arm/crypto/poly1305-armv4.pl

496 my ($D0,$D1,$D2,$D3,$D4, $H0,$H1,$H2,$H3,$H4) = map("q$_",(5..14));
588 	@ H0>>+H1>>+H2>>+H3>>+H4
602 	@ H0, H2, H3 are guaranteed to be 26 bits wide, while H1 and H4
609 	@ H4 = H4*R0 + H3*R1 + H2*R2 + H1*R3 + H0 * R4,
627 	@ one has to watch for H2 (which is narrower than H0) and 5*H4
800 	vld4.32		{$H0#lo[0],$H1#lo[0],$H2#lo[0],$H3#lo[0]},[$inp]!
809 	vrev32.8	$H2,$H2
814 	vsri.u32	$H3#lo,$H2#lo,#14
815 	vshl.u32	$H2#lo,$H2#lo,#12
819 	vsri.u32	$H2#lo,$H1#lo,#20
822 	vbic.i32	$H2#lo,#0xfc000000
828 	vadd.i32	$H2#hi,$H2#lo,$D2#lo
846 	vld4.32		{$H0#lo,$H1#lo,$H2#lo,$H3#lo},[$inp]	@ inp[0:1]
848 	vld4.32		{$H0#hi,$H1#hi,$H2#hi,$H3#hi},[$in2]	@ inp[2:3] (or 0)
858 	vrev32.8	$H2,$H2
863 	vsri.u32	$H3,$H2,#14
864 	vshl.u32	$H2,$H2,#12
867 	vsri.u32	$H2,$H1,#20
870 	vbic.i32	$H2,#0xfc000000
906 	vadd.i32	$H2#lo,$H2#lo,$D2#lo	@ accumulate inp[0:1]
907 	vmull.u32	$D2,$H2#hi,${R0}[1]
922 	vmlal.u32	$D3,$H2#hi,${R1}[1]
929 	vmlal.u32	$D4,$H2#hi,${R2}[1]
934 	vmlal.u32	$D0,$H2#hi,${S3}[1]
942 	vmlal.u32	$D1,$H2#hi,${S4}[1]
945 	vld4.32		{$H0#hi,$H1#hi,$H2#hi,$H3#hi},[$in2]	@ inp[2:3] (or 0)
955 	vmlal.u32	$D2,$H2#lo,${R0}[0]
958 	vmlal.u32	$D3,$H2#lo,${R1}[0]
966 	vmlal.u32	$D4,$H2#lo,${R2}[0]
971 	vmlal.u32	$D0,$H2#lo,${S3}[0]
980 	vmlal.u32	$D1,$H2#lo,${S4}[0]
983 	vld4.32		{$H0#lo,$H1#lo,$H2#lo,$H3#lo},[$inp]	@ inp[0:1]
988 	vrev32.8	$H2,$H2
1012 	  vsri.u32	$H3,$H2,#14
1014 	  vshl.u32	$H2,$H2,#12
1023 	  vsri.u32	$H2,$H1,#20
1027 	  vbic.i32	$H2,#0xfc000000
1053 	vadd.i32	$H2#hi,$H2#lo,$D2#lo	@ add hash value and move to #hi
1063 	vadd.i32	$H2#lo,$H2#lo,$D2#lo	@ can be redundant
1064 	vmull.u32	$D2,$H2#hi,$R0
1076 	vmlal.u32	$D3,$H2#hi,$R1
1086 	vmlal.u32	$D4,$H2#hi,$R2
1093 	vmlal.u32	$D0,$H2#hi,$S3
1105 	vmlal.u32	$D1,$H2#hi,$S4
1116 	vmlal.u32	$D2,$H2#lo,$R0
1124 	vmlal.u32	$D3,$H2#lo,$R1
1134 	vmlal.u32	$D4,$H2#lo,$R2
1139 	vmlal.u32	$D0,$H2#lo,$S3
1149 	vmlal.u32	$D1,$H2#lo,$S4