LXVD2X	(INP)(R_x040), VS50	// load v18 (=vs50) in advance
	VSLDOI	$8, V16, V16, V17
	SHA512ROUND0(V7, V0, V1, V2, V3, V4, V5, V6, V17, R_x0b0)
	VPERMLE(V18,V18,LEMASK,V18)
	SHA512ROUND0(V6, V7, V0, V1, V2, V3, V4, V5, V18, R_x0c0)
	LXVD2X	(INP)(R_x050), VS52	// load v20 (=vs52) in advance
	VSLDOI	$8, V18, V18, V19
	SHA512ROUND0(V5, V6, V7, V0, V1, V2, V3, V4, V19, R_x0d0)

	XXLOR key2, key2, V26; \
	VCIPHER vin, V25, vin; \
	VCIPHER vin, V26, vin

// Encrypt 4 values in V15 - V18
// with the specified key from
// VS1 - VS9.
#define VCIPHER_4X1_KEY(key) \
	XXLOR key, key, V23; \
	VCIPHER V15, V23, V15; \
	VCIPHER V16, V23, V16; \
	VCIPHER V17, V23, V17; \
	VCIPHER V18, V23, V18

// Encrypt 8 values in V15 - V22
// with the specified key,
// assuming it is a VSreg

	LVX	(R4),V16	// load from buffer
	OR	$0,R2,R2

	VPMSUMD	V17,const1,V9	// vpmsumd with constants
	LVX	(R4+off16),V17	// load next from buffer
	OR	$0,R2,R2

	VPMSUMD	V18,const1,V10	// vpmsumd with constants
	LVX	(R4+off32),V18	// load next from buffer
	OR	$0,R2,R2

	VPMSUMD	V19,const1,V11	// vpmsumd with constants
	LVX	(R4+off48),V19	// load next from buffer
	OR	$0,R2,R2

	VSEL     V6, V5, V31, V7   // merge even and odd indices
	VCLZD    V7, V18           // find index of first match
	MFVSRD   V18, R25          // get first value
	CMP      R25, $64          // Found if < 64
	BLT      foundR25          // Return byte index where found
	VSLDOI   $8, V18, V18, V18 // Adjust 2nd value
	MFVSRD   V18, R25          // get second value
	CMP      R25, $64          // Found if < 64

	SHA256ROUND0(V0, V1, V2, V3, V4, V5, V6, V7, V16, R_x0a0)
	VSLDOI	$4, V16, V16, V17
	SHA256ROUND0(V7, V0, V1, V2, V3, V4, V5, V6, V17, R_x0b0)
	VSLDOI	$4, V17, V17, V18
	SHA256ROUND0(V6, V7, V0, V1, V2, V3, V4, V5, V18, R_x0c0)
	VSLDOI	$4, V18, V18, V19
	LXVD2X	(INP)(R_x030), V20 // load v20 in advance
	SHA256ROUND0(V5, V6, V7, V0, V1, V2, V3, V4, V19, R_x0d0)
	VPERMLE(V20, V20, LEMASK, V20)

	SHA256ROUND0(V0, V1, V2, V3, V4, V5, V6, V7, V16, R_x0a0)
	VSLDOI	$4, V16, V16, V17
	SHA256ROUND0(V7, V0, V1, V2, V3, V4, V5, V6, V17, R_x0b0)
	VSLDOI	$4, V17, V17, V18
	SHA256ROUND0(V6, V7, V0, V1, V2, V3, V4, V5, V18, R_x0c0)
	VSLDOI	$4, V18, V18, V19
	LXVD2X	(INP)(R_x030), V20 // load v20 in advance
	SHA256ROUND0(V5, V6, V7, V0, V1, V2, V3, V4, V19, R_x0d0)
	VPERMLE(V20, V20, LEMASK, V20)

	VACCCQ V7, V15, V30, V31
	VACQ   V7, V15, V30, V23
	VACCCQ V8, V16, V31, V0  // V0 has carry-over
	VACQ   V8, V16, V31, V24

	VPDI  $0x4, V17, V17, V17 // flip the doublewords to big-endian order
	VPDI  $0x4, V18, V18, V18 // flip the doublewords to big-endian order
	VPDI  $0x4, V19, V19, V19 // flip the doublewords to big-endian order
	VPDI  $0x4, V20, V20, V20 // flip the doublewords to big-endian order

	VCNT V13.B8, V11.B8                                         // ab59200e
	VMOV V31.B[15], V18                                         // f2071f5e
	VDUP V31.B[15], V18                                         // f2071f5e
	VDUP V31.B[13], V20.B16                                     // f4071b4e
	VEOR V4.B8, V18.B8, V7.B8                                   // 471e242e

	VXOR	V12, V12, V12 \
	VXOR	V13, V13, V13 \
	VXOR	V14, V14, V14 \
	VXOR	V15, V15, V15 \
	VXOR	V16, V16, V16 \
	VXOR	V17, V17, V17 \
	VXOR	V18, V18, V18 \
	VXOR	V19, V19, V19 \
	VXOR	V20, V20, V20

//func cryptBlocksChain(src, dst *byte, length int, key *uint32, iv *byte, enc int, nr int)
TEXT ·cryptBlocksChain(SB), NOSPLIT|NOFRAME, $0
	MOVD	src+0(FP), INP
	MOVD	dst+8(FP), OUTP
	MOVD	length+16(FP), LEN

	{"V7", "V7"},
	{"V8", "V8"},
	{"V9", "V9"},
	{"V10", "V10"},
	{"V11", "V11"},
	{"V12", "V12"},
	{"V13", "V13"},
	{"V14", "V14"},
	{"V15", "V15"},
	{"V16", "V16"},
	{"V17", "V17"},
	{"V18", "V18"},
	{"V19", "V19"},
	{"V20", "V20"},
	{"V21", "V21"},
	{"V22", "V22"},
	{"V23", "V23"},
	{"V24", "V24"},
	{"V25", "V25"},
	{"V26", "V26"},
	{"V27", "V27"},
	{"V28", "V28"},