52 		unsigned char tmp[16];  in poly1305_inner()
54 		unsigned u, v;  in poly1305_inner()  local
60 		if (len < 16) {  in poly1305_inner()
64 			len = 16;  in poly1305_inner()
71 		v = br_dec16le(buf);  in poly1305_inner()
72 		a[0] += v & 0x01FFF;  in poly1305_inner()
73 		v >>= 13;  in poly1305_inner()
74 		v |= buf[2] << 3;  in poly1305_inner()
75 		v |= buf[3] << 11;  in poly1305_inner()
76 		a[1] += v & 0x01FFF;  in poly1305_inner()
77 		v >>= 13;  in poly1305_inner()
78 		v |= buf[4] << 6;  in poly1305_inner()
79 		a[2] += v & 0x01FFF;  in poly1305_inner()
80 		v >>= 13;  in poly1305_inner()
81 		v |= buf[5] << 1;  in poly1305_inner()
82 		v |= buf[6] << 9;  in poly1305_inner()
83 		a[3] += v & 0x01FFF;  in poly1305_inner()
84 		v >>= 13;  in poly1305_inner()
85 		v |= buf[7] << 4;  in poly1305_inner()
86 		v |= buf[8] << 12;  in poly1305_inner()
87 		a[4] += v & 0x01FFF;  in poly1305_inner()
88 		v >>= 13;  in poly1305_inner()
89 		v |= buf[9] << 7;  in poly1305_inner()
90 		a[5] += v & 0x01FFF;  in poly1305_inner()
91 		v >>= 13;  in poly1305_inner()
92 		v |= buf[10] << 2;  in poly1305_inner()
93 		v |= buf[11] << 10;  in poly1305_inner()
94 		a[6] += v & 0x01FFF;  in poly1305_inner()
95 		v >>= 13;  in poly1305_inner()
96 		v |= buf[12] << 5;  in poly1305_inner()
97 		a[7] += v & 0x01FFF;  in poly1305_inner()
98 		v = br_dec16le(buf + 13);  in poly1305_inner()
99 		a[8] += v & 0x01FFF;  in poly1305_inner()
100 		v >>= 13;  in poly1305_inner()
101 		v |= buf[15] << 3;  in poly1305_inner()
102 		a[9] += v | 0x00800;  in poly1305_inner()
159 		buf += 16;  in poly1305_inner()
160 		len -= 16;  in poly1305_inner()
170 	unsigned char pkey[32], foot[16];  in br_poly1305_ctmul32_run()
175 	 * Compute the MAC key. The 'r' value is the first 16 bytes of  in br_poly1305_ctmul32_run()
192 	 * are meant to be padded with zeros up to the next multiple of 16,  in br_poly1305_ctmul32_run()
193 	 * and the length of the footer is 16 bytes as well.  in br_poly1305_ctmul32_run()
211 	r[16] = z >> 13;  in br_poly1305_ctmul32_run()
274 	z = acc[0] + (acc[1] << 13) + br_dec16le(pkey + 16);  in br_poly1305_ctmul32_run()
276 	z = (z >> 16) + (acc[2] << 10) + br_dec16le(pkey + 18);  in br_poly1305_ctmul32_run()
278 	z = (z >> 16) + (acc[3] << 7) + br_dec16le(pkey + 20);  in br_poly1305_ctmul32_run()
280 	z = (z >> 16) + (acc[4] << 4) + br_dec16le(pkey + 22);  in br_poly1305_ctmul32_run()
282 	z = (z >> 16) + (acc[5] << 1) + (acc[6] << 14) + br_dec16le(pkey + 24);  in br_poly1305_ctmul32_run()
284 	z = (z >> 16) + (acc[7] << 11) + br_dec16le(pkey + 26);  in br_poly1305_ctmul32_run()
286 	z = (z >> 16) + (acc[8] << 8) + br_dec16le(pkey + 28);  in br_poly1305_ctmul32_run()
288 	z = (z >> 16) + (acc[9] << 5) + br_dec16le(pkey + 30);  in br_poly1305_ctmul32_run()