/* * Copyright (c) 2013, Kenneth MacKay * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include <linux/random.h>#include <linux/slab.h>#include <linux/swab.h>#include <linux/fips.h>#include <crypto/ecdh.h>#include <crypto/rng.h> #include "ecc.h"#include "ecc_curve_defs.h" typedef struct { u64 m_low; u64 m_high;} uint128_t; static inline const struct ecc_curve *ecc_get_curve(unsigned int curve_id){ switch (curve_id) { /* In FIPS mode only allow P256 and higher */ case ECC_CURVE_NIST_P192: return fips_enabled ? NULL : &nist_p192; case ECC_CURVE_NIST_P256: return &nist_p256; default: return NULL; }} static u64 *ecc_alloc_digits_space(unsigned int ndigits){ size_t len = ndigits * sizeof(u64); if (!len) return NULL; return kmalloc(len, GFP_KERNEL);} static void ecc_free_digits_space(u64 *space){ kzfree(space);} static struct ecc_point *ecc_alloc_point(unsigned int ndigits){ struct ecc_point *p = kmalloc(sizeof(*p), GFP_KERNEL); if (!p) return NULL; p->x = ecc_alloc_digits_space(ndigits); if (!p->x) goto err_alloc_x; p->y = ecc_alloc_digits_space(ndigits); if (!p->y) goto err_alloc_y; p->ndigits = ndigits; return p; err_alloc_y: ecc_free_digits_space(p->x);err_alloc_x: kfree(p); return NULL;} static void ecc_free_point(struct ecc_point *p){ if (!p) return; kzfree(p->x); kzfree(p->y); kzfree(p);} static void vli_clear(u64 *vli, unsigned int ndigits){ int i; for (i = 0; i < ndigits; i++) vli[i] = 0;} /* Returns true if vli == 0, false otherwise. */static bool vli_is_zero(const u64 *vli, unsigned int ndigits){ int i; for (i = 0; i < ndigits; i++) { if (vli[i]) return false; } return true;} /* Returns nonzero if bit bit of vli is set. */static u64 vli_test_bit(const u64 *vli, unsigned int bit){ return (vli[bit / 64] & ((u64)1 << (bit % 64)));} /* Counts the number of 64-bit "digits" in vli. */static unsigned int vli_num_digits(const u64 *vli, unsigned int ndigits){ int i; /* Search from the end until we find a non-zero digit. * We do it in reverse because we expect that most digits will * be nonzero. */ for (i = ndigits - 1; i >= 0 && vli[i] == 0; i--); return (i + 1);} /* Counts the number of bits required for vli. */static unsigned int vli_num_bits(const u64 *vli, unsigned int ndigits){ unsigned int i, num_digits; u64 digit; num_digits = vli_num_digits(vli, ndigits); if (num_digits == 0) return 0; digit = vli[num_digits - 1]; for (i = 0; digit; i++) digit >>= 1; return ((num_digits - 1) * 64 + i);} /* Sets dest = src. */static void vli_set(u64 *dest, const u64 *src, unsigned int ndigits){ int i; for (i = 0; i < ndigits; i++) dest[i] = src[i];} /* Returns sign of left - right. */static int vli_cmp(const u64 *left, const u64 *right, unsigned int ndigits){ int i; for (i = ndigits - 1; i >= 0; i--) { if (left[i] > right[i]) return 1; else if (left[i] < right[i]) return -1; } return 0;} /* Computes result = in << c, returning carry. Can modify in place * (if result == in). 0 < shift < 64. */static u64 vli_lshift(u64 *result, const u64 *in, unsigned int shift, unsigned int ndigits){ u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 temp = in[i]; result[i] = (temp << shift) | carry; carry = temp >> (64 - shift); } return carry;} /* Computes vli = vli >> 1. */static void vli_rshift1(u64 *vli, unsigned int ndigits){ u64 *end = vli; u64 carry = 0; vli += ndigits; while (vli-- > end) { u64 temp = *vli; *vli = (temp >> 1) | carry; carry = temp << 63; }} /* Computes result = left + right, returning carry. Can modify in place. */static u64 vli_add(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits){ u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 sum; sum = left[i] + right[i] + carry; if (sum != left[i]) carry = (sum < left[i]); result[i] = sum; } return carry;} /* Computes result = left - right, returning borrow. Can modify in place. */static u64 vli_sub(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits){ u64 borrow = 0; int i; for (i = 0; i < ndigits; i++) { u64 diff; diff = left[i] - right[i] - borrow; if (diff != left[i]) borrow = (diff > left[i]); result[i] = diff; } return borrow;} static uint128_t mul_64_64(u64 left, u64 right){ u64 a0 = left & 0xffffffffull; u64 a1 = left >> 32; u64 b0 = right & 0xffffffffull; u64 b1 = right >> 32; u64 m0 = a0 * b0; u64 m1 = a0 * b1; u64 m2 = a1 * b0; u64 m3 = a1 * b1; uint128_t result; m2 += (m0 >> 32); m2 += m1; /* Overflow */ if (m2 < m1) m3 += 0x100000000ull; result.m_low = (m0 & 0xffffffffull) | (m2 << 32); result.m_high = m3 + (m2 >> 32); return result;} static uint128_t add_128_128(uint128_t a, uint128_t b){ uint128_t result; result.m_low = a.m_low + b.m_low; result.m_high = a.m_high + b.m_high + (result.m_low < a.m_low); return result;} static void vli_mult(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits){ uint128_t r01 = { 0, 0 }; u64 r2 = 0; unsigned int i, k; /* Compute each digit of result in sequence, maintaining the * carries. */ for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i < ndigits; i++) { uint128_t product; product = mul_64_64(left[i], right[k - i]); r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low;} static void vli_square(u64 *result, const u64 *left, unsigned int ndigits){ uint128_t r01 = { 0, 0 }; u64 r2 = 0; int i, k; for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i <= k - i; i++) { uint128_t product; product = mul_64_64(left[i], left[k - i]); if (i < k - i) { r2 += product.m_high >> 63; product.m_high = (product.m_high << 1) | (product.m_low >> 63); product.m_low <<= 1; } r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low;} /* Computes result = (left + right) % mod. * Assumes that left < mod and right < mod, result != mod. */static void vli_mod_add(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits){ u64 carry; carry = vli_add(result, left, right, ndigits); /* result > mod (result = mod + remainder), so subtract mod to * get remainder. */ if (carry || vli_cmp(result, mod, ndigits) >= 0) vli_sub(result, result, mod, ndigits);} /* Computes result = (left - right) % mod. * Assumes that left < mod and right < mod, result != mod. */static void vli_mod_sub(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits){ u64 borrow = vli_sub(result, left, right, ndigits); /* In this case, p_result == -diff == (max int) - diff. * Since -x % d == d - x, we can get the correct result from * result + mod (with overflow). */ if (borrow) vli_add(result, result, mod, ndigits);} /* Computes p_result = p_product % curve_p. * See algorithm 5 and 6 from * http://www.isys.uni-klu.ac.at/PDF/2001-0126-MT.pdf */static void vli_mmod_fast_192(u64 *result, const u64 *product, const u64 *curve_prime, u64 *tmp){ const unsigned int ndigits = 3; int carry; vli_set(result, product, ndigits); vli_set(tmp, &product[3], ndigits); carry = vli_add(result, result, tmp, ndigits); tmp[0] = 0; tmp[1] = product[3]; tmp[2] = product[4]; carry += vli_add(result, result, tmp, ndigits); tmp[0] = tmp[1] = product[5]; tmp[2] = 0; carry += vli_add(result, result, tmp, ndigits); while (carry || vli_cmp(curve_prime, result, ndigits) != 1) carry -= vli_sub(result, result, curve_prime, ndigits);} /* Computes result = product % curve_prime * from http://www.nsa.gov/ia/_files/nist-routines.pdf */static void vli_mmod_fast_256(u64 *result, const u64 *product, const u64 *curve_prime, u64 *tmp){ int carry; const unsigned int ndigits = 4; /* t */ vli_set(result, product, ndigits); /* s1 */ tmp[0] = 0; tmp[1] = product[5] & 0xffffffff00000000ull; tmp[2] = product[6]; tmp[3] = product[7]; carry = vli_lshift(tmp, tmp, 1, ndigits); carry += vli_add(result, result, tmp, ndigits); /* s2 */ tmp[1] = product[6] << 32; tmp[2] = (product[6] >> 32) | (product[7] << 32); tmp[3] = product[7] >> 32; carry += vli_lshift(tmp, tmp, 1, ndigits); carry += vli_add(result, result, tmp, ndigits); /* s3 */ tmp[0] = product[4]; tmp[1] = product[5] & 0xffffffff; tmp[2] = 0; tmp[3] = product[7]; carry += vli_add(result, result, tmp, ndigits); /* s4 */ tmp[0] = (product[4] >> 32) | (product[5] << 32); tmp[1] = (product[5] >> 32) | (product[6] & 0xffffffff00000000ull); tmp[2] = product[7]; tmp[3] = (product[6] >> 32) | (product[4] << 32); carry += vli_add(result, result, tmp, ndigits); /* d1 */ tmp[0] = (product[5] >> 32) | (product[6] << 32); tmp[1] = (product[6] >> 32); tmp[2] = 0; tmp[3] = (product[4] & 0xffffffff) | (product[5] << 32); carry -= vli_sub(result, result, tmp, ndigits); /* d2 */ tmp[0] = product[6]; tmp[1] = product[7]; tmp[2] = 0; tmp[3] = (product[4] >> 32) | (product[5] & 0xffffffff00000000ull); carry -= vli_sub(result, result, tmp, ndigits); /* d3 */ tmp[0] = (product[6] >> 32) | (product[7] << 32); tmp[1] = (product[7] >> 32) | (product[4] << 32); tmp[2] = (product[4] >> 32) | (product[5] << 32); tmp[3] = (product[6] << 32); carry -= vli_sub(result, result, tmp, ndigits); /* d4 */ tmp[0] = product[7]; tmp[1] = product[4] & 0xffffffff00000000ull; tmp[2] = product[5]; tmp[3] = product[6] & 0xffffffff00000000ull; carry -= vli_sub(result, result, tmp, ndigits);Lines 1–500 of 1070. Load more
/* * Copyright (c) 2013, Kenneth MacKay * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are * met: * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include <linux/random.h> #include <linux/slab.h> #include <linux/swab.h> #include <linux/fips.h> #include <crypto/ecdh.h> #include <crypto/rng.h> #include "ecc.h" #include "ecc_curve_defs.h" typedef struct { u64 m_low; u64 m_high; } uint128_t; static inline const struct ecc_curve *ecc_get_curve(unsigned int curve_id) { switch (curve_id) { /* In FIPS mode only allow P256 and higher */ case ECC_CURVE_NIST_P192: return fips_enabled ? NULL : &nist_p192; case ECC_CURVE_NIST_P256: return &nist_p256; default: return NULL; } } static u64 *ecc_alloc_digits_space(unsigned int ndigits) { size_t len = ndigits * sizeof(u64); if (!len) return NULL; return kmalloc(len, GFP_KERNEL); } static void ecc_free_digits_space(u64 *space) { kzfree(space); } static struct ecc_point *ecc_alloc_point(unsigned int ndigits) { struct ecc_point *p = kmalloc(sizeof(*p), GFP_KERNEL); if (!p) return NULL; p->x = ecc_alloc_digits_space(ndigits); if (!p->x) goto err_alloc_x; p->y = ecc_alloc_digits_space(ndigits); if (!p->y) goto err_alloc_y; p->ndigits = ndigits; return p; err_alloc_y: ecc_free_digits_space(p->x); err_alloc_x: kfree(p); return NULL; } static void ecc_free_point(struct ecc_point *p) { if (!p) return; kzfree(p->x); kzfree(p->y); kzfree(p); } static void vli_clear(u64 *vli, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) vli[i] = 0; } /* Returns true if vli == 0, false otherwise. */ static bool vli_is_zero(const u64 *vli, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) { if (vli[i]) return false; } return true; } /* Returns nonzero if bit bit of vli is set. */ static u64 vli_test_bit(const u64 *vli, unsigned int bit) { return (vli[bit / 64] & ((u64)1 << (bit % 64))); } /* Counts the number of 64-bit "digits" in vli. */ static unsigned int vli_num_digits(const u64 *vli, unsigned int ndigits) { int i; /* Search from the end until we find a non-zero digit. * We do it in reverse because we expect that most digits will * be nonzero. */ for (i = ndigits - 1; i >= 0 && vli[i] == 0; i--); return (i + 1); } /* Counts the number of bits required for vli. */ static unsigned int vli_num_bits(const u64 *vli, unsigned int ndigits) { unsigned int i, num_digits; u64 digit; num_digits = vli_num_digits(vli, ndigits); if (num_digits == 0) return 0; digit = vli[num_digits - 1]; for (i = 0; digit; i++) digit >>= 1; return ((num_digits - 1) * 64 + i); } /* Sets dest = src. */ static void vli_set(u64 *dest, const u64 *src, unsigned int ndigits) { int i; for (i = 0; i < ndigits; i++) dest[i] = src[i]; } /* Returns sign of left - right. */ static int vli_cmp(const u64 *left, const u64 *right, unsigned int ndigits) { int i; for (i = ndigits - 1; i >= 0; i--) { if (left[i] > right[i]) return 1; else if (left[i] < right[i]) return -1; } return 0; } /* Computes result = in << c, returning carry. Can modify in place * (if result == in). 0 < shift < 64. */ static u64 vli_lshift(u64 *result, const u64 *in, unsigned int shift, unsigned int ndigits) { u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 temp = in[i]; result[i] = (temp << shift) | carry; carry = temp >> (64 - shift); } return carry; } /* Computes vli = vli >> 1. */ static void vli_rshift1(u64 *vli, unsigned int ndigits) { u64 *end = vli; u64 carry = 0; vli += ndigits; while (vli-- > end) { u64 temp = *vli; *vli = (temp >> 1) | carry; carry = temp << 63; } } /* Computes result = left + right, returning carry. Can modify in place. */ static u64 vli_add(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { u64 carry = 0; int i; for (i = 0; i < ndigits; i++) { u64 sum; sum = left[i] + right[i] + carry; if (sum != left[i]) carry = (sum < left[i]); result[i] = sum; } return carry; } /* Computes result = left - right, returning borrow. Can modify in place. */ static u64 vli_sub(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { u64 borrow = 0; int i; for (i = 0; i < ndigits; i++) { u64 diff; diff = left[i] - right[i] - borrow; if (diff != left[i]) borrow = (diff > left[i]); result[i] = diff; } return borrow; } static uint128_t mul_64_64(u64 left, u64 right) { u64 a0 = left & 0xffffffffull; u64 a1 = left >> 32; u64 b0 = right & 0xffffffffull; u64 b1 = right >> 32; u64 m0 = a0 * b0; u64 m1 = a0 * b1; u64 m2 = a1 * b0; u64 m3 = a1 * b1; uint128_t result; m2 += (m0 >> 32); m2 += m1; /* Overflow */ if (m2 < m1) m3 += 0x100000000ull; result.m_low = (m0 & 0xffffffffull) | (m2 << 32); result.m_high = m3 + (m2 >> 32); return result; } static uint128_t add_128_128(uint128_t a, uint128_t b) { uint128_t result; result.m_low = a.m_low + b.m_low; result.m_high = a.m_high + b.m_high + (result.m_low < a.m_low); return result; } static void vli_mult(u64 *result, const u64 *left, const u64 *right, unsigned int ndigits) { uint128_t r01 = { 0, 0 }; u64 r2 = 0; unsigned int i, k; /* Compute each digit of result in sequence, maintaining the * carries. */ for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i < ndigits; i++) { uint128_t product; product = mul_64_64(left[i], right[k - i]); r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low; } static void vli_square(u64 *result, const u64 *left, unsigned int ndigits) { uint128_t r01 = { 0, 0 }; u64 r2 = 0; int i, k; for (k = 0; k < ndigits * 2 - 1; k++) { unsigned int min; if (k < ndigits) min = 0; else min = (k + 1) - ndigits; for (i = min; i <= k && i <= k - i; i++) { uint128_t product; product = mul_64_64(left[i], left[k - i]); if (i < k - i) { r2 += product.m_high >> 63; product.m_high = (product.m_high << 1) | (product.m_low >> 63); product.m_low <<= 1; } r01 = add_128_128(r01, product); r2 += (r01.m_high < product.m_high); } result[k] = r01.m_low; r01.m_low = r01.m_high; r01.m_high = r2; r2 = 0; } result[ndigits * 2 - 1] = r01.m_low; } /* Computes result = (left + right) % mod. * Assumes that left < mod and right < mod, result != mod. */ static void vli_mod_add(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits) { u64 carry; carry = vli_add(result, left, right, ndigits); /* result > mod (result = mod + remainder), so subtract mod to * get remainder. */ if (carry || vli_cmp(result, mod, ndigits) >= 0) vli_sub(result, result, mod, ndigits); } /* Computes result = (left - right) % mod. * Assumes that left < mod and right < mod, result != mod. */ static void vli_mod_sub(u64 *result, const u64 *left, const u64 *right, const u64 *mod, unsigned int ndigits) { u64 borrow = vli_sub(result, left, right, ndigits); /* In this case, p_result == -diff == (max int) - diff. * Since -x % d == d - x, we can get the correct result from * result + mod (with overflow). */ if (borrow) vli_add(result, result, mod, ndigits); } /* Computes p_result = p_product % curve_p. * See algorithm 5 and 6 from * http://www.isys.uni-klu.ac.at/PDF/2001-0126-MT.pdf */ static void vli_mmod_fast_192(u64 *result, const u64 *product, const u64 *curve_prime, u64 *tmp) { const unsigned int ndigits = 3; int carry; vli_set(result, product, ndigits); vli_set(tmp, &product[3], ndigits); carry = vli_add(result, result, tmp, ndigits); tmp[0] = 0; tmp[1] = product[3]; tmp[2] = product[4]; carry += vli_add(result, result, tmp, ndigits); tmp[0] = tmp[1] = product[5]; tmp[2] = 0; carry += vli_add(result, result, tmp, ndigits); while (carry || vli_cmp(curve_prime, result, ndigits) != 1) carry -= vli_sub(result, result, curve_prime, ndigits); } /* Computes result = product % curve_prime * from http://www.nsa.gov/ia/_files/nist-routines.pdf */ static void vli_mmod_fast_256(u64 *result, const u64 *product, const u64 *curve_prime, u64 *tmp) { int carry; const unsigned int ndigits = 4; /* t */ vli_set(result, product, ndigits); /* s1 */ tmp[0] = 0; tmp[1] = product[5] & 0xffffffff00000000ull; tmp[2] = product[6]; tmp[3] = product[7]; carry = vli_lshift(tmp, tmp, 1, ndigits); carry += vli_add(result, result, tmp, ndigits); /* s2 */ tmp[1] = product[6] << 32; tmp[2] = (product[6] >> 32) | (product[7] << 32); tmp[3] = product[7] >> 32; carry += vli_lshift(tmp, tmp, 1, ndigits); carry += vli_add(result, result, tmp, ndigits); /* s3 */ tmp[0] = product[4]; tmp[1] = product[5] & 0xffffffff; tmp[2] = 0; tmp[3] = product[7]; carry += vli_add(result, result, tmp, ndigits); /* s4 */ tmp[0] = (product[4] >> 32) | (product[5] << 32); tmp[1] = (product[5] >> 32) | (product[6] & 0xffffffff00000000ull); tmp[2] = product[7]; tmp[3] = (product[6] >> 32) | (product[4] << 32); carry += vli_add(result, result, tmp, ndigits); /* d1 */ tmp[0] = (product[5] >> 32) | (product[6] << 32); tmp[1] = (product[6] >> 32); tmp[2] = 0; tmp[3] = (product[4] & 0xffffffff) | (product[5] << 32); carry -= vli_sub(result, result, tmp, ndigits); /* d2 */ tmp[0] = product[6]; tmp[1] = product[7]; tmp[2] = 0; tmp[3] = (product[4] >> 32) | (product[5] & 0xffffffff00000000ull); carry -= vli_sub(result, result, tmp, ndigits); /* d3 */ tmp[0] = (product[6] >> 32) | (product[7] << 32); tmp[1] = (product[7] >> 32) | (product[4] << 32); tmp[2] = (product[4] >> 32) | (product[5] << 32); tmp[3] = (product[6] << 32); carry -= vli_sub(result, result, tmp, ndigits); /* d4 */ tmp[0] = product[7]; tmp[1] = product[4] & 0xffffffff00000000ull; tmp[2] = product[5]; tmp[3] = product[6] & 0xffffffff00000000ull; carry -= vli_sub(result, result, tmp, ndigits);