55  * If the current accumulator is a = a0 + a1*W + a2*W^2 (where W = 2^44)
60  *       + (a0*r2 + a1*r1 + a2*r0) * W^2
61  *       + (a1*r2 + a2*r1) * W^3
62  *       + (a2*r2) * W^4
68  *  b0 = a0*r0 + a1*u2 + a2*u1
69  *  b1 = a0*r1 + a1*r0 + a2*u2
70  *  b2 = a0*r2 + a1*r1 + a2*r0
75  *  b0 = a0*r0 + a1*u2 + a2*t1
76  *  b1 = a0*r1 + a1*r0 + a2*t2
77  *  b2 = a0*r2 + a1*r1 + a2*r0
119 		MUL128(mxhi, mxlo, a2, m2); \  in poly1305_inner_big()
125 	uint64_t a0, a1, a2;  in poly1305_inner_big()  local
136 	a2 = acc[2];  in poly1305_inner_big()
150 		a2 += v2 + ((uint64_t)1 << 40);  in poly1305_inner_big()
156 		a2 = c2 + d1;  in poly1305_inner_big()
165 		a2 += v2 + ((uint64_t)1 << 40);  in poly1305_inner_big()
171 		a2 = c2 + d1;  in poly1305_inner_big()
180 		a2 += v2 + ((uint64_t)1 << 40);  in poly1305_inner_big()
186 		a2 = c2 + d1;  in poly1305_inner_big()
195 		a2 += v2 + ((uint64_t)1 << 40);  in poly1305_inner_big()
201 		a2 = c2 + d1;  in poly1305_inner_big()
205 		a2 += a1 >> 44;  in poly1305_inner_big()
207 		a0 += 20 * (a2 >> 44);  in poly1305_inner_big()
208 		a2 &= MASK44;  in poly1305_inner_big()
215 	acc[2] = a2;  in poly1305_inner_big()
224 	uint64_t a0, a1, a2;  in poly1305_inner_small()  local
235 	a2 = acc[2];  in poly1305_inner_small()
258 		a2 += v2 + ((uint64_t)1 << 40);  in poly1305_inner_small()
268 		MUL128(mxhi, mxlo, a2, m2); \  in poly1305_inner_small()
281 		a2 = c2 + d1;  in poly1305_inner_small()
285 		a2 += a1 >> 44;  in poly1305_inner_small()
287 		a0 += 20 * (a2 >> 44);  in poly1305_inner_small()
288 		a2 &= MASK44;  in poly1305_inner_small()
295 	acc[2] = a2;  in poly1305_inner_small()