SHA512ROUND(V2, V3, V1, V4, V0, V22, V26, V14, V15, V13, V18, V19)
	SHA512ROUND(V4, V2, V0, V1, V3, V23, V27, V15, V16, V14, V19, V12)
	SHA512ROUND(V1, V4, V3, V0, V2, V24, V28, V16, V17, V15, V12, V13)

	SHA512ROUND(V0, V1, V2, V3, V4, V25, V29, V17, V18, V16, V13, V14)
	SHA512ROUND(V3, V0, V4, V2, V1, V26, V30, V18, V19, V17, V14, V15)
	SHA512ROUND(V2, V3, V1, V4, V0, V27, V31, V19, V12, V18, V15, V16)

	VEOR	V13.B16, V1.B16, V13.B16
	VEOR	V14.B16, V2.B16, V14.B16
	VEOR	V15.B16, V3.B16, V15.B16
	VREV32	V12.H8, V12.H8
	VREV32	V13.H8, V13.H8
	VREV32	V14.H8, V14.H8
	VREV32	V15.H8, V15.H8
	// V8..V11 += V12..V15
	// V4..V7 <<<= ((V4..V7 XOR V8..V11), 12)
	VADD	V8.S4, V12.S4, V8.S4
	VADD	V9.S4, V13.S4, V9.S4
	VADD	V10.S4, V14.S4, V10.S4
	VADD	V11.S4, V15.S4, V11.S4
	VEOR	V8.B16, V4.B16, V16.B16
	VEOR	V9.B16, V5.B16, V17.B16

	VADDUWM V2, V6, V2
	VADDUWM V3, V7, V3

	VPERMXOR V12, V0, V21, V12
	VPERMXOR V13, V1, V21, V13
	VPERMXOR V14, V2, V21, V14
	VPERMXOR V15, V3, V21, V15

	VADDUWM V8, V12, V8
	VADDUWM V9, V13, V9
	VADDUWM V10, V14, V10
	VADDUWM V11, V15, V11

	VXOR V4, V8, V4
	VXOR V5, V9, V5
	VXOR V6, V10, V6
	VXOR V7, V11, V7

	VRLW V4, V28, V4
	VRLW V5, V28, V5
	VRLW V6, V28, V6

	VCIPHER_1X9_KEYS(V15)		// Encrypt V15 with 9 keys
	XXLOR	VS10, VS10, V23		// Save possible last key
	BLT	CR2, final_block_last
	VCIPHER_1X2_KEYS(V15, VS10, VS11)	// Encrypt V15 with next 2 keys
	XXLOR	VS12, VS12, V23		// Save possible last key
	BEQ	CR2, final_block_last
	VCIPHER_1X2_KEYS(V15, VS12, VS13) // Encrypt V15 with last 2 keys
	XXLOR	VS14, VS14, V23		// Save last key

    T14, T15> Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8,
    T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15) {
  return internal::ValueArray15<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11,
      T12, T13, T14, T15>(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12,
      v13, v14, v15);
}

template <typename T1, typename T2, typename T3, typename T4, typename T5,

	// Add 0, 1, 2, 3 to counter stripes.
	VADD V30.S4, V12.S4, V12.S4

	// Zeros for remaining two matrix entries.
	VEOR V13.B16, V13.B16, V13.B16
	VEOR V14.B16, V14.B16, V14.B16
	VEOR V15.B16, V15.B16, V15.B16

	// Save seed state for adding back later.
	VMOV V4.B16, V20.B16
	VMOV V5.B16, V21.B16
	VMOV V6.B16, V22.B16
	VMOV V7.B16, V23.B16
	VMOV V8.B16, V24.B16
	VMOV V9.B16, V25.B16
	VMOV V10.B16, V26.B16

    T14, T15> Values(T1 v1, T2 v2, T3 v3, T4 v4, T5 v5, T6 v6, T7 v7, T8 v8,
    T9 v9, T10 v10, T11 v11, T12 v12, T13 v13, T14 v14, T15 v15) {
  return internal::ValueArray15<T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11,
      T12, T13, T14, T15>(v1, v2, v3, v4, v5, v6, v7, v8, v9, v10, v11, v12,
      v13, v14, v15);
}

template <typename T1, typename T2, typename T3, typename T4, typename T5,

	LVX	(R3+off80),V17
	VPMSUMW	V13,V17,V13
	BC	18,0,v13

	LVX	(R4+off96),V14
	LVX	(R3+off96),V16
	VPMSUMW	V14,V16,V14
	BC	18,0,v14

	LVX	(R4+off112),V15
	LVX	(R3+off112),V17
	VPMSUMW	V15,V17,V15

	VXOR	V19,V15,V19
v14:	VXOR	V20,V14,V20
v13:	VXOR	V19,V13,V19
v12:	VXOR	V20,V12,V20
v11:	VXOR	V19,V11,V19
v10:	VXOR	V20,V10,V20
v9:	VXOR	V19,V9,V19
v8:	VXOR	V20,V8,V20

	AESIMC	V2.B16, V9.B16
	AESIMC	V3.B16, V8.B16
	VLD1.P	64(R10), [V0.B16, V1.B16, V2.B16, V3.B16]
	AESIMC	V0.B16, V15.B16
	AESIMC	V1.B16, V14.B16
	AESIMC	V2.B16, V13.B16
	AESIMC	V3.B16, V12.B16
	VLD1	(R10), [V0.B16]
	VST1.P	[V0.B16], 16(R11)
	VST1.P	[V12.B16, V13.B16, V14.B16, V15.B16], 64(R11)
	VST1.P	[V8.B16, V9.B16, V10.B16, V11.B16], 64(R11)
	VST1	[V4.B16, V5.B16, V6.B16, V7.B16], (R11)
	B	ksDone
ks256:

	SHA256ROUND1(V3, V4, V5, V6, V7, V0, V1, V2, V13, V14, V15, V23, V12, R_x050)
	SHA256ROUND1(V2, V3, V4, V5, V6, V7, V0, V1, V14, V15, V16, V8, V13, R_x060)
	SHA256ROUND1(V1, V2, V3, V4, V5, V6, V7, V0, V15, V16, V17, V9, V14, R_x070)
	SHA256ROUND1(V0, V1, V2, V3, V4, V5, V6, V7, V16, V17, V18, V10, V15, R_x080)
	SHA256ROUND1(V7, V0, V1, V2, V3, V4, V5, V6, V17, V18, V19, V11, V16, R_x090)