BC	18,0,v4

	LVX	(R4+off80),V5
	LVX	(R3+off80),V17
	VPMSUMW	V5,V17,V5
	BC	18,0,v5

	LVX	(R4+off96),V6
	LVX	(R3+off96),V16
	VPMSUMW	V6,V16,V6
	BC	18,0,v6

	LVX	(R4+off112),V7
	LVX	(R3+off112),V17
	VPMSUMW	V7,V17,V7
	BC	18,0,v7

	ADD	$128,R3
	ADD	$128,R4

	LVX	(R4),V8
	LVX	(R3),V16
	VPMSUMW	V8,V16,V8
	BC	18,0,v8

	LVX	(R4+off16),V9
	LVX	(R3+off16),V17

#ifdef NEEDS_ESPERM
	MOVD	$·rcon(SB), PTR // PTR points to rcon addr
	LVX	(PTR), ESPERM
	ADD	$0x10, PTR
#else
	MOVD	$·rcon+0x10(SB), PTR // PTR points to rcon addr (skipping permute vector)
#endif

	// Get key from memory and write aligned into VR
	P8_LXVB16X(INP, R0, IN0)
	ADD	$0x10, INP, INP
	MOVD	$0x20, TEMP

	CMPW	ROUNDS, $12
	LVX	(PTR)(R0), RCON    // lvx   4,0,6      Load first 16 bytes into RCON
	LVX	(PTR)(TEMP), MASK

loop:
	MOVD	TBL_STRT, TBL
	LVX	(TBL)(R_x000), KI

	LXVD2X	(INP)(R_x000), V8 // load v8 in advance

	// Offload to VSR24-31 (aka FPR24-31)
	XXLOR	V0, V0, VS24
	XXLOR	V1, V1, VS25
	XXLOR	V2, V2, VS26
	XXLOR	V3, V3, VS27
	XXLOR	V4, V4, VS28
	XXLOR	V5, V5, VS29
	XXLOR	V6, V6, VS30
	XXLOR	V7, V7, VS31

	VADDUWM	KI, V7, V7        // h+K[i]
	LVX	(TBL)(R_x010), KI

	VSHASIGMAD	$0, a, $1, S0; \
	VADDUDM		FUNC, h, h; \
	VXOR		b, a, FUNC; \
	VADDUDM		S1, h, h; \
	VSEL		b, c, FUNC, FUNC; \
	VADDUDM		KI, g, g; \
	VADDUDM		h, d, d; \
	VADDUDM		FUNC, S0, S0; \
	LVX		(TBL)(idx), KI; \
	VADDUDM		S0, h, h

#define SHA512ROUND1(a, b, c, d, e, f, g, h, xi, xj, xj_1, xj_9, xj_14, idx) \
	VSHASIGMAD	$0, xj_1, $0, s0; \
	VSEL		g, f, e, FUNC; \
	VSHASIGMAD	$15, e, $1, S1; \

	MOVD	$-192, R12
	LVX	(R0+R12), V20
	MOVD	$-176, R12
	LVX	(R0+R12), V21
	MOVD	$-160, R12
	LVX	(R0+R12), V22
	MOVD	$-144, R12
	LVX	(R0+R12), V23
	MOVD	$-128, R12
	LVX	(R0+R12), V24
	MOVD	$-112, R12
	LVX	(R0+R12), V25
	MOVD	$-96, R12
	LVX	(R0+R12), V26
	MOVD	$-80, R12
	LVX	(R0+R12), V27
	MOVD	$-64, R12
	LVX	(R0+R12), V28
	MOVD	$-48, R12

	"POPCNTW",
	"POPCNTB",
	"CNTTZW",
	"CNTTZWCC",
	"CNTTZD",
	"CNTTZDCC",
	"COPY",
	"PASTECC",
	"DARN",
	"MADDHD",
	"MADDHDU",
	"MADDLD",
	"LVEBX",
	"LVEHX",
	"LVEWX",
	"LVX",
	"LVXL",
	"LVSL",
	"LVSR",
	"STVEBX",
	"STVEHX",
	"STVEWX",
	"STVX",
	"STVXL",
	"VAND",
	"VANDC",
	"VNAND",
	"VOR",
	"VORC",
	"VNOR",
	"VXOR",
	"VEQV",

	FCMPO F1, F2, CR0               // FCMPO F1,CR0,F2 // fc011040
	FCMPU F1, F2                    // fc011000
	FCMPU F1, F2, CR0               // FCMPU F1,CR0,F2 // fc011000
	LVX (R3)(R4), V1                // 7c2418ce
	LVX (R3)(R0), V1                // 7c2018ce
	LVX (R3), V1                    // 7c2018ce
	LVXL (R3)(R4), V1               // 7c241ace
	LVXL (R3)(R0), V1               // 7c201ace
	LVXL (R3), V1                   // 7c201ace

// VSUBUQM, VSUBCUQ, and VSEL instructions.

// 2. ppc64 does not have a multiply high and low
// like s390x, so those were implemented using
// macros to compute the equivalent values.

// 3. The LVX, STVX instructions on ppc64 require
// 16 byte alignment of the data.  To avoid that
// requirement, data is loaded using LXVD2X and
// STXVD2X with VPERM to reorder bytes correctly.

	MOVD    in+32(FP), BLK_INP
	MOVD    in_len+40(FP), IN_LEN
	MOVD    counter+56(FP), COUNTER
	MOVD    key+64(FP), BLK_KEY

// Set up permute string when needed.
#ifdef NEEDS_ESPERM
	MOVD    $·rcon(SB), R14
	LVX     (R14), ESPERM   // Permute value for P8_ macros.
#endif
	SETUP_COUNTER		// V30 Counter V31 BE {0, 0, 0, 1}
	LOAD_KEYS(BLK_KEY, KEY_LEN)	// VS1 - VS10/12/14 based on keysize
	CMP     IN_LEN, $128
	BLT	block64

			opset(AMOVHU, r0)

			opset(AMOVHZU, r0)
			opset(AMOVWU, r0)
			opset(AMOVWZU, r0)
			opset(AMOVDU, r0)
			opset(AMOVMW, r0)

		case ALVEBX: /* lvebx, lvehx, lvewx, lvx, lvxl, lvsl, lvsr */
			opset(ALVEHX, r0)
			opset(ALVEWX, r0)
			opset(ALVX, r0)
			opset(ALVXL, r0)
			opset(ALVSL, r0)
			opset(ALVSR, r0)