94 #define S(x, n)         ROR64c(x, n)  macro
96 #define Sigma0(x)       (S(x, 28) ^ S(x, 34) ^ S(x, 39))
97 #define Sigma1(x)       (S(x, 14) ^ S(x, 18) ^ S(x, 41))
98 #define Gamma0(x)       (S(x, 1) ^ S(x, 8) ^ R(x, 7))
99 #define Gamma1(x)       (S(x, 19) ^ S(x, 61) ^ R(x, 6))
112 	u64 S[8], t0, t1;  in sha512_compress()  local
122 		S[i] = md->state[i];  in sha512_compress()
137 		t0 = S[7] + Sigma1(S[4]) + Ch(S[4], S[5], S[6]) + K[i] + W[i];  in sha512_compress()
138 		t1 = Sigma0(S[0]) + Maj(S[0], S[1], S[2]);  in sha512_compress()
139 		S[7] = S[6];  in sha512_compress()
140 		S[6] = S[5];  in sha512_compress()
141 		S[5] = S[4];  in sha512_compress()
142 		S[4] = S[3] + t0;  in sha512_compress()
143 		S[3] = S[2];  in sha512_compress()
144 		S[2] = S[1];  in sha512_compress()
145 		S[1] = S[0];  in sha512_compress()
146 		S[0] = t0 + t1;  in sha512_compress()
151 		md->state[i] = md->state[i] + S[i];  in sha512_compress()