1] = cpu_to_be32(tmp[1]);
+	dst[2] = cpu_to_be32(tmp[2]);
+	dst[3] = cpu_to_be32(tmp[3]);
 }
 
 static struct crypto_alg camellia_alg = {
Acked-by on v1 2/5
#5 lore raw

Re: [PATCH 2/5] camellia: cleanup

Quoted 15 lines
Quoted 3 lines

Thu, 25 Oct 2007 12:45:42 +0100
[Subject: [PATCH 2/5] camellia: cleanup] Denys Vlasenko <[email protected]> wrote...

Quoted 10 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia2.diff
Rename some macros to shorter names: CAMELLIA_RR8 -> ROR8, making it easier to understand that it is just a right rotation, nothing camellia-specific in it.
CAMELLIA_SUBKEY_L() -> SUBKEY_L() - just shorter.

Quoted 4 lines
Quoted 2 lines

Move be32 <-> cpu conversions out of en/decrypt128/256 and into camellia_en/decrypt - no reason to have that code duplicated twice.

Signed-off-by Denys Vlasenko <[email protected]>
Acked-by Noriaki TAKAMIYA <[email protected]>

--
Noriaki TAKAMIYA

maintainer
#6 lore raw

Re: [PATCH 2/5] camellia: cleanup

In reply to Denys Vlasenko
Quoted 11 lines · Denys Vlasenko
Quoted 10 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia2.diff
Rename some macros to shorter names: CAMELLIA_RR8 -> ROR8, making it easier to understand that it is just a right rotation, nothing camellia-specific in it.
CAMELLIA_SUBKEY_L() -> SUBKEY_L() - just shorter.

Quoted 4 lines
Quoted 2 lines

Move be32 <-> cpu conversions out of en/decrypt128/256 and into camellia_en/decrypt - no reason to have that code duplicated twice.

Signed-off-by Denys Vlasenko <[email protected]>

Patch applied. BTW, we have a function called ror32 that can replace all of these ROR* macros.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#7 lore raw

PATCH 3/5 camellia: cleanup

In reply to Denys Vlasenko
Quoted 8 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia3.diff
Optimize GETU32 to use 4-byte memcpy (modern gcc will convert such memcpy to single move instruction on i386). Original GETU32 did four byte fetches, and shifted/XORed those.

Signed-off-by Denys Vlasenko <[email protected]>

--
vda

crypto/camellia.c renamed from crypto/camellia2.c +21 -18
@@ -330,10 +330,12 @@ static const u32 camellia_sp4404[256] = 
  *  macros
  */
 
-# define GETU32(pt) (((u32)(pt)[0] << 24)	\
-		     ^ ((u32)(pt)[1] << 16)	\
-		     ^ ((u32)(pt)[2] <<  8)	\
-		     ^ ((u32)(pt)[3]))
+# define GETU32(v, pt) \
+    do { \
+	/* latest breed of gcc is clever enough to use move */ \
+	memcpy(&(v), (pt), 4); \
+	(v) = be32_to_cpu(v); \
+    } while(0)
 
 /* rotation right shift 1byte */
 #define ROR8(x) (((x) >> 8) + ((x) << 24))

@@ -433,10 +435,11 @@ static void camellia_setup128(const unsi
 	/**
 	 *  k == kll || klr || krl || krr (|| is concatination)
 	 */
-	kll = GETU32(key     );
-	klr = GETU32(key +  4);
-	krl = GETU32(key +  8);
-	krr = GETU32(key + 12);
+	GETU32(kll, key     );
+	GETU32(klr, key +  4);
+	GETU32(krl, key +  8);
+	GETU32(krr, key + 12);
+
 	/**
 	 * generate KL dependent subkeys
 	 */

@@ -687,8 +690,8 @@ static void camellia_setup128(const unsi
 
 static void camellia_setup256(const unsigned char *key, u32 *subkey)
 {
-	u32 kll,klr,krl,krr;           /* left half of key */
-	u32 krll,krlr,krrl,krrr;       /* right half of key */
+	u32 kll, klr, krl, krr;        /* left half of key */
+	u32 krll, krlr, krrl, krrr;    /* right half of key */
 	u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
 	u32 kw4l, kw4r, dw, tl, tr;
 	u32 subL[34];

@@ -698,14 +701,14 @@ static void camellia_setup256(const unsi
 	 *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
 	 *  (|| is concatination)
 	 */
-	kll  = GETU32(key     );
-	klr  = GETU32(key +  4);
-	krl  = GETU32(key +  8);
-	krr  = GETU32(key + 12);
-	krll = GETU32(key + 16);
-	krlr = GETU32(key + 20);
-	krrl = GETU32(key + 24);
-	krrr = GETU32(key + 28);
+	GETU32(kll,  key     );
+	GETU32(klr,  key +  4);
+	GETU32(krl,  key +  8);
+	GETU32(krr,  key + 12);
+	GETU32(krll, key + 16);
+	GETU32(krlr, key + 20);
+	GETU32(krrl, key + 24);
+	GETU32(krrr, key + 28);
 
 	/* generate KL dependent subkeys */
 	/* kw1 */
Acked-by on v1 3/5
#8 lore raw

Re: [PATCH 3/5] camellia: cleanup

Quoted 7 lines
Quoted 3 lines

Thu, 25 Oct 2007 12:46:35 +0100
[Subject: [PATCH 3/5] camellia: cleanup] Denys Vlasenko <[email protected]> wrote...

Quoted 2 lines · Denys Vlasenko

Hi Hervert,

Quoted 8 lines
Quoted 6 lines

Please review and maybe propagate upstream following patches.

camellia3.diff
Optimize GETU32 to use 4-byte memcpy (modern gcc will convert such memcpy to single move instruction on i386). Original GETU32 did four byte fetches, and shifted/XORed those.

Signed-off-by Denys Vlasenko <[email protected]>
Acked-by Noriaki TAKAMIYA <[email protected]>

--
Noriaki TAKAMIYA

maintainer
#9 lore raw

Re: [PATCH 3/5] camellia: cleanup

In reply to Denys Vlasenko
Quoted 11 lines · Denys Vlasenko
Quoted 8 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia3.diff
Optimize GETU32 to use 4-byte memcpy (modern gcc will convert such memcpy to single move instruction on i386). Original GETU32 did four byte fetches, and shifted/XORed those.

Signed-off-by Denys Vlasenko <[email protected]>

Patch applied.

crypto/camellia.c static const u32 camellia_sp4404[256] = · line 338

Quoted 6 lines
crypto/camellia.c renamed from crypto/camellia2.c +6 -0
+# define GETU32(v, pt) \
+    do { \
+	/* latest breed of gcc is clever enough to use move */ \
+	memcpy(&(v), (pt), 4); \
+	(v) = be32_to_cpu(v); \
+    } while(0)

You can get rid of this memcpy too since camellia declares an alignmask of 3 which means that the key is 32-bit aligned.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#10 lore raw

PATCH 4/5 camellia: de-unrolling

In reply to Denys Vlasenko
Quoted 10 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia4.diff
Move huge unrolled pieces of code (3 screenfuls) at the end of 128/256 key setup routines into common camellia_setup_tail(), convert it to loop there.
Loop is still unrolled six times, so performance hit is very small, code size win is big.

Signed-off-by Denys Vlasenko <[email protected]>

--
vda

crypto/camellia.c renamed from crypto/camellia3.c +23 -84
@@ -424,6 +424,27 @@ static const u32 camellia_sp4404[256] = 
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 
+static void camellia_setup_tail(u32 *subkey, int max)
+{
+	u32 dw;
+	int i = 2;
+	do {
+		dw = SUBKEY_L(i + 0) ^ SUBKEY_R(i + 0); dw = ROL8(dw);/* round 1 */
+		SUBKEY_R(i + 0) = SUBKEY_L(i + 0) ^ dw; SUBKEY_L(i + 0) = dw;
+		dw = SUBKEY_L(i + 1) ^ SUBKEY_R(i + 1); dw = ROL8(dw);/* round 2 */
+		SUBKEY_R(i + 1) = SUBKEY_L(i + 1) ^ dw; SUBKEY_L(i + 1) = dw;
+		dw = SUBKEY_L(i + 2) ^ SUBKEY_R(i + 2); dw = ROL8(dw);/* round 3 */
+		SUBKEY_R(i + 2) = SUBKEY_L(i + 2) ^ dw; SUBKEY_L(i + 2) = dw;
+		dw = SUBKEY_L(i + 3) ^ SUBKEY_R(i + 3); dw = ROL8(dw);/* round 4 */
+		SUBKEY_R(i + 3) = SUBKEY_L(i + 3) ^ dw; SUBKEY_L(i + 3) = dw;
+		dw = SUBKEY_L(i + 4) ^ SUBKEY_R(i + 4); dw = ROL8(dw);/* round 5 */
+		SUBKEY_R(i + 4) = SUBKEY_L(i + 4) ^ dw; SUBKEY_L(i + 4) = dw;
+		dw = SUBKEY_L(i + 5) ^ SUBKEY_R(i + 5); dw = ROL8(dw);/* round 6 */
+		SUBKEY_R(i + 5) = SUBKEY_L(i + 5) ^ dw; SUBKEY_L(i + 5) = dw;
+		i += 8;
+	} while (i < max);
+}
+
 static void camellia_setup128(const unsigned char *key, u32 *subkey)
 {
 	u32 kll, klr, krl, krr;

@@ -650,42 +671,7 @@ static void camellia_setup128(const unsi
 	SUBKEY_R(24) = subR[24] ^ subR[23];
 
 	/* apply the inverse of the last half of P-function */
-	dw = SUBKEY_L(2) ^ SUBKEY_R(2); dw = ROL8(dw);/* round 1 */
-	SUBKEY_R(2) = SUBKEY_L(2) ^ dw; SUBKEY_L(2) = dw;
-	dw = SUBKEY_L(3) ^ SUBKEY_R(3); dw = ROL8(dw);/* round 2 */
-	SUBKEY_R(3) = SUBKEY_L(3) ^ dw; SUBKEY_L(3) = dw;
-	dw = SUBKEY_L(4) ^ SUBKEY_R(4); dw = ROL8(dw);/* round 3 */
-	SUBKEY_R(4) = SUBKEY_L(4) ^ dw; SUBKEY_L(4) = dw;
-	dw = SUBKEY_L(5) ^ SUBKEY_R(5); dw = ROL8(dw);/* round 4 */
-	SUBKEY_R(5) = SUBKEY_L(5) ^ dw; SUBKEY_L(5) = dw;
-	dw = SUBKEY_L(6) ^ SUBKEY_R(6); dw = ROL8(dw);/* round 5 */
-	SUBKEY_R(6) = SUBKEY_L(6) ^ dw; SUBKEY_L(6) = dw;
-	dw = SUBKEY_L(7) ^ SUBKEY_R(7); dw = ROL8(dw);/* round 6 */
-	SUBKEY_R(7) = SUBKEY_L(7) ^ dw; SUBKEY_L(7) = dw;
-	dw = SUBKEY_L(10) ^ SUBKEY_R(10); dw = ROL8(dw);/* round 7 */
-	SUBKEY_R(10) = SUBKEY_L(10) ^ dw; SUBKEY_L(10) = dw;
-	dw = SUBKEY_L(11) ^ SUBKEY_R(11); dw = ROL8(dw);/* round 8 */
-	SUBKEY_R(11) = SUBKEY_L(11) ^ dw; SUBKEY_L(11) = dw;
-	dw = SUBKEY_L(12) ^ SUBKEY_R(12); dw = ROL8(dw);/* round 9 */
-	SUBKEY_R(12) = SUBKEY_L(12) ^ dw; SUBKEY_L(12) = dw;
-	dw = SUBKEY_L(13) ^ SUBKEY_R(13); dw = ROL8(dw);/* round 10 */
-	SUBKEY_R(13) = SUBKEY_L(13) ^ dw; SUBKEY_L(13) = dw;
-	dw = SUBKEY_L(14) ^ SUBKEY_R(14); dw = ROL8(dw);/* round 11 */
-	SUBKEY_R(14) = SUBKEY_L(14) ^ dw; SUBKEY_L(14) = dw;
-	dw = SUBKEY_L(15) ^ SUBKEY_R(15); dw = ROL8(dw);/* round 12 */
-	SUBKEY_R(15) = SUBKEY_L(15) ^ dw; SUBKEY_L(15) = dw;
-	dw = SUBKEY_L(18) ^ SUBKEY_R(18); dw = ROL8(dw);/* round 13 */
-	SUBKEY_R(18) = SUBKEY_L(18) ^ dw; SUBKEY_L(18) = dw;
-	dw = SUBKEY_L(19) ^ SUBKEY_R(19); dw = ROL8(dw);/* round 14 */
-	SUBKEY_R(19) = SUBKEY_L(19) ^ dw; SUBKEY_L(19) = dw;
-	dw = SUBKEY_L(20) ^ SUBKEY_R(20); dw = ROL8(dw);/* round 15 */
-	SUBKEY_R(20) = SUBKEY_L(20) ^ dw; SUBKEY_L(20) = dw;
-	dw = SUBKEY_L(21) ^ SUBKEY_R(21); dw = ROL8(dw);/* round 16 */
-	SUBKEY_R(21) = SUBKEY_L(21) ^ dw; SUBKEY_L(21) = dw;
-	dw = SUBKEY_L(22) ^ SUBKEY_R(22); dw = ROL8(dw);/* round 17 */
-	SUBKEY_R(22) = SUBKEY_L(22) ^ dw; SUBKEY_L(22) = dw;
-	dw = SUBKEY_L(23) ^ SUBKEY_R(23); dw = ROL8(dw);/* round 18 */
-	SUBKEY_R(23) = SUBKEY_L(23) ^ dw; SUBKEY_L(23) = dw;
+	camellia_setup_tail(subkey, 24);
 }
 
 static void camellia_setup256(const unsigned char *key, u32 *subkey)

@@ -995,54 +981,7 @@ static void camellia_setup256(const unsi
 	SUBKEY_R(32) = subR[32] ^ subR[31];
 
 	/* apply the inverse of the last half of P-function */
-	dw = SUBKEY_L(2) ^ SUBKEY_R(2); dw = ROL8(dw);/* round 1 */
-	SUBKEY_R(2) = SUBKEY_L(2) ^ dw; SUBKEY_L(2) = dw;
-	dw = SUBKEY_L(3) ^ SUBKEY_R(3); dw = ROL8(dw);/* round 2 */
-	SUBKEY_R(3) = SUBKEY_L(3) ^ dw; SUBKEY_L(3) = dw;
-	dw = SUBKEY_L(4) ^ SUBKEY_R(4); dw = ROL8(dw);/* round 3 */
-	SUBKEY_R(4) = SUBKEY_L(4) ^ dw; SUBKEY_L(4) = dw;
-	dw = SUBKEY_L(5) ^ SUBKEY_R(5); dw = ROL8(dw);/* round 4 */
-	SUBKEY_R(5) = SUBKEY_L(5) ^ dw; SUBKEY_L(5) = dw;
-	dw = SUBKEY_L(6) ^ SUBKEY_R(6); dw = ROL8(dw);/* round 5 */
-	SUBKEY_R(6) = SUBKEY_L(6) ^ dw; SUBKEY_L(6) = dw;
-	dw = SUBKEY_L(7) ^ SUBKEY_R(7); dw = ROL8(dw);/* round 6 */
-	SUBKEY_R(7) = SUBKEY_L(7) ^ dw; SUBKEY_L(7) = dw;
-	dw = SUBKEY_L(10) ^ SUBKEY_R(10); dw = ROL8(dw);/* round 7 */
-	SUBKEY_R(10) = SUBKEY_L(10) ^ dw; SUBKEY_L(10) = dw;
-	dw = SUBKEY_L(11) ^ SUBKEY_R(11); dw = ROL8(dw);/* round 8 */
-	SUBKEY_R(11) = SUBKEY_L(11) ^ dw; SUBKEY_L(11) = dw;
-	dw = SUBKEY_L(12) ^ SUBKEY_R(12); dw = ROL8(dw);/* round 9 */
-	SUBKEY_R(12) = SUBKEY_L(12) ^ dw; SUBKEY_L(12) = dw;
-	dw = SUBKEY_L(13) ^ SUBKEY_R(13); dw = ROL8(dw);/* round 10 */
-	SUBKEY_R(13) = SUBKEY_L(13) ^ dw; SUBKEY_L(13) = dw;
-	dw = SUBKEY_L(14) ^ SUBKEY_R(14); dw = ROL8(dw);/* round 11 */
-	SUBKEY_R(14) = SUBKEY_L(14) ^ dw; SUBKEY_L(14) = dw;
-	dw = SUBKEY_L(15) ^ SUBKEY_R(15); dw = ROL8(dw);/* round 12 */
-	SUBKEY_R(15) = SUBKEY_L(15) ^ dw; SUBKEY_L(15) = dw;
-	dw = SUBKEY_L(18) ^ SUBKEY_R(18); dw = ROL8(dw);/* round 13 */
-	SUBKEY_R(18) = SUBKEY_L(18) ^ dw; SUBKEY_L(18) = dw;
-	dw = SUBKEY_L(19) ^ SUBKEY_R(19); dw = ROL8(dw);/* round 14 */
-	SUBKEY_R(19) = SUBKEY_L(19) ^ dw; SUBKEY_L(19) = dw;
-	dw = SUBKEY_L(20) ^ SUBKEY_R(20); dw = ROL8(dw);/* round 15 */
-	SUBKEY_R(20) = SUBKEY_L(20) ^ dw; SUBKEY_L(20) = dw;
-	dw = SUBKEY_L(21) ^ SUBKEY_R(21); dw = ROL8(dw);/* round 16 */
-	SUBKEY_R(21) = SUBKEY_L(21) ^ dw; SUBKEY_L(21) = dw;
-	dw = SUBKEY_L(22) ^ SUBKEY_R(22); dw = ROL8(dw);/* round 17 */
-	SUBKEY_R(22) = SUBKEY_L(22) ^ dw; SUBKEY_L(22) = dw;
-	dw = SUBKEY_L(23) ^ SUBKEY_R(23); dw = ROL8(dw);/* round 18 */
-	SUBKEY_R(23) = SUBKEY_L(23) ^ dw; SUBKEY_L(23) = dw;
-	dw = SUBKEY_L(26) ^ SUBKEY_R(26); dw = ROL8(dw);/* round 19 */
-	SUBKEY_R(26) = SUBKEY_L(26) ^ dw; SUBKEY_L(26) = dw;
-	dw = SUBKEY_L(27) ^ SUBKEY_R(27); dw = ROL8(dw);/* round 20 */
-	SUBKEY_R(27) = SUBKEY_L(27) ^ dw; SUBKEY_L(27) = dw;
-	dw = SUBKEY_L(28) ^ SUBKEY_R(28); dw = ROL8(dw);/* round 21 */
-	SUBKEY_R(28) = SUBKEY_L(28) ^ dw; SUBKEY_L(28) = dw;
-	dw = SUBKEY_L(29) ^ SUBKEY_R(29); dw = ROL8(dw);/* round 22 */
-	SUBKEY_R(29) = SUBKEY_L(29) ^ dw; SUBKEY_L(29) = dw;
-	dw = SUBKEY_L(30) ^ SUBKEY_R(30); dw = ROL8(dw);/* round 23 */
-	SUBKEY_R(30) = SUBKEY_L(30) ^ dw; SUBKEY_L(30) = dw;
-	dw = SUBKEY_L(31) ^ SUBKEY_R(31); dw = ROL8(dw);/* round 24 */
-	SUBKEY_R(31) = SUBKEY_L(31) ^ dw; SUBKEY_L(31) = dw;
+	camellia_setup_tail(subkey, 32);
 }
 
 static void camellia_setup192(const unsigned char *key, u32 *subkey)
Acked-by on v1 4/5
#11 lore raw

Re: [PATCH 4/5] camellia: de-unrolling

Hi,

Quoted 16 lines
Quoted 3 lines

Thu, 25 Oct 2007 12:47:16 +0100
[Subject: [PATCH 4/5] camellia: de-unrolling] Denys Vlasenko <[email protected]> wrote...

Quoted 10 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia4.diff
Move huge unrolled pieces of code (3 screenfuls) at the end of 128/256 key setup routines into common camellia_setup_tail(), convert it to loop there.
Loop is still unrolled six times, so performance hit is very small, code size win is big.

Quoted 3 lines
Signed-off-by Denys Vlasenko <[email protected]>

--
vda

Acked-by Noriaki TAKAMIYA <[email protected]>

--
Noriaki TAKAMIYA

maintainer
#12 lore raw

Re: [PATCH 4/5] camellia: de-unrolling

In reply to Denys Vlasenko
Quoted 5 lines · Denys Vlasenko
Quoted 4 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

Quoted 8 lines
Quoted 6 lines

camellia4.diff
Move huge unrolled pieces of code (3 screenfuls) at the end of 128/256 key setup routines into common camellia_setup_tail(), convert it to loop there.
Loop is still unrolled six times, so performance hit is very small, code size win is big.

Signed-off-by Denys Vlasenko <[email protected]>

Good work! Patch applied.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#13 lore raw

PATCH 5/5 camellia: de-unrolling, 64bit-ization

In reply to Denys Vlasenko
Quoted 15 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia5.diff
Use alternative key setup implementation with mostly 64-bit ops if BITS_PER_LONG >= 64. Both much smaller and much faster.

Unify camellia_en/decrypt128/256 into camellia_do_en/decrypt. Code was similar, with just one additional if() we can use came code.

If CONFIG_CC_OPTIMIZE_FOR_SIZE is defined,
use loop in camellia_do_en/decrypt instead of unrolled code. ~5% encrypt/decrypt slowdown.

Quoted 6 lines

Replace (x & 0xff) with (u8)x, gcc is not smart enough to realize that it can do (x & 0xff) this way (which is smaller at least on i386).

Don't do (x & 0xff) in a few places where x cannot be > 255 anyway:
t0 = il >> 16; v = camellia_sp0222[(t1 >> 8) & 0xff];
il16 is u32, (thus t1 >> 8) is one byte!

Signed-off-by Denys Vlasenko <[email protected]>

--
vda

crypto/camellia.c renamed from crypto/camellia4.c +186 -452
@@ -36,6 +36,13 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
+#if BITS_PER_LONG >= 64
+
+/* Use alternative implementation with mostly 64-bit ops */
+#include "camellia_64.c"
+
+#else
+
 static const u32 camellia_sp1110[256] = {
 	0x70707000,0x82828200,0x2c2c2c00,0xececec00,
 	0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,

@@ -329,7 +336,6 @@ static const u32 camellia_sp4404[256] = 
 /*
  *  macros
  */
-
 # define GETU32(v, pt) \
     do { \
 	/* latest breed of gcc is clever enough to use move */ \

@@ -364,63 +370,28 @@ static const u32 camellia_sp4404[256] = 
     } while(0)
 
 
+/*
+ * Key setup
+ */
 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
     do {							\
 	il = xl ^ kl;						\
 	ir = xr ^ kr;						\
 	t0 = il >> 16;						\
 	t1 = ir >> 16;						\
-	yl = camellia_sp1110[ir & 0xff]				\
-	   ^ camellia_sp0222[(t1 >> 8) & 0xff]			\
-	   ^ camellia_sp3033[t1 & 0xff]				\
-	   ^ camellia_sp4404[(ir >> 8) & 0xff];			\
-	yr = camellia_sp1110[(t0 >> 8) & 0xff]			\
-	   ^ camellia_sp0222[t0 & 0xff]				\
-	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
-	   ^ camellia_sp4404[il & 0xff];			\
+	yl = camellia_sp1110[(u8)(ir     )]			\
+	   ^ camellia_sp0222[    (t1 >> 8)]			\
+	   ^ camellia_sp3033[(u8)(t1     )]			\
+	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
+	yr = camellia_sp1110[    (t0 >> 8)]			\
+	   ^ camellia_sp0222[(u8)(t0     )]			\
+	   ^ camellia_sp3033[(u8)(il >> 8)]			\
+	   ^ camellia_sp4404[(u8)(il     )];			\
 	yl ^= yr;						\
 	yr = ROR8(yr);						\
 	yr ^= yl;						\
     } while(0)
 
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
-    do {								\
-	t0 = kll;							\
-	t2 = krr;							\
-	t0 &= ll;							\
-	t2 |= rr;							\
-	rl ^= t2;							\
-	lr ^= ROL1(t0);							\
-	t3 = krl;							\
-	t1 = klr;							\
-	t3 &= rl;							\
-	t1 |= lr;							\
-	ll ^= t1;							\
-	rr ^= ROL1(t3);							\
-    } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {								\
-	ir =  camellia_sp1110[xr & 0xff];				\
-	il =  camellia_sp1110[(xl>>24) & 0xff];				\
-	ir ^= camellia_sp0222[(xr>>24) & 0xff];				\
-	il ^= camellia_sp0222[(xl>>16) & 0xff];				\
-	ir ^= camellia_sp3033[(xr>>16) & 0xff];				\
-	il ^= camellia_sp3033[(xl>>8) & 0xff];				\
-	ir ^= camellia_sp4404[(xr>>8) & 0xff];				\
-	il ^= camellia_sp4404[xl & 0xff];				\
-	il ^= kl;							\
-	ir ^= il ^ kr;							\
-	yl ^= ir;							\
-	yr ^= ROR8(il) ^ ir;						\
-    } while(0)
-
-
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 

@@ -622,7 +593,7 @@ static void camellia_setup128(const unsi
 	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
 	SUBKEY_R(6) = subR[5] ^ subR[7];
 	tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = tl & subL[8],  /* FL(kl1) */
+	dw = tl & subL[8];  /* FL(kl1) */
 		tr = subR[10] ^ ROL1(dw);
 	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
 	SUBKEY_R(7) = subR[6] ^ tr;

@@ -1000,400 +971,173 @@ static void camellia_setup192(const unsi
 }
 
 
-static void camellia_encrypt128(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;               /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
-
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+/*
+ * Encrypt/decrypt
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+    do {								\
+	t0 = kll;							\
+	t2 = krr;							\
+	t0 &= ll;							\
+	t2 |= rr;							\
+	rl ^= t2;							\
+	lr ^= ROL1(t0);							\
+	t3 = krl;							\
+	t1 = klr;							\
+	t3 &= rl;							\
+	t1 |= lr;							\
+	ll ^= t1;							\
+	rr ^= ROL1(t3);							\
+    } while(0)
 
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(24);
-	io_text[1] = io[3] ^ SUBKEY_R(24);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir)		\
+    do {								\
+	ir =  camellia_sp1110[(u8)xr];					\
+	il =  camellia_sp1110[    (xl >> 24)];				\
+	ir ^= camellia_sp0222[    (xr >> 24)];				\
+	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
+	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
+	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
+	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
+	il ^= camellia_sp4404[(u8)xl];					\
+	il ^= kl;							\
+	ir ^= il ^ kr;							\
+	yl ^= ir;							\
+	yr ^= ROR8(il) ^ ir;						\
+    } while(0)
 
-static void camellia_decrypt128(const u32 *subkey, u32 *io_text)
+/* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
+static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
 
-	u32 io[4];
-
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(24);
-	io[1] = io_text[1] ^ SUBKEY_R(24);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(0);
+	io[1] ^= SUBKEY_R(0);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
-
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
-
-static void camellia_encrypt256(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     t0,t1,il,ir); \
+} while (0)
+
+#ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+	{
+		unsigned i = 0;
+		while (1) {
+			ROUNDS(i);
+			i += 8;
+			if (i >= max)
+				break;
+			FLS(i);
+		}
+	}
+#else
+	ROUNDS(0);
+	FLS(8);
+	ROUNDS(8);
+	FLS(16);
+	ROUNDS(16);
+	if (max == 32) {
+		FLS(24);
+		ROUNDS(24);
+	}
+#endif
 
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[0],io[1],il,ir,t0,t1);
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(32);
-	io_text[1] = io[3] ^ SUBKEY_R(32);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(max);
+	io[3] ^= SUBKEY_R(max);
+	/* NB: io[0],[1] should be swapped with [2],[3] by caller! */
 }
 
-static void camellia_decrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
 {
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
+	u32 il,ir,t0,t1;               /* temporary variables */
 
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(32);
-	io[1] = io_text[1] ^ SUBKEY_R(32);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(i);
+	io[1] ^= SUBKEY_R(i);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     t0,t1,il,ir); \
+} while (0)
+
+#ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+	while (1) {
+		i -= 8;
+		ROUNDS(i);
+		if (i == 0)
+			break;
+		FLS(i);
+	}
+#else
+	if (i == 32) {
+		ROUNDS(24);
+		FLS(24);
+	}
+	ROUNDS(16);
+	FLS(16);
+	ROUNDS(8);
+	FLS(8);
+	ROUNDS(0);
+#endif
+
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(0);
+	io[3] ^= SUBKEY_R(0);
+	/* NB: 0,1 should be swapped with 2,3 by caller! */
 }
 
 

@@ -1445,21 +1189,15 @@ static void camellia_encrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_encrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_encrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_encrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_encrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)

@@ -1475,21 +1213,15 @@ static void camellia_decrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_decrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_decrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_decrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_decrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static struct crypto_alg camellia_alg = {

@@ -1528,3 +1260,5 @@ module_exit(camellia_fini);
 
 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
 MODULE_LICENSE("GPL");
+
+#endif /* if BITS_PER_LONG < 64 */
crypto/camellia_64.c new file +1172 -0

1,172 lines not on this page · raw message

Acked-by on v1 5/5
#14 lore raw

Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 23 lines
Quoted 3 lines

Thu, 25 Oct 2007 12:48:29 +0100
[Subject: [PATCH 5/5] camellia: de-unrolling, 64bit-ization] Denys Vlasenko <[email protected]> wrote...

Quoted 18 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia5.diff
Use alternative key setup implementation with mostly 64-bit ops if BITS_PER_LONG >= 64. Both much smaller and much faster.

Unify camellia_en/decrypt128/256 into camellia_do_en/decrypt. Code was similar, with just one additional if() we can use came code.

If CONFIG_CC_OPTIMIZE_FOR_SIZE is defined,
use loop in camellia_do_en/decrypt instead of unrolled code. ~5% encrypt/decrypt slowdown.

Replace (x & 0xff) with (u8)x, gcc is not smart enough to realize that it can do (x & 0xff) this way (which is smaller at least on i386).

Quoted 7 lines
Quoted 3 lines
    Don't do (x & 0xff) in a few places where x cannot be > 255 anyway:
        t0 = il >> 16; v = camellia_sp0222[(t1 >> 8) & 0xff];
    il16 is u32, (thus t1 >> 8) is one byte!
Signed-off-by Denys Vlasenko <[email protected]>

--
vda

Acked-by Noriaki TAKAMIYA <[email protected]>

--
Noriaki TAKAMIYA

maintainer
#15 lore raw

Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

In reply to Denys Vlasenko
Quoted 9 lines · Denys Vlasenko
Quoted 8 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia5.diff
Use alternative key setup implementation with mostly 64-bit ops if BITS_PER_LONG >= 64. Both much smaller and much faster.

Quoted 6 lines
Quoted 6 lines

Unify camellia_en/decrypt128/256 into camellia_do_en/decrypt. Code was similar, with just one additional if() we can use came code.

If CONFIG_CC_OPTIMIZE_FOR_SIZE is defined,
use loop in camellia_do_en/decrypt instead of unrolled code. ~5% encrypt/decrypt slowdown.

Having two versions of the cdoe is unmaintainable. So please either decide that 5% is worth it or isn't.

The rest of this patch looks fine.

Cheers,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#16 lore raw

Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 13 lines · Herbert Xu
Quoted 12 lines · Denys Vlasenko
Quoted 11 lines · Denys Vlasenko

Hi Hervert,

Please review and maybe propagate upstream following patches.

camellia5.diff
Use alternative key setup implementation with mostly 64-bit ops if BITS_PER_LONG >= 64. Both much smaller and much faster.

Unify camellia_en/decrypt128/256 into camellia_do_en/decrypt. Code was similar, with just one additional if() we can use came code.

Quoted 6 lines
Quoted 3 lines
Quoted 3 lines

If CONFIG_CC_OPTIMIZE_FOR_SIZE is defined,
use loop in camellia_do_en/decrypt instead of unrolled code. ~5% encrypt/decrypt slowdown.

Having two versions of the cdoe is unmaintainable. So please either decide that 5% is worth it or isn't.

*I* am happy with 5% speed sacrifice. I'm afraid other people won't be.

I just want to escape vicious cycle of -Os people arguing with -O2 people to no end. I don't want somebody to come later and unroll the loop again. And then me to come
and de-unroll it again...

It's better for everybody to recognize that both POVs are valid, and have provisions for tuning size/speed tradeoff by the user (person which builds the binary).

That's why I made a patch where unrolling can be enabled by CONFIG_xxx.

If you disagree with me and don't want this type of selectability, the updated patch is attached.

Thanks!
--
vda

crypto/camellia.c renamed from crypto/camellia4.c +158 -453
@@ -36,6 +36,13 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
+#if BITS_PER_LONG >= 64
+
+/* Use alternative implementation with mostly 64-bit ops */
+#include "camellia_64.c"
+
+#else
+
 static const u32 camellia_sp1110[256] = {
 	0x70707000,0x82828200,0x2c2c2c00,0xececec00,
 	0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,

@@ -329,7 +336,6 @@ static const u32 camellia_sp4404[256] = 
 /*
  *  macros
  */
-
 # define GETU32(v, pt) \
     do { \
 	/* latest breed of gcc is clever enough to use move */ \

@@ -364,63 +370,28 @@ static const u32 camellia_sp4404[256] = 
     } while(0)
 
 
+/*
+ * Key setup
+ */
 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
     do {							\
 	il = xl ^ kl;						\
 	ir = xr ^ kr;						\
 	t0 = il >> 16;						\
 	t1 = ir >> 16;						\
-	yl = camellia_sp1110[ir & 0xff]				\
-	   ^ camellia_sp0222[(t1 >> 8) & 0xff]			\
-	   ^ camellia_sp3033[t1 & 0xff]				\
-	   ^ camellia_sp4404[(ir >> 8) & 0xff];			\
-	yr = camellia_sp1110[(t0 >> 8) & 0xff]			\
-	   ^ camellia_sp0222[t0 & 0xff]				\
-	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
-	   ^ camellia_sp4404[il & 0xff];			\
+	yl = camellia_sp1110[(u8)(ir     )]			\
+	   ^ camellia_sp0222[    (t1 >> 8)]			\
+	   ^ camellia_sp3033[(u8)(t1     )]			\
+	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
+	yr = camellia_sp1110[    (t0 >> 8)]			\
+	   ^ camellia_sp0222[(u8)(t0     )]			\
+	   ^ camellia_sp3033[(u8)(il >> 8)]			\
+	   ^ camellia_sp4404[(u8)(il     )];			\
 	yl ^= yr;						\
 	yr = ROR8(yr);						\
 	yr ^= yl;						\
     } while(0)
 
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
-    do {								\
-	t0 = kll;							\
-	t2 = krr;							\
-	t0 &= ll;							\
-	t2 |= rr;							\
-	rl ^= t2;							\
-	lr ^= ROL1(t0);							\
-	t3 = krl;							\
-	t1 = klr;							\
-	t3 &= rl;							\
-	t1 |= lr;							\
-	ll ^= t1;							\
-	rr ^= ROL1(t3);							\
-    } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {								\
-	ir =  camellia_sp1110[xr & 0xff];				\
-	il =  camellia_sp1110[(xl>>24) & 0xff];				\
-	ir ^= camellia_sp0222[(xr>>24) & 0xff];				\
-	il ^= camellia_sp0222[(xl>>16) & 0xff];				\
-	ir ^= camellia_sp3033[(xr>>16) & 0xff];				\
-	il ^= camellia_sp3033[(xl>>8) & 0xff];				\
-	ir ^= camellia_sp4404[(xr>>8) & 0xff];				\
-	il ^= camellia_sp4404[xl & 0xff];				\
-	il ^= kl;							\
-	ir ^= il ^ kr;							\
-	yl ^= ir;							\
-	yr ^= ROR8(il) ^ ir;						\
-    } while(0)
-
-
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 

@@ -622,7 +593,7 @@ static void camellia_setup128(const unsi
 	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
 	SUBKEY_R(6) = subR[5] ^ subR[7];
 	tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = tl & subL[8],  /* FL(kl1) */
+	dw = tl & subL[8];  /* FL(kl1) */
 		tr = subR[10] ^ ROL1(dw);
 	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
 	SUBKEY_R(7) = subR[6] ^ tr;

@@ -1000,400 +971,144 @@ static void camellia_setup192(const unsi
 }
 
 
-static void camellia_encrypt128(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;               /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
-
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+/*
+ * Encrypt/decrypt
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+    do {								\
+	t0 = kll;							\
+	t2 = krr;							\
+	t0 &= ll;							\
+	t2 |= rr;							\
+	rl ^= t2;							\
+	lr ^= ROL1(t0);							\
+	t3 = krl;							\
+	t1 = klr;							\
+	t3 &= rl;							\
+	t1 |= lr;							\
+	ll ^= t1;							\
+	rr ^= ROL1(t3);							\
+    } while(0)
 
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(24);
-	io_text[1] = io[3] ^ SUBKEY_R(24);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir)		\
+    do {								\
+	ir =  camellia_sp1110[(u8)xr];					\
+	il =  camellia_sp1110[    (xl >> 24)];				\
+	ir ^= camellia_sp0222[    (xr >> 24)];				\
+	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
+	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
+	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
+	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
+	il ^= camellia_sp4404[(u8)xl];					\
+	il ^= kl;							\
+	ir ^= il ^ kr;							\
+	yl ^= ir;							\
+	yr ^= ROR8(il) ^ ir;						\
+    } while(0)
 
-static void camellia_decrypt128(const u32 *subkey, u32 *io_text)
+/* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
+static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(24);
-	io[1] = io_text[1] ^ SUBKEY_R(24);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
-
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
-
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
-
-static void camellia_encrypt256(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
+	unsigned i;
 
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(0);
+	io[1] ^= SUBKEY_R(0);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[0],io[1],il,ir,t0,t1);
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     t0,t1,il,ir); \
+} while (0)
+	i = 0;
+	while (1) {
+		ROUNDS(i);
+		i += 8;
+		if (i >= max)
+			break;
+		FLS(i);
+	}
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(32);
-	io_text[1] = io[3] ^ SUBKEY_R(32);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(max);
+	io[3] ^= SUBKEY_R(max);
+	/* NB: io[0],[1] should be swapped with [2],[3] by caller! */
 }
 
-static void camellia_decrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
 {
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
+	u32 il,ir,t0,t1;               /* temporary variables */
 
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(32);
-	io[1] = io_text[1] ^ SUBKEY_R(32);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(i);
+	io[1] ^= SUBKEY_R(i);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     t0,t1,il,ir); \
+} while (0)
+	while (1) {
+		i -= 8;
+		ROUNDS(i);
+		if (i == 0)
+			break;
+		FLS(i);
+	}
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(0);
+	io[3] ^= SUBKEY_R(0);
+	/* NB: 0,1 should be swapped with 2,3 by caller! */
 }
 
 

@@ -1445,21 +1160,15 @@ static void camellia_encrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_encrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_encrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_encrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_encrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)

@@ -1475,21 +1184,15 @@ static void camellia_decrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_decrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_decrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_decrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_decrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static struct crypto_alg camellia_alg = {

@@ -1528,3 +1231,5 @@ module_exit(camellia_fini);
 
 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
 MODULE_LICENSE("GPL");
+
+#endif /* if BITS_PER_LONG < 64 */
crypto/camellia_64.c new file +1172 -0

1,172 lines not on this page · raw message

maintainer
#17 lore raw

Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 2 lines · Denys Vlasenko

*I* am happy with 5% speed sacrifice. I'm afraid other people won't be.

I'd like to hear the opinion of the author.

Takamiya-san, what do you think about this change?

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
#18 lore raw

Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Hi,

Sorry for late reply

Quoted 11 lines
Quoted 3 lines

Thu, 8 Nov 2007 21:30:20 +0800 頃、
[Subject: Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization] において、 Herbert Xu <[email protected]>さんが書きました....

Quoted 2 lines · Denys Vlasenko

*I* am happy with 5% speed sacrifice. I'm afraid other people won't be.

I'd like to hear the opinion of the author.

Takamiya-san, what do you think about this change?

For IPsec processing, I think performance is important.

If this fix improves the performance, it is acceptable.

But, there are many duplicate decralations between camellia.c and camellia_64.c...
(e.g., CAMELLIA_MIN_KEY_SIZE and so on)

Regards,

--
Noriaki TAKAMIYA

#19 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Hi,

sorry, again.

Quoted 11 lines
Quoted 7 lines

Tue, 13 Nov 2007 15:07:02 +0900 (JST)
[Subject: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization] Noriaki TAKAMIYA <[email protected]> wrote...

I'd like to hear the opinion of the author.

Takamiya-san, what do you think about this change?

For IPsec processing, I think performance is important.

If this fix improves the performance, it is acceptable.

I misunderstood the meaning. If this fix decreases the performance, I wouldn't prefer this patch(and the below is also one of the reason).

Quoted 3 lines

But, there are many duplicate decralations between camellia.c and camellia_64.c...
(e.g., CAMELLIA_MIN_KEY_SIZE and so on)

Regards,

--
Noriaki TAKAMIYA

author
#20 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 12 lines · Noriaki TAKAMIYA

Hi,

sorry, again.

Quoted 8 lines
Quoted 7 lines

Tue, 13 Nov 2007 15:07:02 +0900 (JST)
[Subject: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization] Noriaki TAKAMIYA <[email protected]> wrote...

I'd like to hear the opinion of the author.

Takamiya-san, what do you think about this change?

Quoted 7 lines
Quoted 3 lines

For IPsec processing, I think performance is important.

If this fix improves the performance, it is acceptable.

I misunderstood the meaning. If this fix decreases the performance, I wouldn't prefer this patch(and the below is also one of the reason).

My preferred solution is to make loop unrolling conditional on CONFIG_CC_OPTIMIZE_FOR_SIZE - and this is what is done in my (first) patch (see attached). This part:

+#ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+ while (1) {

+               i -= 8;
+               ROUNDS(i);
+               if (i == 0)

+ break;
+ FLS(i);
+ }
+#else
+ if (i == 32) {
+ ROUNDS(24);
+ FLS(24);

+       }
+       ROUNDS(16);
+       FLS(16);
+       ROUNDS(8);
+       FLS(8);
+       ROUNDS(0);

+#endif

Do you agree that this solution does not look too ugly and would satisfy both "speed" and "size" camps?

For reference, size and speed numbers again:

All times are in microseconds. Two runs give some idea of test variability. "Setup NN: NNNNNN NNNNNN" - time taken by 100000 key setups (two runs). "Encrypt: NNNNNN NNNNNN" - time taken by 1000 encryptions of 8K buffer. "Decrypt: NNNNNN NNNNNN" - time taken by 1000 decryptions of 8K buffer. "(matches)" - encrypt/decrypt cycle produced non corrupted plaintext.

CONFIG_CC_OPTIMIZE_FOR_SIZE is not set:

$ ./camellia
Setup 16:32779 33169 Encrypt:153582 153740 Decrypt:150985 149811 (matches)
Setup 24:49333 48987 Encrypt:197973 198853 Decrypt:201240 197585 (matches)
Setup 32:46700 47680 Encrypt:195650 195800 Decrypt:195450 195469 (matches)
$ ./camellia5
Setup 16:33417 32968 Encrypt:149195 149095 Decrypt:148593 148661 (matches)
Setup 24:50082 50064 Encrypt:201214 199204 Decrypt:197078 197579 (matches)
Setup 32:48938 48824 Encrypt:200231 199545 Decrypt:198954 198996 (matches)
$ ./camellia_64
Setup 16:22247 22473 Encrypt:152321 149860 Decrypt:149058 148451 (matches)
Setup 24:33832 34017 Encrypt:200428 202969 Decrypt:196789 195524 (matches)
Setup 32:32884 32821 Encrypt:200414 200640 Decrypt:197857 195987 (matches)
$ size camellia.o camellia7.o camellia_64.o
   text    data     bss     dec     hex filename
  24586       0       0   24586    600a camellia.o
  21714       0       0   21714    54d2 camellia5.o
  18666       0       0   18666    48ea camellia_64.o

Very small speed loss in camellia -> camellia5, noticeably smaller size. Big key setup speedup in 64-bit camellia_64, and it is even smaller.

CONFIG_CC_OPTIMIZE_FOR_SIZE is set:

$ ./camellia_Os
Setup 16:32573 34985 Encrypt:151825 152011 Decrypt:147581 147630 (matches)
Setup 24:48528 49250 Encrypt:196223 199056 Decrypt:198811 196394 (matches)
Setup 32:46650 47538 Encrypt:197466 196412 Decrypt:196290 196550 (matches)
$ ./camellia5_Os
Setup 16:33360 34487 Encrypt:154718 154499 Decrypt:157432 157135 (matches)
Setup 24:53969 54304 Encrypt:205184 205818 Decrypt:210675 208552 (matches)
Setup 32:53064 52904 Encrypt:205350 205439 Decrypt:211654 208468 (matches)
$ ./camellia_64_Os
Setup 16:24696 25894 Encrypt:155903 155747 Decrypt:157385 155696 (matches)
Setup 24:33873 33230 Encrypt:206111 206385 Decrypt:208111 207650 (matches)
Setup 32:32799 32325 Encrypt:209715 205973 Decrypt:207578 207644 (matches)
$ size camellia_Os.o camellia7_Os.o camellia_64_Os.o
   text    data     bss     dec     hex filename
  24586       0       0   24586    600a camellia_Os.o
  15906       0       0   15906    3e22 camellia5_Os.o
  13098       0       0   13098    332a camellia_64_Os.o

~5% speed loss in camellia -> camellia5, much smaller size. Big key setup speedup in 64-bit camellia_64, and it is even smaller still. --
vda

crypto/camellia.c renamed from crypto/camellia4.c +186 -452
@@ -36,6 +36,13 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
+#if BITS_PER_LONG >= 64
+
+/* Use alternative implementation with mostly 64-bit ops */
+#include "camellia_64.c"
+
+#else
+
 static const u32 camellia_sp1110[256] = {
 	0x70707000,0x82828200,0x2c2c2c00,0xececec00,
 	0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,

@@ -329,7 +336,6 @@ static const u32 camellia_sp4404[256] = 
 /*
  *  macros
  */
-
 # define GETU32(v, pt) \
     do { \
 	/* latest breed of gcc is clever enough to use move */ \

@@ -364,63 +370,28 @@ static const u32 camellia_sp4404[256] = 
     } while(0)
 
 
+/*
+ * Key setup
+ */
 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
     do {							\
 	il = xl ^ kl;						\
 	ir = xr ^ kr;						\
 	t0 = il >> 16;						\
 	t1 = ir >> 16;						\
-	yl = camellia_sp1110[ir & 0xff]				\
-	   ^ camellia_sp0222[(t1 >> 8) & 0xff]			\
-	   ^ camellia_sp3033[t1 & 0xff]				\
-	   ^ camellia_sp4404[(ir >> 8) & 0xff];			\
-	yr = camellia_sp1110[(t0 >> 8) & 0xff]			\
-	   ^ camellia_sp0222[t0 & 0xff]				\
-	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
-	   ^ camellia_sp4404[il & 0xff];			\
+	yl = camellia_sp1110[(u8)(ir     )]			\
+	   ^ camellia_sp0222[    (t1 >> 8)]			\
+	   ^ camellia_sp3033[(u8)(t1     )]			\
+	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
+	yr = camellia_sp1110[    (t0 >> 8)]			\
+	   ^ camellia_sp0222[(u8)(t0     )]			\
+	   ^ camellia_sp3033[(u8)(il >> 8)]			\
+	   ^ camellia_sp4404[(u8)(il     )];			\
 	yl ^= yr;						\
 	yr = ROR8(yr);						\
 	yr ^= yl;						\
     } while(0)
 
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
-    do {								\
-	t0 = kll;							\
-	t2 = krr;							\
-	t0 &= ll;							\
-	t2 |= rr;							\
-	rl ^= t2;							\
-	lr ^= ROL1(t0);							\
-	t3 = krl;							\
-	t1 = klr;							\
-	t3 &= rl;							\
-	t1 |= lr;							\
-	ll ^= t1;							\
-	rr ^= ROL1(t3);							\
-    } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {								\
-	ir =  camellia_sp1110[xr & 0xff];				\
-	il =  camellia_sp1110[(xl>>24) & 0xff];				\
-	ir ^= camellia_sp0222[(xr>>24) & 0xff];				\
-	il ^= camellia_sp0222[(xl>>16) & 0xff];				\
-	ir ^= camellia_sp3033[(xr>>16) & 0xff];				\
-	il ^= camellia_sp3033[(xl>>8) & 0xff];				\
-	ir ^= camellia_sp4404[(xr>>8) & 0xff];				\
-	il ^= camellia_sp4404[xl & 0xff];				\
-	il ^= kl;							\
-	ir ^= il ^ kr;							\
-	yl ^= ir;							\
-	yr ^= ROR8(il) ^ ir;						\
-    } while(0)
-
-
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 

@@ -622,7 +593,7 @@ static void camellia_setup128(const unsi
 	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
 	SUBKEY_R(6) = subR[5] ^ subR[7];
 	tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = tl & subL[8],  /* FL(kl1) */
+	dw = tl & subL[8];  /* FL(kl1) */
 		tr = subR[10] ^ ROL1(dw);
 	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
 	SUBKEY_R(7) = subR[6] ^ tr;

@@ -1000,400 +971,173 @@ static void camellia_setup192(const unsi
 }
 
 
-static void camellia_encrypt128(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;               /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
-
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+/*
+ * Encrypt/decrypt
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+    do {								\
+	t0 = kll;							\
+	t2 = krr;							\
+	t0 &= ll;							\
+	t2 |= rr;							\
+	rl ^= t2;							\
+	lr ^= ROL1(t0);							\
+	t3 = krl;							\
+	t1 = klr;							\
+	t3 &= rl;							\
+	t1 |= lr;							\
+	ll ^= t1;							\
+	rr ^= ROL1(t3);							\
+    } while(0)
 
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(24);
-	io_text[1] = io[3] ^ SUBKEY_R(24);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir)		\
+    do {								\
+	ir =  camellia_sp1110[(u8)xr];					\
+	il =  camellia_sp1110[    (xl >> 24)];				\
+	ir ^= camellia_sp0222[    (xr >> 24)];				\
+	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
+	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
+	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
+	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
+	il ^= camellia_sp4404[(u8)xl];					\
+	il ^= kl;							\
+	ir ^= il ^ kr;							\
+	yl ^= ir;							\
+	yr ^= ROR8(il) ^ ir;						\
+    } while(0)
 
-static void camellia_decrypt128(const u32 *subkey, u32 *io_text)
+/* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
+static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
 
-	u32 io[4];
-
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(24);
-	io[1] = io_text[1] ^ SUBKEY_R(24);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(0);
+	io[1] ^= SUBKEY_R(0);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
-
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
-
-static void camellia_encrypt256(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     t0,t1,il,ir); \
+} while (0)
+
+#ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+	{
+		unsigned i = 0;
+		while (1) {
+			ROUNDS(i);
+			i += 8;
+			if (i >= max)
+				break;
+			FLS(i);
+		}
+	}
+#else
+	ROUNDS(0);
+	FLS(8);
+	ROUNDS(8);
+	FLS(16);
+	ROUNDS(16);
+	if (max == 32) {
+		FLS(24);
+		ROUNDS(24);
+	}
+#endif
 
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[0],io[1],il,ir,t0,t1);
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(32);
-	io_text[1] = io[3] ^ SUBKEY_R(32);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(max);
+	io[3] ^= SUBKEY_R(max);
+	/* NB: io[0],[1] should be swapped with [2],[3] by caller! */
 }
 
-static void camellia_decrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
 {
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
+	u32 il,ir,t0,t1;               /* temporary variables */
 
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(32);
-	io[1] = io_text[1] ^ SUBKEY_R(32);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(i);
+	io[1] ^= SUBKEY_R(i);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     t0,t1,il,ir); \
+} while (0)
+
+#ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+	while (1) {
+		i -= 8;
+		ROUNDS(i);
+		if (i == 0)
+			break;
+		FLS(i);
+	}
+#else
+	if (i == 32) {
+		ROUNDS(24);
+		FLS(24);
+	}
+	ROUNDS(16);
+	FLS(16);
+	ROUNDS(8);
+	FLS(8);
+	ROUNDS(0);
+#endif
+
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(0);
+	io[3] ^= SUBKEY_R(0);
+	/* NB: 0,1 should be swapped with 2,3 by caller! */
 }
 
 

@@ -1445,21 +1189,15 @@ static void camellia_encrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_encrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_encrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_encrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_encrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)

@@ -1475,21 +1213,15 @@ static void camellia_decrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_decrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_decrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_decrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_decrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static struct crypto_alg camellia_alg = {

@@ -1528,3 +1260,5 @@ module_exit(camellia_fini);
 
 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
 MODULE_LICENSE("GPL");
+
+#endif /* if BITS_PER_LONG < 64 */
crypto/camellia_64.c new file +1172 -0

1,172 lines not on this page · raw message

maintainer
#21 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 15:34:33 -0700

Quoted 3 lines

My preferred solution is to make loop unrolling conditional on CONFIG_CC_OPTIMIZE_FOR_SIZE - and this is what is done in my (first) patch (see attached). This part:

The default build is going to be CONFIG_CC_OPTIMIZE_FOR_SIZE basically for everyone, this is what people get by default and this is what every distribution uses.

Therefore %99.9999 of folks will get the slowdown.

So in my book this is not an acceptable way to deal with this problem.

author
#22 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 7 lines · David Miller

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 15:34:33 -0700

Quoted 3 lines

My preferred solution is to make loop unrolling conditional on CONFIG_CC_OPTIMIZE_FOR_SIZE - and this is what is done in my (first) patch (see attached). This part:

Quoted 8 lines

The default build is going to be CONFIG_CC_OPTIMIZE_FOR_SIZE basically for everyone, this is what people get by default and this is what every distribution uses.

Therefore %99.9999 of folks will get the slowdown.

So in my book this is not an acceptable way to deal with this problem.

Loop unrolling here amounts to 25% code growth:

text data bss dec hex filename

  21714       0       0   21714    54d2 camellia5.o
  15906       0       0   15906    3e22 camellia5_Os.o

Saving 25% or code size and going 5% slower is perfectly acceptable tradeof for some users. NB: I'm not saying all, ut some significant part of users would like to be able to have this choice.

If CONFIG_CC_OPTIMIZE_FOR_SIZE is not an acceptable method, do you have other ideas?
--
vda

maintainer
#23 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 19:47:08 -0700

Quoted 2 lines

If CONFIG_CC_OPTIMIZE_FOR_SIZE is not an acceptable method, do you have other ideas?

Look at ways to make the code run faster without loop unrolling?

author
#24 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 7 lines · David Miller

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 19:47:08 -0700

Quoted 2 lines

If CONFIG_CC_OPTIMIZE_FOR_SIZE is not an acceptable method, do you have other ideas?

Look at ways to make the code run faster without loop unrolling?

I did it. I noticed that key setup is mostly operating on 64-bit quantities, and provided alternative implementation which exploits that fact. It's smaller and faster.

However, after I've done that, the question still stands:
should I unroll the loop or not?

The situation we are in now is exactly the sutiation I want to avoid:

Quoted 5 lines · Denys Vlasenko
Quoted 2 lines

Having two versions of the cdoe is unmaintainable. So please either decide that 5% is worth it or isn't.

*I* am happy with 5% speed sacrifice. I'm afraid other people won't be.

Quoted 8 lines

I just want to escape vicious cycle of -Os people arguing with -O2 people to no end. I don't want somebody to come later and unroll the loop again. And then me to come
and de-unroll it again...

It's better for everybody to recognize that both POVs are valid, and have provisions for tuning size/speed tradeoff by the user (person which builds the binary).

That's why I made a patch where unrolling can be enabled by CONFIG_xxx.

I will resubmit the patch without de-unrolling. Meanwhile, I'd like to ask you guys to think about ways to make size/speed tradeoffs selectable at build time. --
vda

maintainer
#25 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 22:30:47 -0700

Quoted 12 lines · David Miller
Quoted 7 lines

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 19:47:08 -0700

Quoted 2 lines

If CONFIG_CC_OPTIMIZE_FOR_SIZE is not an acceptable method, do you have other ideas?

Look at ways to make the code run faster without loop unrolling?

I did it. I noticed that key setup is mostly operating on 64-bit quantities, and provided alternative implementation which exploits that fact. It's smaller and faster.

Great, then you don't have to unroll the loop and performance is at least as good as before _and_ you save code space.

It's perfect, you don't need compile time checks or anything silly like that.

Please submit this new version :-)

author
#26 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 10 lines · David Miller

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 22:30:47 -0700

Quoted 7 lines · David Miller
Quoted 6 lines

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 19:47:08 -0700

Quoted 2 lines

If CONFIG_CC_OPTIMIZE_FOR_SIZE is not an acceptable method, do you have other ideas?

Quoted 8 lines
Quoted 5 lines
Quoted 1 line

Look at ways to make the code run faster without loop unrolling?

I did it. I noticed that key setup is mostly operating on 64-bit quantities, and provided alternative implementation which exploits that fact. It's smaller and faster.

Great, then you don't have to unroll the loop and performance is at least as good as before _and_ you save code space.

Unfortunately, it's applicable only to key setup,
and unrolling happens in actual encryption.

But the point still stands: irrespective of other optimizations, unrolled and non-unrolled forms will still have different sizes and speeds, and in some cases (like this one) you can't pick one form which fits all.

Quoted 1 line

Please submit this new version :-)

Just did it. It's linux-2.6.23.1.camellia5.diff
--
vda

author
#27 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

In reply to Denys Vlasenko
Quoted 3 lines · Denys Vlasenko

I will resubmit the patch without de-unrolling. Meanwhile, I'd like to ask you guys to think about ways to make size/speed tradeoffs selectable at build time.

Here is the patch which has loops still unrolled,
but otherwise unchanged.

Description:

    Use alternative key setup implementation with mostly 64-bit ops
    if BITS_PER_LONG >= 64. Both much smaller and much faster.

    Unify camellia_en/decrypt128/256 into camellia_do_en/decrypt.
    Code was similar, with just one additional if() we can use came code.

    Replace (x & 0xff) with (u8)x, gcc is not smart enough to realize
    that it can do (x & 0xff) this way (which is smaller at least on i386).

    Don't do (x & 0xff) in a few places where x cannot be > 255 anyway:
        t0 = il >> 16; v = camellia_sp0222[(t1 >> 8) & 0xff];
    il16 is u32, (thus t1 >> 8) is one byte!
Signed-off-by Denys Vlasenko <[email protected]>

--
vda

crypto/camellia.c +163 -452
diff -urpN linux-2.6.23.1.camellia/crypto/camellia.c linux-2.6.23.1.camellia5/crypto/camellia.c
@@ -36,6 +36,13 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 
+#if BITS_PER_LONG >= 64
+
+/* Use alternative implementation with mostly 64-bit ops */
+#include "camellia_64.c"
+
+#else
+
 static const u32 camellia_sp1110[256] = {
 	0x70707000,0x82828200,0x2c2c2c00,0xececec00,
 	0xb3b3b300,0x27272700,0xc0c0c000,0xe5e5e500,

@@ -329,7 +336,6 @@ static const u32 camellia_sp4404[256] = 
 /*
  *  macros
  */
-
 # define GETU32(v, pt) \
     do { \
 	/* latest breed of gcc is clever enough to use move */ \

@@ -364,63 +370,28 @@ static const u32 camellia_sp4404[256] = 
     } while(0)
 
 
+/*
+ * Key setup
+ */
 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
     do {							\
 	il = xl ^ kl;						\
 	ir = xr ^ kr;						\
 	t0 = il >> 16;						\
 	t1 = ir >> 16;						\
-	yl = camellia_sp1110[ir & 0xff]				\
-	   ^ camellia_sp0222[(t1 >> 8) & 0xff]			\
-	   ^ camellia_sp3033[t1 & 0xff]				\
-	   ^ camellia_sp4404[(ir >> 8) & 0xff];			\
-	yr = camellia_sp1110[(t0 >> 8) & 0xff]			\
-	   ^ camellia_sp0222[t0 & 0xff]				\
-	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
-	   ^ camellia_sp4404[il & 0xff];			\
+	yl = camellia_sp1110[(u8)(ir     )]			\
+	   ^ camellia_sp0222[    (t1 >> 8)]			\
+	   ^ camellia_sp3033[(u8)(t1     )]			\
+	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
+	yr = camellia_sp1110[    (t0 >> 8)]			\
+	   ^ camellia_sp0222[(u8)(t0     )]			\
+	   ^ camellia_sp3033[(u8)(il >> 8)]			\
+	   ^ camellia_sp4404[(u8)(il     )];			\
 	yl ^= yr;						\
 	yr = ROR8(yr);						\
 	yr ^= yl;						\
     } while(0)
 
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
-    do {								\
-	t0 = kll;							\
-	t2 = krr;							\
-	t0 &= ll;							\
-	t2 |= rr;							\
-	rl ^= t2;							\
-	lr ^= ROL1(t0);							\
-	t3 = krl;							\
-	t1 = klr;							\
-	t3 &= rl;							\
-	t1 |= lr;							\
-	ll ^= t1;							\
-	rr ^= ROL1(t3);							\
-    } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {								\
-	ir =  camellia_sp1110[xr & 0xff];				\
-	il =  camellia_sp1110[(xl>>24) & 0xff];				\
-	ir ^= camellia_sp0222[(xr>>24) & 0xff];				\
-	il ^= camellia_sp0222[(xl>>16) & 0xff];				\
-	ir ^= camellia_sp3033[(xr>>16) & 0xff];				\
-	il ^= camellia_sp3033[(xl>>8) & 0xff];				\
-	ir ^= camellia_sp4404[(xr>>8) & 0xff];				\
-	il ^= camellia_sp4404[xl & 0xff];				\
-	il ^= kl;							\
-	ir ^= il ^ kr;							\
-	yl ^= ir;							\
-	yr ^= ROR8(il) ^ ir;						\
-    } while(0)
-
-
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 

@@ -622,7 +593,7 @@ static void camellia_setup128(const unsi
 	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
 	SUBKEY_R(6) = subR[5] ^ subR[7];
 	tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = tl & subL[8],  /* FL(kl1) */
+	dw = tl & subL[8];  /* FL(kl1) */
 		tr = subR[10] ^ ROL1(dw);
 	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
 	SUBKEY_R(7) = subR[6] ^ tr;

@@ -1000,400 +971,150 @@ static void camellia_setup192(const unsi
 }
 
 
-static void camellia_encrypt128(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;               /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
-
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+/*
+ * Encrypt/decrypt
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+    do {								\
+	t0 = kll;							\
+	t2 = krr;							\
+	t0 &= ll;							\
+	t2 |= rr;							\
+	rl ^= t2;							\
+	lr ^= ROL1(t0);							\
+	t3 = krl;							\
+	t1 = klr;							\
+	t3 &= rl;							\
+	t1 |= lr;							\
+	ll ^= t1;							\
+	rr ^= ROL1(t3);							\
+    } while(0)
 
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(24);
-	io_text[1] = io[3] ^ SUBKEY_R(24);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir)		\
+    do {								\
+	ir =  camellia_sp1110[(u8)xr];					\
+	il =  camellia_sp1110[    (xl >> 24)];				\
+	ir ^= camellia_sp0222[    (xr >> 24)];				\
+	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
+	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
+	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
+	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
+	il ^= camellia_sp4404[(u8)xl];					\
+	il ^= kl;							\
+	ir ^= il ^ kr;							\
+	yl ^= ir;							\
+	yr ^= ROR8(il) ^ ir;						\
+    } while(0)
 
-static void camellia_decrypt128(const u32 *subkey, u32 *io_text)
+/* max = 24: 128bit encrypt, max = 32: 256bit encrypt */
+static void camellia_do_encrypt(const u32 *subkey, u32 *io, unsigned max)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
 
-	u32 io[4];
-
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(24);
-	io[1] = io_text[1] ^ SUBKEY_R(24);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(0);
+	io[1] ^= SUBKEY_R(0);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
-
-	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
-}
-
-static void camellia_encrypt256(const u32 *subkey, u32 *io_text)
-{
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
-
-	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(0);
-	io[1] = io_text[1] ^ SUBKEY_R(0);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     t0,t1,il,ir); \
+} while (0)
+
+	ROUNDS(0);
+	FLS(8);
+	ROUNDS(8);
+	FLS(16);
+	ROUNDS(16);
+	if (max == 32) {
+		FLS(24);
+		ROUNDS(24);
+	}
 
-	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[0],io[1],il,ir,t0,t1);
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(32);
-	io_text[1] = io[3] ^ SUBKEY_R(32);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(max);
+	io[3] ^= SUBKEY_R(max);
+	/* NB: io[0],[1] should be swapped with [2],[3] by caller! */
 }
 
-static void camellia_decrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_do_decrypt(const u32 *subkey, u32 *io, unsigned i)
 {
-	u32 il,ir,t0,t1;           /* temporary variables */
-
-	u32 io[4];
+	u32 il,ir,t0,t1;               /* temporary variables */
 
 	/* pre whitening but absorb kw2 */
-	io[0] = io_text[0] ^ SUBKEY_L(32);
-	io[1] = io_text[1] ^ SUBKEY_R(32);
-	io[2] = io_text[2];
-	io[3] = io_text[3];
+	io[0] ^= SUBKEY_L(i);
+	io[1] ^= SUBKEY_R(i);
 
 	/* main iteration */
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(25),SUBKEY_R(25),
-		     SUBKEY_L(24),SUBKEY_R(24),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(17),SUBKEY_R(17),
-		     SUBKEY_L(16),SUBKEY_R(16),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
-
-	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
-		     SUBKEY_L(9),SUBKEY_R(9),
-		     SUBKEY_L(8),SUBKEY_R(8),
-		     t0,t1,il,ir);
-
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[0],io[1],
-			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
-	CAMELLIA_ROUNDSM(io[2],io[3],
-			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+#define ROUNDS(i) do { \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 7),SUBKEY_R(i + 7), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 6),SUBKEY_R(i + 6), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 5),SUBKEY_R(i + 5), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 4),SUBKEY_R(i + 4), \
+			 io[0],io[1],il,ir); \
+	CAMELLIA_ROUNDSM(io[0],io[1], \
+			 SUBKEY_L(i + 3),SUBKEY_R(i + 3), \
+			 io[2],io[3],il,ir); \
+	CAMELLIA_ROUNDSM(io[2],io[3], \
+			 SUBKEY_L(i + 2),SUBKEY_R(i + 2), \
+			 io[0],io[1],il,ir); \
+} while (0)
+#define FLS(i) do { \
+	CAMELLIA_FLS(io[0],io[1],io[2],io[3], \
+		     SUBKEY_L(i + 1),SUBKEY_R(i + 1), \
+		     SUBKEY_L(i + 0),SUBKEY_R(i + 0), \
+		     t0,t1,il,ir); \
+} while (0)
+
+	if (i == 32) {
+		ROUNDS(24);
+		FLS(24);
+	}
+	ROUNDS(16);
+	FLS(16);
+	ROUNDS(8);
+	FLS(8);
+	ROUNDS(0);
+
+#undef ROUNDS
+#undef FLS
 
 	/* post whitening but kw4 */
-	io_text[0] = io[2] ^ SUBKEY_L(0);
-	io_text[1] = io[3] ^ SUBKEY_R(0);
-	io_text[2] = io[0];
-	io_text[3] = io[1];
+	io[2] ^= SUBKEY_L(0);
+	io[3] ^= SUBKEY_R(0);
+	/* NB: 0,1 should be swapped with 2,3 by caller! */
 }
 
 

@@ -1445,21 +1166,15 @@ static void camellia_encrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_encrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_encrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_encrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_encrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static void camellia_decrypt(struct crypto_tfm *tfm, u8 *out, const u8 *in)

@@ -1475,21 +1190,15 @@ static void camellia_decrypt(struct cryp
 	tmp[2] = be32_to_cpu(src[2]);
 	tmp[3] = be32_to_cpu(src[3]);
 
-	switch (cctx->key_length) {
-	case 16:
-		camellia_decrypt128(cctx->key_table, tmp);
-		break;
-	case 24:
-		/* fall through */
-	case 32:
-		camellia_decrypt256(cctx->key_table, tmp);
-		break;
-	}
-
-	dst[0] = cpu_to_be32(tmp[0]);
-	dst[1] = cpu_to_be32(tmp[1]);
-	dst[2] = cpu_to_be32(tmp[2]);
-	dst[3] = cpu_to_be32(tmp[3]);
+	camellia_do_decrypt(cctx->key_table, tmp,
+		cctx->key_length == 16 ? 24 : 32 /* for key lengths of 24 and 32 */
+	);
+
+	/* do_decrypt returns 0,1 swapped with 2,3 */
+	dst[0] = cpu_to_be32(tmp[2]);
+	dst[1] = cpu_to_be32(tmp[3]);
+	dst[2] = cpu_to_be32(tmp[0]);
+	dst[3] = cpu_to_be32(tmp[1]);
 }
 
 static struct crypto_alg camellia_alg = {

@@ -1528,3 +1237,5 @@ module_exit(camellia_fini);
 
 MODULE_DESCRIPTION("Camellia Cipher Algorithm");
 MODULE_LICENSE("GPL");
+
+#endif /* if BITS_PER_LONG < 64 */
crypto/camellia_64.c +1149 -0

1,149 lines not on this page · raw message

maintainer
#28 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 3 lines · Denys Vlasenko

Use alternative key setup implementation with mostly 64-bit ops if BITS_PER_LONG >= 64. Both much smaller and much faster.

Can we please not have two versions of the same algorithm in C? They're a pain to maintain and test.

Where performance is paramount you could look at doing an assembly version. Unlike two C versions at least that can be easily tested by someone who has access to the platform in question.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#29 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 10 lines · Herbert Xu
Quoted 2 lines · Denys Vlasenko

Use alternative key setup implementation with mostly 64-bit ops if BITS_PER_LONG >= 64. Both much smaller and much faster.

Can we please not have two versions of the same algorithm in C? They're a pain to maintain and test.

Where performance is paramount you could look at doing an assembly version. Unlike two C versions at least that can be easily tested by someone who has access to the platform in question.

Having two versions, one in C and another in assembly cannot be easier than two C versions. Moreover, asm version will be arch specific - one needs to write separate amd64/ppc64/sparc64/etc versions. It means even more versions to maintain.

It would be faster too, though, and I think it makes sense to do it for most popular arches sometime in future.

What I have now is a generic 64-bit C implentation which is likely to be much faster and a bit smaller than 32-bit one on _all_ 64-bit arches. For i386 it's 33% faster.

I think this win is big enough to justify having two versions.

I think that you are right that having separate camellia_64.c with substantial duplication is bad. I reworked ot so that both 32-bit and 64-bit code is now in camellia.c,
and I removed (merged) all duplicated stuff (constants, macros, and whole encryption/decryption part).

I also split this patch into two parts for easier review:
camellia5:
adds 64-bit key setup
camellia6:
unifies encrypt/decrypt routines for different key lengths. This reduces module size by ~25%, with tiny (less than 1%) speed impact.
Also collapses encrypt/decrypt into more readable (visually shorter) form using macros.

Compiled it on i385 and amd64:

text data bss dec hex filename

  29724     224       0   29948    74fc 2.6.23.1.camellia.t/crypto/camellia.o
  29233     224       0   29457    7311 2.6.23.1.camellia5.t/crypto/camellia.o
  21190     224       0   21414    53a6 2.6.23.1.camellia6.t/crypto/camellia.o
  22498     288       0   22786    5902 2.6.23.1.camellia.t64/crypto/camellia.o
  21134     288       0   21422    53ae 2.6.23.1.camellia5.t64/crypto/camellia.o
  16067     288       0   16355    3fe3 2.6.23.1.camellia6.t64/crypto/camellia.o

Takamiya-san, can you review attached patches please?

Signed-off-by Denys Vlasenko <[email protected]>

--
vda

crypto/camellia.c +722 -138
diff -urpN linux-2.6.23.1.camellia/crypto/camellia.c linux-2.6.23.1.camellia5/crypto/camellia.c
@@ -310,6 +310,589 @@ static const u32 camellia_sp4404[256] = 
 #define CAMELLIA_BLOCK_SIZE          16
 #define CAMELLIA_TABLE_BYTE_LEN     272
 
+/*
+ * NB: L and R below stand for 'left' and 'right' as in written numbers.
+ * That is, in (xxxL,xxxR) pair xxxL holds most significant digits,
+ * _not_ least significant ones!
+ */
+
+
+
+#if BITS_PER_LONG >= 64
+
+/*
+ * Key setup implementation with mostly 64-bit ops
+ */
+
+/* key constants */
+
+#define CAMELLIA_SIGMA1 (0xA09E667F3BCC908B)
+#define CAMELLIA_SIGMA2 (0xB67AE8584CAA73B2)
+#define CAMELLIA_SIGMA3 (0xC6EF372FE94F82BE)
+#define CAMELLIA_SIGMA4 (0x54FF53A5F1D36F1C)
+#define CAMELLIA_SIGMA5 (0x10E527FADE682D1D)
+#define CAMELLIA_SIGMA6 (0xB05688C2B3E6C1FD)
+
+/*
+ *  macros
+ */
+#define GETU64(v, pt) \
+    do { \
+	/* latest breed of gcc is clever enough to use move */ \
+	memcpy(&(v), (pt), 8); \
+	(v) = be64_to_cpu(v); \
+    } while(0)
+
+/* rotation right shift 1byte */
+#define ROR8(x) (((x) >> 8) + ((x) << (sizeof(x)*8 - 8)))
+/* rotation left shift 1bit */
+#define ROL1(x) (((x) << 1) + ((x) >> (sizeof(x)*8 - 1)))
+/* rotation left shift 1byte */
+#define ROL8(x) (((x) << 8) + ((x) >> (sizeof(x)*8 - 8)))
+
+#define ROLDQ(l, r, w, bits)				\
+    do {						\
+	w = l;						\
+	l = (l << bits) + (r >> (64 - bits));		\
+	r = (r << bits) + (w >> (64 - bits));		\
+    } while(0)
+
+#define CAMELLIA_F(x, k, y, i)					\
+    do {							\
+	u32 yl, yr;						\
+	i = x ^ k;						\
+	yl = camellia_sp1110[(u8)i]				\
+	   ^ camellia_sp0222[(u8)(i >> 24)]			\
+	   ^ camellia_sp3033[(u8)(i >> 16)]			\
+	   ^ camellia_sp4404[(u8)(i >> 8)];			\
+	yr = camellia_sp1110[    (i >> 56)]			\
+	   ^ camellia_sp0222[(u8)(i >> 48)]			\
+	   ^ camellia_sp3033[(u8)(i >> 40)]			\
+	   ^ camellia_sp4404[(u8)(i >> 32)];			\
+	yl ^= yr;						\
+	yr = ROR8(yr);						\
+	yr ^= yl;						\
+	y = ((u64)yl << 32) + yr;				\
+    } while(0)
+
+#define SUBKEY(INDEX) (subkey[(INDEX)])
+
+#ifdef __BIG_ENDIAN
+#define SUBKEY_L(INDEX) (((u32*)subkey)[(INDEX)*2])
+#define SUBKEY_R(INDEX) (((u32*)subkey)[(INDEX)*2 + 1])
+#else
+#define SUBKEY_L(INDEX) (((u32*)subkey)[(INDEX)*2 + 1])
+#define SUBKEY_R(INDEX) (((u32*)subkey)[(INDEX)*2])
+#endif
+
+static void camellia_setup_tail(u64 *subkey, int max)
+{
+	u32 dw;
+	int i = 2;
+	do {
+		dw = SUBKEY_L(i + 0) ^ SUBKEY_R(i + 0); dw = ROL8(dw);/* round 1 */
+		SUBKEY_R(i + 0) = SUBKEY_L(i + 0) ^ dw; SUBKEY_L(i + 0) = dw;
+		dw = SUBKEY_L(i + 1) ^ SUBKEY_R(i + 1); dw = ROL8(dw);/* round 2 */
+		SUBKEY_R(i + 1) = SUBKEY_L(i + 1) ^ dw; SUBKEY_L(i + 1) = dw;
+		dw = SUBKEY_L(i + 2) ^ SUBKEY_R(i + 2); dw = ROL8(dw);/* round 3 */
+		SUBKEY_R(i + 2) = SUBKEY_L(i + 2) ^ dw; SUBKEY_L(i + 2) = dw;
+		dw = SUBKEY_L(i + 3) ^ SUBKEY_R(i + 3); dw = ROL8(dw);/* round 4 */
+		SUBKEY_R(i + 3) = SUBKEY_L(i + 3) ^ dw; SUBKEY_L(i + 3) = dw;
+		dw = SUBKEY_L(i + 4) ^ SUBKEY_R(i + 4); dw = ROL8(dw);/* round 5 */
+		SUBKEY_R(i + 4) = SUBKEY_L(i + 4) ^ dw; SUBKEY_L(i + 4) = dw;
+		dw = SUBKEY_L(i + 5) ^ SUBKEY_R(i + 5); dw = ROL8(dw);/* round 6 */
+		SUBKEY_R(i + 5) = SUBKEY_L(i + 5) ^ dw; SUBKEY_L(i + 5) = dw;
+		i += 8;
+	} while (i < max);
+}
+
+#ifdef __BIG_ENDIAN
+#define subL(INDEX) (((u32*)sub)[(INDEX)*2])
+#define subR(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
+#else
+#define subL(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
+#define subR(INDEX) (((u32*)sub)[(INDEX)*2])
+#endif
+
+static void camellia_setup128(const unsigned char *key, u64 *subkey)
+{
+	u64 kl, kr;
+	u64 i, t, w;
+	u64 kw4;
+	u32 dw;
+	u64 sub[26];
+
+	/**
+	 *  k == kl || kr (|| is concatination)
+	 */
+	GETU64(kl, key     );
+	GETU64(kr, key +  8);
+
+	/**
+	 * generate KL dependent subkeys
+	 */
+	/* kw1 */
+	sub[0] = kl;
+	/* kw2 */
+	sub[1] = kr;
+	/* rotation left shift 15bit */
+	ROLDQ(kl, kr, w, 15);
+	/* k3 */
+	sub[4] = kl;
+	/* k4 */
+	sub[5] = kr;
+	/* rotation left shift 15+30bit */
+	ROLDQ(kl, kr, w, 30);
+	/* k7 */
+	sub[10] = kl;
+	/* k8 */
+	sub[11] = kr;
+	/* rotation left shift 15+30+15bit */
+	ROLDQ(kl, kr, w, 15);
+	/* k10 */
+	sub[13] = kr;
+	/* rotation left shift 15+30+15+17 bit */
+	ROLDQ(kl, kr, w, 17);
+	/* kl3 */
+	sub[16] = kl;
+	/* kl4 */
+	sub[17] = kr;
+	/* rotation left shift 15+30+15+17+17 bit */
+	ROLDQ(kl, kr, w, 17);
+	/* k13 */
+	sub[18] = kl;
+	/* k14 */
+	sub[19] = kr;
+	/* rotation left shift 15+30+15+17+17+17 bit */
+	ROLDQ(kl, kr, w, 17);
+	/* k17 */
+	sub[22] = kl;
+	/* k18 */
+	sub[23] = kr;
+
+	/* generate KA */
+	kl = sub[0];
+	kr = sub[1];
+	CAMELLIA_F(kl, CAMELLIA_SIGMA1, w, i);
+	kr ^= w;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA2, kl, i);
+	/* current status == (kl, w) */
+	CAMELLIA_F(kl, CAMELLIA_SIGMA3, kr, i);
+	kr ^= w;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA4, w, i);
+	kl ^= w;
+
+	/* generate KA dependent subkeys */
+	/* k1, k2 */
+	sub[2] = kl;
+	sub[3] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* k5,k6 */
+	sub[6] = kl;
+	sub[7] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* kl1, kl2 */
+	sub[8] = kl;
+	sub[9] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* k9 */
+	sub[12] = kl;
+	ROLDQ(kl, kr, w, 15);
+	/* k11, k12 */
+	sub[14] = kl;
+	sub[15] = kr;
+	ROLDQ(kl, kr, w, 34);
+	/* k15, k16 */
+	sub[20] = kl;
+	sub[21] = kr;
+	ROLDQ(kl, kr, w, 17);
+	/* kw3, kw4 */
+	sub[24] = kl;
+	sub[25] = kr;
+
+	/* absorb kw2 to other subkeys */
+	/* round 2 */
+	sub[3] ^= sub[1];
+	/* round 4 */
+	sub[5] ^= sub[1];
+	/* round 6 */
+	sub[7] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(9);
+	dw = subL(1) & subL(9),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl2) */
+	/* round 8 */
+	sub[11] ^= sub[1];
+	/* round 10 */
+	sub[13] ^= sub[1];
+	/* round 12 */
+	sub[15] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(17);
+	dw = subL(1) & subL(17),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl4) */
+	/* round 14 */
+	sub[19] ^= sub[1];
+	/* round 16 */
+	sub[21] ^= sub[1];
+	/* round 18 */
+	sub[23] ^= sub[1];
+	/* kw3 */
+	sub[24] ^= sub[1];
+
+	/* absorb kw4 to other subkeys */
+	kw4 = sub[25];
+	/* round 17 */
+	sub[22] ^= kw4;
+	/* round 15 */
+	sub[20] ^= kw4;
+	/* round 13 */
+	sub[18] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(16)) << 32; //kw4l ^= kw4r & ~subR(16);
+	dw = (u32)(kw4 >> 32) & subL(16); // kw4l & subL[16],
+	kw4 ^= ROL1(dw); /* modified for FL(kl3) */
+	/* round 11 */
+	sub[14] ^= kw4;
+	/* round 9 */
+	sub[12] ^= kw4;
+	/* round 7 */
+	sub[10] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(8)) << 32; //kw4l ^= kw4r & ~subR[8];
+	dw = (u32)(kw4 >> 32) & subL(8);
+	kw4 ^= ROL1(dw); /* modified for FL(kl1) */
+	/* round 5 */
+	sub[6] ^= kw4;
+	/* round 3 */
+	sub[4] ^= kw4;
+	/* round 1 */
+	sub[2] ^= kw4;
+	/* kw1 */
+	sub[0] ^= kw4;
+
+	/* key XOR is end of F-function */
+	SUBKEY(0) = sub[0] ^ sub[2];/* kw1 */
+	SUBKEY(2) = sub[3];       /* round 1 */
+	SUBKEY(3) = sub[2] ^ sub[4]; /* round 2 */
+	SUBKEY(4) = sub[3] ^ sub[5]; /* round 3 */
+	SUBKEY(5) = sub[4] ^ sub[6]; /* round 4 */
+	SUBKEY(6) = sub[5] ^ sub[7]; /* round 5 */
+	t = subL(10) ^ (subR(10) & ~subR(8)); // tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = (u32)t & subL(8);  /* FL(kl1) */
+	t = (t << 32) | (subR(10) ^ ROL1(dw)); // tr = subR[10] ^ ROL1(dw);
+	SUBKEY(7) = sub[6] ^ t; /* round 6 */
+	SUBKEY(8) = sub[8];       /* FL(kl1) */
+	SUBKEY(9) = sub[9];       /* FLinv(kl2) */
+	t = subL(7) ^ (subR(7) & ~subR(9));
+	dw = (u32)t & subL(9);  /* FLinv(kl2) */
+	t = (t << 32) | (subR(7) ^ ROL1(dw));
+	SUBKEY(10) = t ^ sub[11]; /* round 7 */
+	SUBKEY(11) = sub[10] ^ sub[12]; /* round 8 */
+	SUBKEY(12) = sub[11] ^ sub[13]; /* round 9 */
+	SUBKEY(13) = sub[12] ^ sub[14]; /* round 10 */
+	SUBKEY(14) = sub[13] ^ sub[15]; /* round 11 */
+	t = subL(18) ^ (subR(18) & ~subR(16));
+	dw = (u32)t & subL(16); /* FL(kl3) */
+	t = (t << 32) | (subR(18) ^ ROL1(dw));
+	SUBKEY(15) = sub[14] ^ t; /* round 12 */
+	SUBKEY(16) = sub[16];     /* FL(kl3) */
+	SUBKEY(17) = sub[17];     /* FLinv(kl4) */
+	t = subL(15) ^ (subR(15) & ~subR(17));
+	dw = (u32)t & subL(17); /* FLinv(kl4) */
+	t = (t << 32) | (subR(15) ^ ROL1(dw));
+	SUBKEY(18) = t ^ sub[19]; /* round 13 */
+	SUBKEY(19) = sub[18] ^ sub[20]; /* round 14 */
+	SUBKEY(20) = sub[19] ^ sub[21]; /* round 15 */
+	SUBKEY(21) = sub[20] ^ sub[22]; /* round 16 */
+	SUBKEY(22) = sub[21] ^ sub[23]; /* round 17 */
+	SUBKEY(23) = sub[22];     /* round 18 */
+	SUBKEY(24) = sub[24] ^ sub[23]; /* kw3 */
+
+	/* apply the inverse of the last half of P-function */
+	camellia_setup_tail(subkey, 24);
+}
+
+static void camellia_setup256(const unsigned char *key, u64 *subkey)
+{
+	u64 kl, kr;        /* left half of key */
+	u64 krl, krr;      /* right half of key */
+	u64 i, t, w;       /* temporary variables */
+	u64 kw4;
+	u32 dw;
+	u64 sub[34];
+
+	/**
+	 *  key = (kl || kr || krl || krr)
+	 *  (|| is concatination)
+	 */
+	GETU64(kl,  key     );
+	GETU64(kr,  key +  8);
+	GETU64(krl, key + 16);
+	GETU64(krr, key + 24);
+
+	/* generate KL dependent subkeys */
+	/* kw1 */
+	sub[0] = kl;
+	/* kw2 */
+	sub[1] = kr;
+	ROLDQ(kl, kr, w, 45);
+	/* k9 */
+	sub[12] = kl;
+	/* k10 */
+	sub[13] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* kl3 */
+	sub[16] = kl;
+	/* kl4 */
+	sub[17] = kr;
+	ROLDQ(kl, kr, w, 17);
+	/* k17 */
+	sub[22] = kl;
+	/* k18 */
+	sub[23] = kr;
+	ROLDQ(kl, kr, w, 34);
+	/* k23 */
+	sub[30] = kl;
+	/* k24 */
+	sub[31] = kr;
+
+	/* generate KR dependent subkeys */
+	ROLDQ(krl, krr, w, 15);
+	/* k3 */
+	sub[4] = krl;
+	/* k4 */
+	sub[5] = krr;
+	ROLDQ(krl, krr, w, 15);
+	/* kl1 */
+	sub[8] = krl;
+	/* kl2 */
+	sub[9] = krr;
+	ROLDQ(krl, krr, w, 30);
+	/* k13 */
+	sub[18] = krl;
+	/* k14 */
+	sub[19] = krr;
+	ROLDQ(krl, krr, w, 34);
+	/* k19 */
+	sub[26] = krl;
+	/* k20 */
+	sub[27] = krr;
+	ROLDQ(krl, krr, w, 34);
+
+	/* generate KA */
+	kl = sub[0] ^ krl;
+	kr = sub[1] ^ krr;
+	CAMELLIA_F(kl, CAMELLIA_SIGMA1, w, i);
+	kr ^= w;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA2, kl, i);
+	kl ^= krl;
+	CAMELLIA_F(kl, CAMELLIA_SIGMA3, kr, i);
+	kr ^= w ^ krr;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA4, w, i);
+	kl ^= w;
+
+	/* generate KB */
+	krl ^= kl;
+	krr ^= kr;
+	CAMELLIA_F(krl, CAMELLIA_SIGMA5, w, i);
+	krr ^= w;
+	CAMELLIA_F(krr, CAMELLIA_SIGMA6, w, i);
+	krl ^= w;
+
+	/* generate KA dependent subkeys */
+	ROLDQ(kl, kr, w, 15);
+	/* k5 */
+	sub[6] = kl;
+	/* k6 */
+	sub[7] = kr;
+	ROLDQ(kl, kr, w, 30);
+	/* k11 */
+	sub[14] = kl;
+	/* k12 */
+	sub[15] = kr;
+	/* kl5 */
+	ROLDQ(kl, kr, w, 32);
+	sub[24] = kl;
+	/* kl6 */
+	sub[25] = kr;
+	/* rotation left shift 49 from k11,k12 -> k21,k22 */
+	ROLDQ(kl, kr, w, (49 - 32));
+	/* k21 */
+	sub[28] = kl;
+	/* k22 */
+	sub[29] = kr;
+
+	/* generate KB dependent subkeys */
+	/* k1 */
+	sub[2] = krl;
+	/* k2 */
+	sub[3] = krr;
+	ROLDQ(krl, krr, w, 30);
+	/* k7 */
+	sub[10] = krl;
+	/* k8 */
+	sub[11] = krr;
+	ROLDQ(krl, krr, w, 30);
+	/* k15 */
+	sub[20] = krl;
+	/* k16 */
+	sub[21] = krr;
+	ROLDQ(krl, krr, w, 51);
+	/* kw3 */
+	sub[32] = krl;
+	/* kw4 */
+	sub[33] = krr;
+
+	/* absorb kw2 to other subkeys */
+	/* round 2 */
+	sub[3] ^= sub[1];
+	/* round 4 */
+	sub[5] ^= sub[1];
+	/* round 6 */
+	sub[7] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(9);
+	dw = subL(1) & subL(9),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl2) */
+	/* round 8 */
+	sub[11] ^= sub[1];
+	/* round 10 */
+	sub[13] ^= sub[1];
+	/* round 12 */
+	sub[15] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(17);
+	dw = subL(1) & subL(17),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl4) */
+	/* round 14 */
+	sub[19] ^= sub[1];
+	/* round 16 */
+	sub[21] ^= sub[1];
+	/* round 18 */
+	sub[23] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(25);
+	dw = subL(1) & subL(25),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl6) */
+	/* round 20 */
+	sub[27] ^= sub[1];
+	/* round 22 */
+	sub[29] ^= sub[1];
+	/* round 24 */
+	sub[31] ^= sub[1];
+	/* kw3 */
+	sub[32] ^= sub[1];
+
+	/* absorb kw4 to other subkeys */
+	kw4 = sub[33];
+	/* round 23 */
+	sub[30] ^= kw4;
+	/* round 21 */
+	sub[28] ^= kw4;
+	/* round 19 */
+	sub[26] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(24)) << 32; //kw4l ^= kw4r & ~subR[24];
+	dw = (u32)(kw4 >> 32) & subL(24),
+		kw4 ^= ROL1(dw); /* modified for FL(kl5) */
+	/* round 17 */
+	sub[22] ^= kw4;
+	/* round 15 */
+	sub[20] ^= kw4;
+	/* round 13 */
+	sub[18] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(16)) << 32;
+	dw = (u32)(kw4 >> 32) & subL(16),
+		kw4 ^= ROL1(dw); /* modified for FL(kl3) */
+	/* round 11 */
+	sub[14] ^= kw4;
+	/* round 9 */
+	sub[12] ^= kw4;
+	/* round 7 */
+	sub[10] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(8)) << 32;
+	dw = (u32)(kw4 >> 32) & subL(8),
+		kw4 ^= ROL1(dw); /* modified for FL(kl1) */
+	/* round 5 */
+	sub[6] ^= kw4;
+	/* round 3 */
+	sub[4] ^= kw4;
+	/* round 1 */
+	sub[2] ^= kw4;
+	/* kw1 */
+	sub[0] ^= kw4;
+
+	/* key XOR is end of F-function */
+	SUBKEY(0) = sub[0] ^ sub[2];/* kw1 */
+	SUBKEY(2) = sub[3];       /* round 1 */
+	SUBKEY(3) = sub[2] ^ sub[4]; /* round 2 */
+	SUBKEY(4) = sub[3] ^ sub[5]; /* round 3 */
+	SUBKEY(5) = sub[4] ^ sub[6]; /* round 4 */
+	SUBKEY(6) = sub[5] ^ sub[7]; /* round 5 */
+	t = subL(10) ^ (subR(10) & ~subR(8)); // tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = (u32)t & subL(8);  /* FL(kl1) */
+	t = (t << 32) | (subR(10) ^ ROL1(dw)); //tr = subR[10] ^ ROL1(dw);
+	SUBKEY(7) = sub[6] ^ t;   /* round 6 */
+	SUBKEY(8) = sub[8];       /* FL(kl1) */
+	SUBKEY(9) = sub[9];       /* FLinv(kl2) */
+	t = subL(7) ^ (subR(7) & ~subR(9));
+	dw = (u32)t & subL(9);  /* FLinv(kl2) */
+	t = (t << 32) | (subR(7) ^ ROL1(dw));
+	SUBKEY(10) = t ^ sub[11]; /* round 7 */
+	SUBKEY(11) = sub[10] ^ sub[12]; /* round 8 */
+	SUBKEY(12) = sub[11] ^ sub[13]; /* round 9 */
+	SUBKEY(13) = sub[12] ^ sub[14]; /* round 10 */
+	SUBKEY(14) = sub[13] ^ sub[15]; /* round 11 */
+	t = subL(18) ^ (subR(18) & ~subR(16));
+	dw = (u32)t & subL(16); /* FL(kl3) */
+	t = (t << 32) | (subR(18) ^ ROL1(dw));
+	SUBKEY(15) = sub[14] ^ t; /* round 12 */
+	SUBKEY(16) = sub[16];     /* FL(kl3) */
+	SUBKEY(17) = sub[17];     /* FLinv(kl4) */
+	t = subL(15) ^ (subR(15) & ~subR(17));
+	dw = (u32)t & subL(17); /* FLinv(kl4) */
+	t = (t << 32) | (subR(15) ^ ROL1(dw));
+	SUBKEY(18) = t ^ sub[19]; /* round 13 */
+	SUBKEY(19) = sub[18] ^ sub[20]; /* round 14 */
+	SUBKEY(20) = sub[19] ^ sub[21]; /* round 15 */
+	SUBKEY(21) = sub[20] ^ sub[22]; /* round 16 */
+	SUBKEY(22) = sub[21] ^ sub[23]; /* round 17 */
+	t = subL(26) ^ (subR(26) & ~subR(24));
+	dw = (u32)t & subL(24); /* FL(kl5) */
+	t = (t << 32) | (subR(26) ^ ROL1(dw));
+	SUBKEY(23) = sub[22] ^ t; /* round 18 */
+	SUBKEY(24) = sub[24];     /* FL(kl5) */
+	SUBKEY(25) = sub[25];     /* FLinv(kl6) */
+	t = subL(23) ^ (subR(23) & ~subR(25));
+	dw = (u32)t & subL(25); /* FLinv(kl6) */
+	t = (t << 32) | (subR(23) ^ ROL1(dw));
+	SUBKEY(26) = t ^ sub[27]; /* round 19 */
+	SUBKEY(27) = sub[26] ^ sub[28]; /* round 20 */
+	SUBKEY(28) = sub[27] ^ sub[29]; /* round 21 */
+	SUBKEY(29) = sub[28] ^ sub[30]; /* round 22 */
+	SUBKEY(30) = sub[29] ^ sub[31]; /* round 23 */
+	SUBKEY(31) = sub[30];     /* round 24 */
+	SUBKEY(32) = sub[32] ^ sub[31]; /* kw3 */
+
+	/* apply the inverse of the last half of P-function */
+	camellia_setup_tail(subkey, 32);
+}
+
+static void camellia_setup192(const unsigned char *key, u64 *subkey)
+{
+	unsigned char kk[32];
+	u64 krl, krr;
+
+	memcpy(kk, key, 24);
+	memcpy((unsigned char *)&krl, key+16, 8);
+	krr = ~krl;
+	memcpy(kk+24, (unsigned char *)&krr, 8);
+	camellia_setup256(kk, subkey);
+}
+
+typedef u64 key_element;
+typedef const u64 const_key_element;
+
+
+
+#else /* BITS_PER_LONG < 64 */
+
+/*
+ * Key setup implementation with 32-bit ops
+ */
 
 /* key constants */
 

@@ -329,8 +912,7 @@ static const u32 camellia_sp4404[256] = 
 /*
  *  macros
  */
-
-# define GETU32(v, pt) \
+#define GETU32(v, pt) \
     do { \
 	/* latest breed of gcc is clever enough to use move */ \
 	memcpy(&(v), (pt), 4); \

@@ -363,64 +945,25 @@ static const u32 camellia_sp4404[256] = 
 	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
     } while(0)
 
-
 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
     do {							\
 	il = xl ^ kl;						\
 	ir = xr ^ kr;						\
 	t0 = il >> 16;						\
 	t1 = ir >> 16;						\
-	yl = camellia_sp1110[ir & 0xff]				\
-	   ^ camellia_sp0222[(t1 >> 8) & 0xff]			\
-	   ^ camellia_sp3033[t1 & 0xff]				\
-	   ^ camellia_sp4404[(ir >> 8) & 0xff];			\
-	yr = camellia_sp1110[(t0 >> 8) & 0xff]			\
-	   ^ camellia_sp0222[t0 & 0xff]				\
-	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
-	   ^ camellia_sp4404[il & 0xff];			\
+	yl = camellia_sp1110[(u8)(ir     )]			\
+	   ^ camellia_sp0222[    (t1 >> 8)]			\
+	   ^ camellia_sp3033[(u8)(t1     )]			\
+	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
+	yr = camellia_sp1110[    (t0 >> 8)]			\
+	   ^ camellia_sp0222[(u8)(t0     )]			\
+	   ^ camellia_sp3033[(u8)(il >> 8)]			\
+	   ^ camellia_sp4404[(u8)(il     )];			\
 	yl ^= yr;						\
 	yr = ROR8(yr);						\
 	yr ^= yl;						\
     } while(0)
 
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
-    do {								\
-	t0 = kll;							\
-	t2 = krr;							\
-	t0 &= ll;							\
-	t2 |= rr;							\
-	rl ^= t2;							\
-	lr ^= ROL1(t0);							\
-	t3 = krl;							\
-	t1 = klr;							\
-	t3 &= rl;							\
-	t1 |= lr;							\
-	ll ^= t1;							\
-	rr ^= ROL1(t3);							\
-    } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {								\
-	ir =  camellia_sp1110[xr & 0xff];				\
-	il =  camellia_sp1110[(xl>>24) & 0xff];				\
-	ir ^= camellia_sp0222[(xr>>24) & 0xff];				\
-	il ^= camellia_sp0222[(xl>>16) & 0xff];				\
-	ir ^= camellia_sp3033[(xr>>16) & 0xff];				\
-	il ^= camellia_sp3033[(xl>>8) & 0xff];				\
-	ir ^= camellia_sp4404[(xr>>8) & 0xff];				\
-	il ^= camellia_sp4404[xl & 0xff];				\
-	il ^= kl;							\
-	ir ^= il ^ kr;							\
-	yl ^= ir;							\
-	yr ^= ROR8(il) ^ ir;						\
-    } while(0)
-
-
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 

@@ -999,8 +1542,49 @@ static void camellia_setup192(const unsi
 	camellia_setup256(kk, subkey);
 }
 
+typedef u32 key_element;
+typedef const u32 const_key_element;
+
+#endif /* 32/64-bit key setup versions */
+
+
+
+/*
+ * Encrypt/decrypt
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+    do {								\
+	t0 = kll;							\
+	t2 = krr;							\
+	t0 &= ll;							\
+	t2 |= rr;							\
+	rl ^= t2;							\
+	lr ^= ROL1(t0);							\
+	t3 = krl;							\
+	t1 = klr;							\
+	t3 &= rl;							\
+	t1 |= lr;							\
+	ll ^= t1;							\
+	rr ^= ROL1(t3);							\
+    } while(0)
+
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir)		\
+    do {								\
+	ir =  camellia_sp1110[(u8)xr];					\
+	il =  camellia_sp1110[    (xl >> 24)];				\
+	ir ^= camellia_sp0222[    (xr >> 24)];				\
+	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
+	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
+	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
+	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
+	il ^= camellia_sp4404[(u8)xl];					\
+	il ^= kl;							\
+	ir ^= il ^ kr;							\
+	yl ^= ir;							\
+	yr ^= ROR8(il) ^ ir;						\
+    } while(0)
 
-static void camellia_encrypt128(const u32 *subkey, u32 *io_text)
+static void camellia_encrypt128(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
 

@@ -1015,22 +1599,22 @@ static void camellia_encrypt128(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(8),SUBKEY_R(8),

@@ -1039,22 +1623,22 @@ static void camellia_encrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(16),SUBKEY_R(16),

@@ -1063,22 +1647,22 @@ static void camellia_encrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(24);

@@ -1087,7 +1671,7 @@ static void camellia_encrypt128(const u3
 	io_text[3] = io[1];
 }
 
-static void camellia_decrypt128(const u32 *subkey, u32 *io_text)
+static void camellia_decrypt128(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
 

@@ -1102,22 +1686,22 @@ static void camellia_decrypt128(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(17),SUBKEY_R(17),

@@ -1126,22 +1710,22 @@ static void camellia_decrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(9),SUBKEY_R(9),

@@ -1150,22 +1734,22 @@ static void camellia_decrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(0);

@@ -1174,7 +1758,7 @@ static void camellia_decrypt128(const u3
 	io_text[3] = io[1];
 }
 
-static void camellia_encrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_encrypt256(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;           /* temporary variables */
 

@@ -1189,22 +1773,22 @@ static void camellia_encrypt256(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(8),SUBKEY_R(8),

@@ -1213,22 +1797,22 @@ static void camellia_encrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(16),SUBKEY_R(16),

@@ -1237,22 +1821,22 @@ static void camellia_encrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(24),SUBKEY_R(24),

@@ -1261,22 +1845,22 @@ static void camellia_encrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(32);

@@ -1285,7 +1869,7 @@ static void camellia_encrypt256(const u3
 	io_text[3] = io[1];
 }
 
-static void camellia_decrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_decrypt256(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;           /* temporary variables */
 

@@ -1300,22 +1884,22 @@ static void camellia_decrypt256(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(25),SUBKEY_R(25),

@@ -1324,22 +1908,22 @@ static void camellia_decrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(17),SUBKEY_R(17),

@@ -1348,22 +1932,22 @@ static void camellia_decrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(9),SUBKEY_R(9),

@@ -1372,22 +1956,22 @@ static void camellia_decrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(0);

@@ -1399,7 +1983,7 @@ static void camellia_decrypt256(const u3
 
 struct camellia_ctx {
 	int key_length;
-	u32 key_table[CAMELLIA_TABLE_BYTE_LEN / 4];
+	key_element key_table[CAMELLIA_TABLE_BYTE_LEN / sizeof(key_element)];
 };
 
 static int
crypto/camellia.c +108 -405

550 lines not on this page · raw message

maintainer
#30 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 4 lines · Denys Vlasenko

I also split this patch into two parts for easier review:
camellia5:
adds 64-bit key setup

Sorry but this still duplicates way too much code. Also key setup is the slow path relatively speaking so it's even less justifiable.

Quoted 6 lines

camellia6:
unifies encrypt/decrypt routines for different key lengths. This reduces module size by ~25%, with tiny (less than 1%) speed impact.
Also collapses encrypt/decrypt into more readable (visually shorter) form using macros.

This looks pretty neat though. I'll merge it unless I hear any objections.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#31 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Hi Herbert,

Quoted 8 lines · Herbert Xu
Quoted 3 lines · Denys Vlasenko

I also split this patch into two parts for easier review:
camellia5:
adds 64-bit key setup

Sorry but this still duplicates way too much code. Also key setup is the slow path relatively speaking so it's even less justifiable.

Oh, Herbert, have heart, my camellia.c source file is smaller than the one I started from. It's not like it's twice as big. It's smaller already.

64-bit key setup is not just faster, it is also smaller by ~4k, and this benefit is always there, not only when key setup is performed.

With attached camellia7 patch, I further reduce the size of key setup routines by reusing a bit of the code at the end of them. 2 screenfuls of code less.

I hope it makes code duplication a bit more tolerable.

Quoted 6 lines
Quoted 6 lines

camellia6:
unifies encrypt/decrypt routines for different key lengths. This reduces module size by ~25%, with tiny (less than 1%) speed impact.
Also collapses encrypt/decrypt into more readable (visually shorter) form using macros.

And here is

camellia7:
Move "key XOR is end of F-function" code part into camellia_setup_tail(), it is sufficiently similar between camellia_setup128 and camellia_setup256. This shaves off another ~1k:
dec hex filename
21414 53a6 2.6.23.1.camellia6.t/crypto/camellia.o
20518 5026 2.6.23.1.camellia7.t/crypto/camellia.o
16355 3fe3 2.6.23.1.camellia6.t64/crypto/camellia.o
15813 3dc5 2.6.23.1.camellia7.t64/crypto/camellia.o

At the moment I cannot run test it, try to do it ASAP.

Takamiya-san, can you review attached patch please?

Signed-off-by Denys Vlasenko <[email protected]>
Signature · 1 line
vda
crypto/camellia.c +184 -277
diff -urpN linux-2.6.23.1.camellia6/crypto/camellia.c linux-2.6.23.1.camellia7/crypto/camellia.c
@@ -380,15 +380,80 @@ static const u32 camellia_sp4404[256] = 
 #ifdef __BIG_ENDIAN
 #define SUBKEY_L(INDEX) (((u32*)subkey)[(INDEX)*2])
 #define SUBKEY_R(INDEX) (((u32*)subkey)[(INDEX)*2 + 1])
+#define subL(INDEX) (((u32*)sub)[(INDEX)*2])
+#define subR(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
 #else
 #define SUBKEY_L(INDEX) (((u32*)subkey)[(INDEX)*2 + 1])
 #define SUBKEY_R(INDEX) (((u32*)subkey)[(INDEX)*2])
+#define subL(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
+#define subR(INDEX) (((u32*)sub)[(INDEX)*2])
 #endif
 
-static void camellia_setup_tail(u64 *subkey, int max)
+static void camellia_setup_tail(u64 *subkey, u64 *sub, int max)
 {
+	u64 t;
 	u32 dw;
-	int i = 2;
+	int i;
+
+	/* key XOR is end of F-function */
+	SUBKEY(0) = sub[0] ^ sub[2];/* kw1 */
+	SUBKEY(2) = sub[3];       /* round 1 */
+	SUBKEY(3) = sub[2] ^ sub[4]; /* round 2 */
+	SUBKEY(4) = sub[3] ^ sub[5]; /* round 3 */
+	SUBKEY(5) = sub[4] ^ sub[6]; /* round 4 */
+	SUBKEY(6) = sub[5] ^ sub[7]; /* round 5 */
+	t = subL(10) ^ (subR(10) & ~subR(8)); // tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = (u32)t & subL(8);  /* FL(kl1) */
+	t = (t << 32) | (subR(10) ^ ROL1(dw)); // tr = subR[10] ^ ROL1(dw);
+	SUBKEY(7) = sub[6] ^ t;   /* round 6 */
+	SUBKEY(8) = sub[8];       /* FL(kl1) */
+	SUBKEY(9) = sub[9];       /* FLinv(kl2) */
+	t = subL(7) ^ (subR(7) & ~subR(9));
+	dw = (u32)t & subL(9);  /* FLinv(kl2) */
+	t = (t << 32) | (subR(7) ^ ROL1(dw));
+	SUBKEY(10) = t ^ sub[11]; /* round 7 */
+	SUBKEY(11) = sub[10] ^ sub[12]; /* round 8 */
+	SUBKEY(12) = sub[11] ^ sub[13]; /* round 9 */
+	SUBKEY(13) = sub[12] ^ sub[14]; /* round 10 */
+	SUBKEY(14) = sub[13] ^ sub[15]; /* round 11 */
+	t = subL(18) ^ (subR(18) & ~subR(16));
+	dw = (u32)t & subL(16); /* FL(kl3) */
+	t = (t << 32) | (subR(18) ^ ROL1(dw));
+	SUBKEY(15) = sub[14] ^ t; /* round 12 */
+	SUBKEY(16) = sub[16];     /* FL(kl3) */
+	SUBKEY(17) = sub[17];     /* FLinv(kl4) */
+	t = subL(15) ^ (subR(15) & ~subR(17));
+	dw = (u32)t & subL(17); /* FLinv(kl4) */
+	t = (t << 32) | (subR(15) ^ ROL1(dw));
+	SUBKEY(18) = t ^ sub[19]; /* round 13 */
+	SUBKEY(19) = sub[18] ^ sub[20]; /* round 14 */
+	SUBKEY(20) = sub[19] ^ sub[21]; /* round 15 */
+	SUBKEY(21) = sub[20] ^ sub[22]; /* round 16 */
+	SUBKEY(22) = sub[21] ^ sub[23]; /* round 17 */
+	if (max == 24) {
+		SUBKEY(23) = sub[22];     /* round 18 */
+		SUBKEY(24) = sub[24] ^ sub[23]; /* kw3 */
+	} else { 
+		t = subL(26) ^ (subR(26) & ~subR(24));
+		dw = (u32)t & subL(24); /* FL(kl5) */
+		t = (t << 32) | (subR(26) ^ ROL1(dw));
+		SUBKEY(23) = sub[22] ^ t; /* round 18 */
+		SUBKEY(24) = sub[24];     /* FL(kl5) */
+		SUBKEY(25) = sub[25];     /* FLinv(kl6) */
+		t = subL(23) ^ (subR(23) & ~subR(25));
+		dw = (u32)t & subL(25); /* FLinv(kl6) */
+		t = (t << 32) | (subR(23) ^ ROL1(dw));
+		SUBKEY(26) = t ^ sub[27]; /* round 19 */
+		SUBKEY(27) = sub[26] ^ sub[28]; /* round 20 */
+		SUBKEY(28) = sub[27] ^ sub[29]; /* round 21 */
+		SUBKEY(29) = sub[28] ^ sub[30]; /* round 22 */
+		SUBKEY(30) = sub[29] ^ sub[31]; /* round 23 */
+		SUBKEY(31) = sub[30];     /* round 24 */
+		SUBKEY(32) = sub[32] ^ sub[31]; /* kw3 */
+	}
+
+	/* apply the inverse of the last half of P-function */
+	i = 2;
 	do {
 		dw = SUBKEY_L(i + 0) ^ SUBKEY_R(i + 0); dw = ROL8(dw);/* round 1 */
 		SUBKEY_R(i + 0) = SUBKEY_L(i + 0) ^ dw; SUBKEY_L(i + 0) = dw;

@@ -406,31 +471,21 @@ static void camellia_setup_tail(u64 *sub
 	} while (i < max);
 }
 
-#ifdef __BIG_ENDIAN
-#define subL(INDEX) (((u32*)sub)[(INDEX)*2])
-#define subR(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
-#else
-#define subL(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
-#define subR(INDEX) (((u32*)sub)[(INDEX)*2])
-#endif
-
 static void camellia_setup128(const unsigned char *key, u64 *subkey)
 {
 	u64 kl, kr;
-	u64 i, t, w;
+	u64 i, w;
 	u64 kw4;
 	u32 dw;
 	u64 sub[26];
 
 	/**
-	 *  k == kl || kr (|| is concatination)
+	 *  k == kl || kr (|| is concatenation)
 	 */
 	GETU64(kl, key     );
 	GETU64(kr, key +  8);
 
-	/**
-	 * generate KL dependent subkeys
-	 */
+	/* generate KL dependent subkeys */
 	/* kw1 */
 	sub[0] = kl;
 	/* kw2 */

@@ -567,60 +622,21 @@ static void camellia_setup128(const unsi
 	/* kw1 */
 	sub[0] ^= kw4;
 
-	/* key XOR is end of F-function */
-	SUBKEY(0) = sub[0] ^ sub[2];/* kw1 */
-	SUBKEY(2) = sub[3];       /* round 1 */
-	SUBKEY(3) = sub[2] ^ sub[4]; /* round 2 */
-	SUBKEY(4) = sub[3] ^ sub[5]; /* round 3 */
-	SUBKEY(5) = sub[4] ^ sub[6]; /* round 4 */
-	SUBKEY(6) = sub[5] ^ sub[7]; /* round 5 */
-	t = subL(10) ^ (subR(10) & ~subR(8)); // tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = (u32)t & subL(8);  /* FL(kl1) */
-	t = (t << 32) | (subR(10) ^ ROL1(dw)); // tr = subR[10] ^ ROL1(dw);
-	SUBKEY(7) = sub[6] ^ t; /* round 6 */
-	SUBKEY(8) = sub[8];       /* FL(kl1) */
-	SUBKEY(9) = sub[9];       /* FLinv(kl2) */
-	t = subL(7) ^ (subR(7) & ~subR(9));
-	dw = (u32)t & subL(9);  /* FLinv(kl2) */
-	t = (t << 32) | (subR(7) ^ ROL1(dw));
-	SUBKEY(10) = t ^ sub[11]; /* round 7 */
-	SUBKEY(11) = sub[10] ^ sub[12]; /* round 8 */
-	SUBKEY(12) = sub[11] ^ sub[13]; /* round 9 */
-	SUBKEY(13) = sub[12] ^ sub[14]; /* round 10 */
-	SUBKEY(14) = sub[13] ^ sub[15]; /* round 11 */
-	t = subL(18) ^ (subR(18) & ~subR(16));
-	dw = (u32)t & subL(16); /* FL(kl3) */
-	t = (t << 32) | (subR(18) ^ ROL1(dw));
-	SUBKEY(15) = sub[14] ^ t; /* round 12 */
-	SUBKEY(16) = sub[16];     /* FL(kl3) */
-	SUBKEY(17) = sub[17];     /* FLinv(kl4) */
-	t = subL(15) ^ (subR(15) & ~subR(17));
-	dw = (u32)t & subL(17); /* FLinv(kl4) */
-	t = (t << 32) | (subR(15) ^ ROL1(dw));
-	SUBKEY(18) = t ^ sub[19]; /* round 13 */
-	SUBKEY(19) = sub[18] ^ sub[20]; /* round 14 */
-	SUBKEY(20) = sub[19] ^ sub[21]; /* round 15 */
-	SUBKEY(21) = sub[20] ^ sub[22]; /* round 16 */
-	SUBKEY(22) = sub[21] ^ sub[23]; /* round 17 */
-	SUBKEY(23) = sub[22];     /* round 18 */
-	SUBKEY(24) = sub[24] ^ sub[23]; /* kw3 */
-
-	/* apply the inverse of the last half of P-function */
-	camellia_setup_tail(subkey, 24);
+	camellia_setup_tail(subkey, sub, 24);
 }
 
 static void camellia_setup256(const unsigned char *key, u64 *subkey)
 {
 	u64 kl, kr;        /* left half of key */
 	u64 krl, krr;      /* right half of key */
-	u64 i, t, w;       /* temporary variables */
+	u64 i, w;          /* temporary variables */
 	u64 kw4;
 	u32 dw;
 	u64 sub[34];
 
 	/**
 	 *  key = (kl || kr || krl || krr)
-	 *  (|| is concatination)
+	 *  (|| is concatenation)
 	 */
 	GETU64(kl,  key     );
 	GETU64(kr,  key +  8);

@@ -786,8 +802,8 @@ static void camellia_setup256(const unsi
 	/* round 19 */
 	sub[26] ^= kw4;
 	kw4 ^= (u64)((u32)kw4 & ~subR(24)) << 32; //kw4l ^= kw4r & ~subR[24];
-	dw = (u32)(kw4 >> 32) & subL(24),
-		kw4 ^= ROL1(dw); /* modified for FL(kl5) */
+	dw = (u32)(kw4 >> 32) & subL(24);
+	kw4 ^= ROL1(dw); /* modified for FL(kl5) */
 	/* round 17 */
 	sub[22] ^= kw4;
 	/* round 15 */

@@ -795,8 +811,8 @@ static void camellia_setup256(const unsi
 	/* round 13 */
 	sub[18] ^= kw4;
 	kw4 ^= (u64)((u32)kw4 & ~subR(16)) << 32;
-	dw = (u32)(kw4 >> 32) & subL(16),
-		kw4 ^= ROL1(dw); /* modified for FL(kl3) */
+	dw = (u32)(kw4 >> 32) & subL(16);
+	kw4 ^= ROL1(dw); /* modified for FL(kl3) */
 	/* round 11 */
 	sub[14] ^= kw4;
 	/* round 9 */

@@ -804,8 +820,8 @@ static void camellia_setup256(const unsi
 	/* round 7 */
 	sub[10] ^= kw4;
 	kw4 ^= (u64)((u32)kw4 & ~subR(8)) << 32;
-	dw = (u32)(kw4 >> 32) & subL(8),
-		kw4 ^= ROL1(dw); /* modified for FL(kl1) */
+	dw = (u32)(kw4 >> 32) & subL(8);
+	kw4 ^= ROL1(dw); /* modified for FL(kl1) */
 	/* round 5 */
 	sub[6] ^= kw4;
 	/* round 3 */

@@ -815,60 +831,7 @@ static void camellia_setup256(const unsi
 	/* kw1 */
 	sub[0] ^= kw4;
 
-	/* key XOR is end of F-function */
-	SUBKEY(0) = sub[0] ^ sub[2];/* kw1 */
-	SUBKEY(2) = sub[3];       /* round 1 */
-	SUBKEY(3) = sub[2] ^ sub[4]; /* round 2 */
-	SUBKEY(4) = sub[3] ^ sub[5]; /* round 3 */
-	SUBKEY(5) = sub[4] ^ sub[6]; /* round 4 */
-	SUBKEY(6) = sub[5] ^ sub[7]; /* round 5 */
-	t = subL(10) ^ (subR(10) & ~subR(8)); // tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = (u32)t & subL(8);  /* FL(kl1) */
-	t = (t << 32) | (subR(10) ^ ROL1(dw)); //tr = subR[10] ^ ROL1(dw);
-	SUBKEY(7) = sub[6] ^ t;   /* round 6 */
-	SUBKEY(8) = sub[8];       /* FL(kl1) */
-	SUBKEY(9) = sub[9];       /* FLinv(kl2) */
-	t = subL(7) ^ (subR(7) & ~subR(9));
-	dw = (u32)t & subL(9);  /* FLinv(kl2) */
-	t = (t << 32) | (subR(7) ^ ROL1(dw));
-	SUBKEY(10) = t ^ sub[11]; /* round 7 */
-	SUBKEY(11) = sub[10] ^ sub[12]; /* round 8 */
-	SUBKEY(12) = sub[11] ^ sub[13]; /* round 9 */
-	SUBKEY(13) = sub[12] ^ sub[14]; /* round 10 */
-	SUBKEY(14) = sub[13] ^ sub[15]; /* round 11 */
-	t = subL(18) ^ (subR(18) & ~subR(16));
-	dw = (u32)t & subL(16); /* FL(kl3) */
-	t = (t << 32) | (subR(18) ^ ROL1(dw));
-	SUBKEY(15) = sub[14] ^ t; /* round 12 */
-	SUBKEY(16) = sub[16];     /* FL(kl3) */
-	SUBKEY(17) = sub[17];     /* FLinv(kl4) */
-	t = subL(15) ^ (subR(15) & ~subR(17));
-	dw = (u32)t & subL(17); /* FLinv(kl4) */
-	t = (t << 32) | (subR(15) ^ ROL1(dw));
-	SUBKEY(18) = t ^ sub[19]; /* round 13 */
-	SUBKEY(19) = sub[18] ^ sub[20]; /* round 14 */
-	SUBKEY(20) = sub[19] ^ sub[21]; /* round 15 */
-	SUBKEY(21) = sub[20] ^ sub[22]; /* round 16 */
-	SUBKEY(22) = sub[21] ^ sub[23]; /* round 17 */
-	t = subL(26) ^ (subR(26) & ~subR(24));
-	dw = (u32)t & subL(24); /* FL(kl5) */
-	t = (t << 32) | (subR(26) ^ ROL1(dw));
-	SUBKEY(23) = sub[22] ^ t; /* round 18 */
-	SUBKEY(24) = sub[24];     /* FL(kl5) */
-	SUBKEY(25) = sub[25];     /* FLinv(kl6) */
-	t = subL(23) ^ (subR(23) & ~subR(25));
-	dw = (u32)t & subL(25); /* FLinv(kl6) */
-	t = (t << 32) | (subR(23) ^ ROL1(dw));
-	SUBKEY(26) = t ^ sub[27]; /* round 19 */
-	SUBKEY(27) = sub[26] ^ sub[28]; /* round 20 */
-	SUBKEY(28) = sub[27] ^ sub[29]; /* round 21 */
-	SUBKEY(29) = sub[28] ^ sub[30]; /* round 22 */
-	SUBKEY(30) = sub[29] ^ sub[31]; /* round 23 */
-	SUBKEY(31) = sub[30];     /* round 24 */
-	SUBKEY(32) = sub[32] ^ sub[31]; /* kw3 */
-
-	/* apply the inverse of the last half of P-function */
-	camellia_setup_tail(subkey, 32);
+	camellia_setup_tail(subkey, sub, 32);
 }
 
 static void camellia_setup192(const unsigned char *key, u64 *subkey)

@@ -967,10 +930,104 @@ typedef const u64 const_key_element;
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 
-static void camellia_setup_tail(u32 *subkey, int max)
+static void camellia_setup_tail(u32 *subkey, u32 *subL, u32 *subR, int max)
 {
-	u32 dw;
-	int i = 2;
+	u32 dw, tl, tr;
+	int i;
+
+	/* key XOR is end of F-function */
+	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
+	SUBKEY_R(0) = subR[0] ^ subR[2];
+	SUBKEY_L(2) = subL[3];       /* round 1 */
+	SUBKEY_R(2) = subR[3];
+	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
+	SUBKEY_R(3) = subR[2] ^ subR[4];
+	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
+	SUBKEY_R(4) = subR[3] ^ subR[5];
+	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
+	SUBKEY_R(5) = subR[4] ^ subR[6];
+	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
+	SUBKEY_R(6) = subR[5] ^ subR[7];
+	tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = tl & subL[8],  /* FL(kl1) */
+		tr = subR[10] ^ ROL1(dw);
+	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
+	SUBKEY_R(7) = subR[6] ^ tr;
+	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
+	SUBKEY_R(8) = subR[8];
+	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
+	SUBKEY_R(9) = subR[9];
+	tl = subL[7] ^ (subR[7] & ~subR[9]);
+	dw = tl & subL[9],  /* FLinv(kl2) */
+		tr = subR[7] ^ ROL1(dw);
+	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
+	SUBKEY_R(10) = tr ^ subR[11];
+	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
+	SUBKEY_R(11) = subR[10] ^ subR[12];
+	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
+	SUBKEY_R(12) = subR[11] ^ subR[13];
+	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
+	SUBKEY_R(13) = subR[12] ^ subR[14];
+	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
+	SUBKEY_R(14) = subR[13] ^ subR[15];
+	tl = subL[18] ^ (subR[18] & ~subR[16]);
+	dw = tl & subL[16], /* FL(kl3) */
+		tr = subR[18] ^ ROL1(dw);
+	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
+	SUBKEY_R(15) = subR[14] ^ tr;
+	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
+	SUBKEY_R(16) = subR[16];
+	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
+	SUBKEY_R(17) = subR[17];
+	tl = subL[15] ^ (subR[15] & ~subR[17]);
+	dw = tl & subL[17], /* FLinv(kl4) */
+		tr = subR[15] ^ ROL1(dw);
+	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
+	SUBKEY_R(18) = tr ^ subR[19];
+	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
+	SUBKEY_R(19) = subR[18] ^ subR[20];
+	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
+	SUBKEY_R(20) = subR[19] ^ subR[21];
+	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
+	SUBKEY_R(21) = subR[20] ^ subR[22];
+	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
+	SUBKEY_R(22) = subR[21] ^ subR[23];
+	if (max == 24) {
+		SUBKEY_L(23) = subL[22];     /* round 18 */
+		SUBKEY_R(23) = subR[22];
+		SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
+		SUBKEY_R(24) = subR[24] ^ subR[23];
+	} else {
+		tl = subL[26] ^ (subR[26] & ~subR[24]);
+		dw = tl & subL[24], /* FL(kl5) */
+			tr = subR[26] ^ ROL1(dw);
+		SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
+		SUBKEY_R(23) = subR[22] ^ tr;
+		SUBKEY_L(24) = subL[24];     /* FL(kl5) */
+		SUBKEY_R(24) = subR[24];
+		SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
+		SUBKEY_R(25) = subR[25];
+		tl = subL[23] ^ (subR[23] & ~subR[25]);
+		dw = tl & subL[25], /* FLinv(kl6) */
+			tr = subR[23] ^ ROL1(dw);
+		SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
+		SUBKEY_R(26) = tr ^ subR[27];
+		SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
+		SUBKEY_R(27) = subR[26] ^ subR[28];
+		SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
+		SUBKEY_R(28) = subR[27] ^ subR[29];
+		SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
+		SUBKEY_R(29) = subR[28] ^ subR[30];
+		SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
+		SUBKEY_R(30) = subR[29] ^ subR[31];
+		SUBKEY_L(31) = subL[30];     /* round 24 */
+		SUBKEY_R(31) = subR[30];
+		SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
+		SUBKEY_R(32) = subR[32] ^ subR[31];
+	}
+
+	/* apply the inverse of the last half of P-function */
+	i = 2;
 	do {
 		dw = SUBKEY_L(i + 0) ^ SUBKEY_R(i + 0); dw = ROL8(dw);/* round 1 */
 		SUBKEY_R(i + 0) = SUBKEY_L(i + 0) ^ dw; SUBKEY_L(i + 0) = dw;

@@ -992,21 +1049,19 @@ static void camellia_setup128(const unsi
 {
 	u32 kll, klr, krl, krr;
 	u32 il, ir, t0, t1, w0, w1;
-	u32 kw4l, kw4r, dw, tl, tr;
+	u32 kw4l, kw4r, dw;
 	u32 subL[26];
 	u32 subR[26];
 
 	/**
-	 *  k == kll || klr || krl || krr (|| is concatination)
+	 *  k == kll || klr || krl || krr (|| is concatenation)
 	 */
 	GETU32(kll, key     );
 	GETU32(klr, key +  4);
 	GETU32(krl, key +  8);
 	GETU32(krr, key + 12);
 
-	/**
-	 * generate KL dependent subkeys
-	 */
+	/* generate KL dependent subkeys */
 	/* kw1 */
 	subL[0] = kll; subR[0] = klr;
 	/* kw2 */

@@ -1151,70 +1206,7 @@ static void camellia_setup128(const unsi
 	/* kw1 */
 	subL[0] ^= kw4l; subR[0] ^= kw4r;
 
-	/* key XOR is end of F-function */
-	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
-	SUBKEY_R(0) = subR[0] ^ subR[2];
-	SUBKEY_L(2) = subL[3];       /* round 1 */
-	SUBKEY_R(2) = subR[3];
-	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
-	SUBKEY_R(3) = subR[2] ^ subR[4];
-	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
-	SUBKEY_R(4) = subR[3] ^ subR[5];
-	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
-	SUBKEY_R(5) = subR[4] ^ subR[6];
-	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
-	SUBKEY_R(6) = subR[5] ^ subR[7];
-	tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = tl & subL[8],  /* FL(kl1) */
-		tr = subR[10] ^ ROL1(dw);
-	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
-	SUBKEY_R(7) = subR[6] ^ tr;
-	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
-	SUBKEY_R(8) = subR[8];
-	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
-	SUBKEY_R(9) = subR[9];
-	tl = subL[7] ^ (subR[7] & ~subR[9]);
-	dw = tl & subL[9],  /* FLinv(kl2) */
-		tr = subR[7] ^ ROL1(dw);
-	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
-	SUBKEY_R(10) = tr ^ subR[11];
-	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
-	SUBKEY_R(11) = subR[10] ^ subR[12];
-	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
-	SUBKEY_R(12) = subR[11] ^ subR[13];
-	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
-	SUBKEY_R(13) = subR[12] ^ subR[14];
-	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
-	SUBKEY_R(14) = subR[13] ^ subR[15];
-	tl = subL[18] ^ (subR[18] & ~subR[16]);
-	dw = tl & subL[16], /* FL(kl3) */
-		tr = subR[18] ^ ROL1(dw);
-	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
-	SUBKEY_R(15) = subR[14] ^ tr;
-	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
-	SUBKEY_R(16) = subR[16];
-	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
-	SUBKEY_R(17) = subR[17];
-	tl = subL[15] ^ (subR[15] & ~subR[17]);
-	dw = tl & subL[17], /* FLinv(kl4) */
-		tr = subR[15] ^ ROL1(dw);
-	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
-	SUBKEY_R(18) = tr ^ subR[19];
-	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
-	SUBKEY_R(19) = subR[18] ^ subR[20];
-	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
-	SUBKEY_R(20) = subR[19] ^ subR[21];
-	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
-	SUBKEY_R(21) = subR[20] ^ subR[22];
-	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
-	SUBKEY_R(22) = subR[21] ^ subR[23];
-	SUBKEY_L(23) = subL[22];     /* round 18 */
-	SUBKEY_R(23) = subR[22];
-	SUBKEY_L(24) = subL[24] ^ subL[23]; /* kw3 */
-	SUBKEY_R(24) = subR[24] ^ subR[23];
-
-	/* apply the inverse of the last half of P-function */
-	camellia_setup_tail(subkey, 24);
+	camellia_setup_tail(subkey, subL, subR, 24);
 }
 
 static void camellia_setup256(const unsigned char *key, u32 *subkey)

@@ -1222,13 +1214,13 @@ static void camellia_setup256(const unsi
 	u32 kll, klr, krl, krr;        /* left half of key */
 	u32 krll, krlr, krrl, krrr;    /* right half of key */
 	u32 il, ir, t0, t1, w0, w1;    /* temporary variables */
-	u32 kw4l, kw4r, dw, tl, tr;
+	u32 kw4l, kw4r, dw;
 	u32 subL[34];
 	u32 subR[34];
 
 	/**
 	 *  key = (kll || klr || krl || krr || krll || krlr || krrl || krrr)
-	 *  (|| is concatination)
+	 *  (|| is concatenation)
 	 */
 	GETU32(kll,  key     );
 	GETU32(klr,  key +  4);

@@ -1439,92 +1431,7 @@ static void camellia_setup256(const unsi
 	/* kw1 */
 	subL[0] ^= kw4l; subR[0] ^= kw4r;
 
-	/* key XOR is end of F-function */
-	SUBKEY_L(0) = subL[0] ^ subL[2];/* kw1 */
-	SUBKEY_R(0) = subR[0] ^ subR[2];
-	SUBKEY_L(2) = subL[3];       /* round 1 */
-	SUBKEY_R(2) = subR[3];
-	SUBKEY_L(3) = subL[2] ^ subL[4]; /* round 2 */
-	SUBKEY_R(3) = subR[2] ^ subR[4];
-	SUBKEY_L(4) = subL[3] ^ subL[5]; /* round 3 */
-	SUBKEY_R(4) = subR[3] ^ subR[5];
-	SUBKEY_L(5) = subL[4] ^ subL[6]; /* round 4 */
-	SUBKEY_R(5) = subR[4] ^ subR[6];
-	SUBKEY_L(6) = subL[5] ^ subL[7]; /* round 5 */
-	SUBKEY_R(6) = subR[5] ^ subR[7];
-	tl = subL[10] ^ (subR[10] & ~subR[8]);
-	dw = tl & subL[8],  /* FL(kl1) */
-		tr = subR[10] ^ ROL1(dw);
-	SUBKEY_L(7) = subL[6] ^ tl; /* round 6 */
-	SUBKEY_R(7) = subR[6] ^ tr;
-	SUBKEY_L(8) = subL[8];       /* FL(kl1) */
-	SUBKEY_R(8) = subR[8];
-	SUBKEY_L(9) = subL[9];       /* FLinv(kl2) */
-	SUBKEY_R(9) = subR[9];
-	tl = subL[7] ^ (subR[7] & ~subR[9]);
-	dw = tl & subL[9],  /* FLinv(kl2) */
-		tr = subR[7] ^ ROL1(dw);
-	SUBKEY_L(10) = tl ^ subL[11]; /* round 7 */
-	SUBKEY_R(10) = tr ^ subR[11];
-	SUBKEY_L(11) = subL[10] ^ subL[12]; /* round 8 */
-	SUBKEY_R(11) = subR[10] ^ subR[12];
-	SUBKEY_L(12) = subL[11] ^ subL[13]; /* round 9 */
-	SUBKEY_R(12) = subR[11] ^ subR[13];
-	SUBKEY_L(13) = subL[12] ^ subL[14]; /* round 10 */
-	SUBKEY_R(13) = subR[12] ^ subR[14];
-	SUBKEY_L(14) = subL[13] ^ subL[15]; /* round 11 */
-	SUBKEY_R(14) = subR[13] ^ subR[15];
-	tl = subL[18] ^ (subR[18] & ~subR[16]);
-	dw = tl & subL[16], /* FL(kl3) */
-		tr = subR[18] ^ ROL1(dw);
-	SUBKEY_L(15) = subL[14] ^ tl; /* round 12 */
-	SUBKEY_R(15) = subR[14] ^ tr;
-	SUBKEY_L(16) = subL[16];     /* FL(kl3) */
-	SUBKEY_R(16) = subR[16];
-	SUBKEY_L(17) = subL[17];     /* FLinv(kl4) */
-	SUBKEY_R(17) = subR[17];
-	tl = subL[15] ^ (subR[15] & ~subR[17]);
-	dw = tl & subL[17], /* FLinv(kl4) */
-		tr = subR[15] ^ ROL1(dw);
-	SUBKEY_L(18) = tl ^ subL[19]; /* round 13 */
-	SUBKEY_R(18) = tr ^ subR[19];
-	SUBKEY_L(19) = subL[18] ^ subL[20]; /* round 14 */
-	SUBKEY_R(19) = subR[18] ^ subR[20];
-	SUBKEY_L(20) = subL[19] ^ subL[21]; /* round 15 */
-	SUBKEY_R(20) = subR[19] ^ subR[21];
-	SUBKEY_L(21) = subL[20] ^ subL[22]; /* round 16 */
-	SUBKEY_R(21) = subR[20] ^ subR[22];
-	SUBKEY_L(22) = subL[21] ^ subL[23]; /* round 17 */
-	SUBKEY_R(22) = subR[21] ^ subR[23];
-	tl = subL[26] ^ (subR[26] & ~subR[24]);
-	dw = tl & subL[24], /* FL(kl5) */
-		tr = subR[26] ^ ROL1(dw);
-	SUBKEY_L(23) = subL[22] ^ tl; /* round 18 */
-	SUBKEY_R(23) = subR[22] ^ tr;
-	SUBKEY_L(24) = subL[24];     /* FL(kl5) */
-	SUBKEY_R(24) = subR[24];
-	SUBKEY_L(25) = subL[25];     /* FLinv(kl6) */
-	SUBKEY_R(25) = subR[25];
-	tl = subL[23] ^ (subR[23] & ~subR[25]);
-	dw = tl & subL[25], /* FLinv(kl6) */
-		tr = subR[23] ^ ROL1(dw);
-	SUBKEY_L(26) = tl ^ subL[27]; /* round 19 */
-	SUBKEY_R(26) = tr ^ subR[27];
-	SUBKEY_L(27) = subL[26] ^ subL[28]; /* round 20 */
-	SUBKEY_R(27) = subR[26] ^ subR[28];
-	SUBKEY_L(28) = subL[27] ^ subL[29]; /* round 21 */
-	SUBKEY_R(28) = subR[27] ^ subR[29];
-	SUBKEY_L(29) = subL[28] ^ subL[30]; /* round 22 */
-	SUBKEY_R(29) = subR[28] ^ subR[30];
-	SUBKEY_L(30) = subL[29] ^ subL[31]; /* round 23 */
-	SUBKEY_R(30) = subR[29] ^ subR[31];
-	SUBKEY_L(31) = subL[30];     /* round 24 */
-	SUBKEY_R(31) = subR[30];
-	SUBKEY_L(32) = subL[32] ^ subL[31]; /* kw3 */
-	SUBKEY_R(32) = subR[32] ^ subR[31];
-
-	/* apply the inverse of the last half of P-function */
-	camellia_setup_tail(subkey, 32);
+	camellia_setup_tail(subkey, subL, subR, 32);
 }
 
 static void camellia_setup192(const unsigned char *key, u32 *subkey)
Acked-by
#32 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Hi,

Quoted 25 lines
Quoted 10 lines

Sun, 18 Nov 2007 20:30:16 -0800
[Subject: Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization] Denys Vlasenko <[email protected]> wrote...

Quoted 6 lines

camellia6:
unifies encrypt/decrypt routines for different key lengths. This reduces module size by ~25%, with tiny (less than 1%) speed impact.
Also collapses encrypt/decrypt into more readable (visually shorter) form using macros.

And here is

camellia7:
Move "key XOR is end of F-function" code part into camellia_setup_tail(), it is sufficiently similar between camellia_setup128 and camellia_setup256. This shaves off another ~1k:
dec hex filename
21414 53a6 2.6.23.1.camellia6.t/crypto/camellia.o
20518 5026 2.6.23.1.camellia7.t/crypto/camellia.o
16355 3fe3 2.6.23.1.camellia6.t64/crypto/camellia.o
15813 3dc5 2.6.23.1.camellia7.t64/crypto/camellia.o

Quoted 3 lines

At the moment I cannot run test it, try to do it ASAP.

Takamiya-san, can you review attached patch please?

Sorry for late reply.

I think you're testing now:-), and if speed impact is less than 1% as you say, I think it is acceptable.

The smaller code size is, the easier to enable camellia in the embedded systems.

Regards,

Acked-by Noriaki TAKAMIYA <[email protected]>

--
Noriaki TAKAMIYA

author
#33 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Hi Herbert, Noriaki,

Quoted 21 lines · Noriaki TAKAMIYA
Quoted 21 lines
Quoted 6 lines
Quoted 6 lines

camellia6:
unifies encrypt/decrypt routines for different key lengths. This reduces module size by ~25%, with tiny (less than 1%) speed impact.
Also collapses encrypt/decrypt into more readable (visually shorter) form using macros.

And here is

camellia7:
Move "key XOR is end of F-function" code part into camellia_setup_tail(), it is sufficiently similar between camellia_setup128 and camellia_setup256. This shaves off another ~1k:
dec hex filename
21414 53a6 2.6.23.1.camellia6.t/crypto/camellia.o
20518 5026 2.6.23.1.camellia7.t/crypto/camellia.o
16355 3fe3 2.6.23.1.camellia6.t64/crypto/camellia.o
15813 3dc5 2.6.23.1.camellia7.t64/crypto/camellia.o

Quoted 8 lines
Quoted 3 lines

At the moment I cannot run test it, try to do it ASAP.

Takamiya-san, can you review attached patch please?

Sorry for late reply.

I think you're testing now:-), and if speed impact is less than 1% as you say, I think it is acceptable.

Actaually I tested it only now. Explored wonders of ubuntu package management. Why it doesn't rebuild module when I do "touch camellia.c" and then run their magic stuff? I suspected that these .deb, .rpm, .whatever are evil, but it changed today. Now I *know* that. ;)

Back to patches.

It turns out that two more key setup stages can be easily folded into common "tail". Attached patches do this.

I'm also attaching all previous patches not yet ACKed by Herbert (patches 5,6,7).

camellia8:
Analogously to camellia7 patch, move
"absorb kw2 to other subkeys" and "absorb kw4 to other subkeys" code parts into camellia_setup_tail(). This further reduces source and object code size at the cost of two brances in key setup code.

Code sizes (starting from the state with pathces 1-4 already applied):
64-bit:

dec      hex   filename
22786    5902  2.6.23.1.camellia4.t64/crypto/camellia.o
21422    53ae  2.6.23.1.camellia5.t64/crypto/camellia.o
16355    3fe3  2.6.23.1.camellia6.t64/crypto/camellia.o
15813    3dc5  2.6.23.1.camellia7.t64/crypto/camellia.o
15670    3d36  2.6.23.1.camellia8.t64/crypto/camellia.o
32-bit:
29948    74fc  2.6.23.1.camellia4.t/crypto/camellia.o
29457    7311  2.6.23.1.camellia5.t/crypto/camellia.o
21414    53a6  2.6.23.1.camellia6.t/crypto/camellia.o
20518    5026  2.6.23.1.camellia7.t/crypto/camellia.o
18454    4816  2.6.23.1.camellia8.t/crypto/camellia.o

Code is compile-tested for 32/64-bit x86 and run tested on 32-bit (tcrypt tests all pass).

Herbert, please let me know what you think about them.

Signed-off-by Denys Vlasenko <[email protected]>
Signature · 1 line
vda
crypto/camellia.c +722 -138
diff -urpN linux-2.6.23.1.camellia/crypto/camellia.c linux-2.6.23.1.camellia5/crypto/camellia.c
@@ -310,6 +310,589 @@ static const u32 camellia_sp4404[256] = 
 #define CAMELLIA_BLOCK_SIZE          16
 #define CAMELLIA_TABLE_BYTE_LEN     272
 
+/*
+ * NB: L and R below stand for 'left' and 'right' as in written numbers.
+ * That is, in (xxxL,xxxR) pair xxxL holds most significant digits,
+ * _not_ least significant ones!
+ */
+
+
+
+#if BITS_PER_LONG >= 64
+
+/*
+ * Key setup implementation with mostly 64-bit ops
+ */
+
+/* key constants */
+
+#define CAMELLIA_SIGMA1 (0xA09E667F3BCC908B)
+#define CAMELLIA_SIGMA2 (0xB67AE8584CAA73B2)
+#define CAMELLIA_SIGMA3 (0xC6EF372FE94F82BE)
+#define CAMELLIA_SIGMA4 (0x54FF53A5F1D36F1C)
+#define CAMELLIA_SIGMA5 (0x10E527FADE682D1D)
+#define CAMELLIA_SIGMA6 (0xB05688C2B3E6C1FD)
+
+/*
+ *  macros
+ */
+#define GETU64(v, pt) \
+    do { \
+	/* latest breed of gcc is clever enough to use move */ \
+	memcpy(&(v), (pt), 8); \
+	(v) = be64_to_cpu(v); \
+    } while(0)
+
+/* rotation right shift 1byte */
+#define ROR8(x) (((x) >> 8) + ((x) << (sizeof(x)*8 - 8)))
+/* rotation left shift 1bit */
+#define ROL1(x) (((x) << 1) + ((x) >> (sizeof(x)*8 - 1)))
+/* rotation left shift 1byte */
+#define ROL8(x) (((x) << 8) + ((x) >> (sizeof(x)*8 - 8)))
+
+#define ROLDQ(l, r, w, bits)				\
+    do {						\
+	w = l;						\
+	l = (l << bits) + (r >> (64 - bits));		\
+	r = (r << bits) + (w >> (64 - bits));		\
+    } while(0)
+
+#define CAMELLIA_F(x, k, y, i)					\
+    do {							\
+	u32 yl, yr;						\
+	i = x ^ k;						\
+	yl = camellia_sp1110[(u8)i]				\
+	   ^ camellia_sp0222[(u8)(i >> 24)]			\
+	   ^ camellia_sp3033[(u8)(i >> 16)]			\
+	   ^ camellia_sp4404[(u8)(i >> 8)];			\
+	yr = camellia_sp1110[    (i >> 56)]			\
+	   ^ camellia_sp0222[(u8)(i >> 48)]			\
+	   ^ camellia_sp3033[(u8)(i >> 40)]			\
+	   ^ camellia_sp4404[(u8)(i >> 32)];			\
+	yl ^= yr;						\
+	yr = ROR8(yr);						\
+	yr ^= yl;						\
+	y = ((u64)yl << 32) + yr;				\
+    } while(0)
+
+#define SUBKEY(INDEX) (subkey[(INDEX)])
+
+#ifdef __BIG_ENDIAN
+#define SUBKEY_L(INDEX) (((u32*)subkey)[(INDEX)*2])
+#define SUBKEY_R(INDEX) (((u32*)subkey)[(INDEX)*2 + 1])
+#else
+#define SUBKEY_L(INDEX) (((u32*)subkey)[(INDEX)*2 + 1])
+#define SUBKEY_R(INDEX) (((u32*)subkey)[(INDEX)*2])
+#endif
+
+static void camellia_setup_tail(u64 *subkey, int max)
+{
+	u32 dw;
+	int i = 2;
+	do {
+		dw = SUBKEY_L(i + 0) ^ SUBKEY_R(i + 0); dw = ROL8(dw);/* round 1 */
+		SUBKEY_R(i + 0) = SUBKEY_L(i + 0) ^ dw; SUBKEY_L(i + 0) = dw;
+		dw = SUBKEY_L(i + 1) ^ SUBKEY_R(i + 1); dw = ROL8(dw);/* round 2 */
+		SUBKEY_R(i + 1) = SUBKEY_L(i + 1) ^ dw; SUBKEY_L(i + 1) = dw;
+		dw = SUBKEY_L(i + 2) ^ SUBKEY_R(i + 2); dw = ROL8(dw);/* round 3 */
+		SUBKEY_R(i + 2) = SUBKEY_L(i + 2) ^ dw; SUBKEY_L(i + 2) = dw;
+		dw = SUBKEY_L(i + 3) ^ SUBKEY_R(i + 3); dw = ROL8(dw);/* round 4 */
+		SUBKEY_R(i + 3) = SUBKEY_L(i + 3) ^ dw; SUBKEY_L(i + 3) = dw;
+		dw = SUBKEY_L(i + 4) ^ SUBKEY_R(i + 4); dw = ROL8(dw);/* round 5 */
+		SUBKEY_R(i + 4) = SUBKEY_L(i + 4) ^ dw; SUBKEY_L(i + 4) = dw;
+		dw = SUBKEY_L(i + 5) ^ SUBKEY_R(i + 5); dw = ROL8(dw);/* round 6 */
+		SUBKEY_R(i + 5) = SUBKEY_L(i + 5) ^ dw; SUBKEY_L(i + 5) = dw;
+		i += 8;
+	} while (i < max);
+}
+
+#ifdef __BIG_ENDIAN
+#define subL(INDEX) (((u32*)sub)[(INDEX)*2])
+#define subR(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
+#else
+#define subL(INDEX) (((u32*)sub)[(INDEX)*2 + 1])
+#define subR(INDEX) (((u32*)sub)[(INDEX)*2])
+#endif
+
+static void camellia_setup128(const unsigned char *key, u64 *subkey)
+{
+	u64 kl, kr;
+	u64 i, t, w;
+	u64 kw4;
+	u32 dw;
+	u64 sub[26];
+
+	/**
+	 *  k == kl || kr (|| is concatination)
+	 */
+	GETU64(kl, key     );
+	GETU64(kr, key +  8);
+
+	/**
+	 * generate KL dependent subkeys
+	 */
+	/* kw1 */
+	sub[0] = kl;
+	/* kw2 */
+	sub[1] = kr;
+	/* rotation left shift 15bit */
+	ROLDQ(kl, kr, w, 15);
+	/* k3 */
+	sub[4] = kl;
+	/* k4 */
+	sub[5] = kr;
+	/* rotation left shift 15+30bit */
+	ROLDQ(kl, kr, w, 30);
+	/* k7 */
+	sub[10] = kl;
+	/* k8 */
+	sub[11] = kr;
+	/* rotation left shift 15+30+15bit */
+	ROLDQ(kl, kr, w, 15);
+	/* k10 */
+	sub[13] = kr;
+	/* rotation left shift 15+30+15+17 bit */
+	ROLDQ(kl, kr, w, 17);
+	/* kl3 */
+	sub[16] = kl;
+	/* kl4 */
+	sub[17] = kr;
+	/* rotation left shift 15+30+15+17+17 bit */
+	ROLDQ(kl, kr, w, 17);
+	/* k13 */
+	sub[18] = kl;
+	/* k14 */
+	sub[19] = kr;
+	/* rotation left shift 15+30+15+17+17+17 bit */
+	ROLDQ(kl, kr, w, 17);
+	/* k17 */
+	sub[22] = kl;
+	/* k18 */
+	sub[23] = kr;
+
+	/* generate KA */
+	kl = sub[0];
+	kr = sub[1];
+	CAMELLIA_F(kl, CAMELLIA_SIGMA1, w, i);
+	kr ^= w;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA2, kl, i);
+	/* current status == (kl, w) */
+	CAMELLIA_F(kl, CAMELLIA_SIGMA3, kr, i);
+	kr ^= w;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA4, w, i);
+	kl ^= w;
+
+	/* generate KA dependent subkeys */
+	/* k1, k2 */
+	sub[2] = kl;
+	sub[3] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* k5,k6 */
+	sub[6] = kl;
+	sub[7] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* kl1, kl2 */
+	sub[8] = kl;
+	sub[9] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* k9 */
+	sub[12] = kl;
+	ROLDQ(kl, kr, w, 15);
+	/* k11, k12 */
+	sub[14] = kl;
+	sub[15] = kr;
+	ROLDQ(kl, kr, w, 34);
+	/* k15, k16 */
+	sub[20] = kl;
+	sub[21] = kr;
+	ROLDQ(kl, kr, w, 17);
+	/* kw3, kw4 */
+	sub[24] = kl;
+	sub[25] = kr;
+
+	/* absorb kw2 to other subkeys */
+	/* round 2 */
+	sub[3] ^= sub[1];
+	/* round 4 */
+	sub[5] ^= sub[1];
+	/* round 6 */
+	sub[7] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(9);
+	dw = subL(1) & subL(9),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl2) */
+	/* round 8 */
+	sub[11] ^= sub[1];
+	/* round 10 */
+	sub[13] ^= sub[1];
+	/* round 12 */
+	sub[15] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(17);
+	dw = subL(1) & subL(17),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl4) */
+	/* round 14 */
+	sub[19] ^= sub[1];
+	/* round 16 */
+	sub[21] ^= sub[1];
+	/* round 18 */
+	sub[23] ^= sub[1];
+	/* kw3 */
+	sub[24] ^= sub[1];
+
+	/* absorb kw4 to other subkeys */
+	kw4 = sub[25];
+	/* round 17 */
+	sub[22] ^= kw4;
+	/* round 15 */
+	sub[20] ^= kw4;
+	/* round 13 */
+	sub[18] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(16)) << 32; //kw4l ^= kw4r & ~subR(16);
+	dw = (u32)(kw4 >> 32) & subL(16); // kw4l & subL[16],
+	kw4 ^= ROL1(dw); /* modified for FL(kl3) */
+	/* round 11 */
+	sub[14] ^= kw4;
+	/* round 9 */
+	sub[12] ^= kw4;
+	/* round 7 */
+	sub[10] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(8)) << 32; //kw4l ^= kw4r & ~subR[8];
+	dw = (u32)(kw4 >> 32) & subL(8);
+	kw4 ^= ROL1(dw); /* modified for FL(kl1) */
+	/* round 5 */
+	sub[6] ^= kw4;
+	/* round 3 */
+	sub[4] ^= kw4;
+	/* round 1 */
+	sub[2] ^= kw4;
+	/* kw1 */
+	sub[0] ^= kw4;
+
+	/* key XOR is end of F-function */
+	SUBKEY(0) = sub[0] ^ sub[2];/* kw1 */
+	SUBKEY(2) = sub[3];       /* round 1 */
+	SUBKEY(3) = sub[2] ^ sub[4]; /* round 2 */
+	SUBKEY(4) = sub[3] ^ sub[5]; /* round 3 */
+	SUBKEY(5) = sub[4] ^ sub[6]; /* round 4 */
+	SUBKEY(6) = sub[5] ^ sub[7]; /* round 5 */
+	t = subL(10) ^ (subR(10) & ~subR(8)); // tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = (u32)t & subL(8);  /* FL(kl1) */
+	t = (t << 32) | (subR(10) ^ ROL1(dw)); // tr = subR[10] ^ ROL1(dw);
+	SUBKEY(7) = sub[6] ^ t; /* round 6 */
+	SUBKEY(8) = sub[8];       /* FL(kl1) */
+	SUBKEY(9) = sub[9];       /* FLinv(kl2) */
+	t = subL(7) ^ (subR(7) & ~subR(9));
+	dw = (u32)t & subL(9);  /* FLinv(kl2) */
+	t = (t << 32) | (subR(7) ^ ROL1(dw));
+	SUBKEY(10) = t ^ sub[11]; /* round 7 */
+	SUBKEY(11) = sub[10] ^ sub[12]; /* round 8 */
+	SUBKEY(12) = sub[11] ^ sub[13]; /* round 9 */
+	SUBKEY(13) = sub[12] ^ sub[14]; /* round 10 */
+	SUBKEY(14) = sub[13] ^ sub[15]; /* round 11 */
+	t = subL(18) ^ (subR(18) & ~subR(16));
+	dw = (u32)t & subL(16); /* FL(kl3) */
+	t = (t << 32) | (subR(18) ^ ROL1(dw));
+	SUBKEY(15) = sub[14] ^ t; /* round 12 */
+	SUBKEY(16) = sub[16];     /* FL(kl3) */
+	SUBKEY(17) = sub[17];     /* FLinv(kl4) */
+	t = subL(15) ^ (subR(15) & ~subR(17));
+	dw = (u32)t & subL(17); /* FLinv(kl4) */
+	t = (t << 32) | (subR(15) ^ ROL1(dw));
+	SUBKEY(18) = t ^ sub[19]; /* round 13 */
+	SUBKEY(19) = sub[18] ^ sub[20]; /* round 14 */
+	SUBKEY(20) = sub[19] ^ sub[21]; /* round 15 */
+	SUBKEY(21) = sub[20] ^ sub[22]; /* round 16 */
+	SUBKEY(22) = sub[21] ^ sub[23]; /* round 17 */
+	SUBKEY(23) = sub[22];     /* round 18 */
+	SUBKEY(24) = sub[24] ^ sub[23]; /* kw3 */
+
+	/* apply the inverse of the last half of P-function */
+	camellia_setup_tail(subkey, 24);
+}
+
+static void camellia_setup256(const unsigned char *key, u64 *subkey)
+{
+	u64 kl, kr;        /* left half of key */
+	u64 krl, krr;      /* right half of key */
+	u64 i, t, w;       /* temporary variables */
+	u64 kw4;
+	u32 dw;
+	u64 sub[34];
+
+	/**
+	 *  key = (kl || kr || krl || krr)
+	 *  (|| is concatination)
+	 */
+	GETU64(kl,  key     );
+	GETU64(kr,  key +  8);
+	GETU64(krl, key + 16);
+	GETU64(krr, key + 24);
+
+	/* generate KL dependent subkeys */
+	/* kw1 */
+	sub[0] = kl;
+	/* kw2 */
+	sub[1] = kr;
+	ROLDQ(kl, kr, w, 45);
+	/* k9 */
+	sub[12] = kl;
+	/* k10 */
+	sub[13] = kr;
+	ROLDQ(kl, kr, w, 15);
+	/* kl3 */
+	sub[16] = kl;
+	/* kl4 */
+	sub[17] = kr;
+	ROLDQ(kl, kr, w, 17);
+	/* k17 */
+	sub[22] = kl;
+	/* k18 */
+	sub[23] = kr;
+	ROLDQ(kl, kr, w, 34);
+	/* k23 */
+	sub[30] = kl;
+	/* k24 */
+	sub[31] = kr;
+
+	/* generate KR dependent subkeys */
+	ROLDQ(krl, krr, w, 15);
+	/* k3 */
+	sub[4] = krl;
+	/* k4 */
+	sub[5] = krr;
+	ROLDQ(krl, krr, w, 15);
+	/* kl1 */
+	sub[8] = krl;
+	/* kl2 */
+	sub[9] = krr;
+	ROLDQ(krl, krr, w, 30);
+	/* k13 */
+	sub[18] = krl;
+	/* k14 */
+	sub[19] = krr;
+	ROLDQ(krl, krr, w, 34);
+	/* k19 */
+	sub[26] = krl;
+	/* k20 */
+	sub[27] = krr;
+	ROLDQ(krl, krr, w, 34);
+
+	/* generate KA */
+	kl = sub[0] ^ krl;
+	kr = sub[1] ^ krr;
+	CAMELLIA_F(kl, CAMELLIA_SIGMA1, w, i);
+	kr ^= w;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA2, kl, i);
+	kl ^= krl;
+	CAMELLIA_F(kl, CAMELLIA_SIGMA3, kr, i);
+	kr ^= w ^ krr;
+	CAMELLIA_F(kr, CAMELLIA_SIGMA4, w, i);
+	kl ^= w;
+
+	/* generate KB */
+	krl ^= kl;
+	krr ^= kr;
+	CAMELLIA_F(krl, CAMELLIA_SIGMA5, w, i);
+	krr ^= w;
+	CAMELLIA_F(krr, CAMELLIA_SIGMA6, w, i);
+	krl ^= w;
+
+	/* generate KA dependent subkeys */
+	ROLDQ(kl, kr, w, 15);
+	/* k5 */
+	sub[6] = kl;
+	/* k6 */
+	sub[7] = kr;
+	ROLDQ(kl, kr, w, 30);
+	/* k11 */
+	sub[14] = kl;
+	/* k12 */
+	sub[15] = kr;
+	/* kl5 */
+	ROLDQ(kl, kr, w, 32);
+	sub[24] = kl;
+	/* kl6 */
+	sub[25] = kr;
+	/* rotation left shift 49 from k11,k12 -> k21,k22 */
+	ROLDQ(kl, kr, w, (49 - 32));
+	/* k21 */
+	sub[28] = kl;
+	/* k22 */
+	sub[29] = kr;
+
+	/* generate KB dependent subkeys */
+	/* k1 */
+	sub[2] = krl;
+	/* k2 */
+	sub[3] = krr;
+	ROLDQ(krl, krr, w, 30);
+	/* k7 */
+	sub[10] = krl;
+	/* k8 */
+	sub[11] = krr;
+	ROLDQ(krl, krr, w, 30);
+	/* k15 */
+	sub[20] = krl;
+	/* k16 */
+	sub[21] = krr;
+	ROLDQ(krl, krr, w, 51);
+	/* kw3 */
+	sub[32] = krl;
+	/* kw4 */
+	sub[33] = krr;
+
+	/* absorb kw2 to other subkeys */
+	/* round 2 */
+	sub[3] ^= sub[1];
+	/* round 4 */
+	sub[5] ^= sub[1];
+	/* round 6 */
+	sub[7] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(9);
+	dw = subL(1) & subL(9),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl2) */
+	/* round 8 */
+	sub[11] ^= sub[1];
+	/* round 10 */
+	sub[13] ^= sub[1];
+	/* round 12 */
+	sub[15] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(17);
+	dw = subL(1) & subL(17),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl4) */
+	/* round 14 */
+	sub[19] ^= sub[1];
+	/* round 16 */
+	sub[21] ^= sub[1];
+	/* round 18 */
+	sub[23] ^= sub[1];
+	subL(1) ^= subR(1) & ~subR(25);
+	dw = subL(1) & subL(25),
+		subR(1) ^= ROL1(dw); /* modified for FLinv(kl6) */
+	/* round 20 */
+	sub[27] ^= sub[1];
+	/* round 22 */
+	sub[29] ^= sub[1];
+	/* round 24 */
+	sub[31] ^= sub[1];
+	/* kw3 */
+	sub[32] ^= sub[1];
+
+	/* absorb kw4 to other subkeys */
+	kw4 = sub[33];
+	/* round 23 */
+	sub[30] ^= kw4;
+	/* round 21 */
+	sub[28] ^= kw4;
+	/* round 19 */
+	sub[26] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(24)) << 32; //kw4l ^= kw4r & ~subR[24];
+	dw = (u32)(kw4 >> 32) & subL(24),
+		kw4 ^= ROL1(dw); /* modified for FL(kl5) */
+	/* round 17 */
+	sub[22] ^= kw4;
+	/* round 15 */
+	sub[20] ^= kw4;
+	/* round 13 */
+	sub[18] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(16)) << 32;
+	dw = (u32)(kw4 >> 32) & subL(16),
+		kw4 ^= ROL1(dw); /* modified for FL(kl3) */
+	/* round 11 */
+	sub[14] ^= kw4;
+	/* round 9 */
+	sub[12] ^= kw4;
+	/* round 7 */
+	sub[10] ^= kw4;
+	kw4 ^= (u64)((u32)kw4 & ~subR(8)) << 32;
+	dw = (u32)(kw4 >> 32) & subL(8),
+		kw4 ^= ROL1(dw); /* modified for FL(kl1) */
+	/* round 5 */
+	sub[6] ^= kw4;
+	/* round 3 */
+	sub[4] ^= kw4;
+	/* round 1 */
+	sub[2] ^= kw4;
+	/* kw1 */
+	sub[0] ^= kw4;
+
+	/* key XOR is end of F-function */
+	SUBKEY(0) = sub[0] ^ sub[2];/* kw1 */
+	SUBKEY(2) = sub[3];       /* round 1 */
+	SUBKEY(3) = sub[2] ^ sub[4]; /* round 2 */
+	SUBKEY(4) = sub[3] ^ sub[5]; /* round 3 */
+	SUBKEY(5) = sub[4] ^ sub[6]; /* round 4 */
+	SUBKEY(6) = sub[5] ^ sub[7]; /* round 5 */
+	t = subL(10) ^ (subR(10) & ~subR(8)); // tl = subL[10] ^ (subR[10] & ~subR[8]);
+	dw = (u32)t & subL(8);  /* FL(kl1) */
+	t = (t << 32) | (subR(10) ^ ROL1(dw)); //tr = subR[10] ^ ROL1(dw);
+	SUBKEY(7) = sub[6] ^ t;   /* round 6 */
+	SUBKEY(8) = sub[8];       /* FL(kl1) */
+	SUBKEY(9) = sub[9];       /* FLinv(kl2) */
+	t = subL(7) ^ (subR(7) & ~subR(9));
+	dw = (u32)t & subL(9);  /* FLinv(kl2) */
+	t = (t << 32) | (subR(7) ^ ROL1(dw));
+	SUBKEY(10) = t ^ sub[11]; /* round 7 */
+	SUBKEY(11) = sub[10] ^ sub[12]; /* round 8 */
+	SUBKEY(12) = sub[11] ^ sub[13]; /* round 9 */
+	SUBKEY(13) = sub[12] ^ sub[14]; /* round 10 */
+	SUBKEY(14) = sub[13] ^ sub[15]; /* round 11 */
+	t = subL(18) ^ (subR(18) & ~subR(16));
+	dw = (u32)t & subL(16); /* FL(kl3) */
+	t = (t << 32) | (subR(18) ^ ROL1(dw));
+	SUBKEY(15) = sub[14] ^ t; /* round 12 */
+	SUBKEY(16) = sub[16];     /* FL(kl3) */
+	SUBKEY(17) = sub[17];     /* FLinv(kl4) */
+	t = subL(15) ^ (subR(15) & ~subR(17));
+	dw = (u32)t & subL(17); /* FLinv(kl4) */
+	t = (t << 32) | (subR(15) ^ ROL1(dw));
+	SUBKEY(18) = t ^ sub[19]; /* round 13 */
+	SUBKEY(19) = sub[18] ^ sub[20]; /* round 14 */
+	SUBKEY(20) = sub[19] ^ sub[21]; /* round 15 */
+	SUBKEY(21) = sub[20] ^ sub[22]; /* round 16 */
+	SUBKEY(22) = sub[21] ^ sub[23]; /* round 17 */
+	t = subL(26) ^ (subR(26) & ~subR(24));
+	dw = (u32)t & subL(24); /* FL(kl5) */
+	t = (t << 32) | (subR(26) ^ ROL1(dw));
+	SUBKEY(23) = sub[22] ^ t; /* round 18 */
+	SUBKEY(24) = sub[24];     /* FL(kl5) */
+	SUBKEY(25) = sub[25];     /* FLinv(kl6) */
+	t = subL(23) ^ (subR(23) & ~subR(25));
+	dw = (u32)t & subL(25); /* FLinv(kl6) */
+	t = (t << 32) | (subR(23) ^ ROL1(dw));
+	SUBKEY(26) = t ^ sub[27]; /* round 19 */
+	SUBKEY(27) = sub[26] ^ sub[28]; /* round 20 */
+	SUBKEY(28) = sub[27] ^ sub[29]; /* round 21 */
+	SUBKEY(29) = sub[28] ^ sub[30]; /* round 22 */
+	SUBKEY(30) = sub[29] ^ sub[31]; /* round 23 */
+	SUBKEY(31) = sub[30];     /* round 24 */
+	SUBKEY(32) = sub[32] ^ sub[31]; /* kw3 */
+
+	/* apply the inverse of the last half of P-function */
+	camellia_setup_tail(subkey, 32);
+}
+
+static void camellia_setup192(const unsigned char *key, u64 *subkey)
+{
+	unsigned char kk[32];
+	u64 krl, krr;
+
+	memcpy(kk, key, 24);
+	memcpy((unsigned char *)&krl, key+16, 8);
+	krr = ~krl;
+	memcpy(kk+24, (unsigned char *)&krr, 8);
+	camellia_setup256(kk, subkey);
+}
+
+typedef u64 key_element;
+typedef const u64 const_key_element;
+
+
+
+#else /* BITS_PER_LONG < 64 */
+
+/*
+ * Key setup implementation with 32-bit ops
+ */
 
 /* key constants */
 

@@ -329,8 +912,7 @@ static const u32 camellia_sp4404[256] = 
 /*
  *  macros
  */
-
-# define GETU32(v, pt) \
+#define GETU32(v, pt) \
     do { \
 	/* latest breed of gcc is clever enough to use move */ \
 	memcpy(&(v), (pt), 4); \

@@ -363,64 +945,25 @@ static const u32 camellia_sp4404[256] = 
 	rr = (w0 << (bits - 32)) + (w1 >> (64 - bits));	\
     } while(0)
 
-
 #define CAMELLIA_F(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
     do {							\
 	il = xl ^ kl;						\
 	ir = xr ^ kr;						\
 	t0 = il >> 16;						\
 	t1 = ir >> 16;						\
-	yl = camellia_sp1110[ir & 0xff]				\
-	   ^ camellia_sp0222[(t1 >> 8) & 0xff]			\
-	   ^ camellia_sp3033[t1 & 0xff]				\
-	   ^ camellia_sp4404[(ir >> 8) & 0xff];			\
-	yr = camellia_sp1110[(t0 >> 8) & 0xff]			\
-	   ^ camellia_sp0222[t0 & 0xff]				\
-	   ^ camellia_sp3033[(il >> 8) & 0xff]			\
-	   ^ camellia_sp4404[il & 0xff];			\
+	yl = camellia_sp1110[(u8)(ir     )]			\
+	   ^ camellia_sp0222[    (t1 >> 8)]			\
+	   ^ camellia_sp3033[(u8)(t1     )]			\
+	   ^ camellia_sp4404[(u8)(ir >> 8)];			\
+	yr = camellia_sp1110[    (t0 >> 8)]			\
+	   ^ camellia_sp0222[(u8)(t0     )]			\
+	   ^ camellia_sp3033[(u8)(il >> 8)]			\
+	   ^ camellia_sp4404[(u8)(il     )];			\
 	yl ^= yr;						\
 	yr = ROR8(yr);						\
 	yr ^= yl;						\
     } while(0)
 
-
-/*
- * for speed up
- *
- */
-#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
-    do {								\
-	t0 = kll;							\
-	t2 = krr;							\
-	t0 &= ll;							\
-	t2 |= rr;							\
-	rl ^= t2;							\
-	lr ^= ROL1(t0);							\
-	t3 = krl;							\
-	t1 = klr;							\
-	t3 &= rl;							\
-	t1 |= lr;							\
-	ll ^= t1;							\
-	rr ^= ROL1(t3);							\
-    } while(0)
-
-#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir, t0, t1)	\
-    do {								\
-	ir =  camellia_sp1110[xr & 0xff];				\
-	il =  camellia_sp1110[(xl>>24) & 0xff];				\
-	ir ^= camellia_sp0222[(xr>>24) & 0xff];				\
-	il ^= camellia_sp0222[(xl>>16) & 0xff];				\
-	ir ^= camellia_sp3033[(xr>>16) & 0xff];				\
-	il ^= camellia_sp3033[(xl>>8) & 0xff];				\
-	ir ^= camellia_sp4404[(xr>>8) & 0xff];				\
-	il ^= camellia_sp4404[xl & 0xff];				\
-	il ^= kl;							\
-	ir ^= il ^ kr;							\
-	yl ^= ir;							\
-	yr ^= ROR8(il) ^ ir;						\
-    } while(0)
-
-
 #define SUBKEY_L(INDEX) (subkey[(INDEX)*2])
 #define SUBKEY_R(INDEX) (subkey[(INDEX)*2 + 1])
 

@@ -999,8 +1542,49 @@ static void camellia_setup192(const unsi
 	camellia_setup256(kk, subkey);
 }
 
+typedef u32 key_element;
+typedef const u32 const_key_element;
+
+#endif /* 32/64-bit key setup versions */
+
+
+
+/*
+ * Encrypt/decrypt
+ */
+#define CAMELLIA_FLS(ll, lr, rl, rr, kll, klr, krl, krr, t0, t1, t2, t3) \
+    do {								\
+	t0 = kll;							\
+	t2 = krr;							\
+	t0 &= ll;							\
+	t2 |= rr;							\
+	rl ^= t2;							\
+	lr ^= ROL1(t0);							\
+	t3 = krl;							\
+	t1 = klr;							\
+	t3 &= rl;							\
+	t1 |= lr;							\
+	ll ^= t1;							\
+	rr ^= ROL1(t3);							\
+    } while(0)
+
+#define CAMELLIA_ROUNDSM(xl, xr, kl, kr, yl, yr, il, ir)		\
+    do {								\
+	ir =  camellia_sp1110[(u8)xr];					\
+	il =  camellia_sp1110[    (xl >> 24)];				\
+	ir ^= camellia_sp0222[    (xr >> 24)];				\
+	il ^= camellia_sp0222[(u8)(xl >> 16)];				\
+	ir ^= camellia_sp3033[(u8)(xr >> 16)];				\
+	il ^= camellia_sp3033[(u8)(xl >> 8)];				\
+	ir ^= camellia_sp4404[(u8)(xr >> 8)];				\
+	il ^= camellia_sp4404[(u8)xl];					\
+	il ^= kl;							\
+	ir ^= il ^ kr;							\
+	yl ^= ir;							\
+	yr ^= ROR8(il) ^ ir;						\
+    } while(0)
 
-static void camellia_encrypt128(const u32 *subkey, u32 *io_text)
+static void camellia_encrypt128(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
 

@@ -1015,22 +1599,22 @@ static void camellia_encrypt128(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(8),SUBKEY_R(8),

@@ -1039,22 +1623,22 @@ static void camellia_encrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(16),SUBKEY_R(16),

@@ -1063,22 +1647,22 @@ static void camellia_encrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(24);

@@ -1087,7 +1671,7 @@ static void camellia_encrypt128(const u3
 	io_text[3] = io[1];
 }
 
-static void camellia_decrypt128(const u32 *subkey, u32 *io_text)
+static void camellia_decrypt128(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;               /* temporary variables */
 

@@ -1102,22 +1686,22 @@ static void camellia_decrypt128(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(17),SUBKEY_R(17),

@@ -1126,22 +1710,22 @@ static void camellia_decrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(9),SUBKEY_R(9),

@@ -1150,22 +1734,22 @@ static void camellia_decrypt128(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(0);

@@ -1174,7 +1758,7 @@ static void camellia_decrypt128(const u3
 	io_text[3] = io[1];
 }
 
-static void camellia_encrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_encrypt256(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;           /* temporary variables */
 

@@ -1189,22 +1773,22 @@ static void camellia_encrypt256(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(8),SUBKEY_R(8),

@@ -1213,22 +1797,22 @@ static void camellia_encrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(16),SUBKEY_R(16),

@@ -1237,22 +1821,22 @@ static void camellia_encrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(24),SUBKEY_R(24),

@@ -1261,22 +1845,22 @@ static void camellia_encrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(32);

@@ -1285,7 +1869,7 @@ static void camellia_encrypt256(const u3
 	io_text[3] = io[1];
 }
 
-static void camellia_decrypt256(const u32 *subkey, u32 *io_text)
+static void camellia_decrypt256(const_key_element *subkey, u32 *io_text)
 {
 	u32 il,ir,t0,t1;           /* temporary variables */
 

@@ -1300,22 +1884,22 @@ static void camellia_decrypt256(const u3
 	/* main iteration */
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(31),SUBKEY_R(31),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(30),SUBKEY_R(30),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(29),SUBKEY_R(29),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(28),SUBKEY_R(28),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(27),SUBKEY_R(27),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(26),SUBKEY_R(26),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(25),SUBKEY_R(25),

@@ -1324,22 +1908,22 @@ static void camellia_decrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(23),SUBKEY_R(23),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(22),SUBKEY_R(22),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(21),SUBKEY_R(21),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(20),SUBKEY_R(20),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(19),SUBKEY_R(19),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(18),SUBKEY_R(18),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(17),SUBKEY_R(17),

@@ -1348,22 +1932,22 @@ static void camellia_decrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(15),SUBKEY_R(15),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(14),SUBKEY_R(14),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(13),SUBKEY_R(13),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(12),SUBKEY_R(12),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(11),SUBKEY_R(11),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(10),SUBKEY_R(10),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	CAMELLIA_FLS(io[0],io[1],io[2],io[3],
 		     SUBKEY_L(9),SUBKEY_R(9),

@@ -1372,22 +1956,22 @@ static void camellia_decrypt256(const u3
 
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(7),SUBKEY_R(7),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(6),SUBKEY_R(6),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(5),SUBKEY_R(5),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(4),SUBKEY_R(4),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 	CAMELLIA_ROUNDSM(io[0],io[1],
 			 SUBKEY_L(3),SUBKEY_R(3),
-			 io[2],io[3],il,ir,t0,t1);
+			 io[2],io[3],il,ir);
 	CAMELLIA_ROUNDSM(io[2],io[3],
 			 SUBKEY_L(2),SUBKEY_R(2),
-			 io[0],io[1],il,ir,t0,t1);
+			 io[0],io[1],il,ir);
 
 	/* post whitening but kw4 */
 	io_text[0] = io[2] ^ SUBKEY_L(0);

@@ -1399,7 +1983,7 @@ static void camellia_decrypt256(const u3
 
 struct camellia_ctx {
 	int key_length;
-	u32 key_table[CAMELLIA_TABLE_BYTE_LEN / 4];
+	key_element key_table[CAMELLIA_TABLE_BYTE_LEN / sizeof(key_element)];
 };
 
 static int
crypto/camellia.c +108 -405

550 lines not on this page · raw message

crypto/camellia.c +168 -270

504 lines not on this page · raw message

crypto/camellia.c +184 -277

580 lines not on this page · raw message

maintainer
#34 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

In reply to Denys Vlasenko
Quoted 8 lines · Denys Vlasenko

Oh, Herbert, have heart, my camellia.c source file is smaller than the one I started from. It's not like it's twice as big. It's smaller already.

64-bit key setup is not just faster, it is also smaller by ~4k, and this benefit is always there, not only when key setup is performed.

The key setup path is the slow path so I don't see why we can't just switch to the 64-bit version if it's better.

BTW I tried to apply your -6 patch but it doesn't apply against cryptodev-2.6 so I had to drop it.

Please make sure that you only send one patch per email and that they apply against cryptodev-2.6. If the patches have dependencies then please make that clear as well.

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#35 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 11 lines · Herbert Xu
Quoted 7 lines · Denys Vlasenko

Oh, Herbert, have heart, my camellia.c source file is smaller than the one I started from. It's not like it's twice as big. It's smaller already.

64-bit key setup is not just faster, it is also smaller by ~4k, and this benefit is always there, not only when key setup is performed.

The key setup path is the slow path so I don't see why we can't just switch to the 64-bit version if it's better.

Yes, with minor modifications "64-bit" version can be compiled and will work correctly on 32-bit CPU. But it will be larger. This is what I got on i386:

text data bss dec hex filename

  18230     224       0   18454    4816 t/crypto/camellia.o
  20198     224       0   20422    4fc6 t_fake64/crypto/camellia.o
Quoted 2 lines

BTW I tried to apply your -6 patch but it doesn't apply against cryptodev-2.6 so I had to drop it.

Will correct this and re-post.
--
vda

maintainer
#36 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 8 lines · Denys Vlasenko

Yes, with minor modifications "64-bit" version can be compiled and will work correctly on 32-bit CPU. But it will be larger. This is what I got on i386:

text data bss dec hex filename

  18230     224       0   18454    4816 t/crypto/camellia.o
  20198     224       0   20422    4fc6 t_fake64/crypto/camellia.o

What are the size differences on x86-64?

Thanks,

Signature · 4 lines
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <[email protected]>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
author
#37 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

Quoted 10 lines · Herbert Xu
Quoted 7 lines · Denys Vlasenko

Yes, with minor modifications "64-bit" version can be compiled and will work correctly on 32-bit CPU. But it will be larger. This is what I got on i386:

text data bss dec hex filename

  18230     224       0   18454    4816 t/crypto/camellia.o
  20198     224       0   20422    4fc6 t_fake64/crypto/camellia.o

What are the size differences on x86-64?

The above sizes were: final code (with all patches applied) built for i386
versus same code with #if BITS_PER_LONG >= 64 replaced by #if 1, and a few fixes for "integer is too big for long" warnings)

For 64-bit, replacing that #if is a no-op, sizes
will be the same.

If you are asking about 64-bit size comparison *across patches* 5..8, here they are:

64-bit:

dec      hex   filename
22786    5902  2.6.23.1.camellia4.t64/crypto/camellia.o
21422    53ae  2.6.23.1.camellia5.t64/crypto/camellia.o
16355    3fe3  2.6.23.1.camellia6.t64/crypto/camellia.o
15813    3dc5  2.6.23.1.camellia7.t64/crypto/camellia.o
15670    3d36  2.6.23.1.camellia8.t64/crypto/camellia.o

--
vda

#38 lore raw

Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization

In reply to Denys Vlasenko

Hi,

Quoted 23 lines
Quoted 3 lines

Tue, 13 Nov 2007 19:47:08 -0700
[Subject: Re: [camellia-oss:00952] Re: [PATCH 5/5] camellia: de-unrolling, 64bit-ization] Denys Vlasenko <[email protected]> wrote...

Quoted 7 lines · David Miller

From: Denys Vlasenko <[email protected]>
Date: Tue, 13 Nov 2007 15:34:33 -0700

Quoted 3 lines

My preferred solution is to make loop unrolling conditional on CONFIG_CC_OPTIMIZE_FOR_SIZE - and this is what is done in my (first) patch (see attached). This part:

Quoted 8 lines

The default build is going to be CONFIG_CC_OPTIMIZE_FOR_SIZE basically for everyone, this is what people get by default and this is what every distribution uses.

Therefore %99.9999 of folks will get the slowdown.

So in my book this is not an acceptable way to deal with this problem.

Loop unrolling here amounts to 25% code growth:

Quoted 7 lines

text data bss dec hex filename

  21714       0       0   21714    54d2 camellia5.o
  15906       0       0   15906    3e22 camellia5_Os.o

Saving 25% or code size and going 5% slower is perfectly acceptable tradeof for some users. NB: I'm not saying all, ut some significant part of users would like to be able to have this choice.

IMHO, if you are going to use camellia on the embedded system, size of code will be important.

On the other hand, I think typically the CPU performance is restricted on the embedded system, so the performance of code will be important...

I'm not sure 5% slow down is important or not. It will depend on the system.

Regards,

--
Noriaki TAKAMYA