155     u64 h0, h1, h2, c;  in poly1305_blocks()  local
165     h2 = st->h[2];  in poly1305_blocks()
175         h2 += (u64)(d1 >> 64) + padbit;  in poly1305_blocks()
182              (h2 * s1);  in poly1305_blocks()
183         h2 = (h2 * r0);  in poly1305_blocks()
189         h2 += (u64)(d1 >> 64);  in poly1305_blocks()
191         c = (h2 >> 2) + (h2 & ~3UL);  in poly1305_blocks()
192         h2 &= 3;  in poly1305_blocks()
195         h2 += CONSTANT_TIME_CARRY(h1,c);  in poly1305_blocks()
212     st->h[2] = h2;  in poly1305_blocks()
219     u64 h0, h1, h2;  in poly1305_emit()  local
226     h2 = st->h[2];  in poly1305_emit()
231     g2 = h2 + (u64)(t >> 64);  in poly1305_emit()
297     u32 h0, h1, h2, h3, h4, c;  in poly1305_blocks()  local
311     h2 = st->h[2];  in poly1305_blocks()
319         h2 = (u32)(d2 = (u64)h2 + (d1 >> 32) + U8TOU32(inp + 8));  in poly1305_blocks()
326              ((u64)h2 * s2) +  in poly1305_blocks()
330              ((u64)h2 * s3) +  in poly1305_blocks()
335              ((u64)h2 * r0) +  in poly1305_blocks()
340              ((u64)h2 * r1) +  in poly1305_blocks()
349         h2 = (u32)(d2 += d1 >> 32);  in poly1305_blocks()
357         h2 += (c = CONSTANT_TIME_CARRY(h1,c));  in poly1305_blocks()
358         h3 += (c = CONSTANT_TIME_CARRY(h2,c));  in poly1305_blocks()
376     st->h[2] = h2;  in poly1305_blocks()
385     u32 h0, h1, h2, h3, h4;  in poly1305_emit()  local
392     h2 = st->h[2];  in poly1305_emit()
399     g2 = (u32)(t = (u64)h2 + (t >> 32));  in poly1305_emit()
412     h2 = (h2 & mask) | g2;  in poly1305_emit()
418     h2 = (u32)(t = (u64)h2 + (t >> 32) + nonce[2]);  in poly1305_emit()
423     U32TO8(mac + 8, h2);  in poly1305_emit()