check32:
	// X6 contains $32
	BLT	X5, X6, compare16
compare32:
	MOV	0(X10), X15
	MOV	0(X12), X16
	MOV	8(X10), X17
	MOV	8(X12), X18
	BNE	X15, X16, cmp8a
	BNE	X17, X18, cmp8b
	MOV	16(X10), X15
	MOV	16(X12), X16
	MOV	24(X10), X17
	MOV	24(X12), X18
	BNE	X15, X16, cmp8a
	BNE	X17, X18, cmp8b
	ADD	$32, X10
	ADD	$32, X12
	SUB	$32, X5
	BGE	X5, X6, compare32
	BEQZ	X5, cmp_len

check16:
	MOV	$16, X6

	"chacha8:\x00\x00\x00\x00\x00\x00\x00\x19>\x15\x0e\xacHk4O\x11a\xa8R\xcd5\x9atr\x8cXO\x9c]\x10\xdf\xf61\xea\x11\x18\x06\x8a\xaa",
	"chacha8:\x00\x00\x00\x00\x00\x00\x00\x1a>\x15\x0e\xacHk4O\x11a\xa8R\xcd5\x9atr\x8cXO\x9c]\x10\xdf\xf61\xea\x11\x18\x06\x8a\xaa",

	VPMADD52HUQ X7, X11, K1, X18                       // 62e2a509b5d7
	VPMADD52HUQ X0, X11, K1, X18                       // 62e2a509b5d0
	VPMADD52HUQ 17(SP)(BP*2), X11, K1, X18             // 62e2a509b5946c11000000
	VPMADD52HUQ -7(DI)(R8*4), X11, K1, X18             // 62a2a509b59487f9ffffff
	VPMADD52HUQ X7, X31, K1, X18                       // 62e28501b5d7
	VPMADD52HUQ X0, X31, K1, X18                       // 62e28501b5d0

 * Called from standard RISCV ELF psABI, where x8-x9, x18-x27, f8-f9 and
 * f18-f27 are callee-save, so they must be saved explicitly, along with
 * x1 (LR).
 */
.globl crosscall1
crosscall1:
	sd	x1, -200(sp)
	addi	sp, sp, -200
	sd	x8, 8(sp)
	sd	x9, 16(sp)
	sd	x18, 24(sp)
	sd	x19, 32(sp)
	sd	x20, 40(sp)
	sd	x21, 48(sp)
	sd	x22, 56(sp)
	sd	x23, 64(sp)

	var x10, x11, x12, x13, x14, x15, x16, x17, x18, x19 int
	var x20, x21, x22, x23, x24, x25, x26, x27, x28, x29 int
	var x30, x31, x32 int

	_ = x00
	_ = x01
	_ = x02
	_ = x03
	_ = x04
	_ = x05
	_ = x06
	_ = x07
	_ = x08
	_ = x09

	_ = x10
	_ = x11
	_ = x12
	_ = x13
	_ = x14
	_ = x15
	_ = x16
	_ = x17
	_ = x18
	_ = x19

	_ = x20
	_ = x21
	_ = x22
	_ = x23

	MOV	$64, X9
	BLT	X12, X9, f_loop32_check
f_loop64:
	MOV	0(X11), X14
	MOV	8(X11), X15
	MOV	16(X11), X16
	MOV	24(X11), X17
	MOV	32(X11), X18
	MOV	40(X11), X19
	MOV	48(X11), X20
	MOV	56(X11), X21
	MOV	X14, 0(X10)
	MOV	X15, 8(X10)
	MOV	X16, 16(X10)
	MOV	X17, 24(X10)
	MOV	X18, 32(X10)
	MOV	X19, 40(X10)
	MOV	X20, 48(X10)
	MOV	X21, 56(X10)
	ADD	$64, X10
	ADD	$64, X11
	SUB	$64, X12
	BGE	X12, X9, f_loop64

	SLTU	X21, X16, X22
	ADD	X15, X22, X29	// next c

	MULHU	X17, X6, X18	// z_hi[3] = x[3] * y
	MUL	X17, X6, X17	// z_lo[3] = x[3] * y
	ADD	X17, X19, X21	// z_lo[3] = x[3] * y + z[3]
	SLTU	X17, X21, X22
	ADD	X18, X22, X18	// z_hi[3] = x[3] * y + z[3]
	ADD	X21, X29, X19	// z_lo[3] = x[3] * y + z[3] + c
	SLTU	X21, X19, X22
	ADD	X18, X22, X29	// next c

	MOV	X10, 0*8(X5)	// z[0]
	MOV	X13, 1*8(X5)	// z[1]

	var x18 uint64
	_, x18 = bits.Sub64(uint64(p224Uint1(x8)), uint64(0x0), uint64(p224Uint1(x16)))
	var x19 uint64
	p224CmovznzU64(&x19, p224Uint1(x18), x9, x1)
	var x20 uint64
	p224CmovznzU64(&x20, p224Uint1(x18), x11, x3)
	var x21 uint64
	p224CmovznzU64(&x21, p224Uint1(x18), x13, x5)
	var x22 uint64
	p224CmovznzU64(&x22, p224Uint1(x18), x15, x7)
	out1[0] = x19
	out1[1] = x20

	VRCP28SD X2, X24, K2, X18                          // 62e2bd02cbd2 or 62e2bd22cbd2 or 62e2bd42cbd2
	VRCP28SD X27, X24, K2, X18                         // 6282bd02cbd3 or 6282bd22cbd3 or 6282bd42cbd3
	VRCP28SD X26, X24, K2, X18                         // 6282bd02cbd2 or 6282bd22cbd2 or 6282bd42cbd2

	VANDNPS -7(CX)(DX*8), X3, K7, X18                  // 62e1640f5594d1f9ffffff
	VANDNPS X15, X18, K7, X18                          // 62c16c0755d7
	VANDNPS X28, X18, K7, X18                          // 62816c0755d4
	VANDNPS 17(SP)(BP*1), X18, K7, X18                 // 62e16c0755942c11000000
	VANDNPS -7(CX)(DX*8), X18, K7, X18                 // 62e16c075594d1f9ffffff