43 	 * is extended to the 0..18 range.  in poly1305_inner()
51 	while (len > 0) {  in poly1305_inner()
61 			memset(tmp, 0, sizeof tmp);  in poly1305_inner()
72 		a[0] += v & 0x01FFF;  in poly1305_inner()
76 		a[1] += v & 0x01FFF;  in poly1305_inner()
79 		a[2] += v & 0x01FFF;  in poly1305_inner()
83 		a[3] += v & 0x01FFF;  in poly1305_inner()
87 		a[4] += v & 0x01FFF;  in poly1305_inner()
90 		a[5] += v & 0x01FFF;  in poly1305_inner()
94 		a[6] += v & 0x01FFF;  in poly1305_inner()
97 		a[7] += v & 0x01FFF;  in poly1305_inner()
99 		a[8] += v & 0x01FFF;  in poly1305_inner()
102 		a[9] += v | 0x00800;  in poly1305_inner()
122 		cc1 = 0;  in poly1305_inner()
123 		for (u = 0; u < 10; u ++) {  in poly1305_inner()
127 				+ MUL15(a[0], r[u + 9 - 0])  in poly1305_inner()
132 			b[u] = s & 0x1FFF;  in poly1305_inner()
135 		cc2 = 0;  in poly1305_inner()
136 		for (u = 0; u < 10; u ++) {  in poly1305_inner()
145 			b[u] = s & 0x1FFF;  in poly1305_inner()
152 		 * propagate them into a[0] and a[1].  in poly1305_inner()
155 		z += (z << 2) + a[0];  in poly1305_inner()
156 		a[0] = z & 0x1FFF;  in poly1305_inner()
178 	memset(pkey, 0, sizeof pkey);  in br_poly1305_ctmul32_run()
179 	ichacha(key, iv, 0, pkey, sizeof pkey);  in br_poly1305_ctmul32_run()
200 	z = br_dec32le(pkey) & 0x03FFFFFF;  in br_poly1305_ctmul32_run()
201 	r[9] = z & 0x1FFF;  in br_poly1305_ctmul32_run()
203 	z = (br_dec32le(pkey +  3) >> 2) & 0x03FFFF03;  in br_poly1305_ctmul32_run()
204 	r[11] = z & 0x1FFF;  in br_poly1305_ctmul32_run()
206 	z = (br_dec32le(pkey +  6) >> 4) & 0x03FFC0FF;  in br_poly1305_ctmul32_run()
207 	r[13] = z & 0x1FFF;  in br_poly1305_ctmul32_run()
209 	z = (br_dec32le(pkey +  9) >> 6) & 0x03F03FFF;  in br_poly1305_ctmul32_run()
210 	r[15] = z & 0x1FFF;  in br_poly1305_ctmul32_run()
212 	z = (br_dec32le(pkey + 12) >> 8) & 0x000FFFFF;  in br_poly1305_ctmul32_run()
213 	r[17] = z & 0x1FFF;  in br_poly1305_ctmul32_run()
219 	for (i = 0; i < 9; i ++) {  in br_poly1305_ctmul32_run()
224 	 * Accumulator is 0.  in br_poly1305_ctmul32_run()
226 	memset(acc, 0, sizeof acc);  in br_poly1305_ctmul32_run()
245 	cc = 0;  in br_poly1305_ctmul32_run()
248 		acc[i] = z & 0x1FFF;  in br_poly1305_ctmul32_run()
251 	z = acc[0] + cc + (cc << 2);  in br_poly1305_ctmul32_run()
252 	acc[0] = z & 0x1FFF;  in br_poly1305_ctmul32_run()
260 	ctl = GT(acc[0], 0x1FFA);  in br_poly1305_ctmul32_run()
262 		ctl &= EQ(acc[i], 0x1FFF);  in br_poly1305_ctmul32_run()
264 	acc[0] = MUX(ctl, acc[0] - 0x1FFB, acc[0]);  in br_poly1305_ctmul32_run()
274 	z = acc[0] + (acc[1] << 13) + br_dec16le(pkey + 16);  in br_poly1305_ctmul32_run()
275 	br_enc16le((unsigned char *)tag, z & 0xFFFF);  in br_poly1305_ctmul32_run()
277 	br_enc16le((unsigned char *)tag + 2, z & 0xFFFF);  in br_poly1305_ctmul32_run()
279 	br_enc16le((unsigned char *)tag + 4, z & 0xFFFF);  in br_poly1305_ctmul32_run()
281 	br_enc16le((unsigned char *)tag + 6, z & 0xFFFF);  in br_poly1305_ctmul32_run()
283 	br_enc16le((unsigned char *)tag + 8, z & 0xFFFF);  in br_poly1305_ctmul32_run()
285 	br_enc16le((unsigned char *)tag + 10, z & 0xFFFF);  in br_poly1305_ctmul32_run()
287 	br_enc16le((unsigned char *)tag + 12, z & 0xFFFF);  in br_poly1305_ctmul32_run()
289 	br_enc16le((unsigned char *)tag + 14, z & 0xFFFF);  in br_poly1305_ctmul32_run()