@ Copyright 2017-2026 The OpenSSL Project Authors. All Rights Reserved.
@ SPDX-License-Identifier: Apache-2.0
@
@ Generated by admin/import-openssl from OpenSSL 2f4e3a5fec05394068cfa7379890ab552483a8a6:
@ the linux32 flavor of crypto/sha/asm/keccak1600-armv4.pl.
@ Do not edit by hand.
.type .Lkeccak_iotas32, %object
.align 5
.Lkeccak_iotas32:
.long 0x00000001, 0x00000000
.long 0x00000000, 0x00000089
.long 0x00000000, 0x8000008b
.long 0x00000000, 0x80008080
.long 0x00000001, 0x0000008b
.long 0x00000001, 0x00008000
.long 0x00000001, 0x80008088
.long 0x00000001, 0x80000082
.long 0x00000000, 0x0000000b
.long 0x00000000, 0x0000000a
.long 0x00000001, 0x00008082
.long 0x00000000, 0x00008003
.long 0x00000001, 0x0000808b
.long 0x00000001, 0x8000000b
.long 0x00000001, 0x8000008a
.long 0x00000001, 0x80000081
.long 0x00000000, 0x80000081
.long 0x00000000, 0x80000008
.long 0x00000000, 0x00000083
.long 0x00000000, 0x80008003
.long 0x00000001, 0x80008088
.long 0x00000000, 0x80000088
.long 0x00000001, 0x00008000
.long 0x00000000, 0x80008082
.size .Lkeccak_iotas32,.-.Lkeccak_iotas32
.type .Lkeccak_KeccakF1600_int, %function
.align 5
.Lkeccak_KeccakF1600_int:
add r9,sp,#176
add r12,sp,#0
add r10,sp,#40
ldmia r9,{{r4,r5,r6,r7,r8,r9}} @ A[4][2..4]
.Lkeccak_KeccakF1600_enter:
str lr,[sp,#440]
eor r11,r11,r11
str r11,[sp,#444]
b .Lkeccak_round2x
.align 4
.Lkeccak_round2x:
ldmia r12,{{r0,r1,r2,r3}} @ A[0][0..1]
ldmia r10,{{r10,r11,r12,r14}} @ A[1][0..1]
eor r0,r0,r10
add r10,sp,#56
eor r1,r1,r11
eor r2,r2,r12
eor r3,r3,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[1][2..3]
eor r4,r4,r10
add r10,sp,#72
eor r5,r5,r11
eor r6,r6,r12
eor r7,r7,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[1][4]..A[2][0]
eor r8,r8,r10
add r10,sp,#88
eor r9,r9,r11
eor r0,r0,r12
eor r1,r1,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[2][1..2]
eor r2,r2,r10
add r10,sp,#104
eor r3,r3,r11
eor r4,r4,r12
eor r5,r5,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[2][3..4]
eor r6,r6,r10
add r10,sp,#120
eor r7,r7,r11
eor r8,r8,r12
eor r9,r9,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[3][0..1]
eor r0,r0,r10
add r10,sp,#136
eor r1,r1,r11
eor r2,r2,r12
eor r3,r3,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[3][2..3]
eor r4,r4,r10
add r10,sp,#152
eor r5,r5,r11
eor r6,r6,r12
eor r7,r7,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[3][4]..A[4][0]
eor r8,r8,r10
ldr r10,[sp,#168] @ A[4][1]
eor r9,r9,r11
ldr r11,[sp,#168+4]
eor r0,r0,r12
ldr r12,[sp,#16] @ A[0][2]
eor r1,r1,r14
ldr r14,[sp,#16+4]
eor r2,r2,r10
add r10,sp,#24
eor r3,r3,r11
eor r4,r4,r12
eor r5,r5,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[0][3..4]
eor r6,r6,r10
eor r7,r7,r11
eor r8,r8,r12
eor r9,r9,r14
eor r10,r0,r5,ror#32-1 @ E[0] = ROL64(C[2], 1) ^ C[0];
str r10,[sp,#208] @ D[1] = E[0]
eor r11,r1,r4
str r11,[sp,#208+4]
eor r12,r6,r1,ror#32-1 @ E[1] = ROL64(C[0], 1) ^ C[3];
eor r14,r7,r0
str r12,[sp,#232] @ D[4] = E[1]
eor r0,r8,r3,ror#32-1 @ C[0] = ROL64(C[1], 1) ^ C[4];
str r14,[sp,#232+4]
eor r1,r9,r2
str r0,[sp,#200] @ D[0] = C[0]
eor r2,r2,r7,ror#32-1 @ C[1] = ROL64(C[3], 1) ^ C[1];
ldr r7,[sp,#144]
eor r3,r3,r6
str r1,[sp,#200+4]
ldr r6,[sp,#144+4]
str r2,[sp,#216] @ D[2] = C[1]
eor r4,r4,r9,ror#32-1 @ C[2] = ROL64(C[4], 1) ^ C[2];
str r3,[sp,#216+4]
eor r5,r5,r8
ldr r8,[sp,#192]
ldr r9,[sp,#192+4]
str r4,[sp,#224] @ D[3] = C[2]
eor r7,r7,r4
str r5,[sp,#224+4]
eor r6,r6,r5
ldr r4,[sp,#0]
@ mov r7,r7,ror#32-10 @ C[3] = ROL64(A[3][3] ^ C[2], rhotates[3][3]);
@ mov r6,r6,ror#32-11
ldr r5,[sp,#0+4]
eor r8,r8,r12
eor r9,r9,r14
ldr r12,[sp,#96]
eor r0,r0,r4
ldr r14,[sp,#96+4]
@ mov r8,r8,ror#32-7 @ C[4] = ROL64(A[4][4] ^ E[1], rhotates[4][4]);
@ mov r9,r9,ror#32-7
eor r1,r1,r5 @ C[0] = A[0][0] ^ C[0];
eor r12,r12,r2
ldr r2,[sp,#48]
eor r14,r14,r3
ldr r3,[sp,#48+4]
mov r5,r12,ror#32-21 @ C[2] = ROL64(A[2][2] ^ C[1], rhotates[2][2]);
ldr r12,[sp,#444] @ load counter
eor r2,r2,r10
adr r10,.Lkeccak_iotas32
mov r4,r14,ror#32-22
add r14,r10,r12
eor r3,r3,r11
ldmia r14,{{r10,r11}} @ iotas[i]
bic r12,r4,r2,ror#32-22
bic r14,r5,r3,ror#32-22
mov r2,r2,ror#32-22 @ C[1] = ROL64(A[1][1] ^ E[0], rhotates[1][1]);
mov r3,r3,ror#32-22
eor r12,r12,r0
eor r14,r14,r1
eor r10,r10,r12
eor r11,r11,r14
str r10,[sp,#240] @ R[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i];
bic r12,r6,r4,ror#11
str r11,[sp,#240+4]
bic r14,r7,r5,ror#10
bic r10,r8,r6,ror#32-(11-7)
bic r11,r9,r7,ror#32-(10-7)
eor r12,r2,r12,ror#32-11
str r12,[sp,#248] @ R[0][1] = C[1] ^ (~C[2] & C[3]);
eor r14,r3,r14,ror#32-10
str r14,[sp,#248+4]
eor r10,r4,r10,ror#32-7
eor r11,r5,r11,ror#32-7
str r10,[sp,#256] @ R[0][2] = C[2] ^ (~C[3] & C[4]);
bic r12,r0,r8,ror#32-7
str r11,[sp,#256+4]
bic r14,r1,r9,ror#32-7
eor r12,r12,r6,ror#32-11
str r12,[sp,#264] @ R[0][3] = C[3] ^ (~C[4] & C[0]);
eor r14,r14,r7,ror#32-10
str r14,[sp,#264+4]
bic r10,r2,r0
add r14,sp,#224
ldr r0,[sp,#24] @ A[0][3]
bic r11,r3,r1
ldr r1,[sp,#24+4]
eor r10,r10,r8,ror#32-7
eor r11,r11,r9,ror#32-7
str r10,[sp,#272] @ R[0][4] = C[4] ^ (~C[0] & C[1]);
add r9,sp,#200
str r11,[sp,#272+4]
ldmia r14,{{r10,r11,r12,r14}} @ D[3..4]
ldmia r9,{{r6,r7,r8,r9}} @ D[0..1]
ldr r2,[sp,#72] @ A[1][4]
eor r0,r0,r10
ldr r3,[sp,#72+4]
eor r1,r1,r11
@ mov r0,r0,ror#32-14 @ C[0] = ROL64(A[0][3] ^ D[3], rhotates[0][3]);
ldr r10,[sp,#128] @ A[3][1]
@ mov r1,r1,ror#32-14
ldr r11,[sp,#128+4]
eor r2,r2,r12
ldr r4,[sp,#80] @ A[2][0]
eor r3,r3,r14
ldr r5,[sp,#80+4]
@ mov r2,r2,ror#32-10 @ C[1] = ROL64(A[1][4] ^ D[4], rhotates[1][4]);
@ mov r3,r3,ror#32-10
eor r6,r6,r4
ldr r12,[sp,#216] @ D[2]
eor r7,r7,r5
ldr r14,[sp,#216+4]
mov r5,r6,ror#32-1 @ C[2] = ROL64(A[2][0] ^ D[0], rhotates[2][0]);
mov r4,r7,ror#32-2
eor r10,r10,r8
ldr r8,[sp,#176] @ A[4][2]
eor r11,r11,r9
ldr r9,[sp,#176+4]
mov r7,r10,ror#32-22 @ C[3] = ROL64(A[3][1] ^ D[1], rhotates[3][1]);
mov r6,r11,ror#32-23
bic r10,r4,r2,ror#32-10
bic r11,r5,r3,ror#32-10
eor r12,r12,r8
eor r14,r14,r9
mov r9,r12,ror#32-30 @ C[4] = ROL64(A[4][2] ^ D[2], rhotates[4][2]);
mov r8,r14,ror#32-31
eor r10,r10,r0,ror#32-14
eor r11,r11,r1,ror#32-14
str r10,[sp,#280] @ R[1][0] = C[0] ^ (~C[1] & C[2])
bic r12,r6,r4
str r11,[sp,#280+4]
bic r14,r7,r5
eor r12,r12,r2,ror#32-10
str r12,[sp,#288] @ R[1][1] = C[1] ^ (~C[2] & C[3]);
eor r14,r14,r3,ror#32-10
str r14,[sp,#288+4]
bic r10,r8,r6
bic r11,r9,r7
bic r12,r0,r8,ror#14
bic r14,r1,r9,ror#14
eor r10,r10,r4
eor r11,r11,r5
str r10,[sp,#296] @ R[1][2] = C[2] ^ (~C[3] & C[4]);
bic r2,r2,r0,ror#32-(14-10)
str r11,[sp,#296+4]
eor r12,r6,r12,ror#32-14
bic r11,r3,r1,ror#32-(14-10)
str r12,[sp,#304] @ R[1][3] = C[3] ^ (~C[4] & C[0]);
eor r14,r7,r14,ror#32-14
str r14,[sp,#304+4]
add r12,sp,#208
ldr r1,[sp,#8] @ A[0][1]
eor r10,r8,r2,ror#32-10
ldr r0,[sp,#8+4]
eor r11,r9,r11,ror#32-10
str r10,[sp,#312] @ R[1][4] = C[4] ^ (~C[0] & C[1]);
str r11,[sp,#312+4]
add r9,sp,#224
ldmia r12,{{r10,r11,r12,r14}} @ D[1..2]
ldr r2,[sp,#56] @ A[1][2]
ldr r3,[sp,#56+4]
ldmia r9,{{r6,r7,r8,r9}} @ D[3..4]
eor r1,r1,r10
ldr r4,[sp,#104] @ A[2][3]
eor r0,r0,r11
ldr r5,[sp,#104+4]
mov r0,r0,ror#32-1 @ C[0] = ROL64(A[0][1] ^ D[1], rhotates[0][1]);
eor r2,r2,r12
ldr r10,[sp,#152] @ A[3][4]
eor r3,r3,r14
ldr r11,[sp,#152+4]
@ mov r2,r2,ror#32-3 @ C[1] = ROL64(A[1][2] ^ D[2], rhotates[1][2]);
ldr r12,[sp,#200] @ D[0]
@ mov r3,r3,ror#32-3
ldr r14,[sp,#200+4]
eor r4,r4,r6
eor r5,r5,r7
@ mov r5,r6,ror#32-12 @ C[2] = ROL64(A[2][3] ^ D[3], rhotates[2][3]);
@ mov r4,r7,ror#32-13 @ [track reverse order below]
eor r10,r10,r8
ldr r8,[sp,#160] @ A[4][0]
eor r11,r11,r9
ldr r9,[sp,#160+4]
mov r6,r10,ror#32-4 @ C[3] = ROL64(A[3][4] ^ D[4], rhotates[3][4]);
mov r7,r11,ror#32-4
eor r12,r12,r8
eor r14,r14,r9
mov r8,r12,ror#32-9 @ C[4] = ROL64(A[4][0] ^ D[0], rhotates[4][0]);
mov r9,r14,ror#32-9
bic r10,r5,r2,ror#13-3
bic r11,r4,r3,ror#12-3
bic r12,r6,r5,ror#32-13
bic r14,r7,r4,ror#32-12
eor r10,r0,r10,ror#32-13
eor r11,r1,r11,ror#32-12
str r10,[sp,#320] @ R[2][0] = C[0] ^ (~C[1] & C[2])
eor r12,r12,r2,ror#32-3
str r11,[sp,#320+4]
eor r14,r14,r3,ror#32-3
str r12,[sp,#328] @ R[2][1] = C[1] ^ (~C[2] & C[3]);
bic r10,r8,r6
bic r11,r9,r7
str r14,[sp,#328+4]
eor r10,r10,r5,ror#32-13
eor r11,r11,r4,ror#32-12
str r10,[sp,#336] @ R[2][2] = C[2] ^ (~C[3] & C[4]);
bic r12,r0,r8
str r11,[sp,#336+4]
bic r14,r1,r9
eor r12,r12,r6
eor r14,r14,r7
str r12,[sp,#344] @ R[2][3] = C[3] ^ (~C[4] & C[0]);
bic r10,r2,r0,ror#3
str r14,[sp,#344+4]
bic r11,r3,r1,ror#3
ldr r1,[sp,#32] @ A[0][4] [in reverse order]
eor r10,r8,r10,ror#32-3
ldr r0,[sp,#32+4]
eor r11,r9,r11,ror#32-3
str r10,[sp,#352] @ R[2][4] = C[4] ^ (~C[0] & C[1]);
add r9,sp,#208
str r11,[sp,#352+4]
ldr r10,[sp,#232] @ D[4]
ldr r11,[sp,#232+4]
ldr r12,[sp,#200] @ D[0]
ldr r14,[sp,#200+4]
ldmia r9,{{r6,r7,r8,r9}} @ D[1..2]
eor r1,r1,r10
ldr r2,[sp,#40] @ A[1][0]
eor r0,r0,r11
ldr r3,[sp,#40+4]
@ mov r1,r10,ror#32-13 @ C[0] = ROL64(A[0][4] ^ D[4], rhotates[0][4]);
ldr r4,[sp,#88] @ A[2][1]
@ mov r0,r11,ror#32-14 @ [was loaded in reverse order]
ldr r5,[sp,#88+4]
eor r2,r2,r12
ldr r10,[sp,#136] @ A[3][2]
eor r3,r3,r14
ldr r11,[sp,#136+4]
@ mov r2,r2,ror#32-18 @ C[1] = ROL64(A[1][0] ^ D[0], rhotates[1][0]);
ldr r12,[sp,#224] @ D[3]
@ mov r3,r3,ror#32-18
ldr r14,[sp,#224+4]
eor r6,r6,r4
eor r7,r7,r5
mov r4,r6,ror#32-5 @ C[2] = ROL64(A[2][1] ^ D[1], rhotates[2][1]);
mov r5,r7,ror#32-5
eor r10,r10,r8
ldr r8,[sp,#184] @ A[4][3]
eor r11,r11,r9
ldr r9,[sp,#184+4]
mov r7,r10,ror#32-7 @ C[3] = ROL64(A[3][2] ^ D[2], rhotates[3][2]);
mov r6,r11,ror#32-8
eor r12,r12,r8
eor r14,r14,r9
mov r8,r12,ror#32-28 @ C[4] = ROL64(A[4][3] ^ D[3], rhotates[4][3]);
mov r9,r14,ror#32-28
bic r10,r4,r2,ror#32-18
bic r11,r5,r3,ror#32-18
eor r10,r10,r0,ror#32-14
eor r11,r11,r1,ror#32-13
str r10,[sp,#360] @ R[3][0] = C[0] ^ (~C[1] & C[2])
bic r12,r6,r4
str r11,[sp,#360+4]
bic r14,r7,r5
eor r12,r12,r2,ror#32-18
str r12,[sp,#368] @ R[3][1] = C[1] ^ (~C[2] & C[3]);
eor r14,r14,r3,ror#32-18
str r14,[sp,#368+4]
bic r10,r8,r6
bic r11,r9,r7
bic r12,r0,r8,ror#14
bic r14,r1,r9,ror#13
eor r10,r10,r4
eor r11,r11,r5
str r10,[sp,#376] @ R[3][2] = C[2] ^ (~C[3] & C[4]);
bic r2,r2,r0,ror#18-14
str r11,[sp,#376+4]
eor r12,r6,r12,ror#32-14
bic r11,r3,r1,ror#18-13
eor r14,r7,r14,ror#32-13
str r12,[sp,#384] @ R[3][3] = C[3] ^ (~C[4] & C[0]);
str r14,[sp,#384+4]
add r14,sp,#216
ldr r0,[sp,#16] @ A[0][2]
eor r10,r8,r2,ror#32-18
ldr r1,[sp,#16+4]
eor r11,r9,r11,ror#32-18
str r10,[sp,#392] @ R[3][4] = C[4] ^ (~C[0] & C[1]);
str r11,[sp,#392+4]
ldmia r14,{{r10,r11,r12,r14}} @ D[2..3]
ldr r2,[sp,#64] @ A[1][3]
ldr r3,[sp,#64+4]
ldr r6,[sp,#232] @ D[4]
ldr r7,[sp,#232+4]
eor r0,r0,r10
ldr r4,[sp,#112] @ A[2][4]
eor r1,r1,r11
ldr r5,[sp,#112+4]
@ mov r0,r0,ror#32-31 @ C[0] = ROL64(A[0][2] ^ D[2], rhotates[0][2]);
ldr r8,[sp,#200] @ D[0]
@ mov r1,r1,ror#32-31
ldr r9,[sp,#200+4]
eor r12,r12,r2
ldr r10,[sp,#120] @ A[3][0]
eor r14,r14,r3
ldr r11,[sp,#120+4]
mov r3,r12,ror#32-27 @ C[1] = ROL64(A[1][3] ^ D[3], rhotates[1][3]);
ldr r12,[sp,#208] @ D[1]
mov r2,r14,ror#32-28
ldr r14,[sp,#208+4]
eor r6,r6,r4
eor r7,r7,r5
mov r5,r6,ror#32-19 @ C[2] = ROL64(A[2][4] ^ D[4], rhotates[2][4]);
mov r4,r7,ror#32-20
eor r10,r10,r8
ldr r8,[sp,#168] @ A[4][1]
eor r11,r11,r9
ldr r9,[sp,#168+4]
mov r7,r10,ror#32-20 @ C[3] = ROL64(A[3][0] ^ D[0], rhotates[3][0]);
mov r6,r11,ror#32-21
eor r8,r8,r12
eor r9,r9,r14
@ mov r8,r2,ror#32-1 @ C[4] = ROL64(A[4][1] ^ D[1], rhotates[4][1]);
@ mov r9,r3,ror#32-1
bic r10,r4,r2
bic r11,r5,r3
eor r10,r10,r0,ror#32-31
str r10,[sp,#400] @ R[4][0] = C[0] ^ (~C[1] & C[2])
eor r11,r11,r1,ror#32-31
str r11,[sp,#400+4]
bic r12,r6,r4
bic r14,r7,r5
eor r12,r12,r2
eor r14,r14,r3
str r12,[sp,#408] @ R[4][1] = C[1] ^ (~C[2] & C[3]);
bic r10,r8,r6,ror#1
str r14,[sp,#408+4]
bic r11,r9,r7,ror#1
bic r12,r0,r8,ror#31-1
bic r14,r1,r9,ror#31-1
eor r4,r4,r10,ror#32-1
str r4,[sp,#416] @ R[4][2] = C[2] ^= (~C[3] & C[4]);
eor r5,r5,r11,ror#32-1
str r5,[sp,#416+4]
eor r6,r6,r12,ror#32-31
eor r7,r7,r14,ror#32-31
str r6,[sp,#424] @ R[4][3] = C[3] ^= (~C[4] & C[0]);
bic r10,r2,r0,ror#32-31
str r7,[sp,#424+4]
bic r11,r3,r1,ror#32-31
add r12,sp,#240
eor r8,r10,r8,ror#32-1
add r10,sp,#280
eor r9,r11,r9,ror#32-1
str r8,[sp,#432] @ R[4][4] = C[4] ^= (~C[0] & C[1]);
str r9,[sp,#432+4]
ldmia r12,{{r0,r1,r2,r3}} @ A[0][0..1]
ldmia r10,{{r10,r11,r12,r14}} @ A[1][0..1]
eor r0,r0,r10
add r10,sp,#296
eor r1,r1,r11
eor r2,r2,r12
eor r3,r3,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[1][2..3]
eor r4,r4,r10
add r10,sp,#312
eor r5,r5,r11
eor r6,r6,r12
eor r7,r7,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[1][4]..A[2][0]
eor r8,r8,r10
add r10,sp,#328
eor r9,r9,r11
eor r0,r0,r12
eor r1,r1,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[2][1..2]
eor r2,r2,r10
add r10,sp,#344
eor r3,r3,r11
eor r4,r4,r12
eor r5,r5,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[2][3..4]
eor r6,r6,r10
add r10,sp,#360
eor r7,r7,r11
eor r8,r8,r12
eor r9,r9,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[3][0..1]
eor r0,r0,r10
add r10,sp,#376
eor r1,r1,r11
eor r2,r2,r12
eor r3,r3,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[3][2..3]
eor r4,r4,r10
add r10,sp,#392
eor r5,r5,r11
eor r6,r6,r12
eor r7,r7,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[3][4]..A[4][0]
eor r8,r8,r10
ldr r10,[sp,#408] @ A[4][1]
eor r9,r9,r11
ldr r11,[sp,#408+4]
eor r0,r0,r12
ldr r12,[sp,#256] @ A[0][2]
eor r1,r1,r14
ldr r14,[sp,#256+4]
eor r2,r2,r10
add r10,sp,#264
eor r3,r3,r11
eor r4,r4,r12
eor r5,r5,r14
ldmia r10,{{r10,r11,r12,r14}} @ A[0][3..4]
eor r6,r6,r10
eor r7,r7,r11
eor r8,r8,r12
eor r9,r9,r14
eor r10,r0,r5,ror#32-1 @ E[0] = ROL64(C[2], 1) ^ C[0];
str r10,[sp,#208] @ D[1] = E[0]
eor r11,r1,r4
str r11,[sp,#208+4]
eor r12,r6,r1,ror#32-1 @ E[1] = ROL64(C[0], 1) ^ C[3];
eor r14,r7,r0
str r12,[sp,#232] @ D[4] = E[1]
eor r0,r8,r3,ror#32-1 @ C[0] = ROL64(C[1], 1) ^ C[4];
str r14,[sp,#232+4]
eor r1,r9,r2
str r0,[sp,#200] @ D[0] = C[0]
eor r2,r2,r7,ror#32-1 @ C[1] = ROL64(C[3], 1) ^ C[1];
ldr r7,[sp,#384]
eor r3,r3,r6
str r1,[sp,#200+4]
ldr r6,[sp,#384+4]
str r2,[sp,#216] @ D[2] = C[1]
eor r4,r4,r9,ror#32-1 @ C[2] = ROL64(C[4], 1) ^ C[2];
str r3,[sp,#216+4]
eor r5,r5,r8
ldr r8,[sp,#432]
ldr r9,[sp,#432+4]
str r4,[sp,#224] @ D[3] = C[2]
eor r7,r7,r4
str r5,[sp,#224+4]
eor r6,r6,r5
ldr r4,[sp,#240]
@ mov r7,r7,ror#32-10 @ C[3] = ROL64(A[3][3] ^ C[2], rhotates[3][3]);
@ mov r6,r6,ror#32-11
ldr r5,[sp,#240+4]
eor r8,r8,r12
eor r9,r9,r14
ldr r12,[sp,#336]
eor r0,r0,r4
ldr r14,[sp,#336+4]
@ mov r8,r8,ror#32-7 @ C[4] = ROL64(A[4][4] ^ E[1], rhotates[4][4]);
@ mov r9,r9,ror#32-7
eor r1,r1,r5 @ C[0] = A[0][0] ^ C[0];
eor r12,r12,r2
ldr r2,[sp,#288]
eor r14,r14,r3
ldr r3,[sp,#288+4]
mov r5,r12,ror#32-21 @ C[2] = ROL64(A[2][2] ^ C[1], rhotates[2][2]);
ldr r12,[sp,#444] @ load counter
eor r2,r2,r10
adr r10,.Lkeccak_iotas32
mov r4,r14,ror#32-22
add r14,r10,r12
eor r3,r3,r11
ldr r10,[r14,#8] @ iotas[i].lo
add r12,r12,#16
ldr r11,[r14,#12] @ iotas[i].hi
cmp r12,#192
str r12,[sp,#444] @ store counter
bic r12,r4,r2,ror#32-22
bic r14,r5,r3,ror#32-22
mov r2,r2,ror#32-22 @ C[1] = ROL64(A[1][1] ^ E[0], rhotates[1][1]);
mov r3,r3,ror#32-22
eor r12,r12,r0
eor r14,r14,r1
eor r10,r10,r12
eor r11,r11,r14
str r10,[sp,#0] @ R[0][0] = C[0] ^ (~C[1] & C[2]) ^ iotas[i];
bic r12,r6,r4,ror#11
str r11,[sp,#0+4]
bic r14,r7,r5,ror#10
bic r10,r8,r6,ror#32-(11-7)
bic r11,r9,r7,ror#32-(10-7)
eor r12,r2,r12,ror#32-11
str r12,[sp,#8] @ R[0][1] = C[1] ^ (~C[2] & C[3]);
eor r14,r3,r14,ror#32-10
str r14,[sp,#8+4]
eor r10,r4,r10,ror#32-7
eor r11,r5,r11,ror#32-7
str r10,[sp,#16] @ R[0][2] = C[2] ^ (~C[3] & C[4]);
bic r12,r0,r8,ror#32-7
str r11,[sp,#16+4]
bic r14,r1,r9,ror#32-7
eor r12,r12,r6,ror#32-11
str r12,[sp,#24] @ R[0][3] = C[3] ^ (~C[4] & C[0]);
eor r14,r14,r7,ror#32-10
str r14,[sp,#24+4]
bic r10,r2,r0
add r14,sp,#224
ldr r0,[sp,#264] @ A[0][3]
bic r11,r3,r1
ldr r1,[sp,#264+4]
eor r10,r10,r8,ror#32-7
eor r11,r11,r9,ror#32-7
str r10,[sp,#32] @ R[0][4] = C[4] ^ (~C[0] & C[1]);
add r9,sp,#200
str r11,[sp,#32+4]
ldmia r14,{{r10,r11,r12,r14}} @ D[3..4]
ldmia r9,{{r6,r7,r8,r9}} @ D[0..1]
ldr r2,[sp,#312] @ A[1][4]
eor r0,r0,r10
ldr r3,[sp,#312+4]
eor r1,r1,r11
@ mov r0,r0,ror#32-14 @ C[0] = ROL64(A[0][3] ^ D[3], rhotates[0][3]);
ldr r10,[sp,#368] @ A[3][1]
@ mov r1,r1,ror#32-14
ldr r11,[sp,#368+4]
eor r2,r2,r12
ldr r4,[sp,#320] @ A[2][0]
eor r3,r3,r14
ldr r5,[sp,#320+4]
@ mov r2,r2,ror#32-10 @ C[1] = ROL64(A[1][4] ^ D[4], rhotates[1][4]);
@ mov r3,r3,ror#32-10
eor r6,r6,r4
ldr r12,[sp,#216] @ D[2]
eor r7,r7,r5
ldr r14,[sp,#216+4]
mov r5,r6,ror#32-1 @ C[2] = ROL64(A[2][0] ^ D[0], rhotates[2][0]);
mov r4,r7,ror#32-2
eor r10,r10,r8
ldr r8,[sp,#416] @ A[4][2]
eor r11,r11,r9
ldr r9,[sp,#416+4]
mov r7,r10,ror#32-22 @ C[3] = ROL64(A[3][1] ^ D[1], rhotates[3][1]);
mov r6,r11,ror#32-23
bic r10,r4,r2,ror#32-10
bic r11,r5,r3,ror#32-10
eor r12,r12,r8
eor r14,r14,r9
mov r9,r12,ror#32-30 @ C[4] = ROL64(A[4][2] ^ D[2], rhotates[4][2]);
mov r8,r14,ror#32-31
eor r10,r10,r0,ror#32-14
eor r11,r11,r1,ror#32-14
str r10,[sp,#40] @ R[1][0] = C[0] ^ (~C[1] & C[2])
bic r12,r6,r4
str r11,[sp,#40+4]
bic r14,r7,r5
eor r12,r12,r2,ror#32-10
str r12,[sp,#48] @ R[1][1] = C[1] ^ (~C[2] & C[3]);
eor r14,r14,r3,ror#32-10
str r14,[sp,#48+4]
bic r10,r8,r6
bic r11,r9,r7
bic r12,r0,r8,ror#14
bic r14,r1,r9,ror#14
eor r10,r10,r4
eor r11,r11,r5
str r10,[sp,#56] @ R[1][2] = C[2] ^ (~C[3] & C[4]);
bic r2,r2,r0,ror#32-(14-10)
str r11,[sp,#56+4]
eor r12,r6,r12,ror#32-14
bic r11,r3,r1,ror#32-(14-10)
str r12,[sp,#64] @ R[1][3] = C[3] ^ (~C[4] & C[0]);
eor r14,r7,r14,ror#32-14
str r14,[sp,#64+4]
add r12,sp,#208
ldr r1,[sp,#248] @ A[0][1]
eor r10,r8,r2,ror#32-10
ldr r0,[sp,#248+4]
eor r11,r9,r11,ror#32-10
str r10,[sp,#72] @ R[1][4] = C[4] ^ (~C[0] & C[1]);
str r11,[sp,#72+4]
add r9,sp,#224
ldmia r12,{{r10,r11,r12,r14}} @ D[1..2]
ldr r2,[sp,#296] @ A[1][2]
ldr r3,[sp,#296+4]
ldmia r9,{{r6,r7,r8,r9}} @ D[3..4]
eor r1,r1,r10
ldr r4,[sp,#344] @ A[2][3]
eor r0,r0,r11
ldr r5,[sp,#344+4]
mov r0,r0,ror#32-1 @ C[0] = ROL64(A[0][1] ^ D[1], rhotates[0][1]);
eor r2,r2,r12
ldr r10,[sp,#392] @ A[3][4]
eor r3,r3,r14
ldr r11,[sp,#392+4]
@ mov r2,r2,ror#32-3 @ C[1] = ROL64(A[1][2] ^ D[2], rhotates[1][2]);
ldr r12,[sp,#200] @ D[0]
@ mov r3,r3,ror#32-3
ldr r14,[sp,#200+4]
eor r4,r4,r6
eor r5,r5,r7
@ mov r5,r6,ror#32-12 @ C[2] = ROL64(A[2][3] ^ D[3], rhotates[2][3]);
@ mov r4,r7,ror#32-13 @ [track reverse order below]
eor r10,r10,r8
ldr r8,[sp,#400] @ A[4][0]
eor r11,r11,r9
ldr r9,[sp,#400+4]
mov r6,r10,ror#32-4 @ C[3] = ROL64(A[3][4] ^ D[4], rhotates[3][4]);
mov r7,r11,ror#32-4
eor r12,r12,r8
eor r14,r14,r9
mov r8,r12,ror#32-9 @ C[4] = ROL64(A[4][0] ^ D[0], rhotates[4][0]);
mov r9,r14,ror#32-9
bic r10,r5,r2,ror#13-3
bic r11,r4,r3,ror#12-3
bic r12,r6,r5,ror#32-13
bic r14,r7,r4,ror#32-12
eor r10,r0,r10,ror#32-13
eor r11,r1,r11,ror#32-12
str r10,[sp,#80] @ R[2][0] = C[0] ^ (~C[1] & C[2])
eor r12,r12,r2,ror#32-3
str r11,[sp,#80+4]
eor r14,r14,r3,ror#32-3
str r12,[sp,#88] @ R[2][1] = C[1] ^ (~C[2] & C[3]);
bic r10,r8,r6
bic r11,r9,r7
str r14,[sp,#88+4]
eor r10,r10,r5,ror#32-13
eor r11,r11,r4,ror#32-12
str r10,[sp,#96] @ R[2][2] = C[2] ^ (~C[3] & C[4]);
bic r12,r0,r8
str r11,[sp,#96+4]
bic r14,r1,r9
eor r12,r12,r6
eor r14,r14,r7
str r12,[sp,#104] @ R[2][3] = C[3] ^ (~C[4] & C[0]);
bic r10,r2,r0,ror#3
str r14,[sp,#104+4]
bic r11,r3,r1,ror#3
ldr r1,[sp,#272] @ A[0][4] [in reverse order]
eor r10,r8,r10,ror#32-3
ldr r0,[sp,#272+4]
eor r11,r9,r11,ror#32-3
str r10,[sp,#112] @ R[2][4] = C[4] ^ (~C[0] & C[1]);
add r9,sp,#208
str r11,[sp,#112+4]
ldr r10,[sp,#232] @ D[4]
ldr r11,[sp,#232+4]
ldr r12,[sp,#200] @ D[0]
ldr r14,[sp,#200+4]
ldmia r9,{{r6,r7,r8,r9}} @ D[1..2]
eor r1,r1,r10
ldr r2,[sp,#280] @ A[1][0]
eor r0,r0,r11
ldr r3,[sp,#280+4]
@ mov r1,r10,ror#32-13 @ C[0] = ROL64(A[0][4] ^ D[4], rhotates[0][4]);
ldr r4,[sp,#328] @ A[2][1]
@ mov r0,r11,ror#32-14 @ [was loaded in reverse order]
ldr r5,[sp,#328+4]
eor r2,r2,r12
ldr r10,[sp,#376] @ A[3][2]
eor r3,r3,r14
ldr r11,[sp,#376+4]
@ mov r2,r2,ror#32-18 @ C[1] = ROL64(A[1][0] ^ D[0], rhotates[1][0]);
ldr r12,[sp,#224] @ D[3]
@ mov r3,r3,ror#32-18
ldr r14,[sp,#224+4]
eor r6,r6,r4
eor r7,r7,r5
mov r4,r6,ror#32-5 @ C[2] = ROL64(A[2][1] ^ D[1], rhotates[2][1]);
mov r5,r7,ror#32-5
eor r10,r10,r8
ldr r8,[sp,#424] @ A[4][3]
eor r11,r11,r9
ldr r9,[sp,#424+4]
mov r7,r10,ror#32-7 @ C[3] = ROL64(A[3][2] ^ D[2], rhotates[3][2]);
mov r6,r11,ror#32-8
eor r12,r12,r8
eor r14,r14,r9
mov r8,r12,ror#32-28 @ C[4] = ROL64(A[4][3] ^ D[3], rhotates[4][3]);
mov r9,r14,ror#32-28
bic r10,r4,r2,ror#32-18
bic r11,r5,r3,ror#32-18
eor r10,r10,r0,ror#32-14
eor r11,r11,r1,ror#32-13
str r10,[sp,#120] @ R[3][0] = C[0] ^ (~C[1] & C[2])
bic r12,r6,r4
str r11,[sp,#120+4]
bic r14,r7,r5
eor r12,r12,r2,ror#32-18
str r12,[sp,#128] @ R[3][1] = C[1] ^ (~C[2] & C[3]);
eor r14,r14,r3,ror#32-18
str r14,[sp,#128+4]
bic r10,r8,r6
bic r11,r9,r7
bic r12,r0,r8,ror#14
bic r14,r1,r9,ror#13
eor r10,r10,r4
eor r11,r11,r5
str r10,[sp,#136] @ R[3][2] = C[2] ^ (~C[3] & C[4]);
bic r2,r2,r0,ror#18-14
str r11,[sp,#136+4]
eor r12,r6,r12,ror#32-14
bic r11,r3,r1,ror#18-13
eor r14,r7,r14,ror#32-13
str r12,[sp,#144] @ R[3][3] = C[3] ^ (~C[4] & C[0]);
str r14,[sp,#144+4]
add r14,sp,#216
ldr r0,[sp,#256] @ A[0][2]
eor r10,r8,r2,ror#32-18
ldr r1,[sp,#256+4]
eor r11,r9,r11,ror#32-18
str r10,[sp,#152] @ R[3][4] = C[4] ^ (~C[0] & C[1]);
str r11,[sp,#152+4]
ldmia r14,{{r10,r11,r12,r14}} @ D[2..3]
ldr r2,[sp,#304] @ A[1][3]
ldr r3,[sp,#304+4]
ldr r6,[sp,#232] @ D[4]
ldr r7,[sp,#232+4]
eor r0,r0,r10
ldr r4,[sp,#352] @ A[2][4]
eor r1,r1,r11
ldr r5,[sp,#352+4]
@ mov r0,r0,ror#32-31 @ C[0] = ROL64(A[0][2] ^ D[2], rhotates[0][2]);
ldr r8,[sp,#200] @ D[0]
@ mov r1,r1,ror#32-31
ldr r9,[sp,#200+4]
eor r12,r12,r2
ldr r10,[sp,#360] @ A[3][0]
eor r14,r14,r3
ldr r11,[sp,#360+4]
mov r3,r12,ror#32-27 @ C[1] = ROL64(A[1][3] ^ D[3], rhotates[1][3]);
ldr r12,[sp,#208] @ D[1]
mov r2,r14,ror#32-28
ldr r14,[sp,#208+4]
eor r6,r6,r4
eor r7,r7,r5
mov r5,r6,ror#32-19 @ C[2] = ROL64(A[2][4] ^ D[4], rhotates[2][4]);
mov r4,r7,ror#32-20
eor r10,r10,r8
ldr r8,[sp,#408] @ A[4][1]
eor r11,r11,r9
ldr r9,[sp,#408+4]
mov r7,r10,ror#32-20 @ C[3] = ROL64(A[3][0] ^ D[0], rhotates[3][0]);
mov r6,r11,ror#32-21
eor r8,r8,r12
eor r9,r9,r14
@ mov r8,r2,ror#32-1 @ C[4] = ROL64(A[4][1] ^ D[1], rhotates[4][1]);
@ mov r9,r3,ror#32-1
bic r10,r4,r2
bic r11,r5,r3
eor r10,r10,r0,ror#32-31
str r10,[sp,#160] @ R[4][0] = C[0] ^ (~C[1] & C[2])
eor r11,r11,r1,ror#32-31
str r11,[sp,#160+4]
bic r12,r6,r4
bic r14,r7,r5
eor r12,r12,r2
eor r14,r14,r3
str r12,[sp,#168] @ R[4][1] = C[1] ^ (~C[2] & C[3]);
bic r10,r8,r6,ror#1
str r14,[sp,#168+4]
bic r11,r9,r7,ror#1
bic r12,r0,r8,ror#31-1
bic r14,r1,r9,ror#31-1
eor r4,r4,r10,ror#32-1
str r4,[sp,#176] @ R[4][2] = C[2] ^= (~C[3] & C[4]);
eor r5,r5,r11,ror#32-1
str r5,[sp,#176+4]
eor r6,r6,r12,ror#32-31
eor r7,r7,r14,ror#32-31
str r6,[sp,#184] @ R[4][3] = C[3] ^= (~C[4] & C[0]);
bic r10,r2,r0,ror#32-31
str r7,[sp,#184+4]
bic r11,r3,r1,ror#32-31
add r12,sp,#0
eor r8,r10,r8,ror#32-1
add r10,sp,#40
eor r9,r11,r9,ror#32-1
str r8,[sp,#192] @ R[4][4] = C[4] ^= (~C[0] & C[1]);
str r9,[sp,#192+4]
blo .Lkeccak_round2x
ldr pc,[sp,#440]
.size .Lkeccak_KeccakF1600_int,.-.Lkeccak_KeccakF1600_int
.type {KeccakF1600}, %function
.align 5
{KeccakF1600}:
stmdb sp!,{{r0,r4-r11,lr}}
sub sp,sp,#440+16 @ space for A[5][5],D[5],T[5][5],...
add r10,r0,#40
add r11,sp,#40
ldmia r0, {{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}} @ copy A[5][5] to stack
stmia sp, {{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
ldmia r10!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
ldmia r10!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
ldmia r10!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
ldmia r10, {{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
add r12,sp,#0
add r10,sp,#40
stmia r11, {{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
bl .Lkeccak_KeccakF1600_enter
ldr r11, [sp,#440+16] @ restore pointer to A
ldmia sp, {{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}} @ return A[5][5]
ldmia r10!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
ldmia r10!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
ldmia r10!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11!,{{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
ldmia r10, {{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
stmia r11, {{r0,r1,r2,r3,r4,r5,r6,r7,r8,r9}}
add sp,sp,#440+20
ldmia sp!,{{r4,r5,r6,r7,r8,r9,r10,r11,pc}}
.size {KeccakF1600},.-{KeccakF1600}
.type .Lkeccak_iotas64, %object
.align 5
.Lkeccak_iotas64:
.quad 0x0000000000000001
.quad 0x0000000000008082
.quad 0x800000000000808a
.quad 0x8000000080008000
.quad 0x000000000000808b
.quad 0x0000000080000001
.quad 0x8000000080008081
.quad 0x8000000000008009
.quad 0x000000000000008a
.quad 0x0000000000000088
.quad 0x0000000080008009
.quad 0x000000008000000a
.quad 0x000000008000808b
.quad 0x800000000000008b
.quad 0x8000000000008089
.quad 0x8000000000008003
.quad 0x8000000000008002
.quad 0x8000000000000080
.quad 0x000000000000800a
.quad 0x800000008000000a
.quad 0x8000000080008081
.quad 0x8000000000008080
.quad 0x0000000080000001
.quad 0x8000000080008008
.size .Lkeccak_iotas64,.-.Lkeccak_iotas64
.type {KeccakF1600_neon}, %function
.align 5
{KeccakF1600_neon}:
add r1, r0, #16
adr r2, .Lkeccak_iotas64
mov r3, #24 @ loop counter
b .Lkeccak_oop_neon
.align 4
.Lkeccak_oop_neon:
@ Theta
vst1.64 {{q4}}, [r0,:64] @ offload A[0..1][4]
veor q13, q0, q5 @ A[0..1][0]^A[2..3][0]
vst1.64 {{d18}}, [r1,:64] @ offload A[2][4]
veor q14, q1, q6 @ A[0..1][1]^A[2..3][1]
veor q15, q2, q7 @ A[0..1][2]^A[2..3][2]
veor d26, d26, d27 @ C[0]=A[0][0]^A[1][0]^A[2][0]^A[3][0]
veor d27, d28, d29 @ C[1]=A[0][1]^A[1][1]^A[2][1]^A[3][1]
veor q14, q3, q8 @ A[0..1][3]^A[2..3][3]
veor q4, q4, q9 @ A[0..1][4]^A[2..3][4]
veor d30, d30, d31 @ C[2]=A[0][2]^A[1][2]^A[2][2]^A[3][2]
veor d31, d28, d29 @ C[3]=A[0][3]^A[1][3]^A[2][3]^A[3][3]
veor d25, d8, d9 @ C[4]=A[0][4]^A[1][4]^A[2][4]^A[3][4]
veor q13, q13, q10 @ C[0..1]^=A[4][0..1]
veor q14, q15, q11 @ C[2..3]^=A[4][2..3]
veor d25, d25, d24 @ C[4]^=A[4][4]
vadd.u64 q4, q13, q13 @ C[0..1]<<1
vadd.u64 q15, q14, q14 @ C[2..3]<<1
vadd.u64 d18, d25, d25 @ C[4]<<1
vsri.u64 q4, q13, #63 @ ROL64(C[0..1],1)
vsri.u64 q15, q14, #63 @ ROL64(C[2..3],1)
vsri.u64 d18, d25, #63 @ ROL64(C[4],1)
veor d25, d25, d9 @ D[0] = C[4] ^= ROL64(C[1],1)
veor q13, q13, q15 @ D[1..2] = C[0..1] ^ ROL64(C[2..3],1)
veor d28, d28, d18 @ D[3] = C[2] ^= ROL64(C[4],1)
veor d29, d29, d8 @ D[4] = C[3] ^= ROL64(C[0],1)
veor d0, d0, d25 @ A[0][0] ^= C[4]
veor d1, d1, d25 @ A[1][0] ^= C[4]
veor d10, d10, d25 @ A[2][0] ^= C[4]
veor d11, d11, d25 @ A[3][0] ^= C[4]
veor d20, d20, d25 @ A[4][0] ^= C[4]
veor d2, d2, d26 @ A[0][1] ^= D[1]
veor d3, d3, d26 @ A[1][1] ^= D[1]
veor d12, d12, d26 @ A[2][1] ^= D[1]
veor d13, d13, d26 @ A[3][1] ^= D[1]
veor d21, d21, d26 @ A[4][1] ^= D[1]
vmov d26, d27
veor d6, d6, d28 @ A[0][3] ^= C[2]
veor d7, d7, d28 @ A[1][3] ^= C[2]
veor d16, d16, d28 @ A[2][3] ^= C[2]
veor d17, d17, d28 @ A[3][3] ^= C[2]
veor d23, d23, d28 @ A[4][3] ^= C[2]
vld1.64 {{q4}}, [r0,:64] @ restore A[0..1][4]
vmov d28, d29
vld1.64 {{d18}}, [r1,:64] @ restore A[2][4]
veor q2, q2, q13 @ A[0..1][2] ^= D[2]
veor q7, q7, q13 @ A[2..3][2] ^= D[2]
veor d22, d22, d27 @ A[4][2] ^= D[2]
veor q4, q4, q14 @ A[0..1][4] ^= C[3]
veor q9, q9, q14 @ A[2..3][4] ^= C[3]
veor d24, d24, d29 @ A[4][4] ^= C[3]
@ Rho + Pi
vmov d26, d2 @ C[1] = A[0][1]
vshl.u64 d2, d3, #44
vmov d27, d4 @ C[2] = A[0][2]
vshl.u64 d4, d14, #43
vmov d28, d6 @ C[3] = A[0][3]
vshl.u64 d6, d17, #21
vmov d29, d8 @ C[4] = A[0][4]
vshl.u64 d8, d24, #14
vsri.u64 d2, d3, #64-44 @ A[0][1] = ROL64(A[1][1], rhotates[1][1])
vsri.u64 d4, d14, #64-43 @ A[0][2] = ROL64(A[2][2], rhotates[2][2])
vsri.u64 d6, d17, #64-21 @ A[0][3] = ROL64(A[3][3], rhotates[3][3])
vsri.u64 d8, d24, #64-14 @ A[0][4] = ROL64(A[4][4], rhotates[4][4])
vshl.u64 d3, d9, #20
vshl.u64 d14, d16, #25
vshl.u64 d17, d15, #15
vshl.u64 d24, d21, #2
vsri.u64 d3, d9, #64-20 @ A[1][1] = ROL64(A[1][4], rhotates[1][4])
vsri.u64 d14, d16, #64-25 @ A[2][2] = ROL64(A[2][3], rhotates[2][3])
vsri.u64 d17, d15, #64-15 @ A[3][3] = ROL64(A[3][2], rhotates[3][2])
vsri.u64 d24, d21, #64-2 @ A[4][4] = ROL64(A[4][1], rhotates[4][1])
vshl.u64 d9, d22, #61
@ vshl.u64 d16, d19, #8
vshl.u64 d15, d12, #10
vshl.u64 d21, d7, #55
vsri.u64 d9, d22, #64-61 @ A[1][4] = ROL64(A[4][2], rhotates[4][2])
vext.8 d16, d19, d19, #8-1 @ A[2][3] = ROL64(A[3][4], rhotates[3][4])
vsri.u64 d15, d12, #64-10 @ A[3][2] = ROL64(A[2][1], rhotates[2][1])
vsri.u64 d21, d7, #64-55 @ A[4][1] = ROL64(A[1][3], rhotates[1][3])
vshl.u64 d22, d18, #39
@ vshl.u64 d19, d23, #56
vshl.u64 d12, d5, #6
vshl.u64 d7, d13, #45
vsri.u64 d22, d18, #64-39 @ A[4][2] = ROL64(A[2][4], rhotates[2][4])
vext.8 d19, d23, d23, #8-7 @ A[3][4] = ROL64(A[4][3], rhotates[4][3])
vsri.u64 d12, d5, #64-6 @ A[2][1] = ROL64(A[1][2], rhotates[1][2])
vsri.u64 d7, d13, #64-45 @ A[1][3] = ROL64(A[3][1], rhotates[3][1])
vshl.u64 d18, d20, #18
vshl.u64 d23, d11, #41
vshl.u64 d5, d10, #3
vshl.u64 d13, d1, #36
vsri.u64 d18, d20, #64-18 @ A[2][4] = ROL64(A[4][0], rhotates[4][0])
vsri.u64 d23, d11, #64-41 @ A[4][3] = ROL64(A[3][0], rhotates[3][0])
vsri.u64 d5, d10, #64-3 @ A[1][2] = ROL64(A[2][0], rhotates[2][0])
vsri.u64 d13, d1, #64-36 @ A[3][1] = ROL64(A[1][0], rhotates[1][0])
vshl.u64 d1, d28, #28
vshl.u64 d10, d26, #1
vshl.u64 d11, d29, #27
vshl.u64 d20, d27, #62
vsri.u64 d1, d28, #64-28 @ A[1][0] = ROL64(C[3], rhotates[0][3])
vsri.u64 d10, d26, #64-1 @ A[2][0] = ROL64(C[1], rhotates[0][1])
vsri.u64 d11, d29, #64-27 @ A[3][0] = ROL64(C[4], rhotates[0][4])
vsri.u64 d20, d27, #64-62 @ A[4][0] = ROL64(C[2], rhotates[0][2])
@ Chi + Iota
vbic q13, q2, q1
vbic q14, q3, q2
vbic q15, q4, q3
veor q13, q13, q0 @ A[0..1][0] ^ (~A[0..1][1] & A[0..1][2])
veor q14, q14, q1 @ A[0..1][1] ^ (~A[0..1][2] & A[0..1][3])
veor q2, q2, q15 @ A[0..1][2] ^= (~A[0..1][3] & A[0..1][4])
vst1.64 {{q13}}, [r0,:64] @ offload A[0..1][0]
vbic q13, q0, q4
vbic q15, q1, q0
vmov q1, q14 @ A[0..1][1]
veor q3, q3, q13 @ A[0..1][3] ^= (~A[0..1][4] & A[0..1][0])
veor q4, q4, q15 @ A[0..1][4] ^= (~A[0..1][0] & A[0..1][1])
vbic q13, q7, q6
vmov q0, q5 @ A[2..3][0]
vbic q14, q8, q7
vmov q15, q6 @ A[2..3][1]
veor q5, q5, q13 @ A[2..3][0] ^= (~A[2..3][1] & A[2..3][2])
vbic q13, q9, q8
veor q6, q6, q14 @ A[2..3][1] ^= (~A[2..3][2] & A[2..3][3])
vbic q14, q0, q9
veor q7, q7, q13 @ A[2..3][2] ^= (~A[2..3][3] & A[2..3][4])
vbic q13, q15, q0
veor q8, q8, q14 @ A[2..3][3] ^= (~A[2..3][4] & A[2..3][0])
vmov q14, q10 @ A[4][0..1]
veor q9, q9, q13 @ A[2..3][4] ^= (~A[2..3][0] & A[2..3][1])
vld1.64 d25, [r2,:64]! @ Iota[i++]
vbic d26, d22, d21
vbic d27, d23, d22
vld1.64 {{q0}}, [r0,:64] @ restore A[0..1][0]
veor d20, d20, d26 @ A[4][0] ^= (~A[4][1] & A[4][2])
vbic d26, d24, d23
veor d21, d21, d27 @ A[4][1] ^= (~A[4][2] & A[4][3])
vbic d27, d28, d24
veor d22, d22, d26 @ A[4][2] ^= (~A[4][3] & A[4][4])
vbic d26, d29, d28
veor d23, d23, d27 @ A[4][3] ^= (~A[4][4] & A[4][0])
veor d0, d0, d25 @ A[0][0] ^= Iota[i]
veor d24, d24, d26 @ A[4][4] ^= (~A[4][0] & A[4][1])
subs r3, r3, #1
bne .Lkeccak_oop_neon
bx lr
.size {KeccakF1600_neon},.-{KeccakF1600_neon}