xref: /freebsd/sys/crypto/openssl/arm/keccak1600-armv4.S (revision bdd1243df58e60e85101c09001d9812a789b6bc4) 
1/* $FreeBSD$ */
2/* Do not modify. This file is auto-generated from keccak1600-armv4.pl. */
3#include "arm_arch.h"
4
5.text
6
7#if defined(__thumb2__)
8.syntax	unified
9.thumb
10#else
11.code	32
12#endif
13
14.type	iotas32, %object
15.align	5
16iotas32:
17.long	0x00000001, 0x00000000
18.long	0x00000000, 0x00000089
19.long	0x00000000, 0x8000008b
20.long	0x00000000, 0x80008080
21.long	0x00000001, 0x0000008b
22.long	0x00000001, 0x00008000
23.long	0x00000001, 0x80008088
24.long	0x00000001, 0x80000082
25.long	0x00000000, 0x0000000b
26.long	0x00000000, 0x0000000a
27.long	0x00000001, 0x00008082
28.long	0x00000000, 0x00008003
29.long	0x00000001, 0x0000808b
30.long	0x00000001, 0x8000000b
31.long	0x00000001, 0x8000008a
32.long	0x00000001, 0x80000081
33.long	0x00000000, 0x80000081
34.long	0x00000000, 0x80000008
35.long	0x00000000, 0x00000083
36.long	0x00000000, 0x80008003
37.long	0x00000001, 0x80008088
38.long	0x00000000, 0x80000088
39.long	0x00000001, 0x00008000
40.long	0x00000000, 0x80008082
41.size	iotas32,.-iotas32
42
43.type	KeccakF1600_int, %function
44.align	5
45KeccakF1600_int:
46	add	r9,sp,#176
47	add	r12,sp,#0
48	add	r10,sp,#40
49	ldmia	r9,{r4,r5,r6,r7,r8,r9}		@ A[4][2..4]
50KeccakF1600_enter:
51	str	lr,[sp,#440]
52	eor	r11,r11,r11
53	str	r11,[sp,#444]
54	b	.Lround2x
55
56.align	4
57.Lround2x:
58	ldmia	r12,{r0,r1,r2,r3}		@ A[0][0..1]
59	ldmia	r10,{r10,r11,r12,r14}	@ A[1][0..1]
60#ifdef	__thumb2__
61	eor	r0,r0,r10
62	eor	r1,r1,r11
63	eor	r2,r2,r12
64	ldrd	r10,r11,[sp,#56]
65	eor	r3,r3,r14
66	ldrd	r12,r14,[sp,#64]
67	eor	r4,r4,r10
68	eor	r5,r5,r11
69	eor	r6,r6,r12
70	ldrd	r10,r11,[sp,#72]
71	eor	r7,r7,r14
72	ldrd	r12,r14,[sp,#80]
73	eor	r8,r8,r10
74	eor	r9,r9,r11
75	eor	r0,r0,r12
76	ldrd	r10,r11,[sp,#88]
77	eor	r1,r1,r14
78	ldrd	r12,r14,[sp,#96]
79	eor	r2,r2,r10
80	eor	r3,r3,r11
81	eor	r4,r4,r12
82	ldrd	r10,r11,[sp,#104]
83	eor	r5,r5,r14
84	ldrd	r12,r14,[sp,#112]
85	eor	r6,r6,r10
86	eor	r7,r7,r11
87	eor	r8,r8,r12
88	ldrd	r10,r11,[sp,#120]
89	eor	r9,r9,r14
90	ldrd	r12,r14,[sp,#128]
91	eor	r0,r0,r10
92	eor	r1,r1,r11
93	eor	r2,r2,r12
94	ldrd	r10,r11,[sp,#136]
95	eor	r3,r3,r14
96	ldrd	r12,r14,[sp,#144]
97	eor	r4,r4,r10
98	eor	r5,r5,r11
99	eor	r6,r6,r12
100	ldrd	r10,r11,[sp,#152]
101	eor	r7,r7,r14
102	ldrd	r12,r14,[sp,#160]
103	eor	r8,r8,r10
104	eor	r9,r9,r11
105	eor	r0,r0,r12
106	ldrd	r10,r11,[sp,#168]
107	eor	r1,r1,r14
108	ldrd	r12,r14,[sp,#16]
109	eor	r2,r2,r10
110	eor	r3,r3,r11
111	eor	r4,r4,r12
112	ldrd	r10,r11,[sp,#24]
113	eor	r5,r5,r14
114	ldrd	r12,r14,[sp,#32]
115#else
116	eor	r0,r0,r10
117	add	r10,sp,#56
118	eor	r1,r1,r11
119	eor	r2,r2,r12
120	eor	r3,r3,r14
121	ldmia	r10,{r10,r11,r12,r14}	@ A[1][2..3]
122	eor	r4,r4,r10
123	add	r10,sp,#72
124	eor	r5,r5,r11
125	eor	r6,r6,r12
126	eor	r7,r7,r14
127	ldmia	r10,{r10,r11,r12,r14}	@ A[1][4]..A[2][0]
128	eor	r8,r8,r10
129	add	r10,sp,#88
130	eor	r9,r9,r11
131	eor	r0,r0,r12
132	eor	r1,r1,r14
133	ldmia	r10,{r10,r11,r12,r14}	@ A[2][1..2]
134	eor	r2,r2,r10
135	add	r10,sp,#104
136	eor	r3,r3,r11
137	eor	r4,r4,r12
138	eor	r5,r5,r14
139	ldmia	r10,{r10,r11,r12,r14}	@ A[2][3..4]
140	eor	r6,r6,r10
141	add	r10,sp,#120
142	eor	r7,r7,r11
143	eor	r8,r8,r12
144	eor	r9,r9,r14
145	ldmia	r10,{r10,r11,r12,r14}	@ A[3][0..1]
146	eor	r0,r0,r10
147	add	r10,sp,#136
148	eor	r1,r1,r11
149	eor	r2,r2,r12
150	eor	r3,r3,r14
151	ldmia	r10,{r10,r11,r12,r14}	@ A[3][2..3]
152	eor	r4,r4,r10
153	add	r10,sp,#152
154	eor	r5,r5,r11
155	eor	r6,r6,r12
156	eor	r7,r7,r14
157	ldmia	r10,{r10,r11,r12,r14}	@ A[3][4]..A[4][0]
158	eor	r8,r8,r10
159	ldr	r10,[sp,#168]		@ A[4][1]
160	eor	r9,r9,r11
161	ldr	r11,[sp,#168+4]
162	eor	r0,r0,r12
163	ldr	r12,[sp,#16]		@ A[0][2]
164	eor	r1,r1,r14
165	ldr	r14,[sp,#16+4]
166	eor	r2,r2,r10
167	add	r10,sp,#24
168	eor	r3,r3,r11
169	eor	r4,r4,r12
170	eor	r5,r5,r14
171	ldmia	r10,{r10,r11,r12,r14}	@ A[0][3..4]
172#endif
173	eor	r6,r6,r10
174	eor	r7,r7,r11
175	eor	r8,r8,r12
176	eor	r9,r9,r14
177
178	eor	r10,r0,r5,ror#32-1	@ E[0] = ROL64(C[2], 1) ^ C[0];
179#ifndef	__thumb2__
180	str	r10,[sp,#208]		@ D[1] = E[0]
181#endif
182	eor	r11,r1,r4
183#ifndef	__thumb2__
184	str	r11,[sp,#208+4]
185#else
186	strd	r10,r11,[sp,#208]		@ D[1] = E[0]
187#endif
188	eor	r12,r6,r1,ror#32-1	@ E[1] = ROL64(C[0], 1) ^ C[3];
189	eor	r14,r7,r0
190#ifndef	__thumb2__
191	str	r12,[sp,#232]		@ D[4] = E[1]
192#endif
193	eor	r0,r8,r3,ror#32-1	@ C[0] = ROL64(C[1], 1) ^ C[4];
194#ifndef	__thumb2__
195	str	r14,[sp,#232+4]
196#else
197	strd	r12,r14,[sp,#232]		@ D[4] = E[1]
198#endif
199	eor	r1,r9,r2
200#ifndef	__thumb2__
201	str	r0,[sp,#200]		@ D[0] = C[0]
202#endif
203	eor	r2,r2,r7,ror#32-1	@ C[1] = ROL64(C[3], 1) ^ C[1];
204#ifndef	__thumb2__
205	ldr	r7,[sp,#144]
206#endif
207	eor	r3,r3,r6
208#ifndef	__thumb2__
209	str	r1,[sp,#200+4]
210#else
211	strd	r0,r1,[sp,#200]		@ D[0] = C[0]
212#endif
213#ifndef	__thumb2__
214	ldr	r6,[sp,#144+4]
215#else
216	ldrd	r7,r6,[sp,#144]
217#endif
218#ifndef	__thumb2__
219	str	r2,[sp,#216]		@ D[2] = C[1]
220#endif
221	eor	r4,r4,r9,ror#32-1	@ C[2] = ROL64(C[4], 1) ^ C[2];
222#ifndef	__thumb2__
223	str	r3,[sp,#216+4]
224#else
225	strd	r2,r3,[sp,#216]		@ D[2] = C[1]
226#endif
227	eor	r5,r5,r8
228
229#ifndef	__thumb2__
230	ldr	r8,[sp,#192]
231#endif
232#ifndef	__thumb2__
233	ldr	r9,[sp,#192+4]
234#else
235	ldrd	r8,r9,[sp,#192]
236#endif
237#ifndef	__thumb2__
238	str	r4,[sp,#224]		@ D[3] = C[2]
239#endif
240	eor	r7,r7,r4
241#ifndef	__thumb2__
242	str	r5,[sp,#224+4]
243#else
244	strd	r4,r5,[sp,#224]		@ D[3] = C[2]
245#endif
246	eor	r6,r6,r5
247#ifndef	__thumb2__
248	ldr	r4,[sp,#0]
249#endif
250	@ mov	r7,r7,ror#32-10		@ C[3] = ROL64(A[3][3] ^ C[2], rhotates[3][3]);   /* D[3] */
251	@ mov	r6,r6,ror#32-11
252#ifndef	__thumb2__
253	ldr	r5,[sp,#0+4]
254#else
255	ldrd	r4,r5,[sp,#0]
256#endif
257	eor	r8,r8,r12
258	eor	r9,r9,r14
259#ifndef	__thumb2__
260	ldr	r12,[sp,#96]
261#endif
262	eor	r0,r0,r4
263#ifndef	__thumb2__
264	ldr	r14,[sp,#96+4]
265#else
266	ldrd	r12,r14,[sp,#96]
267#endif
268	@ mov	r8,r8,ror#32-7		@ C[4] = ROL64(A[4][4] ^ E[1], rhotates[4][4]);   /* D[4] */
269	@ mov	r9,r9,ror#32-7
270	eor	r1,r1,r5		@ C[0] =       A[0][0] ^ C[0];
271	eor	r12,r12,r2
272#ifndef	__thumb2__
273	ldr	r2,[sp,#48]
274#endif
275	eor	r14,r14,r3
276#ifndef	__thumb2__
277	ldr	r3,[sp,#48+4]
278#else
279	ldrd	r2,r3,[sp,#48]
280#endif
281	mov	r5,r12,ror#32-21		@ C[2] = ROL64(A[2][2] ^ C[1], rhotates[2][2]);
282	ldr	r12,[sp,#444]			@ load counter
283	eor	r2,r2,r10
284	adr	r10,iotas32
285	mov	r4,r14,ror#32-22
286	add	r14,r10,r12
287	eor	r3,r3,r11
288	ldmia	r14,{r10,r11}		@ iotas[i]
289	bic	r12,r4,r2,ror#32-22
290	bic	r14,r5,r3,ror#32-22
291	mov	r2,r2,ror#32-22		@ C[1] = ROL64(A[1][1] ^ E[0], rhotates[1][1]);
292	mov	r3,r3,ror#32-22
293	eor	r12,r12,r0
294	eor	r14,r14,r1
295	eor	r10,r10,r12
296	eor	r11,r11,r14
297#ifndef	__thumb2__
298	str	r10,[sp,#240]		@ R[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i];
299#endif
300	bic	r12,r6,r4,ror#11
301#ifndef	__thumb2__
302	str	r11,[sp,#240+4]
303#else
304	strd	r10,r11,[sp,#240]		@ R[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i];
305#endif
306	bic	r14,r7,r5,ror#10
307	bic	r10,r8,r6,ror#32-(11-7)
308	bic	r11,r9,r7,ror#32-(10-7)
309	eor	r12,r2,r12,ror#32-11
310#ifndef	__thumb2__
311	str	r12,[sp,#248]		@ R[0][1] = C[1] ^ (~C[2] & C[3]);
312#endif
313	eor	r14,r3,r14,ror#32-10
314#ifndef	__thumb2__
315	str	r14,[sp,#248+4]
316#else
317	strd	r12,r14,[sp,#248]		@ R[0][1] = C[1] ^ (~C[2] & C[3]);
318#endif
319	eor	r10,r4,r10,ror#32-7
320	eor	r11,r5,r11,ror#32-7
321#ifndef	__thumb2__
322	str	r10,[sp,#256]		@ R[0][2] = C[2] ^ (~C[3] & C[4]);
323#endif
324	bic	r12,r0,r8,ror#32-7
325#ifndef	__thumb2__
326	str	r11,[sp,#256+4]
327#else
328	strd	r10,r11,[sp,#256]		@ R[0][2] = C[2] ^ (~C[3] & C[4]);
329#endif
330	bic	r14,r1,r9,ror#32-7
331	eor	r12,r12,r6,ror#32-11
332#ifndef	__thumb2__
333	str	r12,[sp,#264]		@ R[0][3] = C[3] ^ (~C[4] & C[0]);
334#endif
335	eor	r14,r14,r7,ror#32-10
336#ifndef	__thumb2__
337	str	r14,[sp,#264+4]
338#else
339	strd	r12,r14,[sp,#264]		@ R[0][3] = C[3] ^ (~C[4] & C[0]);
340#endif
341	bic	r10,r2,r0
342	add	r14,sp,#224
343#ifndef	__thumb2__
344	ldr	r0,[sp,#24]		@ A[0][3]
345#endif
346	bic	r11,r3,r1
347#ifndef	__thumb2__
348	ldr	r1,[sp,#24+4]
349#else
350	ldrd	r0,r1,[sp,#24]		@ A[0][3]
351#endif
352	eor	r10,r10,r8,ror#32-7
353	eor	r11,r11,r9,ror#32-7
354#ifndef	__thumb2__
355	str	r10,[sp,#272]		@ R[0][4] = C[4] ^ (~C[0] & C[1]);
356#endif
357	add	r9,sp,#200
358#ifndef	__thumb2__
359	str	r11,[sp,#272+4]
360#else
361	strd	r10,r11,[sp,#272]		@ R[0][4] = C[4] ^ (~C[0] & C[1]);
362#endif
363
364	ldmia	r14,{r10,r11,r12,r14}	@ D[3..4]
365	ldmia	r9,{r6,r7,r8,r9}		@ D[0..1]
366
367#ifndef	__thumb2__
368	ldr	r2,[sp,#72]		@ A[1][4]
369#endif
370	eor	r0,r0,r10
371#ifndef	__thumb2__
372	ldr	r3,[sp,#72+4]
373#else
374	ldrd	r2,r3,[sp,#72]		@ A[1][4]
375#endif
376	eor	r1,r1,r11
377	@ mov	r0,r0,ror#32-14		@ C[0] = ROL64(A[0][3] ^ D[3], rhotates[0][3]);
378#ifndef	__thumb2__
379	ldr	r10,[sp,#128]		@ A[3][1]
380#endif
381	@ mov	r1,r1,ror#32-14
382#ifndef	__thumb2__
383	ldr	r11,[sp,#128+4]
384#else
385	ldrd	r10,r11,[sp,#128]		@ A[3][1]
386#endif
387
388	eor	r2,r2,r12
389#ifndef	__thumb2__
390	ldr	r4,[sp,#80]		@ A[2][0]
391#endif
392	eor	r3,r3,r14
393#ifndef	__thumb2__
394	ldr	r5,[sp,#80+4]
395#else
396	ldrd	r4,r5,[sp,#80]		@ A[2][0]
397#endif
398	@ mov	r2,r2,ror#32-10		@ C[1] = ROL64(A[1][4] ^ D[4], rhotates[1][4]);
399	@ mov	r3,r3,ror#32-10
400
401	eor	r6,r6,r4
402#ifndef	__thumb2__
403	ldr	r12,[sp,#216]		@ D[2]
404#endif
405	eor	r7,r7,r5
406#ifndef	__thumb2__
407	ldr	r14,[sp,#216+4]
408#else
409	ldrd	r12,r14,[sp,#216]		@ D[2]
410#endif
411	mov	r5,r6,ror#32-1		@ C[2] = ROL64(A[2][0] ^ D[0], rhotates[2][0]);
412	mov	r4,r7,ror#32-2
413
414	eor	r10,r10,r8
415#ifndef	__thumb2__
416	ldr	r8,[sp,#176]		@ A[4][2]
417#endif
418	eor	r11,r11,r9
419#ifndef	__thumb2__
420	ldr	r9,[sp,#176+4]
421#else
422	ldrd	r8,r9,[sp,#176]		@ A[4][2]
423#endif
424	mov	r7,r10,ror#32-22		@ C[3] = ROL64(A[3][1] ^ D[1], rhotates[3][1]);
425	mov	r6,r11,ror#32-23
426
427	bic	r10,r4,r2,ror#32-10
428	bic	r11,r5,r3,ror#32-10
429	eor	r12,r12,r8
430	eor	r14,r14,r9
431	mov	r9,r12,ror#32-30		@ C[4] = ROL64(A[4][2] ^ D[2], rhotates[4][2]);
432	mov	r8,r14,ror#32-31
433	eor	r10,r10,r0,ror#32-14
434	eor	r11,r11,r1,ror#32-14
435#ifndef	__thumb2__
436	str	r10,[sp,#280]		@ R[1][0] = C[0] ^ (~C[1] & C[2])
437#endif
438	bic	r12,r6,r4
439#ifndef	__thumb2__
440	str	r11,[sp,#280+4]
441#else
442	strd	r10,r11,[sp,#280]		@ R[1][0] = C[0] ^ (~C[1] & C[2])
443#endif
444	bic	r14,r7,r5
445	eor	r12,r12,r2,ror#32-10
446#ifndef	__thumb2__
447	str	r12,[sp,#288]		@ R[1][1] = C[1] ^ (~C[2] & C[3]);
448#endif
449	eor	r14,r14,r3,ror#32-10
450#ifndef	__thumb2__
451	str	r14,[sp,#288+4]
452#else
453	strd	r12,r14,[sp,#288]		@ R[1][1] = C[1] ^ (~C[2] & C[3]);
454#endif
455	bic	r10,r8,r6
456	bic	r11,r9,r7
457	bic	r12,r0,r8,ror#14
458	bic	r14,r1,r9,ror#14
459	eor	r10,r10,r4
460	eor	r11,r11,r5
461#ifndef	__thumb2__
462	str	r10,[sp,#296]		@ R[1][2] = C[2] ^ (~C[3] & C[4]);
463#endif
464	bic	r2,r2,r0,ror#32-(14-10)
465#ifndef	__thumb2__
466	str	r11,[sp,#296+4]
467#else
468	strd	r10,r11,[sp,#296]		@ R[1][2] = C[2] ^ (~C[3] & C[4]);
469#endif
470	eor	r12,r6,r12,ror#32-14
471	bic	r11,r3,r1,ror#32-(14-10)
472#ifndef	__thumb2__
473	str	r12,[sp,#304]		@ R[1][3] = C[3] ^ (~C[4] & C[0]);
474#endif
475	eor	r14,r7,r14,ror#32-14
476#ifndef	__thumb2__
477	str	r14,[sp,#304+4]
478#else
479	strd	r12,r14,[sp,#304]		@ R[1][3] = C[3] ^ (~C[4] & C[0]);
480#endif
481	add	r12,sp,#208
482#ifndef	__thumb2__
483	ldr	r1,[sp,#8]		@ A[0][1]
484#endif
485	eor	r10,r8,r2,ror#32-10
486#ifndef	__thumb2__
487	ldr	r0,[sp,#8+4]
488#else
489	ldrd	r1,r0,[sp,#8]		@ A[0][1]
490#endif
491	eor	r11,r9,r11,ror#32-10
492#ifndef	__thumb2__
493	str	r10,[sp,#312]		@ R[1][4] = C[4] ^ (~C[0] & C[1]);
494#endif
495#ifndef	__thumb2__
496	str	r11,[sp,#312+4]
497#else
498	strd	r10,r11,[sp,#312]		@ R[1][4] = C[4] ^ (~C[0] & C[1]);
499#endif
500
501	add	r9,sp,#224
502	ldmia	r12,{r10,r11,r12,r14}	@ D[1..2]
503#ifndef	__thumb2__
504	ldr	r2,[sp,#56]		@ A[1][2]
505#endif
506#ifndef	__thumb2__
507	ldr	r3,[sp,#56+4]
508#else
509	ldrd	r2,r3,[sp,#56]		@ A[1][2]
510#endif
511	ldmia	r9,{r6,r7,r8,r9}		@ D[3..4]
512
513	eor	r1,r1,r10
514#ifndef	__thumb2__
515	ldr	r4,[sp,#104]		@ A[2][3]
516#endif
517	eor	r0,r0,r11
518#ifndef	__thumb2__
519	ldr	r5,[sp,#104+4]
520#else
521	ldrd	r4,r5,[sp,#104]		@ A[2][3]
522#endif
523	mov	r0,r0,ror#32-1		@ C[0] = ROL64(A[0][1] ^ D[1], rhotates[0][1]);
524
525	eor	r2,r2,r12
526#ifndef	__thumb2__
527	ldr	r10,[sp,#152]		@ A[3][4]
528#endif
529	eor	r3,r3,r14
530#ifndef	__thumb2__
531	ldr	r11,[sp,#152+4]
532#else
533	ldrd	r10,r11,[sp,#152]		@ A[3][4]
534#endif
535	@ mov	r2,r2,ror#32-3		@ C[1] = ROL64(A[1][2] ^ D[2], rhotates[1][2]);
536#ifndef	__thumb2__
537	ldr	r12,[sp,#200]		@ D[0]
538#endif
539	@ mov	r3,r3,ror#32-3
540#ifndef	__thumb2__
541	ldr	r14,[sp,#200+4]
542#else
543	ldrd	r12,r14,[sp,#200]		@ D[0]
544#endif
545
546	eor	r4,r4,r6
547	eor	r5,r5,r7
548	@ mov	r5,r6,ror#32-12		@ C[2] = ROL64(A[2][3] ^ D[3], rhotates[2][3]);
549	@ mov	r4,r7,ror#32-13		@ [track reverse order below]
550
551	eor	r10,r10,r8
552#ifndef	__thumb2__
553	ldr	r8,[sp,#160]		@ A[4][0]
554#endif
555	eor	r11,r11,r9
556#ifndef	__thumb2__
557	ldr	r9,[sp,#160+4]
558#else
559	ldrd	r8,r9,[sp,#160]		@ A[4][0]
560#endif
561	mov	r6,r10,ror#32-4		@ C[3] = ROL64(A[3][4] ^ D[4], rhotates[3][4]);
562	mov	r7,r11,ror#32-4
563
564	eor	r12,r12,r8
565	eor	r14,r14,r9
566	mov	r8,r12,ror#32-9		@ C[4] = ROL64(A[4][0] ^ D[0], rhotates[4][0]);
567	mov	r9,r14,ror#32-9
568
569	bic	r10,r5,r2,ror#13-3
570	bic	r11,r4,r3,ror#12-3
571	bic	r12,r6,r5,ror#32-13
572	bic	r14,r7,r4,ror#32-12
573	eor	r10,r0,r10,ror#32-13
574	eor	r11,r1,r11,ror#32-12
575#ifndef	__thumb2__
576	str	r10,[sp,#320]		@ R[2][0] = C[0] ^ (~C[1] & C[2])
577#endif
578	eor	r12,r12,r2,ror#32-3
579#ifndef	__thumb2__
580	str	r11,[sp,#320+4]
581#else
582	strd	r10,r11,[sp,#320]		@ R[2][0] = C[0] ^ (~C[1] & C[2])
583#endif
584	eor	r14,r14,r3,ror#32-3
585#ifndef	__thumb2__
586	str	r12,[sp,#328]		@ R[2][1] = C[1] ^ (~C[2] & C[3]);
587#endif
588	bic	r10,r8,r6
589	bic	r11,r9,r7
590#ifndef	__thumb2__
591	str	r14,[sp,#328+4]
592#else
593	strd	r12,r14,[sp,#328]		@ R[2][1] = C[1] ^ (~C[2] & C[3]);
594#endif
595	eor	r10,r10,r5,ror#32-13
596	eor	r11,r11,r4,ror#32-12
597#ifndef	__thumb2__
598	str	r10,[sp,#336]		@ R[2][2] = C[2] ^ (~C[3] & C[4]);
599#endif
600	bic	r12,r0,r8
601#ifndef	__thumb2__
602	str	r11,[sp,#336+4]
603#else
604	strd	r10,r11,[sp,#336]		@ R[2][2] = C[2] ^ (~C[3] & C[4]);
605#endif
606	bic	r14,r1,r9
607	eor	r12,r12,r6
608	eor	r14,r14,r7
609#ifndef	__thumb2__
610	str	r12,[sp,#344]		@ R[2][3] = C[3] ^ (~C[4] & C[0]);
611#endif
612	bic	r10,r2,r0,ror#3
613#ifndef	__thumb2__
614	str	r14,[sp,#344+4]
615#else
616	strd	r12,r14,[sp,#344]		@ R[2][3] = C[3] ^ (~C[4] & C[0]);
617#endif
618	bic	r11,r3,r1,ror#3
619#ifndef	__thumb2__
620	ldr	r1,[sp,#32]		@ A[0][4] [in reverse order]
621#endif
622	eor	r10,r8,r10,ror#32-3
623#ifndef	__thumb2__
624	ldr	r0,[sp,#32+4]
625#else
626	ldrd	r1,r0,[sp,#32]		@ A[0][4] [in reverse order]
627#endif
628	eor	r11,r9,r11,ror#32-3
629#ifndef	__thumb2__
630	str	r10,[sp,#352]		@ R[2][4] = C[4] ^ (~C[0] & C[1]);
631#endif
632	add	r9,sp,#208
633#ifndef	__thumb2__
634	str	r11,[sp,#352+4]
635#else
636	strd	r10,r11,[sp,#352]		@ R[2][4] = C[4] ^ (~C[0] & C[1]);
637#endif
638
639#ifndef	__thumb2__
640	ldr	r10,[sp,#232]		@ D[4]
641#endif
642#ifndef	__thumb2__
643	ldr	r11,[sp,#232+4]
644#else
645	ldrd	r10,r11,[sp,#232]		@ D[4]
646#endif
647#ifndef	__thumb2__
648	ldr	r12,[sp,#200]		@ D[0]
649#endif
650#ifndef	__thumb2__
651	ldr	r14,[sp,#200+4]
652#else
653	ldrd	r12,r14,[sp,#200]		@ D[0]
654#endif
655
656	ldmia	r9,{r6,r7,r8,r9}		@ D[1..2]
657
658	eor	r1,r1,r10
659#ifndef	__thumb2__
660	ldr	r2,[sp,#40]		@ A[1][0]
661#endif
662	eor	r0,r0,r11
663#ifndef	__thumb2__
664	ldr	r3,[sp,#40+4]
665#else
666	ldrd	r2,r3,[sp,#40]		@ A[1][0]
667#endif
668	@ mov	r1,r10,ror#32-13		@ C[0] = ROL64(A[0][4] ^ D[4], rhotates[0][4]);
669#ifndef	__thumb2__
670	ldr	r4,[sp,#88]		@ A[2][1]
671#endif
672	@ mov	r0,r11,ror#32-14		@ [was loaded in reverse order]
673#ifndef	__thumb2__
674	ldr	r5,[sp,#88+4]
675#else
676	ldrd	r4,r5,[sp,#88]		@ A[2][1]
677#endif
678
679	eor	r2,r2,r12
680#ifndef	__thumb2__
681	ldr	r10,[sp,#136]		@ A[3][2]
682#endif
683	eor	r3,r3,r14
684#ifndef	__thumb2__
685	ldr	r11,[sp,#136+4]
686#else
687	ldrd	r10,r11,[sp,#136]		@ A[3][2]
688#endif
689	@ mov	r2,r2,ror#32-18		@ C[1] = ROL64(A[1][0] ^ D[0], rhotates[1][0]);
690#ifndef	__thumb2__
691	ldr	r12,[sp,#224]		@ D[3]
692#endif
693	@ mov	r3,r3,ror#32-18
694#ifndef	__thumb2__
695	ldr	r14,[sp,#224+4]
696#else
697	ldrd	r12,r14,[sp,#224]		@ D[3]
698#endif
699
700	eor	r6,r6,r4
701	eor	r7,r7,r5
702	mov	r4,r6,ror#32-5		@ C[2] = ROL64(A[2][1] ^ D[1], rhotates[2][1]);
703	mov	r5,r7,ror#32-5
704
705	eor	r10,r10,r8
706#ifndef	__thumb2__
707	ldr	r8,[sp,#184]		@ A[4][3]
708#endif
709	eor	r11,r11,r9
710#ifndef	__thumb2__
711	ldr	r9,[sp,#184+4]
712#else
713	ldrd	r8,r9,[sp,#184]		@ A[4][3]
714#endif
715	mov	r7,r10,ror#32-7		@ C[3] = ROL64(A[3][2] ^ D[2], rhotates[3][2]);
716	mov	r6,r11,ror#32-8
717
718	eor	r12,r12,r8
719	eor	r14,r14,r9
720	mov	r8,r12,ror#32-28		@ C[4] = ROL64(A[4][3] ^ D[3], rhotates[4][3]);
721	mov	r9,r14,ror#32-28
722
723	bic	r10,r4,r2,ror#32-18
724	bic	r11,r5,r3,ror#32-18
725	eor	r10,r10,r0,ror#32-14
726	eor	r11,r11,r1,ror#32-13
727#ifndef	__thumb2__
728	str	r10,[sp,#360]		@ R[3][0] = C[0] ^ (~C[1] & C[2])
729#endif
730	bic	r12,r6,r4
731#ifndef	__thumb2__
732	str	r11,[sp,#360+4]
733#else
734	strd	r10,r11,[sp,#360]		@ R[3][0] = C[0] ^ (~C[1] & C[2])
735#endif
736	bic	r14,r7,r5
737	eor	r12,r12,r2,ror#32-18
738#ifndef	__thumb2__
739	str	r12,[sp,#368]		@ R[3][1] = C[1] ^ (~C[2] & C[3]);
740#endif
741	eor	r14,r14,r3,ror#32-18
742#ifndef	__thumb2__
743	str	r14,[sp,#368+4]
744#else
745	strd	r12,r14,[sp,#368]		@ R[3][1] = C[1] ^ (~C[2] & C[3]);
746#endif
747	bic	r10,r8,r6
748	bic	r11,r9,r7
749	bic	r12,r0,r8,ror#14
750	bic	r14,r1,r9,ror#13
751	eor	r10,r10,r4
752	eor	r11,r11,r5
753#ifndef	__thumb2__
754	str	r10,[sp,#376]		@ R[3][2] = C[2] ^ (~C[3] & C[4]);
755#endif
756	bic	r2,r2,r0,ror#18-14
757#ifndef	__thumb2__
758	str	r11,[sp,#376+4]
759#else
760	strd	r10,r11,[sp,#376]		@ R[3][2] = C[2] ^ (~C[3] & C[4]);
761#endif
762	eor	r12,r6,r12,ror#32-14
763	bic	r11,r3,r1,ror#18-13
764	eor	r14,r7,r14,ror#32-13
765#ifndef	__thumb2__
766	str	r12,[sp,#384]		@ R[3][3] = C[3] ^ (~C[4] & C[0]);
767#endif
768#ifndef	__thumb2__
769	str	r14,[sp,#384+4]
770#else
771	strd	r12,r14,[sp,#384]		@ R[3][3] = C[3] ^ (~C[4] & C[0]);
772#endif
773	add	r14,sp,#216
774#ifndef	__thumb2__
775	ldr	r0,[sp,#16]		@ A[0][2]
776#endif
777	eor	r10,r8,r2,ror#32-18
778#ifndef	__thumb2__
779	ldr	r1,[sp,#16+4]
780#else
781	ldrd	r0,r1,[sp,#16]		@ A[0][2]
782#endif
783	eor	r11,r9,r11,ror#32-18
784#ifndef	__thumb2__
785	str	r10,[sp,#392]		@ R[3][4] = C[4] ^ (~C[0] & C[1]);
786#endif
787#ifndef	__thumb2__
788	str	r11,[sp,#392+4]
789#else
790	strd	r10,r11,[sp,#392]		@ R[3][4] = C[4] ^ (~C[0] & C[1]);
791#endif
792
793	ldmia	r14,{r10,r11,r12,r14}	@ D[2..3]
794#ifndef	__thumb2__
795	ldr	r2,[sp,#64]		@ A[1][3]
796#endif
797#ifndef	__thumb2__
798	ldr	r3,[sp,#64+4]
799#else
800	ldrd	r2,r3,[sp,#64]		@ A[1][3]
801#endif
802#ifndef	__thumb2__
803	ldr	r6,[sp,#232]		@ D[4]
804#endif
805#ifndef	__thumb2__
806	ldr	r7,[sp,#232+4]
807#else
808	ldrd	r6,r7,[sp,#232]		@ D[4]
809#endif
810
811	eor	r0,r0,r10
812#ifndef	__thumb2__
813	ldr	r4,[sp,#112]		@ A[2][4]
814#endif
815	eor	r1,r1,r11
816#ifndef	__thumb2__
817	ldr	r5,[sp,#112+4]
818#else
819	ldrd	r4,r5,[sp,#112]		@ A[2][4]
820#endif
821	@ mov	r0,r0,ror#32-31		@ C[0] = ROL64(A[0][2] ^ D[2], rhotates[0][2]);
822#ifndef	__thumb2__
823	ldr	r8,[sp,#200]		@ D[0]
824#endif
825	@ mov	r1,r1,ror#32-31
826#ifndef	__thumb2__
827	ldr	r9,[sp,#200+4]
828#else
829	ldrd	r8,r9,[sp,#200]		@ D[0]
830#endif
831
832	eor	r12,r12,r2
833#ifndef	__thumb2__
834	ldr	r10,[sp,#120]		@ A[3][0]
835#endif
836	eor	r14,r14,r3
837#ifndef	__thumb2__
838	ldr	r11,[sp,#120+4]
839#else
840	ldrd	r10,r11,[sp,#120]		@ A[3][0]
841#endif
842	mov	r3,r12,ror#32-27		@ C[1] = ROL64(A[1][3] ^ D[3], rhotates[1][3]);
843#ifndef	__thumb2__
844	ldr	r12,[sp,#208]		@ D[1]
845#endif
846	mov	r2,r14,ror#32-28
847#ifndef	__thumb2__
848	ldr	r14,[sp,#208+4]
849#else
850	ldrd	r12,r14,[sp,#208]		@ D[1]
851#endif
852
853	eor	r6,r6,r4
854	eor	r7,r7,r5
855	mov	r5,r6,ror#32-19		@ C[2] = ROL64(A[2][4] ^ D[4], rhotates[2][4]);
856	mov	r4,r7,ror#32-20
857
858	eor	r10,r10,r8
859#ifndef	__thumb2__
860	ldr	r8,[sp,#168]		@ A[4][1]
861#endif
862	eor	r11,r11,r9
863#ifndef	__thumb2__
864	ldr	r9,[sp,#168+4]
865#else
866	ldrd	r8,r9,[sp,#168]		@ A[4][1]
867#endif
868	mov	r7,r10,ror#32-20		@ C[3] = ROL64(A[3][0] ^ D[0], rhotates[3][0]);
869	mov	r6,r11,ror#32-21
870
871	eor	r8,r8,r12
872	eor	r9,r9,r14
873	@ mov	r8,r2,ror#32-1		@ C[4] = ROL64(A[4][1] ^ D[1], rhotates[4][1]);
874	@ mov	r9,r3,ror#32-1
875
876	bic	r10,r4,r2
877	bic	r11,r5,r3
878	eor	r10,r10,r0,ror#32-31
879#ifndef	__thumb2__
880	str	r10,[sp,#400]		@ R[4][0] = C[0] ^ (~C[1] & C[2])
881#endif
882	eor	r11,r11,r1,ror#32-31
883#ifndef	__thumb2__
884	str	r11,[sp,#400+4]
885#else
886	strd	r10,r11,[sp,#400]		@ R[4][0] = C[0] ^ (~C[1] & C[2])
887#endif
888	bic	r12,r6,r4
889	bic	r14,r7,r5
890	eor	r12,r12,r2
891	eor	r14,r14,r3
892#ifndef	__thumb2__
893	str	r12,[sp,#408]		@ R[4][1] = C[1] ^ (~C[2] & C[3]);
894#endif
895	bic	r10,r8,r6,ror#1
896#ifndef	__thumb2__
897	str	r14,[sp,#408+4]
898#else
899	strd	r12,r14,[sp,#408]		@ R[4][1] = C[1] ^ (~C[2] & C[3]);
900#endif
901	bic	r11,r9,r7,ror#1
902	bic	r12,r0,r8,ror#31-1
903	bic	r14,r1,r9,ror#31-1
904	eor	r4,r4,r10,ror#32-1
905#ifndef	__thumb2__
906	str	r4,[sp,#416]		@ R[4][2] = C[2] ^= (~C[3] & C[4]);
907#endif
908	eor	r5,r5,r11,ror#32-1
909#ifndef	__thumb2__
910	str	r5,[sp,#416+4]
911#else
912	strd	r4,r5,[sp,#416]		@ R[4][2] = C[2] ^= (~C[3] & C[4]);
913#endif
914	eor	r6,r6,r12,ror#32-31
915	eor	r7,r7,r14,ror#32-31
916#ifndef	__thumb2__
917	str	r6,[sp,#424]		@ R[4][3] = C[3] ^= (~C[4] & C[0]);
918#endif
919	bic	r10,r2,r0,ror#32-31
920#ifndef	__thumb2__
921	str	r7,[sp,#424+4]
922#else
923	strd	r6,r7,[sp,#424]		@ R[4][3] = C[3] ^= (~C[4] & C[0]);
924#endif
925	bic	r11,r3,r1,ror#32-31
926	add	r12,sp,#240
927	eor	r8,r10,r8,ror#32-1
928	add	r10,sp,#280
929	eor	r9,r11,r9,ror#32-1
930#ifndef	__thumb2__
931	str	r8,[sp,#432]		@ R[4][4] = C[4] ^= (~C[0] & C[1]);
932#endif
933#ifndef	__thumb2__
934	str	r9,[sp,#432+4]
935#else
936	strd	r8,r9,[sp,#432]		@ R[4][4] = C[4] ^= (~C[0] & C[1]);
937#endif
938	ldmia	r12,{r0,r1,r2,r3}		@ A[0][0..1]
939	ldmia	r10,{r10,r11,r12,r14}	@ A[1][0..1]
940#ifdef	__thumb2__
941	eor	r0,r0,r10
942	eor	r1,r1,r11
943	eor	r2,r2,r12
944	ldrd	r10,r11,[sp,#296]
945	eor	r3,r3,r14
946	ldrd	r12,r14,[sp,#304]
947	eor	r4,r4,r10
948	eor	r5,r5,r11
949	eor	r6,r6,r12
950	ldrd	r10,r11,[sp,#312]
951	eor	r7,r7,r14
952	ldrd	r12,r14,[sp,#320]
953	eor	r8,r8,r10
954	eor	r9,r9,r11
955	eor	r0,r0,r12
956	ldrd	r10,r11,[sp,#328]
957	eor	r1,r1,r14
958	ldrd	r12,r14,[sp,#336]
959	eor	r2,r2,r10
960	eor	r3,r3,r11
961	eor	r4,r4,r12
962	ldrd	r10,r11,[sp,#344]
963	eor	r5,r5,r14
964	ldrd	r12,r14,[sp,#352]
965	eor	r6,r6,r10
966	eor	r7,r7,r11
967	eor	r8,r8,r12
968	ldrd	r10,r11,[sp,#360]
969	eor	r9,r9,r14
970	ldrd	r12,r14,[sp,#368]
971	eor	r0,r0,r10
972	eor	r1,r1,r11
973	eor	r2,r2,r12
974	ldrd	r10,r11,[sp,#376]
975	eor	r3,r3,r14
976	ldrd	r12,r14,[sp,#384]
977	eor	r4,r4,r10
978	eor	r5,r5,r11
979	eor	r6,r6,r12
980	ldrd	r10,r11,[sp,#392]
981	eor	r7,r7,r14
982	ldrd	r12,r14,[sp,#400]
983	eor	r8,r8,r10
984	eor	r9,r9,r11
985	eor	r0,r0,r12
986	ldrd	r10,r11,[sp,#408]
987	eor	r1,r1,r14
988	ldrd	r12,r14,[sp,#256]
989	eor	r2,r2,r10
990	eor	r3,r3,r11
991	eor	r4,r4,r12
992	ldrd	r10,r11,[sp,#264]
993	eor	r5,r5,r14
994	ldrd	r12,r14,[sp,#272]
995#else
996	eor	r0,r0,r10
997	add	r10,sp,#296
998	eor	r1,r1,r11
999	eor	r2,r2,r12
1000	eor	r3,r3,r14
1001	ldmia	r10,{r10,r11,r12,r14}	@ A[1][2..3]
1002	eor	r4,r4,r10
1003	add	r10,sp,#312
1004	eor	r5,r5,r11
1005	eor	r6,r6,r12
1006	eor	r7,r7,r14
1007	ldmia	r10,{r10,r11,r12,r14}	@ A[1][4]..A[2][0]
1008	eor	r8,r8,r10
1009	add	r10,sp,#328
1010	eor	r9,r9,r11
1011	eor	r0,r0,r12
1012	eor	r1,r1,r14
1013	ldmia	r10,{r10,r11,r12,r14}	@ A[2][1..2]
1014	eor	r2,r2,r10
1015	add	r10,sp,#344
1016	eor	r3,r3,r11
1017	eor	r4,r4,r12
1018	eor	r5,r5,r14
1019	ldmia	r10,{r10,r11,r12,r14}	@ A[2][3..4]
1020	eor	r6,r6,r10
1021	add	r10,sp,#360
1022	eor	r7,r7,r11
1023	eor	r8,r8,r12
1024	eor	r9,r9,r14
1025	ldmia	r10,{r10,r11,r12,r14}	@ A[3][0..1]
1026	eor	r0,r0,r10
1027	add	r10,sp,#376
1028	eor	r1,r1,r11
1029	eor	r2,r2,r12
1030	eor	r3,r3,r14
1031	ldmia	r10,{r10,r11,r12,r14}	@ A[3][2..3]
1032	eor	r4,r4,r10
1033	add	r10,sp,#392
1034	eor	r5,r5,r11
1035	eor	r6,r6,r12
1036	eor	r7,r7,r14
1037	ldmia	r10,{r10,r11,r12,r14}	@ A[3][4]..A[4][0]
1038	eor	r8,r8,r10
1039	ldr	r10,[sp,#408]		@ A[4][1]
1040	eor	r9,r9,r11
1041	ldr	r11,[sp,#408+4]
1042	eor	r0,r0,r12
1043	ldr	r12,[sp,#256]		@ A[0][2]
1044	eor	r1,r1,r14
1045	ldr	r14,[sp,#256+4]
1046	eor	r2,r2,r10
1047	add	r10,sp,#264
1048	eor	r3,r3,r11
1049	eor	r4,r4,r12
1050	eor	r5,r5,r14
1051	ldmia	r10,{r10,r11,r12,r14}	@ A[0][3..4]
1052#endif
1053	eor	r6,r6,r10
1054	eor	r7,r7,r11
1055	eor	r8,r8,r12
1056	eor	r9,r9,r14
1057
1058	eor	r10,r0,r5,ror#32-1	@ E[0] = ROL64(C[2], 1) ^ C[0];
1059#ifndef	__thumb2__
1060	str	r10,[sp,#208]		@ D[1] = E[0]
1061#endif
1062	eor	r11,r1,r4
1063#ifndef	__thumb2__
1064	str	r11,[sp,#208+4]
1065#else
1066	strd	r10,r11,[sp,#208]		@ D[1] = E[0]
1067#endif
1068	eor	r12,r6,r1,ror#32-1	@ E[1] = ROL64(C[0], 1) ^ C[3];
1069	eor	r14,r7,r0
1070#ifndef	__thumb2__
1071	str	r12,[sp,#232]		@ D[4] = E[1]
1072#endif
1073	eor	r0,r8,r3,ror#32-1	@ C[0] = ROL64(C[1], 1) ^ C[4];
1074#ifndef	__thumb2__
1075	str	r14,[sp,#232+4]
1076#else
1077	strd	r12,r14,[sp,#232]		@ D[4] = E[1]
1078#endif
1079	eor	r1,r9,r2
1080#ifndef	__thumb2__
1081	str	r0,[sp,#200]		@ D[0] = C[0]
1082#endif
1083	eor	r2,r2,r7,ror#32-1	@ C[1] = ROL64(C[3], 1) ^ C[1];
1084#ifndef	__thumb2__
1085	ldr	r7,[sp,#384]
1086#endif
1087	eor	r3,r3,r6
1088#ifndef	__thumb2__
1089	str	r1,[sp,#200+4]
1090#else
1091	strd	r0,r1,[sp,#200]		@ D[0] = C[0]
1092#endif
1093#ifndef	__thumb2__
1094	ldr	r6,[sp,#384+4]
1095#else
1096	ldrd	r7,r6,[sp,#384]
1097#endif
1098#ifndef	__thumb2__
1099	str	r2,[sp,#216]		@ D[2] = C[1]
1100#endif
1101	eor	r4,r4,r9,ror#32-1	@ C[2] = ROL64(C[4], 1) ^ C[2];
1102#ifndef	__thumb2__
1103	str	r3,[sp,#216+4]
1104#else
1105	strd	r2,r3,[sp,#216]		@ D[2] = C[1]
1106#endif
1107	eor	r5,r5,r8
1108
1109#ifndef	__thumb2__
1110	ldr	r8,[sp,#432]
1111#endif
1112#ifndef	__thumb2__
1113	ldr	r9,[sp,#432+4]
1114#else
1115	ldrd	r8,r9,[sp,#432]
1116#endif
1117#ifndef	__thumb2__
1118	str	r4,[sp,#224]		@ D[3] = C[2]
1119#endif
1120	eor	r7,r7,r4
1121#ifndef	__thumb2__
1122	str	r5,[sp,#224+4]
1123#else
1124	strd	r4,r5,[sp,#224]		@ D[3] = C[2]
1125#endif
1126	eor	r6,r6,r5
1127#ifndef	__thumb2__
1128	ldr	r4,[sp,#240]
1129#endif
1130	@ mov	r7,r7,ror#32-10		@ C[3] = ROL64(A[3][3] ^ C[2], rhotates[3][3]);   /* D[3] */
1131	@ mov	r6,r6,ror#32-11
1132#ifndef	__thumb2__
1133	ldr	r5,[sp,#240+4]
1134#else
1135	ldrd	r4,r5,[sp,#240]
1136#endif
1137	eor	r8,r8,r12
1138	eor	r9,r9,r14
1139#ifndef	__thumb2__
1140	ldr	r12,[sp,#336]
1141#endif
1142	eor	r0,r0,r4
1143#ifndef	__thumb2__
1144	ldr	r14,[sp,#336+4]
1145#else
1146	ldrd	r12,r14,[sp,#336]
1147#endif
1148	@ mov	r8,r8,ror#32-7		@ C[4] = ROL64(A[4][4] ^ E[1], rhotates[4][4]);   /* D[4] */
1149	@ mov	r9,r9,ror#32-7
1150	eor	r1,r1,r5		@ C[0] =       A[0][0] ^ C[0];
1151	eor	r12,r12,r2
1152#ifndef	__thumb2__
1153	ldr	r2,[sp,#288]
1154#endif
1155	eor	r14,r14,r3
1156#ifndef	__thumb2__
1157	ldr	r3,[sp,#288+4]
1158#else
1159	ldrd	r2,r3,[sp,#288]
1160#endif
1161	mov	r5,r12,ror#32-21		@ C[2] = ROL64(A[2][2] ^ C[1], rhotates[2][2]);
1162	ldr	r12,[sp,#444]			@ load counter
1163	eor	r2,r2,r10
1164	adr	r10,iotas32
1165	mov	r4,r14,ror#32-22
1166	add	r14,r10,r12
1167	eor	r3,r3,r11
1168#ifndef	__thumb2__
1169	ldr	r10,[r14,#8]		@ iotas[i].lo
1170#endif
1171	add	r12,r12,#16
1172#ifndef	__thumb2__
1173	ldr	r11,[r14,#12]		@ iotas[i].hi
1174#else
1175	ldrd	r10,r11,[r14,#8]		@ iotas[i].lo
1176#endif
1177	cmp	r12,#192
1178	str	r12,[sp,#444]			@ store counter
1179	bic	r12,r4,r2,ror#32-22
1180	bic	r14,r5,r3,ror#32-22
1181	mov	r2,r2,ror#32-22		@ C[1] = ROL64(A[1][1] ^ E[0], rhotates[1][1]);
1182	mov	r3,r3,ror#32-22
1183	eor	r12,r12,r0
1184	eor	r14,r14,r1
1185	eor	r10,r10,r12
1186	eor	r11,r11,r14
1187#ifndef	__thumb2__
1188	str	r10,[sp,#0]		@ R[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i];
1189#endif
1190	bic	r12,r6,r4,ror#11
1191#ifndef	__thumb2__
1192	str	r11,[sp,#0+4]
1193#else
1194	strd	r10,r11,[sp,#0]		@ R[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i];
1195#endif
1196	bic	r14,r7,r5,ror#10
1197	bic	r10,r8,r6,ror#32-(11-7)
1198	bic	r11,r9,r7,ror#32-(10-7)
1199	eor	r12,r2,r12,ror#32-11
1200#ifndef	__thumb2__
1201	str	r12,[sp,#8]		@ R[0][1] = C[1] ^ (~C[2] & C[3]);
1202#endif
1203	eor	r14,r3,r14,ror#32-10
1204#ifndef	__thumb2__
1205	str	r14,[sp,#8+4]
1206#else
1207	strd	r12,r14,[sp,#8]		@ R[0][1] = C[1] ^ (~C[2] & C[3]);
1208#endif
1209	eor	r10,r4,r10,ror#32-7
1210	eor	r11,r5,r11,ror#32-7
1211#ifndef	__thumb2__
1212	str	r10,[sp,#16]		@ R[0][2] = C[2] ^ (~C[3] & C[4]);
1213#endif
1214	bic	r12,r0,r8,ror#32-7
1215#ifndef	__thumb2__
1216	str	r11,[sp,#16+4]
1217#else
1218	strd	r10,r11,[sp,#16]		@ R[0][2] = C[2] ^ (~C[3] & C[4]);
1219#endif
1220	bic	r14,r1,r9,ror#32-7
1221	eor	r12,r12,r6,ror#32-11
1222#ifndef	__thumb2__
1223	str	r12,[sp,#24]		@ R[0][3] = C[3] ^ (~C[4] & C[0]);
1224#endif
1225	eor	r14,r14,r7,ror#32-10
1226#ifndef	__thumb2__
1227	str	r14,[sp,#24+4]
1228#else
1229	strd	r12,r14,[sp,#24]		@ R[0][3] = C[3] ^ (~C[4] & C[0]);
1230#endif
1231	bic	r10,r2,r0
1232	add	r14,sp,#224
1233#ifndef	__thumb2__
1234	ldr	r0,[sp,#264]		@ A[0][3]
1235#endif
1236	bic	r11,r3,r1
1237#ifndef	__thumb2__
1238	ldr	r1,[sp,#264+4]
1239#else
1240	ldrd	r0,r1,[sp,#264]		@ A[0][3]
1241#endif
1242	eor	r10,r10,r8,ror#32-7
1243	eor	r11,r11,r9,ror#32-7
1244#ifndef	__thumb2__
1245	str	r10,[sp,#32]		@ R[0][4] = C[4] ^ (~C[0] & C[1]);
1246#endif
1247	add	r9,sp,#200
1248#ifndef	__thumb2__
1249	str	r11,[sp,#32+4]
1250#else
1251	strd	r10,r11,[sp,#32]		@ R[0][4] = C[4] ^ (~C[0] & C[1]);
1252#endif
1253
1254	ldmia	r14,{r10,r11,r12,r14}	@ D[3..4]
1255	ldmia	r9,{r6,r7,r8,r9}		@ D[0..1]
1256
1257#ifndef	__thumb2__
1258	ldr	r2,[sp,#312]		@ A[1][4]
1259#endif
1260	eor	r0,r0,r10
1261#ifndef	__thumb2__
1262	ldr	r3,[sp,#312+4]
1263#else
1264	ldrd	r2,r3,[sp,#312]		@ A[1][4]
1265#endif
1266	eor	r1,r1,r11
1267	@ mov	r0,r0,ror#32-14		@ C[0] = ROL64(A[0][3] ^ D[3], rhotates[0][3]);
1268#ifndef	__thumb2__
1269	ldr	r10,[sp,#368]		@ A[3][1]
1270#endif
1271	@ mov	r1,r1,ror#32-14
1272#ifndef	__thumb2__
1273	ldr	r11,[sp,#368+4]
1274#else
1275	ldrd	r10,r11,[sp,#368]		@ A[3][1]
1276#endif
1277
1278	eor	r2,r2,r12
1279#ifndef	__thumb2__
1280	ldr	r4,[sp,#320]		@ A[2][0]
1281#endif
1282	eor	r3,r3,r14
1283#ifndef	__thumb2__
1284	ldr	r5,[sp,#320+4]
1285#else
1286	ldrd	r4,r5,[sp,#320]		@ A[2][0]
1287#endif
1288	@ mov	r2,r2,ror#32-10		@ C[1] = ROL64(A[1][4] ^ D[4], rhotates[1][4]);
1289	@ mov	r3,r3,ror#32-10
1290
1291	eor	r6,r6,r4
1292#ifndef	__thumb2__
1293	ldr	r12,[sp,#216]		@ D[2]
1294#endif
1295	eor	r7,r7,r5
1296#ifndef	__thumb2__
1297	ldr	r14,[sp,#216+4]
1298#else
1299	ldrd	r12,r14,[sp,#216]		@ D[2]
1300#endif
1301	mov	r5,r6,ror#32-1		@ C[2] = ROL64(A[2][0] ^ D[0], rhotates[2][0]);
1302	mov	r4,r7,ror#32-2
1303
1304	eor	r10,r10,r8
1305#ifndef	__thumb2__
1306	ldr	r8,[sp,#416]		@ A[4][2]
1307#endif
1308	eor	r11,r11,r9
1309#ifndef	__thumb2__
1310	ldr	r9,[sp,#416+4]
1311#else
1312	ldrd	r8,r9,[sp,#416]		@ A[4][2]
1313#endif
1314	mov	r7,r10,ror#32-22		@ C[3] = ROL64(A[3][1] ^ D[1], rhotates[3][1]);
1315	mov	r6,r11,ror#32-23
1316
1317	bic	r10,r4,r2,ror#32-10
1318	bic	r11,r5,r3,ror#32-10
1319	eor	r12,r12,r8
1320	eor	r14,r14,r9
1321	mov	r9,r12,ror#32-30		@ C[4] = ROL64(A[4][2] ^ D[2], rhotates[4][2]);
1322	mov	r8,r14,ror#32-31
1323	eor	r10,r10,r0,ror#32-14
1324	eor	r11,r11,r1,ror#32-14
1325#ifndef	__thumb2__
1326	str	r10,[sp,#40]		@ R[1][0] = C[0] ^ (~C[1] & C[2])
1327#endif
1328	bic	r12,r6,r4
1329#ifndef	__thumb2__
1330	str	r11,[sp,#40+4]
1331#else
1332	strd	r10,r11,[sp,#40]		@ R[1][0] = C[0] ^ (~C[1] & C[2])
1333#endif
1334	bic	r14,r7,r5
1335	eor	r12,r12,r2,ror#32-10
1336#ifndef	__thumb2__
1337	str	r12,[sp,#48]		@ R[1][1] = C[1] ^ (~C[2] & C[3]);
1338#endif
1339	eor	r14,r14,r3,ror#32-10
1340#ifndef	__thumb2__
1341	str	r14,[sp,#48+4]
1342#else
1343	strd	r12,r14,[sp,#48]		@ R[1][1] = C[1] ^ (~C[2] & C[3]);
1344#endif
1345	bic	r10,r8,r6
1346	bic	r11,r9,r7
1347	bic	r12,r0,r8,ror#14
1348	bic	r14,r1,r9,ror#14
1349	eor	r10,r10,r4
1350	eor	r11,r11,r5
1351#ifndef	__thumb2__
1352	str	r10,[sp,#56]		@ R[1][2] = C[2] ^ (~C[3] & C[4]);
1353#endif
1354	bic	r2,r2,r0,ror#32-(14-10)
1355#ifndef	__thumb2__
1356	str	r11,[sp,#56+4]
1357#else
1358	strd	r10,r11,[sp,#56]		@ R[1][2] = C[2] ^ (~C[3] & C[4]);
1359#endif
1360	eor	r12,r6,r12,ror#32-14
1361	bic	r11,r3,r1,ror#32-(14-10)
1362#ifndef	__thumb2__
1363	str	r12,[sp,#64]		@ R[1][3] = C[3] ^ (~C[4] & C[0]);
1364#endif
1365	eor	r14,r7,r14,ror#32-14
1366#ifndef	__thumb2__
1367	str	r14,[sp,#64+4]
1368#else
1369	strd	r12,r14,[sp,#64]		@ R[1][3] = C[3] ^ (~C[4] & C[0]);
1370#endif
1371	add	r12,sp,#208
1372#ifndef	__thumb2__
1373	ldr	r1,[sp,#248]		@ A[0][1]
1374#endif
1375	eor	r10,r8,r2,ror#32-10
1376#ifndef	__thumb2__
1377	ldr	r0,[sp,#248+4]
1378#else
1379	ldrd	r1,r0,[sp,#248]		@ A[0][1]
1380#endif
1381	eor	r11,r9,r11,ror#32-10
1382#ifndef	__thumb2__
1383	str	r10,[sp,#72]		@ R[1][4] = C[4] ^ (~C[0] & C[1]);
1384#endif
1385#ifndef	__thumb2__
1386	str	r11,[sp,#72+4]
1387#else
1388	strd	r10,r11,[sp,#72]		@ R[1][4] = C[4] ^ (~C[0] & C[1]);
1389#endif
1390
1391	add	r9,sp,#224
1392	ldmia	r12,{r10,r11,r12,r14}	@ D[1..2]
1393#ifndef	__thumb2__
1394	ldr	r2,[sp,#296]		@ A[1][2]
1395#endif
1396#ifndef	__thumb2__
1397	ldr	r3,[sp,#296+4]
1398#else
1399	ldrd	r2,r3,[sp,#296]		@ A[1][2]
1400#endif
1401	ldmia	r9,{r6,r7,r8,r9}		@ D[3..4]
1402
1403	eor	r1,r1,r10
1404#ifndef	__thumb2__
1405	ldr	r4,[sp,#344]		@ A[2][3]
1406#endif
1407	eor	r0,r0,r11
1408#ifndef	__thumb2__
1409	ldr	r5,[sp,#344+4]
1410#else
1411	ldrd	r4,r5,[sp,#344]		@ A[2][3]
1412#endif
1413	mov	r0,r0,ror#32-1		@ C[0] = ROL64(A[0][1] ^ D[1], rhotates[0][1]);
1414
1415	eor	r2,r2,r12
1416#ifndef	__thumb2__
1417	ldr	r10,[sp,#392]		@ A[3][4]
1418#endif
1419	eor	r3,r3,r14
1420#ifndef	__thumb2__
1421	ldr	r11,[sp,#392+4]
1422#else
1423	ldrd	r10,r11,[sp,#392]		@ A[3][4]
1424#endif
1425	@ mov	r2,r2,ror#32-3		@ C[1] = ROL64(A[1][2] ^ D[2], rhotates[1][2]);
1426#ifndef	__thumb2__
1427	ldr	r12,[sp,#200]		@ D[0]
1428#endif
1429	@ mov	r3,r3,ror#32-3
1430#ifndef	__thumb2__
1431	ldr	r14,[sp,#200+4]
1432#else
1433	ldrd	r12,r14,[sp,#200]		@ D[0]
1434#endif
1435
1436	eor	r4,r4,r6
1437	eor	r5,r5,r7
1438	@ mov	r5,r6,ror#32-12		@ C[2] = ROL64(A[2][3] ^ D[3], rhotates[2][3]);
1439	@ mov	r4,r7,ror#32-13		@ [track reverse order below]
1440
1441	eor	r10,r10,r8
1442#ifndef	__thumb2__
1443	ldr	r8,[sp,#400]		@ A[4][0]
1444#endif
1445	eor	r11,r11,r9
1446#ifndef	__thumb2__
1447	ldr	r9,[sp,#400+4]
1448#else
1449	ldrd	r8,r9,[sp,#400]		@ A[4][0]
1450#endif
1451	mov	r6,r10,ror#32-4		@ C[3] = ROL64(A[3][4] ^ D[4], rhotates[3][4]);
1452	mov	r7,r11,ror#32-4
1453
1454	eor	r12,r12,r8
1455	eor	r14,r14,r9
1456	mov	r8,r12,ror#32-9		@ C[4] = ROL64(A[4][0] ^ D[0], rhotates[4][0]);
1457	mov	r9,r14,ror#32-9
1458
1459	bic	r10,r5,r2,ror#13-3
1460	bic	r11,r4,r3,ror#12-3
1461	bic	r12,r6,r5,ror#32-13
1462	bic	r14,r7,r4,ror#32-12
1463	eor	r10,r0,r10,ror#32-13
1464	eor	r11,r1,r11,ror#32-12
1465#ifndef	__thumb2__
1466	str	r10,[sp,#80]		@ R[2][0] = C[0] ^ (~C[1] & C[2])
1467#endif
1468	eor	r12,r12,r2,ror#32-3
1469#ifndef	__thumb2__
1470	str	r11,[sp,#80+4]
1471#else
1472	strd	r10,r11,[sp,#80]		@ R[2][0] = C[0] ^ (~C[1] & C[2])
1473#endif
1474	eor	r14,r14,r3,ror#32-3
1475#ifndef	__thumb2__
1476	str	r12,[sp,#88]		@ R[2][1] = C[1] ^ (~C[2] & C[3]);
1477#endif
1478	bic	r10,r8,r6
1479	bic	r11,r9,r7
1480#ifndef	__thumb2__
1481	str	r14,[sp,#88+4]
1482#else
1483	strd	r12,r14,[sp,#88]		@ R[2][1] = C[1] ^ (~C[2] & C[3]);
1484#endif
1485	eor	r10,r10,r5,ror#32-13
1486	eor	r11,r11,r4,ror#32-12
1487#ifndef	__thumb2__
1488	str	r10,[sp,#96]		@ R[2][2] = C[2] ^ (~C[3] & C[4]);
1489#endif
1490	bic	r12,r0,r8
1491#ifndef	__thumb2__
1492	str	r11,[sp,#96+4]
1493#else
1494	strd	r10,r11,[sp,#96]		@ R[2][2] = C[2] ^ (~C[3] & C[4]);
1495#endif
1496	bic	r14,r1,r9
1497	eor	r12,r12,r6
1498	eor	r14,r14,r7
1499#ifndef	__thumb2__
1500	str	r12,[sp,#104]		@ R[2][3] = C[3] ^ (~C[4] & C[0]);
1501#endif
1502	bic	r10,r2,r0,ror#3
1503#ifndef	__thumb2__
1504	str	r14,[sp,#104+4]
1505#else
1506	strd	r12,r14,[sp,#104]		@ R[2][3] = C[3] ^ (~C[4] & C[0]);
1507#endif
1508	bic	r11,r3,r1,ror#3
1509#ifndef	__thumb2__
1510	ldr	r1,[sp,#272]		@ A[0][4] [in reverse order]
1511#endif
1512	eor	r10,r8,r10,ror#32-3
1513#ifndef	__thumb2__
1514	ldr	r0,[sp,#272+4]
1515#else
1516	ldrd	r1,r0,[sp,#272]		@ A[0][4] [in reverse order]
1517#endif
1518	eor	r11,r9,r11,ror#32-3
1519#ifndef	__thumb2__
1520	str	r10,[sp,#112]		@ R[2][4] = C[4] ^ (~C[0] & C[1]);
1521#endif
1522	add	r9,sp,#208
1523#ifndef	__thumb2__
1524	str	r11,[sp,#112+4]
1525#else
1526	strd	r10,r11,[sp,#112]		@ R[2][4] = C[4] ^ (~C[0] & C[1]);
1527#endif
1528
1529#ifndef	__thumb2__
1530	ldr	r10,[sp,#232]		@ D[4]
1531#endif
1532#ifndef	__thumb2__
1533	ldr	r11,[sp,#232+4]
1534#else
1535	ldrd	r10,r11,[sp,#232]		@ D[4]
1536#endif
1537#ifndef	__thumb2__
1538	ldr	r12,[sp,#200]		@ D[0]
1539#endif
1540#ifndef	__thumb2__
1541	ldr	r14,[sp,#200+4]
1542#else
1543	ldrd	r12,r14,[sp,#200]		@ D[0]
1544#endif
1545
1546	ldmia	r9,{r6,r7,r8,r9}		@ D[1..2]
1547
1548	eor	r1,r1,r10
1549#ifndef	__thumb2__
1550	ldr	r2,[sp,#280]		@ A[1][0]
1551#endif
1552	eor	r0,r0,r11
1553#ifndef	__thumb2__
1554	ldr	r3,[sp,#280+4]
1555#else
1556	ldrd	r2,r3,[sp,#280]		@ A[1][0]
1557#endif
1558	@ mov	r1,r10,ror#32-13		@ C[0] = ROL64(A[0][4] ^ D[4], rhotates[0][4]);
1559#ifndef	__thumb2__
1560	ldr	r4,[sp,#328]		@ A[2][1]
1561#endif
1562	@ mov	r0,r11,ror#32-14		@ [was loaded in reverse order]
1563#ifndef	__thumb2__
1564	ldr	r5,[sp,#328+4]
1565#else
1566	ldrd	r4,r5,[sp,#328]		@ A[2][1]
1567#endif
1568
1569	eor	r2,r2,r12
1570#ifndef	__thumb2__
1571	ldr	r10,[sp,#376]		@ A[3][2]
1572#endif
1573	eor	r3,r3,r14
1574#ifndef	__thumb2__
1575	ldr	r11,[sp,#376+4]
1576#else
1577	ldrd	r10,r11,[sp,#376]		@ A[3][2]
1578#endif
1579	@ mov	r2,r2,ror#32-18		@ C[1] = ROL64(A[1][0] ^ D[0], rhotates[1][0]);
1580#ifndef	__thumb2__
1581	ldr	r12,[sp,#224]		@ D[3]
1582#endif
1583	@ mov	r3,r3,ror#32-18
1584#ifndef	__thumb2__
1585	ldr	r14,[sp,#224+4]
1586#else
1587	ldrd	r12,r14,[sp,#224]		@ D[3]
1588#endif
1589
1590	eor	r6,r6,r4
1591	eor	r7,r7,r5
1592	mov	r4,r6,ror#32-5		@ C[2] = ROL64(A[2][1] ^ D[1], rhotates[2][1]);
1593	mov	r5,r7,ror#32-5
1594
1595	eor	r10,r10,r8
1596#ifndef	__thumb2__
1597	ldr	r8,[sp,#424]		@ A[4][3]
1598#endif
1599	eor	r11,r11,r9
1600#ifndef	__thumb2__
1601	ldr	r9,[sp,#424+4]
1602#else
1603	ldrd	r8,r9,[sp,#424]		@ A[4][3]
1604#endif
1605	mov	r7,r10,ror#32-7		@ C[3] = ROL64(A[3][2] ^ D[2], rhotates[3][2]);
1606	mov	r6,r11,ror#32-8
1607
1608	eor	r12,r12,r8
1609	eor	r14,r14,r9
1610	mov	r8,r12,ror#32-28		@ C[4] = ROL64(A[4][3] ^ D[3], rhotates[4][3]);
1611	mov	r9,r14,ror#32-28
1612
1613	bic	r10,r4,r2,ror#32-18
1614	bic	r11,r5,r3,ror#32-18
1615	eor	r10,r10,r0,ror#32-14
1616	eor	r11,r11,r1,ror#32-13
1617#ifndef	__thumb2__
1618	str	r10,[sp,#120]		@ R[3][0] = C[0] ^ (~C[1] & C[2])
1619#endif
1620	bic	r12,r6,r4
1621#ifndef	__thumb2__
1622	str	r11,[sp,#120+4]
1623#else
1624	strd	r10,r11,[sp,#120]		@ R[3][0] = C[0] ^ (~C[1] & C[2])
1625#endif
1626	bic	r14,r7,r5
1627	eor	r12,r12,r2,ror#32-18
1628#ifndef	__thumb2__
1629	str	r12,[sp,#128]		@ R[3][1] = C[1] ^ (~C[2] & C[3]);
1630#endif
1631	eor	r14,r14,r3,ror#32-18
1632#ifndef	__thumb2__
1633	str	r14,[sp,#128+4]
1634#else
1635	strd	r12,r14,[sp,#128]		@ R[3][1] = C[1] ^ (~C[2] & C[3]);
1636#endif
1637	bic	r10,r8,r6
1638	bic	r11,r9,r7
1639	bic	r12,r0,r8,ror#14
1640	bic	r14,r1,r9,ror#13
1641	eor	r10,r10,r4
1642	eor	r11,r11,r5
1643#ifndef	__thumb2__
1644	str	r10,[sp,#136]		@ R[3][2] = C[2] ^ (~C[3] & C[4]);
1645#endif
1646	bic	r2,r2,r0,ror#18-14
1647#ifndef	__thumb2__
1648	str	r11,[sp,#136+4]
1649#else
1650	strd	r10,r11,[sp,#136]		@ R[3][2] = C[2] ^ (~C[3] & C[4]);
1651#endif
1652	eor	r12,r6,r12,ror#32-14
1653	bic	r11,r3,r1,ror#18-13
1654	eor	r14,r7,r14,ror#32-13
1655#ifndef	__thumb2__
1656	str	r12,[sp,#144]		@ R[3][3] = C[3] ^ (~C[4] & C[0]);
1657#endif
1658#ifndef	__thumb2__
1659	str	r14,[sp,#144+4]
1660#else
1661	strd	r12,r14,[sp,#144]		@ R[3][3] = C[3] ^ (~C[4] & C[0]);
1662#endif
1663	add	r14,sp,#216
1664#ifndef	__thumb2__
1665	ldr	r0,[sp,#256]		@ A[0][2]
1666#endif
1667	eor	r10,r8,r2,ror#32-18
1668#ifndef	__thumb2__
1669	ldr	r1,[sp,#256+4]
1670#else
1671	ldrd	r0,r1,[sp,#256]		@ A[0][2]
1672#endif
1673	eor	r11,r9,r11,ror#32-18
1674#ifndef	__thumb2__
1675	str	r10,[sp,#152]		@ R[3][4] = C[4] ^ (~C[0] & C[1]);
1676#endif
1677#ifndef	__thumb2__
1678	str	r11,[sp,#152+4]
1679#else
1680	strd	r10,r11,[sp,#152]		@ R[3][4] = C[4] ^ (~C[0] & C[1]);
1681#endif
1682
1683	ldmia	r14,{r10,r11,r12,r14}	@ D[2..3]
1684#ifndef	__thumb2__
1685	ldr	r2,[sp,#304]		@ A[1][3]
1686#endif
1687#ifndef	__thumb2__
1688	ldr	r3,[sp,#304+4]
1689#else
1690	ldrd	r2,r3,[sp,#304]		@ A[1][3]
1691#endif
1692#ifndef	__thumb2__
1693	ldr	r6,[sp,#232]		@ D[4]
1694#endif
1695#ifndef	__thumb2__
1696	ldr	r7,[sp,#232+4]
1697#else
1698	ldrd	r6,r7,[sp,#232]		@ D[4]
1699#endif
1700
1701	eor	r0,r0,r10
1702#ifndef	__thumb2__
1703	ldr	r4,[sp,#352]		@ A[2][4]
1704#endif
1705	eor	r1,r1,r11
1706#ifndef	__thumb2__
1707	ldr	r5,[sp,#352+4]
1708#else
1709	ldrd	r4,r5,[sp,#352]		@ A[2][4]
1710#endif
1711	@ mov	r0,r0,ror#32-31		@ C[0] = ROL64(A[0][2] ^ D[2], rhotates[0][2]);
1712#ifndef	__thumb2__
1713	ldr	r8,[sp,#200]		@ D[0]
1714#endif
1715	@ mov	r1,r1,ror#32-31
1716#ifndef	__thumb2__
1717	ldr	r9,[sp,#200+4]
1718#else
1719	ldrd	r8,r9,[sp,#200]		@ D[0]
1720#endif
1721
1722	eor	r12,r12,r2
1723#ifndef	__thumb2__
1724	ldr	r10,[sp,#360]		@ A[3][0]
1725#endif
1726	eor	r14,r14,r3
1727#ifndef	__thumb2__
1728	ldr	r11,[sp,#360+4]
1729#else
1730	ldrd	r10,r11,[sp,#360]		@ A[3][0]
1731#endif
1732	mov	r3,r12,ror#32-27		@ C[1] = ROL64(A[1][3] ^ D[3], rhotates[1][3]);
1733#ifndef	__thumb2__
1734	ldr	r12,[sp,#208]		@ D[1]
1735#endif
1736	mov	r2,r14,ror#32-28
1737#ifndef	__thumb2__
1738	ldr	r14,[sp,#208+4]
1739#else
1740	ldrd	r12,r14,[sp,#208]		@ D[1]
1741#endif
1742
1743	eor	r6,r6,r4
1744	eor	r7,r7,r5
1745	mov	r5,r6,ror#32-19		@ C[2] = ROL64(A[2][4] ^ D[4], rhotates[2][4]);
1746	mov	r4,r7,ror#32-20
1747
1748	eor	r10,r10,r8
1749#ifndef	__thumb2__
1750	ldr	r8,[sp,#408]		@ A[4][1]
1751#endif
1752	eor	r11,r11,r9
1753#ifndef	__thumb2__
1754	ldr	r9,[sp,#408+4]
1755#else
1756	ldrd	r8,r9,[sp,#408]		@ A[4][1]
1757#endif
1758	mov	r7,r10,ror#32-20		@ C[3] = ROL64(A[3][0] ^ D[0], rhotates[3][0]);
1759	mov	r6,r11,ror#32-21
1760
1761	eor	r8,r8,r12
1762	eor	r9,r9,r14
1763	@ mov	r8,r2,ror#32-1		@ C[4] = ROL64(A[4][1] ^ D[1], rhotates[4][1]);
1764	@ mov	r9,r3,ror#32-1
1765
1766	bic	r10,r4,r2
1767	bic	r11,r5,r3
1768	eor	r10,r10,r0,ror#32-31
1769#ifndef	__thumb2__
1770	str	r10,[sp,#160]		@ R[4][0] = C[0] ^ (~C[1] & C[2])
1771#endif
1772	eor	r11,r11,r1,ror#32-31
1773#ifndef	__thumb2__
1774	str	r11,[sp,#160+4]
1775#else
1776	strd	r10,r11,[sp,#160]		@ R[4][0] = C[0] ^ (~C[1] & C[2])
1777#endif
1778	bic	r12,r6,r4
1779	bic	r14,r7,r5
1780	eor	r12,r12,r2
1781	eor	r14,r14,r3
1782#ifndef	__thumb2__
1783	str	r12,[sp,#168]		@ R[4][1] = C[1] ^ (~C[2] & C[3]);
1784#endif
1785	bic	r10,r8,r6,ror#1
1786#ifndef	__thumb2__
1787	str	r14,[sp,#168+4]
1788#else
1789	strd	r12,r14,[sp,#168]		@ R[4][1] = C[1] ^ (~C[2] & C[3]);
1790#endif
1791	bic	r11,r9,r7,ror#1
1792	bic	r12,r0,r8,ror#31-1
1793	bic	r14,r1,r9,ror#31-1
1794	eor	r4,r4,r10,ror#32-1
1795#ifndef	__thumb2__
1796	str	r4,[sp,#176]		@ R[4][2] = C[2] ^= (~C[3] & C[4]);
1797#endif
1798	eor	r5,r5,r11,ror#32-1
1799#ifndef	__thumb2__
1800	str	r5,[sp,#176+4]
1801#else
1802	strd	r4,r5,[sp,#176]		@ R[4][2] = C[2] ^= (~C[3] & C[4]);
1803#endif
1804	eor	r6,r6,r12,ror#32-31
1805	eor	r7,r7,r14,ror#32-31
1806#ifndef	__thumb2__
1807	str	r6,[sp,#184]		@ R[4][3] = C[3] ^= (~C[4] & C[0]);
1808#endif
1809	bic	r10,r2,r0,ror#32-31
1810#ifndef	__thumb2__
1811	str	r7,[sp,#184+4]
1812#else
1813	strd	r6,r7,[sp,#184]		@ R[4][3] = C[3] ^= (~C[4] & C[0]);
1814#endif
1815	bic	r11,r3,r1,ror#32-31
1816	add	r12,sp,#0
1817	eor	r8,r10,r8,ror#32-1
1818	add	r10,sp,#40
1819	eor	r9,r11,r9,ror#32-1
1820#ifndef	__thumb2__
1821	str	r8,[sp,#192]		@ R[4][4] = C[4] ^= (~C[0] & C[1]);
1822#endif
1823#ifndef	__thumb2__
1824	str	r9,[sp,#192+4]
1825#else
1826	strd	r8,r9,[sp,#192]		@ R[4][4] = C[4] ^= (~C[0] & C[1]);
1827#endif
1828	blo	.Lround2x
1829
1830	ldr	pc,[sp,#440]
1831.size	KeccakF1600_int,.-KeccakF1600_int
1832
1833.type	KeccakF1600, %function
1834.align	5
1835KeccakF1600:
1836	stmdb	sp!,{r0,r4-r11,lr}
1837	sub	sp,sp,#440+16			@ space for A[5][5],D[5],T[5][5],...
1838
1839	add	r10,r0,#40
1840	add	r11,sp,#40
1841	ldmia	r0,    {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}		@ copy A[5][5] to stack
1842	stmia	sp,    {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1843	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1844	stmia	r11!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1845	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1846	stmia	r11!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1847	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1848	stmia	r11!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1849	ldmia	r10, {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1850	add	r12,sp,#0
1851	add	r10,sp,#40
1852	stmia	r11, {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1853
1854	bl	KeccakF1600_enter
1855
1856	ldr	r11, [sp,#440+16]		@ restore pointer to A
1857	ldmia	sp,    {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1858	stmia	r11!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}		@ return A[5][5]
1859	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1860	stmia	r11!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1861	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1862	stmia	r11!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1863	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1864	stmia	r11!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1865	ldmia	r10, {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1866	stmia	r11, {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1867
1868	add	sp,sp,#440+20
1869	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,pc}
1870.size	KeccakF1600,.-KeccakF1600
1871.globl	SHA3_absorb
1872.type	SHA3_absorb,%function
1873.align	5
1874SHA3_absorb:
1875	stmdb	sp!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9,r10,r11,r12,lr}
1876	sub	sp,sp,#456+16
1877
1878	add	r10,r0,#40
1879	@ mov	r11,r1
1880	mov	r12,r2
1881	mov	r14,r3
1882	cmp	r2,r3
1883	blo	.Labsorb_abort
1884
1885	add	r11,sp,#0
1886	ldmia	r0,      {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}	@ copy A[5][5] to stack
1887	stmia	r11!,   {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1888	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1889	stmia	r11!,   {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1890	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1891	stmia	r11!,   {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1892	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1893	stmia	r11!,   {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1894	ldmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1895	stmia	r11,    {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
1896
1897	ldr	r11,[sp,#476]		@ restore r11
1898#ifdef	__thumb2__
1899	mov	r9,#0x00ff00ff
1900	mov	r8,#0x0f0f0f0f
1901	mov	r7,#0x33333333
1902	mov	r6,#0x55555555
1903#else
1904	mov	r6,#0x11		@ compose constants
1905	mov	r8,#0x0f
1906	mov	r9,#0xff
1907	orr	r6,r6,r6,lsl#8
1908	orr	r8,r8,r8,lsl#8
1909	orr	r6,r6,r6,lsl#16		@ 0x11111111
1910	orr	r9,r9,r9,lsl#16		@ 0x00ff00ff
1911	orr	r8,r8,r8,lsl#16		@ 0x0f0f0f0f
1912	orr	r7,r6,r6,lsl#1		@ 0x33333333
1913	orr	r6,r6,r6,lsl#2		@ 0x55555555
1914#endif
1915	str	r9,[sp,#468]
1916	str	r8,[sp,#464]
1917	str	r7,[sp,#460]
1918	str	r6,[sp,#456]
1919	b	.Loop_absorb
1920
1921.align	4
1922.Loop_absorb:
1923	subs	r0,r12,r14
1924	blo	.Labsorbed
1925	add	r10,sp,#0
1926	str	r0,[sp,#480]		@ save len - bsz
1927
1928.align	4
1929.Loop_block:
1930	ldrb	r0,[r11],#1
1931	ldrb	r1,[r11],#1
1932	ldrb	r2,[r11],#1
1933	ldrb	r3,[r11],#1
1934	ldrb	r4,[r11],#1
1935	orr	r0,r0,r1,lsl#8
1936	ldrb	r1,[r11],#1
1937	orr	r0,r0,r2,lsl#16
1938	ldrb	r2,[r11],#1
1939	orr	r0,r0,r3,lsl#24		@ lo
1940	ldrb	r3,[r11],#1
1941	orr	r1,r4,r1,lsl#8
1942	orr	r1,r1,r2,lsl#16
1943	orr	r1,r1,r3,lsl#24		@ hi
1944
1945	and	r2,r0,r6		@ &=0x55555555
1946	and	r0,r0,r6,lsl#1		@ &=0xaaaaaaaa
1947	and	r3,r1,r6		@ &=0x55555555
1948	and	r1,r1,r6,lsl#1		@ &=0xaaaaaaaa
1949	orr	r2,r2,r2,lsr#1
1950	orr	r0,r0,r0,lsl#1
1951	orr	r3,r3,r3,lsr#1
1952	orr	r1,r1,r1,lsl#1
1953	and	r2,r2,r7		@ &=0x33333333
1954	and	r0,r0,r7,lsl#2		@ &=0xcccccccc
1955	and	r3,r3,r7		@ &=0x33333333
1956	and	r1,r1,r7,lsl#2		@ &=0xcccccccc
1957	orr	r2,r2,r2,lsr#2
1958	orr	r0,r0,r0,lsl#2
1959	orr	r3,r3,r3,lsr#2
1960	orr	r1,r1,r1,lsl#2
1961	and	r2,r2,r8		@ &=0x0f0f0f0f
1962	and	r0,r0,r8,lsl#4		@ &=0xf0f0f0f0
1963	and	r3,r3,r8		@ &=0x0f0f0f0f
1964	and	r1,r1,r8,lsl#4		@ &=0xf0f0f0f0
1965	ldmia	r10,{r4,r5}		@ A_flat[i]
1966	orr	r2,r2,r2,lsr#4
1967	orr	r0,r0,r0,lsl#4
1968	orr	r3,r3,r3,lsr#4
1969	orr	r1,r1,r1,lsl#4
1970	and	r2,r2,r9		@ &=0x00ff00ff
1971	and	r0,r0,r9,lsl#8		@ &=0xff00ff00
1972	and	r3,r3,r9		@ &=0x00ff00ff
1973	and	r1,r1,r9,lsl#8		@ &=0xff00ff00
1974	orr	r2,r2,r2,lsr#8
1975	orr	r0,r0,r0,lsl#8
1976	orr	r3,r3,r3,lsr#8
1977	orr	r1,r1,r1,lsl#8
1978
1979	mov	r2,r2,lsl#16
1980	mov	r1,r1,lsr#16
1981	eor	r4,r4,r3,lsl#16
1982	eor	r5,r5,r0,lsr#16
1983	eor	r4,r4,r2,lsr#16
1984	eor	r5,r5,r1,lsl#16
1985	stmia	r10!,{r4,r5}	@ A_flat[i++] ^= BitInterleave(inp[0..7])
1986
1987	subs	r14,r14,#8
1988	bhi	.Loop_block
1989
1990	str	r11,[sp,#476]
1991
1992	bl	KeccakF1600_int
1993
1994	add	r14,sp,#456
1995	ldmia	r14,{r6,r7,r8,r9,r10,r11,r12,r14}	@ restore constants and variables
1996	b	.Loop_absorb
1997
1998.align	4
1999.Labsorbed:
2000	add	r11,sp,#40
2001	ldmia	sp,      {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2002	stmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}	@ return A[5][5]
2003	ldmia	r11!,   {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2004	stmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2005	ldmia	r11!,   {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2006	stmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2007	ldmia	r11!,   {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2008	stmia	r10!,{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2009	ldmia	r11,    {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2010	stmia	r10, {r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}
2011
2012.Labsorb_abort:
2013	add	sp,sp,#456+32
2014	mov	r0,r12			@ return value
2015	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,r11,r12,pc}
2016.size	SHA3_absorb,.-SHA3_absorb
2017.globl	SHA3_squeeze
2018.type	SHA3_squeeze,%function
2019.align	5
2020SHA3_squeeze:
2021	stmdb	sp!,{r0,r3-r10,lr}
2022
2023	mov	r10,r0
2024	mov	r4,r1
2025	mov	r5,r2
2026	mov	r12,r3
2027
2028#ifdef	__thumb2__
2029	mov	r9,#0x00ff00ff
2030	mov	r8,#0x0f0f0f0f
2031	mov	r7,#0x33333333
2032	mov	r6,#0x55555555
2033#else
2034	mov	r6,#0x11		@ compose constants
2035	mov	r8,#0x0f
2036	mov	r9,#0xff
2037	orr	r6,r6,r6,lsl#8
2038	orr	r8,r8,r8,lsl#8
2039	orr	r6,r6,r6,lsl#16		@ 0x11111111
2040	orr	r9,r9,r9,lsl#16		@ 0x00ff00ff
2041	orr	r8,r8,r8,lsl#16		@ 0x0f0f0f0f
2042	orr	r7,r6,r6,lsl#1		@ 0x33333333
2043	orr	r6,r6,r6,lsl#2		@ 0x55555555
2044#endif
2045	stmdb	sp!,{r6,r7,r8,r9}
2046
2047	mov	r14,r10
2048	b	.Loop_squeeze
2049
2050.align	4
2051.Loop_squeeze:
2052	ldmia	r10!,{r0,r1}	@ A_flat[i++]
2053
2054	mov	r2,r0,lsl#16
2055	mov	r3,r1,lsl#16		@ r3 = r1 << 16
2056	mov	r2,r2,lsr#16		@ r2 = r0 & 0x0000ffff
2057	mov	r1,r1,lsr#16
2058	mov	r0,r0,lsr#16		@ r0 = r0 >> 16
2059	mov	r1,r1,lsl#16		@ r1 = r1 & 0xffff0000
2060
2061	orr	r2,r2,r2,lsl#8
2062	orr	r3,r3,r3,lsr#8
2063	orr	r0,r0,r0,lsl#8
2064	orr	r1,r1,r1,lsr#8
2065	and	r2,r2,r9		@ &=0x00ff00ff
2066	and	r3,r3,r9,lsl#8		@ &=0xff00ff00
2067	and	r0,r0,r9		@ &=0x00ff00ff
2068	and	r1,r1,r9,lsl#8		@ &=0xff00ff00
2069	orr	r2,r2,r2,lsl#4
2070	orr	r3,r3,r3,lsr#4
2071	orr	r0,r0,r0,lsl#4
2072	orr	r1,r1,r1,lsr#4
2073	and	r2,r2,r8		@ &=0x0f0f0f0f
2074	and	r3,r3,r8,lsl#4		@ &=0xf0f0f0f0
2075	and	r0,r0,r8		@ &=0x0f0f0f0f
2076	and	r1,r1,r8,lsl#4		@ &=0xf0f0f0f0
2077	orr	r2,r2,r2,lsl#2
2078	orr	r3,r3,r3,lsr#2
2079	orr	r0,r0,r0,lsl#2
2080	orr	r1,r1,r1,lsr#2
2081	and	r2,r2,r7		@ &=0x33333333
2082	and	r3,r3,r7,lsl#2		@ &=0xcccccccc
2083	and	r0,r0,r7		@ &=0x33333333
2084	and	r1,r1,r7,lsl#2		@ &=0xcccccccc
2085	orr	r2,r2,r2,lsl#1
2086	orr	r3,r3,r3,lsr#1
2087	orr	r0,r0,r0,lsl#1
2088	orr	r1,r1,r1,lsr#1
2089	and	r2,r2,r6		@ &=0x55555555
2090	and	r3,r3,r6,lsl#1		@ &=0xaaaaaaaa
2091	and	r0,r0,r6		@ &=0x55555555
2092	and	r1,r1,r6,lsl#1		@ &=0xaaaaaaaa
2093
2094	orr	r2,r2,r3
2095	orr	r0,r0,r1
2096
2097	cmp	r5,#8
2098	blo	.Lsqueeze_tail
2099	mov	r1,r2,lsr#8
2100	strb	r2,[r4],#1
2101	mov	r3,r2,lsr#16
2102	strb	r1,[r4],#1
2103	mov	r2,r2,lsr#24
2104	strb	r3,[r4],#1
2105	strb	r2,[r4],#1
2106
2107	mov	r1,r0,lsr#8
2108	strb	r0,[r4],#1
2109	mov	r3,r0,lsr#16
2110	strb	r1,[r4],#1
2111	mov	r0,r0,lsr#24
2112	strb	r3,[r4],#1
2113	strb	r0,[r4],#1
2114	subs	r5,r5,#8
2115	beq	.Lsqueeze_done
2116
2117	subs	r12,r12,#8		@ bsz -= 8
2118	bhi	.Loop_squeeze
2119
2120	mov	r0,r14			@ original r10
2121
2122	bl	KeccakF1600
2123
2124	ldmia	sp,{r6,r7,r8,r9,r10,r12}		@ restore constants and variables
2125	mov	r14,r10
2126	b	.Loop_squeeze
2127
2128.align	4
2129.Lsqueeze_tail:
2130	strb	r2,[r4],#1
2131	mov	r2,r2,lsr#8
2132	subs	r5,r5,#1
2133	beq	.Lsqueeze_done
2134	strb	r2,[r4],#1
2135	mov	r2,r2,lsr#8
2136	subs	r5,r5,#1
2137	beq	.Lsqueeze_done
2138	strb	r2,[r4],#1
2139	mov	r2,r2,lsr#8
2140	subs	r5,r5,#1
2141	beq	.Lsqueeze_done
2142	strb	r2,[r4],#1
2143	subs	r5,r5,#1
2144	beq	.Lsqueeze_done
2145
2146	strb	r0,[r4],#1
2147	mov	r0,r0,lsr#8
2148	subs	r5,r5,#1
2149	beq	.Lsqueeze_done
2150	strb	r0,[r4],#1
2151	mov	r0,r0,lsr#8
2152	subs	r5,r5,#1
2153	beq	.Lsqueeze_done
2154	strb	r0,[r4]
2155	b	.Lsqueeze_done
2156
2157.align	4
2158.Lsqueeze_done:
2159	add	sp,sp,#24
2160	ldmia	sp!,{r4,r5,r6,r7,r8,r9,r10,pc}
2161.size	SHA3_squeeze,.-SHA3_squeeze
2162#if __ARM_MAX_ARCH__>=7
2163.fpu	neon
2164
2165.type	iotas64, %object
2166.align	5
2167iotas64:
2168.quad	0x0000000000000001
2169.quad	0x0000000000008082
2170.quad	0x800000000000808a
2171.quad	0x8000000080008000
2172.quad	0x000000000000808b
2173.quad	0x0000000080000001
2174.quad	0x8000000080008081
2175.quad	0x8000000000008009
2176.quad	0x000000000000008a
2177.quad	0x0000000000000088
2178.quad	0x0000000080008009
2179.quad	0x000000008000000a
2180.quad	0x000000008000808b
2181.quad	0x800000000000008b
2182.quad	0x8000000000008089
2183.quad	0x8000000000008003
2184.quad	0x8000000000008002
2185.quad	0x8000000000000080
2186.quad	0x000000000000800a
2187.quad	0x800000008000000a
2188.quad	0x8000000080008081
2189.quad	0x8000000000008080
2190.quad	0x0000000080000001
2191.quad	0x8000000080008008
2192.size	iotas64,.-iotas64
2193
2194.type	KeccakF1600_neon, %function
2195.align	5
2196KeccakF1600_neon:
2197	add	r1, r0, #16
2198	adr	r2, iotas64
2199	mov	r3, #24			@ loop counter
2200	b	.Loop_neon
2201
2202.align	4
2203.Loop_neon:
2204	@ Theta
2205	vst1.64	{q4},  [r0,:64]		@ offload A[0..1][4]
2206	veor	q13, q0,  q5		@ A[0..1][0]^A[2..3][0]
2207	vst1.64	{d18}, [r1,:64]		@ offload A[2][4]
2208	veor	q14, q1,  q6		@ A[0..1][1]^A[2..3][1]
2209	veor	q15, q2,  q7		@ A[0..1][2]^A[2..3][2]
2210	veor	d26, d26, d27		@ C[0]=A[0][0]^A[1][0]^A[2][0]^A[3][0]
2211	veor	d27, d28, d29		@ C[1]=A[0][1]^A[1][1]^A[2][1]^A[3][1]
2212	veor	q14, q3,  q8		@ A[0..1][3]^A[2..3][3]
2213	veor	q4,  q4,  q9		@ A[0..1][4]^A[2..3][4]
2214	veor	d30, d30, d31		@ C[2]=A[0][2]^A[1][2]^A[2][2]^A[3][2]
2215	veor	d31, d28, d29		@ C[3]=A[0][3]^A[1][3]^A[2][3]^A[3][3]
2216	veor	d25, d8,  d9		@ C[4]=A[0][4]^A[1][4]^A[2][4]^A[3][4]
2217	veor	q13, q13, q10		@ C[0..1]^=A[4][0..1]
2218	veor	q14, q15, q11		@ C[2..3]^=A[4][2..3]
2219	veor	d25, d25, d24		@ C[4]^=A[4][4]
2220
2221	vadd.u64	q4,  q13, q13		@ C[0..1]<<1
2222	vadd.u64	q15, q14, q14		@ C[2..3]<<1
2223	vadd.u64	d18, d25, d25		@ C[4]<<1
2224	vsri.u64	q4,  q13, #63		@ ROL64(C[0..1],1)
2225	vsri.u64	q15, q14, #63		@ ROL64(C[2..3],1)
2226	vsri.u64	d18, d25, #63		@ ROL64(C[4],1)
2227	veor	d25, d25, d9		@ D[0] = C[4] ^= ROL64(C[1],1)
2228	veor	q13, q13, q15		@ D[1..2] = C[0..1] ^ ROL64(C[2..3],1)
2229	veor	d28, d28, d18		@ D[3] = C[2] ^= ROL64(C[4],1)
2230	veor	d29, d29, d8		@ D[4] = C[3] ^= ROL64(C[0],1)
2231
2232	veor	d0,  d0,  d25		@ A[0][0] ^= C[4]
2233	veor	d1,  d1,  d25		@ A[1][0] ^= C[4]
2234	veor	d10, d10, d25		@ A[2][0] ^= C[4]
2235	veor	d11, d11, d25		@ A[3][0] ^= C[4]
2236	veor	d20, d20, d25		@ A[4][0] ^= C[4]
2237
2238	veor	d2,  d2,  d26		@ A[0][1] ^= D[1]
2239	veor	d3,  d3,  d26		@ A[1][1] ^= D[1]
2240	veor	d12, d12, d26		@ A[2][1] ^= D[1]
2241	veor	d13, d13, d26		@ A[3][1] ^= D[1]
2242	veor	d21, d21, d26		@ A[4][1] ^= D[1]
2243	vmov	d26, d27
2244
2245	veor	d6,  d6,  d28		@ A[0][3] ^= C[2]
2246	veor	d7,  d7,  d28		@ A[1][3] ^= C[2]
2247	veor	d16, d16, d28		@ A[2][3] ^= C[2]
2248	veor	d17, d17, d28		@ A[3][3] ^= C[2]
2249	veor	d23, d23, d28		@ A[4][3] ^= C[2]
2250	vld1.64	{q4},  [r0,:64]		@ restore A[0..1][4]
2251	vmov	d28, d29
2252
2253	vld1.64	{d18}, [r1,:64]		@ restore A[2][4]
2254	veor	q2,  q2,  q13		@ A[0..1][2] ^= D[2]
2255	veor	q7,  q7,  q13		@ A[2..3][2] ^= D[2]
2256	veor	d22, d22, d27		@ A[4][2]    ^= D[2]
2257
2258	veor	q4,  q4,  q14		@ A[0..1][4] ^= C[3]
2259	veor	q9,  q9,  q14		@ A[2..3][4] ^= C[3]
2260	veor	d24, d24, d29		@ A[4][4]    ^= C[3]
2261
2262	@ Rho + Pi
2263	vmov	d26, d2			@ C[1] = A[0][1]
2264	vshl.u64	d2,  d3,  #44
2265	vmov	d27, d4			@ C[2] = A[0][2]
2266	vshl.u64	d4,  d14, #43
2267	vmov	d28, d6			@ C[3] = A[0][3]
2268	vshl.u64	d6,  d17, #21
2269	vmov	d29, d8			@ C[4] = A[0][4]
2270	vshl.u64	d8,  d24, #14
2271	vsri.u64	d2,  d3,  #64-44	@ A[0][1] = ROL64(A[1][1], rhotates[1][1])
2272	vsri.u64	d4,  d14, #64-43	@ A[0][2] = ROL64(A[2][2], rhotates[2][2])
2273	vsri.u64	d6,  d17, #64-21	@ A[0][3] = ROL64(A[3][3], rhotates[3][3])
2274	vsri.u64	d8,  d24, #64-14	@ A[0][4] = ROL64(A[4][4], rhotates[4][4])
2275
2276	vshl.u64	d3,  d9,  #20
2277	vshl.u64	d14, d16, #25
2278	vshl.u64	d17, d15, #15
2279	vshl.u64	d24, d21, #2
2280	vsri.u64	d3,  d9,  #64-20	@ A[1][1] = ROL64(A[1][4], rhotates[1][4])
2281	vsri.u64	d14, d16, #64-25	@ A[2][2] = ROL64(A[2][3], rhotates[2][3])
2282	vsri.u64	d17, d15, #64-15	@ A[3][3] = ROL64(A[3][2], rhotates[3][2])
2283	vsri.u64	d24, d21, #64-2		@ A[4][4] = ROL64(A[4][1], rhotates[4][1])
2284
2285	vshl.u64	d9,  d22, #61
2286	@ vshl.u64	d16, d19, #8
2287	vshl.u64	d15, d12, #10
2288	vshl.u64	d21, d7,  #55
2289	vsri.u64	d9,  d22, #64-61	@ A[1][4] = ROL64(A[4][2], rhotates[4][2])
2290	vext.8	d16, d19, d19, #8-1	@ A[2][3] = ROL64(A[3][4], rhotates[3][4])
2291	vsri.u64	d15, d12, #64-10	@ A[3][2] = ROL64(A[2][1], rhotates[2][1])
2292	vsri.u64	d21, d7,  #64-55	@ A[4][1] = ROL64(A[1][3], rhotates[1][3])
2293
2294	vshl.u64	d22, d18, #39
2295	@ vshl.u64	d19, d23, #56
2296	vshl.u64	d12, d5,  #6
2297	vshl.u64	d7,  d13, #45
2298	vsri.u64	d22, d18, #64-39	@ A[4][2] = ROL64(A[2][4], rhotates[2][4])
2299	vext.8	d19, d23, d23, #8-7	@ A[3][4] = ROL64(A[4][3], rhotates[4][3])
2300	vsri.u64	d12, d5,  #64-6		@ A[2][1] = ROL64(A[1][2], rhotates[1][2])
2301	vsri.u64	d7,  d13, #64-45	@ A[1][3] = ROL64(A[3][1], rhotates[3][1])
2302
2303	vshl.u64	d18, d20, #18
2304	vshl.u64	d23, d11, #41
2305	vshl.u64	d5,  d10, #3
2306	vshl.u64	d13, d1,  #36
2307	vsri.u64	d18, d20, #64-18	@ A[2][4] = ROL64(A[4][0], rhotates[4][0])
2308	vsri.u64	d23, d11, #64-41	@ A[4][3] = ROL64(A[3][0], rhotates[3][0])
2309	vsri.u64	d5,  d10, #64-3		@ A[1][2] = ROL64(A[2][0], rhotates[2][0])
2310	vsri.u64	d13, d1,  #64-36	@ A[3][1] = ROL64(A[1][0], rhotates[1][0])
2311
2312	vshl.u64	d1,  d28, #28
2313	vshl.u64	d10, d26, #1
2314	vshl.u64	d11, d29, #27
2315	vshl.u64	d20, d27, #62
2316	vsri.u64	d1,  d28, #64-28	@ A[1][0] = ROL64(C[3],    rhotates[0][3])
2317	vsri.u64	d10, d26, #64-1		@ A[2][0] = ROL64(C[1],    rhotates[0][1])
2318	vsri.u64	d11, d29, #64-27	@ A[3][0] = ROL64(C[4],    rhotates[0][4])
2319	vsri.u64	d20, d27, #64-62	@ A[4][0] = ROL64(C[2],    rhotates[0][2])
2320
2321	@ Chi + Iota
2322	vbic	q13, q2,  q1
2323	vbic	q14, q3,  q2
2324	vbic	q15, q4,  q3
2325	veor	q13, q13, q0		@ A[0..1][0] ^ (~A[0..1][1] & A[0..1][2])
2326	veor	q14, q14, q1		@ A[0..1][1] ^ (~A[0..1][2] & A[0..1][3])
2327	veor	q2,  q2,  q15		@ A[0..1][2] ^= (~A[0..1][3] & A[0..1][4])
2328	vst1.64	{q13}, [r0,:64]		@ offload A[0..1][0]
2329	vbic	q13, q0,  q4
2330	vbic	q15, q1,  q0
2331	vmov	q1,  q14		@ A[0..1][1]
2332	veor	q3,  q3,  q13		@ A[0..1][3] ^= (~A[0..1][4] & A[0..1][0])
2333	veor	q4,  q4,  q15		@ A[0..1][4] ^= (~A[0..1][0] & A[0..1][1])
2334
2335	vbic	q13, q7,  q6
2336	vmov	q0,  q5			@ A[2..3][0]
2337	vbic	q14, q8,  q7
2338	vmov	q15, q6			@ A[2..3][1]
2339	veor	q5,  q5,  q13		@ A[2..3][0] ^= (~A[2..3][1] & A[2..3][2])
2340	vbic	q13, q9,  q8
2341	veor	q6,  q6,  q14		@ A[2..3][1] ^= (~A[2..3][2] & A[2..3][3])
2342	vbic	q14, q0,  q9
2343	veor	q7,  q7,  q13		@ A[2..3][2] ^= (~A[2..3][3] & A[2..3][4])
2344	vbic	q13, q15, q0
2345	veor	q8,  q8,  q14		@ A[2..3][3] ^= (~A[2..3][4] & A[2..3][0])
2346	vmov	q14, q10		@ A[4][0..1]
2347	veor	q9,  q9,  q13		@ A[2..3][4] ^= (~A[2..3][0] & A[2..3][1])
2348
2349	vld1.64	d25, [r2,:64]!		@ Iota[i++]
2350	vbic	d26, d22, d21
2351	vbic	d27, d23, d22
2352	vld1.64	{q0}, [r0,:64]		@ restore A[0..1][0]
2353	veor	d20, d20, d26		@ A[4][0] ^= (~A[4][1] & A[4][2])
2354	vbic	d26, d24, d23
2355	veor	d21, d21, d27		@ A[4][1] ^= (~A[4][2] & A[4][3])
2356	vbic	d27, d28, d24
2357	veor	d22, d22, d26		@ A[4][2] ^= (~A[4][3] & A[4][4])
2358	vbic	d26, d29, d28
2359	veor	d23, d23, d27		@ A[4][3] ^= (~A[4][4] & A[4][0])
2360	veor	d0,  d0,  d25		@ A[0][0] ^= Iota[i]
2361	veor	d24, d24, d26		@ A[4][4] ^= (~A[4][0] & A[4][1])
2362
2363	subs	r3, r3, #1
2364	bne	.Loop_neon
2365
2366.word	0xe12fff1e
2367.size	KeccakF1600_neon,.-KeccakF1600_neon
2368
2369.globl	SHA3_absorb_neon
2370.type	SHA3_absorb_neon, %function
2371.align	5
2372SHA3_absorb_neon:
2373	stmdb	sp!, {r4,r5,r6,lr}
2374	vstmdb	sp!, {d8,d9,d10,d11,d12,d13,d14,d15}
2375
2376	mov	r4, r1			@ inp
2377	mov	r5, r2			@ len
2378	mov	r6, r3			@ bsz
2379
2380	vld1.32	{d0}, [r0,:64]!		@ A[0][0]
2381	vld1.32	{d2}, [r0,:64]!		@ A[0][1]
2382	vld1.32	{d4}, [r0,:64]!		@ A[0][2]
2383	vld1.32	{d6}, [r0,:64]!		@ A[0][3]
2384	vld1.32	{d8}, [r0,:64]!		@ A[0][4]
2385
2386	vld1.32	{d1}, [r0,:64]!		@ A[1][0]
2387	vld1.32	{d3}, [r0,:64]!		@ A[1][1]
2388	vld1.32	{d5}, [r0,:64]!		@ A[1][2]
2389	vld1.32	{d7}, [r0,:64]!		@ A[1][3]
2390	vld1.32	{d9}, [r0,:64]!		@ A[1][4]
2391
2392	vld1.32	{d10}, [r0,:64]!		@ A[2][0]
2393	vld1.32	{d12}, [r0,:64]!		@ A[2][1]
2394	vld1.32	{d14}, [r0,:64]!		@ A[2][2]
2395	vld1.32	{d16}, [r0,:64]!		@ A[2][3]
2396	vld1.32	{d18}, [r0,:64]!		@ A[2][4]
2397
2398	vld1.32	{d11}, [r0,:64]!		@ A[3][0]
2399	vld1.32	{d13}, [r0,:64]!		@ A[3][1]
2400	vld1.32	{d15}, [r0,:64]!		@ A[3][2]
2401	vld1.32	{d17}, [r0,:64]!		@ A[3][3]
2402	vld1.32	{d19}, [r0,:64]!		@ A[3][4]
2403
2404	vld1.32	{d20,d21,d22,d23}, [r0,:64]!	@ A[4][0..3]
2405	vld1.32	{d24}, [r0,:64]		@ A[4][4]
2406	sub	r0, r0, #24*8		@ rewind
2407	b	.Loop_absorb_neon
2408
2409.align	4
2410.Loop_absorb_neon:
2411	subs	r12, r5, r6		@ len - bsz
2412	blo	.Labsorbed_neon
2413	mov	r5, r12
2414
2415	vld1.8	{d31}, [r4]!		@ endian-neutral loads...
2416	cmp	r6, #8*2
2417	veor	d0, d0, d31		@ A[0][0] ^= *inp++
2418	blo	.Lprocess_neon
2419	vld1.8	{d31}, [r4]!
2420	veor	d2, d2, d31		@ A[0][1] ^= *inp++
2421	beq	.Lprocess_neon
2422	vld1.8	{d31}, [r4]!
2423	cmp	r6, #8*4
2424	veor	d4, d4, d31		@ A[0][2] ^= *inp++
2425	blo	.Lprocess_neon
2426	vld1.8	{d31}, [r4]!
2427	veor	d6, d6, d31		@ A[0][3] ^= *inp++
2428	beq	.Lprocess_neon
2429	vld1.8	{d31},[r4]!
2430	cmp	r6, #8*6
2431	veor	d8, d8, d31		@ A[0][4] ^= *inp++
2432	blo	.Lprocess_neon
2433
2434	vld1.8	{d31}, [r4]!
2435	veor	d1, d1, d31		@ A[1][0] ^= *inp++
2436	beq	.Lprocess_neon
2437	vld1.8	{d31}, [r4]!
2438	cmp	r6, #8*8
2439	veor	d3, d3, d31		@ A[1][1] ^= *inp++
2440	blo	.Lprocess_neon
2441	vld1.8	{d31}, [r4]!
2442	veor	d5, d5, d31		@ A[1][2] ^= *inp++
2443	beq	.Lprocess_neon
2444	vld1.8	{d31}, [r4]!
2445	cmp	r6, #8*10
2446	veor	d7, d7, d31		@ A[1][3] ^= *inp++
2447	blo	.Lprocess_neon
2448	vld1.8	{d31}, [r4]!
2449	veor	d9, d9, d31		@ A[1][4] ^= *inp++
2450	beq	.Lprocess_neon
2451
2452	vld1.8	{d31}, [r4]!
2453	cmp	r6, #8*12
2454	veor	d10, d10, d31		@ A[2][0] ^= *inp++
2455	blo	.Lprocess_neon
2456	vld1.8	{d31}, [r4]!
2457	veor	d12, d12, d31		@ A[2][1] ^= *inp++
2458	beq	.Lprocess_neon
2459	vld1.8	{d31}, [r4]!
2460	cmp	r6, #8*14
2461	veor	d14, d14, d31		@ A[2][2] ^= *inp++
2462	blo	.Lprocess_neon
2463	vld1.8	{d31}, [r4]!
2464	veor	d16, d16, d31		@ A[2][3] ^= *inp++
2465	beq	.Lprocess_neon
2466	vld1.8	{d31}, [r4]!
2467	cmp	r6, #8*16
2468	veor	d18, d18, d31		@ A[2][4] ^= *inp++
2469	blo	.Lprocess_neon
2470
2471	vld1.8	{d31}, [r4]!
2472	veor	d11, d11, d31		@ A[3][0] ^= *inp++
2473	beq	.Lprocess_neon
2474	vld1.8	{d31}, [r4]!
2475	cmp	r6, #8*18
2476	veor	d13, d13, d31		@ A[3][1] ^= *inp++
2477	blo	.Lprocess_neon
2478	vld1.8	{d31}, [r4]!
2479	veor	d15, d15, d31		@ A[3][2] ^= *inp++
2480	beq	.Lprocess_neon
2481	vld1.8	{d31}, [r4]!
2482	cmp	r6, #8*20
2483	veor	d17, d17, d31		@ A[3][3] ^= *inp++
2484	blo	.Lprocess_neon
2485	vld1.8	{d31}, [r4]!
2486	veor	d19, d19, d31		@ A[3][4] ^= *inp++
2487	beq	.Lprocess_neon
2488
2489	vld1.8	{d31}, [r4]!
2490	cmp	r6, #8*22
2491	veor	d20, d20, d31		@ A[4][0] ^= *inp++
2492	blo	.Lprocess_neon
2493	vld1.8	{d31}, [r4]!
2494	veor	d21, d21, d31		@ A[4][1] ^= *inp++
2495	beq	.Lprocess_neon
2496	vld1.8	{d31}, [r4]!
2497	cmp	r6, #8*24
2498	veor	d22, d22, d31		@ A[4][2] ^= *inp++
2499	blo	.Lprocess_neon
2500	vld1.8	{d31}, [r4]!
2501	veor	d23, d23, d31		@ A[4][3] ^= *inp++
2502	beq	.Lprocess_neon
2503	vld1.8	{d31}, [r4]!
2504	veor	d24, d24, d31		@ A[4][4] ^= *inp++
2505
2506.Lprocess_neon:
2507	bl	KeccakF1600_neon
2508	b	.Loop_absorb_neon
2509
2510.align	4
2511.Labsorbed_neon:
2512	vst1.32	{d0}, [r0,:64]!		@ A[0][0..4]
2513	vst1.32	{d2}, [r0,:64]!
2514	vst1.32	{d4}, [r0,:64]!
2515	vst1.32	{d6}, [r0,:64]!
2516	vst1.32	{d8}, [r0,:64]!
2517
2518	vst1.32	{d1}, [r0,:64]!		@ A[1][0..4]
2519	vst1.32	{d3}, [r0,:64]!
2520	vst1.32	{d5}, [r0,:64]!
2521	vst1.32	{d7}, [r0,:64]!
2522	vst1.32	{d9}, [r0,:64]!
2523
2524	vst1.32	{d10}, [r0,:64]!		@ A[2][0..4]
2525	vst1.32	{d12}, [r0,:64]!
2526	vst1.32	{d14}, [r0,:64]!
2527	vst1.32	{d16}, [r0,:64]!
2528	vst1.32	{d18}, [r0,:64]!
2529
2530	vst1.32	{d11}, [r0,:64]!		@ A[3][0..4]
2531	vst1.32	{d13}, [r0,:64]!
2532	vst1.32	{d15}, [r0,:64]!
2533	vst1.32	{d17}, [r0,:64]!
2534	vst1.32	{d19}, [r0,:64]!
2535
2536	vst1.32	{d20,d21,d22,d23}, [r0,:64]!	@ A[4][0..4]
2537	vst1.32	{d24}, [r0,:64]
2538
2539	mov	r0, r5			@ return value
2540	vldmia	sp!, {d8,d9,d10,d11,d12,d13,d14,d15}
2541	ldmia	sp!, {r4,r5,r6,pc}
2542.size	SHA3_absorb_neon,.-SHA3_absorb_neon
2543
2544.globl	SHA3_squeeze_neon
2545.type	SHA3_squeeze_neon, %function
2546.align	5
2547SHA3_squeeze_neon:
2548	stmdb	sp!, {r4,r5,r6,lr}
2549
2550	mov	r4, r1			@ out
2551	mov	r5, r2			@ len
2552	mov	r6, r3			@ bsz
2553	mov	r12, r0			@ A_flat
2554	mov	r14, r3			@ bsz
2555	b	.Loop_squeeze_neon
2556
2557.align	4
2558.Loop_squeeze_neon:
2559	cmp	r5, #8
2560	blo	.Lsqueeze_neon_tail
2561	vld1.32	{d0}, [r12]!
2562	vst1.8	{d0}, [r4]!		@ endian-neutral store
2563
2564	subs	r5, r5, #8		@ len -= 8
2565	beq	.Lsqueeze_neon_done
2566
2567	subs	r14, r14, #8		@ bsz -= 8
2568	bhi	.Loop_squeeze_neon
2569
2570	vstmdb	sp!,  {d8,d9,d10,d11,d12,d13,d14,d15}
2571
2572	vld1.32	{d0}, [r0,:64]!		@ A[0][0..4]
2573	vld1.32	{d2}, [r0,:64]!
2574	vld1.32	{d4}, [r0,:64]!
2575	vld1.32	{d6}, [r0,:64]!
2576	vld1.32	{d8}, [r0,:64]!
2577
2578	vld1.32	{d1}, [r0,:64]!		@ A[1][0..4]
2579	vld1.32	{d3}, [r0,:64]!
2580	vld1.32	{d5}, [r0,:64]!
2581	vld1.32	{d7}, [r0,:64]!
2582	vld1.32	{d9}, [r0,:64]!
2583
2584	vld1.32	{d10}, [r0,:64]!		@ A[2][0..4]
2585	vld1.32	{d12}, [r0,:64]!
2586	vld1.32	{d14}, [r0,:64]!
2587	vld1.32	{d16}, [r0,:64]!
2588	vld1.32	{d18}, [r0,:64]!
2589
2590	vld1.32	{d11}, [r0,:64]!		@ A[3][0..4]
2591	vld1.32	{d13}, [r0,:64]!
2592	vld1.32	{d15}, [r0,:64]!
2593	vld1.32	{d17}, [r0,:64]!
2594	vld1.32	{d19}, [r0,:64]!
2595
2596	vld1.32	{d20,d21,d22,d23}, [r0,:64]!	@ A[4][0..4]
2597	vld1.32	{d24}, [r0,:64]
2598	sub	r0, r0, #24*8		@ rewind
2599
2600	bl	KeccakF1600_neon
2601
2602	mov	r12, r0			@ A_flat
2603	vst1.32	{d0}, [r0,:64]!		@ A[0][0..4]
2604	vst1.32	{d2}, [r0,:64]!
2605	vst1.32	{d4}, [r0,:64]!
2606	vst1.32	{d6}, [r0,:64]!
2607	vst1.32	{d8}, [r0,:64]!
2608
2609	vst1.32	{d1}, [r0,:64]!		@ A[1][0..4]
2610	vst1.32	{d3}, [r0,:64]!
2611	vst1.32	{d5}, [r0,:64]!
2612	vst1.32	{d7}, [r0,:64]!
2613	vst1.32	{d9}, [r0,:64]!
2614
2615	vst1.32	{d10}, [r0,:64]!		@ A[2][0..4]
2616	vst1.32	{d12}, [r0,:64]!
2617	vst1.32	{d14}, [r0,:64]!
2618	vst1.32	{d16}, [r0,:64]!
2619	vst1.32	{d18}, [r0,:64]!
2620
2621	vst1.32	{d11}, [r0,:64]!		@ A[3][0..4]
2622	vst1.32	{d13}, [r0,:64]!
2623	vst1.32	{d15}, [r0,:64]!
2624	vst1.32	{d17}, [r0,:64]!
2625	vst1.32	{d19}, [r0,:64]!
2626
2627	vst1.32	{d20,d21,d22,d23}, [r0,:64]!	@ A[4][0..4]
2628	mov	r14, r6			@ bsz
2629	vst1.32	{d24}, [r0,:64]
2630	mov	r0,  r12		@ rewind
2631
2632	vldmia	sp!, {d8,d9,d10,d11,d12,d13,d14,d15}
2633	b	.Loop_squeeze_neon
2634
2635.align	4
2636.Lsqueeze_neon_tail:
2637	ldmia	r12, {r2,r3}
2638	cmp	r5, #2
2639	strb	r2, [r4],#1		@ endian-neutral store
2640	mov	r2, r2, lsr#8
2641	blo	.Lsqueeze_neon_done
2642	strb	r2, [r4], #1
2643	mov	r2, r2, lsr#8
2644	beq	.Lsqueeze_neon_done
2645	strb	r2, [r4], #1
2646	mov	r2, r2, lsr#8
2647	cmp	r5, #4
2648	blo	.Lsqueeze_neon_done
2649	strb	r2, [r4], #1
2650	beq	.Lsqueeze_neon_done
2651
2652	strb	r3, [r4], #1
2653	mov	r3, r3, lsr#8
2654	cmp	r5, #6
2655	blo	.Lsqueeze_neon_done
2656	strb	r3, [r4], #1
2657	mov	r3, r3, lsr#8
2658	beq	.Lsqueeze_neon_done
2659	strb	r3, [r4], #1
2660
2661.Lsqueeze_neon_done:
2662	ldmia	sp!, {r4,r5,r6,pc}
2663.size	SHA3_squeeze_neon,.-SHA3_squeeze_neon
2664#endif
2665.byte	75,101,99,99,97,107,45,49,54,48,48,32,97,98,115,111,114,98,32,97,110,100,32,115,113,117,101,101,122,101,32,102,111,114,32,65,82,77,118,52,47,78,69,79,78,44,32,67,82,89,80,84,79,71,65,77,83,32,98,121,32,60,97,112,112,114,111,64,111,112,101,110,115,115,108,46,111,114,103,62,0
2666.align	2
2667.align	2
2668