include/crypto/gf128mul.h

24    1. distributions of this source code include the above copyright
61  * The elements of GF(2^128) := GF(2)[X]/(X^128-X^7-X^2-X^1-1) can
70  *   b[0]     b[1]     b[2]     b[3]          b[13]    b[14]    b[15]
75  * The above buffer represents the polynomial 1, and X^7+X^2+X^1+1 looks
82  * represents X^127. X^7+X^2+X^1+1 looks like 00000000 .... 10000111,
105  *  MS            x[0]           LS  MS            x[1]		  LS
106  *  ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
109  *  MS            x[2]           LS  MS            x[3]		  LS
110  *  ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
115  *  MS            x[0]           LS  MS            x[1]		  LS
116  *  ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
119  *  MS            x[2]           LS  MS            x[3]		  LS
120  *  ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
141     MS            x[0]           LS  MS            x[1]		  LS
142     ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
145     MS            x[2]           LS  MS            x[3]		  LS
146     ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
152     MS            x[0]           LS  MS            x[1]		  LS
153     ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
156     MS            x[2]           LS  MS            x[3]		  LS
157     ms   ls ms   ls ms   ls ms   ls  ms   ls ms   ls ms   ls ms   ls
178 	/* a constant-time version of 'x & ((u64)1 << which) ? (u64)-1 : 0' */  in gf128mul_mask_from_bit()
191 	r->b = cpu_to_be64((b >> 1) | (a << 63));  in gf128mul_x_lle()
192 	r->a = cpu_to_be64((a >> 1) ^ _tt);  in gf128mul_x_lle()
203 	r->a = cpu_to_be64((a << 1) | (b >> 63));  in gf128mul_x_bbe()
204 	r->b = cpu_to_be64((b << 1) ^ _tt);  in gf128mul_x_bbe()
216 	r->a = cpu_to_le64((a << 1) | (b >> 63));  in gf128mul_x_ble()
217 	r->b = cpu_to_le64((b << 1) ^ _tt);  in gf128mul_x_ble()