#define m1		X4
#define m2		X5
#define m3		X6
#define m4		X7
#define shufMask	X8	// input data endian conversion control mask
#define abefSave	X9	// digest hash vector inter-block buffer abef
#define cdghSave	X10	// digest hash vector inter-block buffer cdgh

#define nop(m,a)		// nop instead of final SHA256MSG1 for first and last few rounds

#define sha256msg1(m,a) \	// final SHA256MSG1 for middle rounds that require it

	KLMD	R2, R8                 // b93f0028
	KIMD	R0, R4                 // b93e0004
	KDSA	R0, R8                 // b93a0008
	KMA	R2, R6, R4              // b9296024
	KMCTR   R2, R6, R4              // b92d6024

	// vector add and sub instructions
	VAB	V3, V4, V4              // e743400000f3
	VAH	V3, V4, V4              // e743400010f3
	VAF	V3, V4, V4              // e743400020f3
	VAG	V3, V4, V4              // e743400030f3

// From http://software.intel.com/en-us/articles
// (look for improving-the-performance-of-the-secure-hash-algorithm-1)
// This implementation is 2x unrolled, and interleaves vector instructions,
// used to precompute W, with scalar computation of current round
// for optimal scheduling.

// Trivial helper macros.
#define UPDATE_HASH(A,TB,C,D,E) \
	ADDL	(R9), A \
	MOVL	A, (R9) \

DATA  ·kcon+0x418(SB)/8, $0x1011121300010203
DATA  ·kcon+0x420(SB)/8, $0x1011121310111213
DATA  ·kcon+0x428(SB)/8, $0x0405060700010203
DATA  ·kcon+0x430(SB)/8, $0x1011121308090a0b
DATA  ·kcon+0x438(SB)/8, $0x0405060700010203
#else
DATA  ·kcon+0x410(SB)/8, $0x1011121300010203
DATA  ·kcon+0x418(SB)/8, $0x1011121310111213 // permutation control vectors
DATA  ·kcon+0x420(SB)/8, $0x0405060700010203

	MOVD	$32,R11		// set offsets to load into vector
	MOVD	$48,R12		// set offsets to load into vector

	PCALIGN	$16
cmp64_loop:
	LXVD2X	(R5)(R0),V3	// load bytes of A at offset 0 into vector
	LXVD2X	(R6)(R0),V4	// load bytes of B at offset 0 into vector
	VCMPEQUDCC	V3,V4,V1
	BGE	CR6,different	// jump out if its different

	LXVD2X	(R5)(R10),V3	// load bytes of A at offset 16 into vector

#ifndef GOPPC64_power9
#define ADJUST_FOR_CNTLZW -16
#else
#define ADJUST_FOR_CNTLZW 0
#endif

// Now, find the index of the 16B vector the match was discovered in. If CNTLZW is used
// to determine the offset into the 16B vector, it will overcount by 16. Account for it here.
foundat3:
	SUB	R3,R8,R3
	ADD	$48+ADJUST_FOR_CNTLZW,R3
	BR	vfound
foundat2:
	SUB	R3,R8,R3

	VSPLTB $2, V0, V8   // Splat 3rd byte of sep

	// Loop to process 3 byte separator.
	// string[0:16] is in V2
	// string[2:18] is in V3
	// sep[0:2] splatted in V1
	// sec[3] splatted in v8
	// Load vectors at string, string+1
	// and string+2. Compare string, string+1
	// against first 2 bytes of separator
	// splatted, and string+2 against 3rd
	// byte splatted. Merge the results with

	MOVD  plist_base+0(FP), R1  // r1 points to plist
	MOVD  bpx_offset+24(FP), R2 // r2 offset to BPX vector table
	MOVD  R14, R7               // save r14
	MOVD  R15, R8               // save r15
	MOVWZ 16(R0), R9
	MOVWZ 544(R9), R9
	MOVWZ 24(R9), R9            // call vector in r9
	ADD   R2, R9                // add offset to vector table
	MOVWZ (R9), R9              // r9 points to entry point

// For {en,de}cryptBlockAsm
#define BLK_INP    R3
#define BLK_OUT    R4
#define BLK_KEY    R5
#define BLK_ROUNDS R6
#define BLK_IDX    R7

DATA ·rcon+0x00(SB)/8, $0x0f0e0d0c0b0a0908 // Permute for vector doubleword endian swap
DATA ·rcon+0x08(SB)/8, $0x0706050403020100
DATA ·rcon+0x10(SB)/8, $0x0100000001000000 // RCON
DATA ·rcon+0x18(SB)/8, $0x0100000001000000 // RCON
DATA ·rcon+0x20(SB)/8, $0x1b0000001b000000

//
// This algorithm uses 5 26-bit limbs to represent a 130-bit
// value. These limbs are, for the most part, zero extended and
// placed into 64-bit vector register elements. Each vector
// register is 128-bits wide and so holds 2 of these elements.
// Using 26-bit limbs allows us plenty of headroom to accommodate
// accumulations before and after multiplication without
// overflowing either 32-bits (before multiplication) or 64-bits