aesopt.h

// SPDX-License-Identifier: Brian-Gladman-3-Clause
/*
 * ---------------------------------------------------------------------------
 * Copyright (c) 1998-2007, Brian Gladman, Worcester, UK. All rights reserved.
 *
 * LICENSE TERMS
 *
 * The free distribution and use of this software is allowed (with or without
 * changes) provided that:
 *
 *  1. source code distributions include the above copyright notice, this
 *	list of conditions and the following disclaimer;
 *
 *  2. binary distributions include the above copyright notice, this list
 *	of conditions and the following disclaimer in their documentation;
 *
 *  3. the name of the copyright holder is not used to endorse products
 *	built using this software without specific written permission.
 *
 * DISCLAIMER
 *
 * This software is provided 'as is' with no explicit or implied warranties
 * in respect of its properties, including, but not limited to, correctness
 * and/or fitness for purpose.
 * ---------------------------------------------------------------------------
 * Issue Date: 20/12/2007
 *
 * This file contains the compilation options for AES (Rijndael) and code
 * that is common across encryption, key scheduling and table generation.
 *
 * OPERATION
 *
 * These source code files implement the AES algorithm Rijndael designed by
 * Joan Daemen and Vincent Rijmen. This version is designed for the standard
 * block size of 16 bytes and for key sizes of 128, 192 and 256 bits (16, 24
 * and 32 bytes).
 *
 * This version is designed for flexibility and speed using operations on
 * 32-bit words rather than operations on bytes.  It can be compiled with
 * either big or little endian internal byte order but is faster when the
 * native byte order for the processor is used.
 *
 * THE CIPHER INTERFACE
 *
 * The cipher interface is implemented as an array of bytes in which lower
 * AES bit sequence indexes map to higher numeric significance within bytes.
 */

/*
 * OpenSolaris changes
 * 1. Added __cplusplus and _AESTAB_H header guards
 * 2. Added header files sys/types.h and aes_impl.h
 * 3. Added defines for AES_ENCRYPT, AES_DECRYPT, AES_REV_DKS, and ASM_AMD64_C
 * 4. Moved defines for IS_BIG_ENDIAN, IS_LITTLE_ENDIAN, PLATFORM_BYTE_ORDER
 *    from brg_endian.h
 * 5. Undefined VIA_ACE_POSSIBLE and ASSUME_VIA_ACE_PRESENT
 * 6. Changed uint_8t and uint_32t to uint8_t and uint32_t
 * 7. Defined aes_sw32 as htonl() for byte swapping
 * 8. Cstyled and hdrchk code
 *
 */

#ifndef _AESOPT_H
#define	_AESOPT_H

#ifdef	__cplusplus
extern "C" {
#endif

#include <sys/zfs_context.h>
#include <aes/aes_impl.h>

/*  SUPPORT FEATURES */
#define	AES_ENCRYPT /* if support for encryption is needed */
#define	AES_DECRYPT /* if support for decryption is needed */

/*  PLATFORM-SPECIFIC FEATURES */
#define	IS_BIG_ENDIAN		4321 /* byte 0 is most significant (mc68k) */
#define	IS_LITTLE_ENDIAN	1234 /* byte 0 is least significant (i386) */
#define	PLATFORM_BYTE_ORDER	IS_LITTLE_ENDIAN
#define	AES_REV_DKS /* define to reverse decryption key schedule */


/*
 *  CONFIGURATION - THE USE OF DEFINES
 *	Later in this section there are a number of defines that control the
 *	operation of the code.  In each section, the purpose of each define is
 *	explained so that the relevant form can be included or excluded by
 *	setting either 1's or 0's respectively on the branches of the related
 *	#if clauses.  The following local defines should not be changed.
 */

#define	ENCRYPTION_IN_C	1
#define	DECRYPTION_IN_C	2
#define	ENC_KEYING_IN_C	4
#define	DEC_KEYING_IN_C	8

#define	NO_TABLES	0
#define	ONE_TABLE	1
#define	FOUR_TABLES	4
#define	NONE		0
#define	PARTIAL		1
#define	FULL		2

/*  --- START OF USER CONFIGURED OPTIONS --- */

/*
 *  1. BYTE ORDER WITHIN 32 BIT WORDS
 *
 *	The fundamental data processing units in Rijndael are 8-bit bytes. The
 *	input, output and key input are all enumerated arrays of bytes in which
 *	bytes are numbered starting at zero and increasing to one less than the
 *	number of bytes in the array in question. This enumeration is only used
 *	for naming bytes and does not imply any adjacency or order relationship
 *	from one byte to another. When these inputs and outputs are considered
 *	as bit sequences, bits 8*n to 8*n+7 of the bit sequence are mapped to
 *	byte[n] with bit 8n+i in the sequence mapped to bit 7-i within the byte.
 *	In this implementation bits are numbered from 0 to 7 starting at the
 *	numerically least significant end of each byte.  Bit n represents 2^n.
 *
 *	However, Rijndael can be implemented more efficiently using 32-bit
 *	words by packing bytes into words so that bytes 4*n to 4*n+3 are placed
 *	into word[n]. While in principle these bytes can be assembled into words
 *	in any positions, this implementation only supports the two formats in
 *	which bytes in adjacent positions within words also have adjacent byte
 *	numbers. This order is called big-endian if the lowest numbered bytes
 *	in words have the highest numeric significance and little-endian if the
 *	opposite applies.
 *
 *	This code can work in either order irrespective of the order used by the
 *	machine on which it runs. Normally the internal byte order will be set
 *	to the order of the processor on which the code is to be run but this
 *	define	can be used to reverse this in special situations
 *
 *	WARNING: Assembler code versions rely on PLATFORM_BYTE_ORDER being set.
 *	This define will hence be redefined later (in section 4) if necessary
 */

#if 1
#define	ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
#elif 0
#define	ALGORITHM_BYTE_ORDER IS_LITTLE_ENDIAN
#elif 0
#define	ALGORITHM_BYTE_ORDER IS_BIG_ENDIAN
#else
#error The algorithm byte order is not defined
#endif

/*  2. VIA ACE SUPPORT */

#if defined(__GNUC__) && defined(__i386__) || \
	defined(_WIN32) && defined(_M_IX86) && \
	!(defined(_WIN64) || defined(_WIN32_WCE) || \
	defined(_MSC_VER) && (_MSC_VER <= 800))
#define	VIA_ACE_POSSIBLE
#endif

/*
 *  Define this option if support for the VIA ACE is required. This uses
 *  inline assembler instructions and is only implemented for the Microsoft,
 *  Intel and GCC compilers.  If VIA ACE is known to be present, then defining
 *  ASSUME_VIA_ACE_PRESENT will remove the ordinary encryption/decryption
 *  code.  If USE_VIA_ACE_IF_PRESENT is defined then VIA ACE will be used if
 *  it is detected (both present and enabled) but the normal AES code will
 *  also be present.
 *
 *  When VIA ACE is to be used, all AES encryption contexts MUST be 16 byte
 *  aligned; other input/output buffers do not need to be 16 byte aligned
 *  but there are very large performance gains if this can be arranged.
 *  VIA ACE also requires the decryption key schedule to be in reverse
 *  order (which later checks below ensure).
 */

/*  VIA ACE is not used here for OpenSolaris: */
#undef	VIA_ACE_POSSIBLE
#undef	ASSUME_VIA_ACE_PRESENT

#if 0 && defined(VIA_ACE_POSSIBLE) && !defined(USE_VIA_ACE_IF_PRESENT)
#define	USE_VIA_ACE_IF_PRESENT
#endif

#if 0 && defined(VIA_ACE_POSSIBLE) && !defined(ASSUME_VIA_ACE_PRESENT)
#define	ASSUME_VIA_ACE_PRESENT
#endif


/*
 *  3. ASSEMBLER SUPPORT
 *
 *	This define (which can be on the command line) enables the use of the
 *	assembler code routines for encryption, decryption and key scheduling
 *	as follows:
 *
 *	ASM_X86_V1C uses the assembler (aes_x86_v1.asm) with large tables for
 *		encryption and decryption and but with key scheduling in C
 *	ASM_X86_V2  uses assembler (aes_x86_v2.asm) with compressed tables for
 *		encryption, decryption and key scheduling
 *	ASM_X86_V2C uses assembler (aes_x86_v2.asm) with compressed tables for
 *		encryption and decryption and but with key scheduling in C
 *	ASM_AMD64_C uses assembler (aes_amd64.asm) with compressed tables for
 *		encryption and decryption and but with key scheduling in C
 *
 *	Change one 'if 0' below to 'if 1' to select the version or define
 *	as a compilation option.
 */

#if 0 && !defined(ASM_X86_V1C)
#define	ASM_X86_V1C
#elif 0 && !defined(ASM_X86_V2)
#define	ASM_X86_V2
#elif 0 && !defined(ASM_X86_V2C)
#define	ASM_X86_V2C
#elif 1 && !defined(ASM_AMD64_C)
#define	ASM_AMD64_C
#endif

#if (defined(ASM_X86_V1C) || defined(ASM_X86_V2) || defined(ASM_X86_V2C)) && \
	!defined(_M_IX86) || defined(ASM_AMD64_C) && !defined(_M_X64) && \
	!defined(__amd64)
#error Assembler code is only available for x86 and AMD64 systems
#endif

/*
 *  4. FAST INPUT/OUTPUT OPERATIONS.
 *
 *	On some machines it is possible to improve speed by transferring the
 *	bytes in the input and output arrays to and from the internal 32-bit
 *	variables by addressing these arrays as if they are arrays of 32-bit
 *	words.  On some machines this will always be possible but there may
 *	be a large performance penalty if the byte arrays are not aligned on
 *	the normal word boundaries. On other machines this technique will
 *	lead to memory access errors when such 32-bit word accesses are not
 *	properly aligned. The option SAFE_IO avoids such problems but will
 *	often be slower on those machines that support misaligned access
 *	(especially so if care is taken to align the input  and output byte
 *	arrays on 32-bit word boundaries). If SAFE_IO is not defined it is
 *	assumed that access to byte arrays as if they are arrays of 32-bit
 *	words will not cause problems when such accesses are misaligned.
 */
#if 1 && !defined(_MSC_VER)
#define	SAFE_IO
#endif

/*
 *  5. LOOP UNROLLING
 *
 *	The code for encryption and decryption cycles through a number of rounds
 *	that can be implemented either in a loop or by expanding the code into a
 *	long sequence of instructions, the latter producing a larger program but
 *	one that will often be much faster. The latter is called loop unrolling.
 *	There are also potential speed advantages in expanding two iterations in
 *	a loop with half the number of iterations, which is called partial loop
 *	unrolling.  The following options allow partial or full loop unrolling
 *	to be set independently for encryption and decryption
 */
#if 1
#define	ENC_UNROLL  FULL
#elif 0
#define	ENC_UNROLL  PARTIAL
#else
#define	ENC_UNROLL  NONE
#endif

#if 1
#define	DEC_UNROLL  FULL
#elif 0
#define	DEC_UNROLL  PARTIAL
#else
#define	DEC_UNROLL  NONE
#endif

#if 1
#define	ENC_KS_UNROLL
#endif

#if 1
#define	DEC_KS_UNROLL
#endif

/*
 *  6. FAST FINITE FIELD OPERATIONS
 *
 *	If this section is included, tables are used to provide faster finite
 *	field arithmetic.  This has no effect if FIXED_TABLES is defined.
 */
#if 1
#define	FF_TABLES
#endif

/*
 *  7. INTERNAL STATE VARIABLE FORMAT
 *
 *	The internal state of Rijndael is stored in a number of local 32-bit
 *	word variables which can be defined either as an array or as individual
 *	names variables. Include this section if you want to store these local
 *	variables in arrays. Otherwise individual local variables will be used.
 */
#if 1
#define	ARRAYS
#endif

/*
 *  8. FIXED OR DYNAMIC TABLES
 *
 *	When this section is included the tables used by the code are compiled
 *	statically into the binary file.  Otherwise the subroutine aes_init()
 *	must be called to compute them before the code is first used.
 */
#if 1 && !(defined(_MSC_VER) && (_MSC_VER <= 800))
#define	FIXED_TABLES
#endif

/*
 *  9. MASKING OR CASTING FROM LONGER VALUES TO BYTES
 *
 *	In some systems it is better to mask longer values to extract bytes
 *	rather than using a cast. This option allows this choice.
 */
#if 0
#define	to_byte(x)  ((uint8_t)(x))
#else
#define	to_byte(x)  ((x) & 0xff)
#endif

/*
 *  10. TABLE ALIGNMENT
 *
 *	On some systems speed will be improved by aligning the AES large lookup
 *	tables on particular boundaries. This define should be set to a power of
 *	two giving the desired alignment. It can be left undefined if alignment
 *	is not needed.  This option is specific to the Microsoft VC++ compiler -
 *	it seems to sometimes cause trouble for the VC++ version 6 compiler.
 */

#if 1 && defined(_MSC_VER) && (_MSC_VER >= 1300)
#define	TABLE_ALIGN 32
#endif

/*
 *  11.  REDUCE CODE AND TABLE SIZE
 *
 *	This replaces some expanded macros with function calls if AES_ASM_V2 or
 *	AES_ASM_V2C are defined
 */

#if 1 && (defined(ASM_X86_V2) || defined(ASM_X86_V2C))
#define	REDUCE_CODE_SIZE
#endif

/*
 *  12. TABLE OPTIONS
 *
 *	This cipher proceeds by repeating in a number of cycles known as rounds
 *	which are implemented by a round function which is optionally be speeded
 *	up using tables.  The basic tables are 256 32-bit words, with either
 *	one or four tables being required for each round function depending on
 *	how much speed is required. Encryption and decryption round functions
 *	are different and the last encryption and decryption round functions are
 *	different again making four different round functions in all.
 *
 *	This means that:
 *	1. Normal encryption and decryption rounds can each use either 0, 1
 *		or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
 *	2. The last encryption and decryption rounds can also use either 0, 1
 *		or 4 tables and table spaces of 0, 1024 or 4096 bytes each.
 *
 *	Include or exclude the appropriate definitions below to set the number
 *	of tables used by this implementation.
 */

#if 1   /* set tables for the normal encryption round */
#define	ENC_ROUND   FOUR_TABLES
#elif 0
#define	ENC_ROUND   ONE_TABLE
#else
#define	ENC_ROUND   NO_TABLES
#endif

#if 1   /* set tables for the last encryption round */
#define	LAST_ENC_ROUND  FOUR_TABLES
#elif 0
#define	LAST_ENC_ROUND  ONE_TABLE
#else
#define	LAST_ENC_ROUND  NO_TABLES
#endif

#if 1   /* set tables for the normal decryption round */
#define	DEC_ROUND   FOUR_TABLES
#elif 0
#define	DEC_ROUND   ONE_TABLE
#else
#define	DEC_ROUND   NO_TABLES
#endif

#if 1   /* set tables for the last decryption round */
#define	LAST_DEC_ROUND  FOUR_TABLES
#elif 0
#define	LAST_DEC_ROUND  ONE_TABLE
#else
#define	LAST_DEC_ROUND  NO_TABLES
#endif

/*
 *  The decryption key schedule can be speeded up with tables in the same
 *	way that the round functions can.  Include or exclude the following
 *	defines to set this requirement.
 */
#if 1
#define	KEY_SCHED   FOUR_TABLES
#elif 0
#define	KEY_SCHED   ONE_TABLE
#else
#define	KEY_SCHED   NO_TABLES
#endif

/*  ---- END OF USER CONFIGURED OPTIONS ---- */

/* VIA ACE support is only available for VC++ and GCC */

#if !defined(_MSC_VER) && !defined(__GNUC__)
#if defined(ASSUME_VIA_ACE_PRESENT)
#undef ASSUME_VIA_ACE_PRESENT
#endif
#if defined(USE_VIA_ACE_IF_PRESENT)
#undef USE_VIA_ACE_IF_PRESENT
#endif
#endif

#if defined(ASSUME_VIA_ACE_PRESENT) && !defined(USE_VIA_ACE_IF_PRESENT)
#define	USE_VIA_ACE_IF_PRESENT
#endif

#if defined(USE_VIA_ACE_IF_PRESENT) && !defined(AES_REV_DKS)
#define	AES_REV_DKS
#endif

/* Assembler support requires the use of platform byte order */

#if (defined(ASM_X86_V1C) || defined(ASM_X86_V2C) || defined(ASM_AMD64_C)) && \
	(ALGORITHM_BYTE_ORDER != PLATFORM_BYTE_ORDER)
#undef  ALGORITHM_BYTE_ORDER
#define	ALGORITHM_BYTE_ORDER PLATFORM_BYTE_ORDER
#endif

/*
 * In this implementation the columns of the state array are each held in
 *	32-bit words. The state array can be held in various ways: in an array
 *	of words, in a number of individual word variables or in a number of
 *	processor registers. The following define maps a variable name x and
 *	a column number c to the way the state array variable is to be held.
 *	The first define below maps the state into an array x[c] whereas the
 *	second form maps the state into a number of individual variables x0,
 *	x1, etc.  Another form could map individual state columns to machine
 *	register names.
 */

#if defined(ARRAYS)
#define	s(x, c) x[c]
#else
#define	s(x, c) x##c
#endif

/*
 *  This implementation provides subroutines for encryption, decryption
 *	and for setting the three key lengths (separately) for encryption
 *	and decryption. Since not all functions are needed, masks are set
 *	up here to determine which will be implemented in C
 */

#if !defined(AES_ENCRYPT)
#define	EFUNCS_IN_C   0
#elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
	defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
#define	EFUNCS_IN_C   ENC_KEYING_IN_C
#elif !defined(ASM_X86_V2)
#define	EFUNCS_IN_C   (ENCRYPTION_IN_C | ENC_KEYING_IN_C)
#else
#define	EFUNCS_IN_C   0
#endif

#if !defined(AES_DECRYPT)
#define	DFUNCS_IN_C   0
#elif defined(ASSUME_VIA_ACE_PRESENT) || defined(ASM_X86_V1C) || \
	defined(ASM_X86_V2C) || defined(ASM_AMD64_C)
#define	DFUNCS_IN_C   DEC_KEYING_IN_C
#elif !defined(ASM_X86_V2)
#define	DFUNCS_IN_C   (DECRYPTION_IN_C | DEC_KEYING_IN_C)
#else
#define	DFUNCS_IN_C   0
#endif

#define	FUNCS_IN_C  (EFUNCS_IN_C | DFUNCS_IN_C)

/* END OF CONFIGURATION OPTIONS */

/* Disable or report errors on some combinations of options */

#if ENC_ROUND == NO_TABLES && LAST_ENC_ROUND != NO_TABLES
#undef  LAST_ENC_ROUND
#define	LAST_ENC_ROUND  NO_TABLES
#elif ENC_ROUND == ONE_TABLE && LAST_ENC_ROUND == FOUR_TABLES
#undef  LAST_ENC_ROUND
#define	LAST_ENC_ROUND  ONE_TABLE
#endif

#if ENC_ROUND == NO_TABLES && ENC_UNROLL != NONE
#undef  ENC_UNROLL
#define	ENC_UNROLL  NONE
#endif

#if DEC_ROUND == NO_TABLES && LAST_DEC_ROUND != NO_TABLES
#undef  LAST_DEC_ROUND
#define	LAST_DEC_ROUND  NO_TABLES
#elif DEC_ROUND == ONE_TABLE && LAST_DEC_ROUND == FOUR_TABLES
#undef  LAST_DEC_ROUND
#define	LAST_DEC_ROUND  ONE_TABLE
#endif

#if DEC_ROUND == NO_TABLES && DEC_UNROLL != NONE
#undef  DEC_UNROLL
#define	DEC_UNROLL  NONE
#endif

#if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
#define	aes_sw32	htonl
#elif defined(bswap32)
#define	aes_sw32	bswap32
#elif defined(bswap_32)
#define	aes_sw32	bswap_32
#else
#define	brot(x, n)  (((uint32_t)(x) << (n)) | ((uint32_t)(x) >> (32 - (n))))
#define	aes_sw32(x) ((brot((x), 8) & 0x00ff00ff) | (brot((x), 24) & 0xff00ff00))
#endif


/*
 *	upr(x, n):  rotates bytes within words by n positions, moving bytes to
 *		higher index positions with wrap around into low positions
 *	ups(x, n):  moves bytes by n positions to higher index positions in
 *		words but without wrap around
 *	bval(x, n): extracts a byte from a word
 *
 *	WARNING:   The definitions given here are intended only for use with
 *		unsigned variables and with shift counts that are compile
 *		time constants
 */

#if (ALGORITHM_BYTE_ORDER == IS_LITTLE_ENDIAN)
#define	upr(x, n)	(((uint32_t)(x) << (8 * (n))) | \
			((uint32_t)(x) >> (32 - 8 * (n))))
#define	ups(x, n)	((uint32_t)(x) << (8 * (n)))
#define	bval(x, n)	to_byte((x) >> (8 * (n)))
#define	bytes2word(b0, b1, b2, b3)  \
		(((uint32_t)(b3) << 24) | ((uint32_t)(b2) << 16) | \
		((uint32_t)(b1) << 8) | (b0))
#endif

#if (ALGORITHM_BYTE_ORDER == IS_BIG_ENDIAN)
#define	upr(x, n)	(((uint32_t)(x) >> (8 * (n))) | \
			((uint32_t)(x) << (32 - 8 * (n))))
#define	ups(x, n)	((uint32_t)(x) >> (8 * (n)))
#define	bval(x, n)	to_byte((x) >> (24 - 8 * (n)))
#define	bytes2word(b0, b1, b2, b3)  \
		(((uint32_t)(b0) << 24) | ((uint32_t)(b1) << 16) | \
		((uint32_t)(b2) << 8) | (b3))
#endif

#if defined(SAFE_IO)
#define	word_in(x, c)	bytes2word(((const uint8_t *)(x) + 4 * c)[0], \
				((const uint8_t *)(x) + 4 * c)[1], \
				((const uint8_t *)(x) + 4 * c)[2], \
				((const uint8_t *)(x) + 4 * c)[3])
#define	word_out(x, c, v) { ((uint8_t *)(x) + 4 * c)[0] = bval(v, 0); \
			((uint8_t *)(x) + 4 * c)[1] = bval(v, 1); \
			((uint8_t *)(x) + 4 * c)[2] = bval(v, 2); \
			((uint8_t *)(x) + 4 * c)[3] = bval(v, 3); }
#elif (ALGORITHM_BYTE_ORDER == PLATFORM_BYTE_ORDER)
#define	word_in(x, c)	(*((uint32_t *)(x) + (c)))
#define	word_out(x, c, v) (*((uint32_t *)(x) + (c)) = (v))
#else
#define	word_in(x, c)	aes_sw32(*((uint32_t *)(x) + (c)))
#define	word_out(x, c, v) (*((uint32_t *)(x) + (c)) = aes_sw32(v))
#endif

/* the finite field modular polynomial and elements */

#define	WPOLY   0x011b
#define	BPOLY	0x1b

/* multiply four bytes in GF(2^8) by 'x' {02} in parallel */

#define	m1  0x80808080
#define	m2  0x7f7f7f7f
#define	gf_mulx(x)  ((((x) & m2) << 1) ^ ((((x) & m1) >> 7) * BPOLY))

/*
 * The following defines provide alternative definitions of gf_mulx that might
 * give improved performance if a fast 32-bit multiply is not available. Note
 * that a temporary variable u needs to be defined where gf_mulx is used.
 *
 * #define	gf_mulx(x) (u = (x) & m1, u |= (u >> 1), ((x) & m2) << 1) ^ \
 *			((u >> 3) | (u >> 6))
 * #define	m4  (0x01010101 * BPOLY)
 * #define	gf_mulx(x) (u = (x) & m1, ((x) & m2) << 1) ^ ((u - (u >> 7)) \
 *			& m4)
 */

/* Work out which tables are needed for the different options   */

#if defined(ASM_X86_V1C)
#if defined(ENC_ROUND)
#undef  ENC_ROUND
#endif
#define	ENC_ROUND   FOUR_TABLES
#if defined(LAST_ENC_ROUND)
#undef  LAST_ENC_ROUND
#endif
#define	LAST_ENC_ROUND  FOUR_TABLES
#if defined(DEC_ROUND)
#undef  DEC_ROUND
#endif
#define	DEC_ROUND   FOUR_TABLES
#if defined(LAST_DEC_ROUND)
#undef  LAST_DEC_ROUND
#endif
#define	LAST_DEC_ROUND  FOUR_TABLES
#if defined(KEY_SCHED)
#undef  KEY_SCHED
#define	KEY_SCHED   FOUR_TABLES
#endif
#endif

#if (FUNCS_IN_C & ENCRYPTION_IN_C) || defined(ASM_X86_V1C)
#if ENC_ROUND == ONE_TABLE
#define	FT1_SET
#elif ENC_ROUND == FOUR_TABLES
#define	FT4_SET
#else
#define	SBX_SET
#endif
#if LAST_ENC_ROUND == ONE_TABLE
#define	FL1_SET
#elif LAST_ENC_ROUND == FOUR_TABLES
#define	FL4_SET
#elif !defined(SBX_SET)
#define	SBX_SET
#endif
#endif

#if (FUNCS_IN_C & DECRYPTION_IN_C) || defined(ASM_X86_V1C)
#if DEC_ROUND == ONE_TABLE
#define	IT1_SET
#elif DEC_ROUND == FOUR_TABLES
#define	IT4_SET
#else
#define	ISB_SET
#endif
#if LAST_DEC_ROUND == ONE_TABLE
#define	IL1_SET
#elif LAST_DEC_ROUND == FOUR_TABLES
#define	IL4_SET
#elif !defined(ISB_SET)
#define	ISB_SET
#endif
#endif


#if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
	defined(ASM_X86_V2C)))
#if ((FUNCS_IN_C & ENC_KEYING_IN_C) || (FUNCS_IN_C & DEC_KEYING_IN_C))
#if KEY_SCHED == ONE_TABLE
#if !defined(FL1_SET) && !defined(FL4_SET)
#define	LS1_SET
#endif
#elif KEY_SCHED == FOUR_TABLES
#if !defined(FL4_SET)
#define	LS4_SET
#endif
#elif !defined(SBX_SET)
#define	SBX_SET
#endif
#endif
#if (FUNCS_IN_C & DEC_KEYING_IN_C)
#if KEY_SCHED == ONE_TABLE
#define	IM1_SET
#elif KEY_SCHED == FOUR_TABLES
#define	IM4_SET
#elif !defined(SBX_SET)
#define	SBX_SET
#endif
#endif
#endif

/* generic definitions of Rijndael macros that use tables */

#define	no_table(x, box, vf, rf, c) bytes2word(\
	box[bval(vf(x, 0, c), rf(0, c))], \
	box[bval(vf(x, 1, c), rf(1, c))], \
	box[bval(vf(x, 2, c), rf(2, c))], \
	box[bval(vf(x, 3, c), rf(3, c))])

#define	one_table(x, op, tab, vf, rf, c) \
	(tab[bval(vf(x, 0, c), rf(0, c))] \
	^ op(tab[bval(vf(x, 1, c), rf(1, c))], 1) \
	^ op(tab[bval(vf(x, 2, c), rf(2, c))], 2) \
	^ op(tab[bval(vf(x, 3, c), rf(3, c))], 3))

#define	four_tables(x, tab, vf, rf, c) \
	(tab[0][bval(vf(x, 0, c), rf(0, c))] \
	^ tab[1][bval(vf(x, 1, c), rf(1, c))] \
	^ tab[2][bval(vf(x, 2, c), rf(2, c))] \
	^ tab[3][bval(vf(x, 3, c), rf(3, c))])

#define	vf1(x, r, c)	(x)
#define	rf1(r, c)	(r)
#define	rf2(r, c)	((8+r-c)&3)

/*
 * Perform forward and inverse column mix operation on four bytes in long word
 * x in parallel. NOTE: x must be a simple variable, NOT an expression in
 * these macros.
 */

#if !(defined(REDUCE_CODE_SIZE) && (defined(ASM_X86_V2) || \
	defined(ASM_X86_V2C)))

#if defined(FM4_SET)	/* not currently used */
#define	fwd_mcol(x)	four_tables(x, t_use(f, m), vf1, rf1, 0)
#elif defined(FM1_SET)	/* not currently used */
#define	fwd_mcol(x)	one_table(x, upr, t_use(f, m), vf1, rf1, 0)
#else
#define	dec_fmvars	uint32_t g2
#define	fwd_mcol(x)	(g2 = gf_mulx(x), g2 ^ upr((x) ^ g2, 3) ^ \
				upr((x), 2) ^ upr((x), 1))
#endif

#if defined(IM4_SET)
#define	inv_mcol(x)	four_tables(x, t_use(i, m), vf1, rf1, 0)
#elif defined(IM1_SET)
#define	inv_mcol(x)	one_table(x, upr, t_use(i, m), vf1, rf1, 0)
#else
#define	dec_imvars	uint32_t g2, g4, g9
#define	inv_mcol(x)	(g2 = gf_mulx(x), g4 = gf_mulx(g2), g9 = \
				(x) ^ gf_mulx(g4), g4 ^= g9, \
				(x) ^ g2 ^ g4 ^ upr(g2 ^ g9, 3) ^ \
				upr(g4, 2) ^ upr(g9, 1))
#endif

#if defined(FL4_SET)
#define	ls_box(x, c)	four_tables(x, t_use(f, l), vf1, rf2, c)
#elif defined(LS4_SET)
#define	ls_box(x, c)	four_tables(x, t_use(l, s), vf1, rf2, c)
#elif defined(FL1_SET)
#define	ls_box(x, c)	one_table(x, upr, t_use(f, l), vf1, rf2, c)
#elif defined(LS1_SET)
#define	ls_box(x, c)	one_table(x, upr, t_use(l, s), vf1, rf2, c)
#else
#define	ls_box(x, c)	no_table(x, t_use(s, box), vf1, rf2, c)
#endif

#endif

#if defined(ASM_X86_V1C) && defined(AES_DECRYPT) && !defined(ISB_SET)
#define	ISB_SET
#endif

#ifdef	__cplusplus
}
#endif

#endif	/* _AESOPT_H */