KLMD	R2, R8                 // b93f0028
	KIMD	R0, R4                 // b93e0004
	KDSA	R0, R8                 // b93a0008
	KMA	R2, R6, R4              // b9296024
	KMCTR   R2, R6, R4              // b92d6024

	// vector add and sub instructions
	VAB	V3, V4, V4              // e743400000f3
	VAH	V3, V4, V4              // e743400010f3
	VAF	V3, V4, V4              // e743400020f3
	VAG	V3, V4, V4              // e743400030f3

// From http://software.intel.com/en-us/articles
// (look for improving-the-performance-of-the-secure-hash-algorithm-1)
// This implementation is 2x unrolled, and interleaves vector instructions,
// used to precompute W, with scalar computation of current round
// for optimal scheduling.

// Trivial helper macros.
#define UPDATE_HASH(A,TB,C,D,E) \
	ADDL	(R9), A \
	MOVL	A, (R9) \

DATA  ·kcon+0x418(SB)/8, $0x1011121300010203
DATA  ·kcon+0x420(SB)/8, $0x1011121310111213
DATA  ·kcon+0x428(SB)/8, $0x0405060700010203
DATA  ·kcon+0x430(SB)/8, $0x1011121308090a0b
DATA  ·kcon+0x438(SB)/8, $0x0405060700010203
#else
DATA  ·kcon+0x410(SB)/8, $0x1011121300010203
DATA  ·kcon+0x418(SB)/8, $0x1011121310111213 // permutation control vectors
DATA  ·kcon+0x420(SB)/8, $0x0405060700010203

	MOVD	$32,R11		// set offsets to load into vector
	MOVD	$48,R12		// set offsets to load into vector

	PCALIGN	$16
cmp64_loop:
	LXVD2X	(R5)(R0),V3	// load bytes of A at offset 0 into vector
	LXVD2X	(R6)(R0),V4	// load bytes of B at offset 0 into vector
	VCMPEQUDCC	V3,V4,V1
	BGE	CR6,different	// jump out if its different

	LXVD2X	(R5)(R10),V3	// load bytes of A at offset 16 into vector

	MOVD  plist_base+0(FP), R1  // r1 points to plist
	MOVD  bpx_offset+24(FP), R2 // r2 offset to BPX vector table
	MOVD  R14, R7               // save r14
	MOVD  R15, R8               // save r15
	MOVWZ 16(R0), R9
	MOVWZ 544(R9), R9
	MOVWZ 24(R9), R9            // call vector in r9
	ADD   R2, R9                // add offset to vector table
	MOVWZ (R9), R9              // r9 points to entry point

// For {en,de}cryptBlockAsm
#define BLK_INP    R3
#define BLK_OUT    R4
#define BLK_KEY    R5
#define BLK_ROUNDS R6
#define BLK_IDX    R7

DATA ·rcon+0x00(SB)/8, $0x0f0e0d0c0b0a0908 // Permute for vector doubleword endian swap
DATA ·rcon+0x08(SB)/8, $0x0706050403020100
DATA ·rcon+0x10(SB)/8, $0x0100000001000000 // RCON
DATA ·rcon+0x18(SB)/8, $0x0100000001000000 // RCON
DATA ·rcon+0x20(SB)/8, $0x1b0000001b000000

//
// This algorithm uses 5 26-bit limbs to represent a 130-bit
// value. These limbs are, for the most part, zero extended and
// placed into 64-bit vector register elements. Each vector
// register is 128-bits wide and so holds 2 of these elements.
// Using 26-bit limbs allows us plenty of headroom to accommodate
// accumulations before and after multiplication without
// overflowing either 32-bits (before multiplication) or 64-bits

	MOVD	pTbl, pTblSave
	// Current tag, after AAD
	VLD1	(tPtr), [ACC0.B16]
	VEOR	ACC1.B16, ACC1.B16, ACC1.B16
	VEOR	ACCM.B16, ACCM.B16, ACCM.B16
	// Prepare initial counter, and the increment vector
	VLD1	(ctrPtr), [CTR.B16]
	VEOR	INC.B16, INC.B16, INC.B16
	MOVD	$1, H0
	VMOV	H0, INC.S[3]
	VREV32	CTR.B16, CTR.B16
	VADD	CTR.S4, INC.S4, CTR.S4
	// Skip to <8 blocks loop
	CMP	$128, srcPtrLen

// license that can be found in the LICENSE file.

//go:build !math_big_pure_go && (ppc64 || ppc64le)

#include "textflag.h"

// This file provides fast assembly versions for the elementary
// arithmetic operations on vectors implemented in arith.go.

// func addVV(z, y, y []Word) (c Word)
// z[i] = x[i] + y[i] for all i, carrying
TEXT ·addVV(SB), NOSPLIT, $0
	MOVD  z_len+8(FP), R7   // R7 = z_len
	MOVD  x+24(FP), R8      // R8 = x[]