MOVV	R0, gobuf_sp(R3)
	MOVV	R0, gobuf_ret(R3)
	MOVV	R0, gobuf_lr(R3)
	MOVV	R0, gobuf_ctxt(R3)
	MOVV	gobuf_pc(R3), R4
	JMP	(R4)

// void mcall(fn func(*g))
// Switch to m->g0's stack, call fn(g).
// Fn must never return. It should gogo(&g->sched)
// to keep running g.
TEXT runtime·mcall(SB), NOSPLIT|NOFRAME, $0-8
	// Save caller state in g->sched
	MOVV	R29, (g_sched+gobuf_sp)(g)

	MOVL	$0, gobuf_sp(BX)	// clear to help garbage collector
	MOVL	$0, gobuf_ret(BX)
	MOVL	$0, gobuf_ctxt(BX)
	MOVL	gobuf_pc(BX), BX
	JMP	BX

// func mcall(fn func(*g))
// Switch to m->g0's stack, call fn(g).
// Fn must never return. It should gogo(&g->sched)
// to keep running g.
TEXT runtime·mcall(SB), NOSPLIT, $0-4
	MOVL	fn+0(FP), DI

	get_tls(DX)
	MOVL	g(DX), AX	// save state in g->sched

// Inferno's libkern/memmove-arm.s
// https://bitbucket.org/inferno-os/inferno-os/src/master/libkern/memmove-arm.s
//
//         Copyright © 1994-1999 Lucent Technologies Inc. All rights reserved.
//         Revisions Copyright © 2000-2007 Vita Nuova Holdings Limited (www.vitanuova.com).  All rights reserved.
//         Portions Copyright 2009 The Go Authors. All rights reserved.
//
// Permission is hereby granted, free of charge, to any person obtaining a copy

	// Called from f.
	// Set m->morebuf to f's caller.
	MOV	RA, (m_morebuf+gobuf_pc)(A0)	// f's caller's PC
	MOV	X2, (m_morebuf+gobuf_sp)(A0)	// f's caller's SP
	MOV	g, (m_morebuf+gobuf_g)(A0)

	// Call newstack on m->g0's stack.
	MOV	m_g0(A0), g
	CALL	runtime·save_g(SB)
	MOV	(g_sched+gobuf_sp)(g), X2
	// Create a stack frame on g0 to call newstack.
	MOV	ZERO, -8(X2)	// Zero saved LR in frame
	SUB	$8, X2
	CALL	runtime·newstack(SB)

	MOVD	$0, gobuf_lr(R5)
	MOVD	$0, gobuf_ctxt(R5)
	CMP	R0, R0 // set condition codes for == test, needed by stack split
	MOVD	gobuf_pc(R5), R6
	BR	(R6)

// void mcall(fn func(*g))
// Switch to m->g0's stack, call fn(g).
// Fn must never return.  It should gogo(&g->sched)
// to keep running g.
TEXT runtime·mcall(SB), NOSPLIT, $-8-8
	// Save caller state in g->sched
	MOVD	R15, (g_sched+gobuf_sp)(g)

	MOVW	$0, R0
	MOVW	z+0(FP), R1
	MOVW	x+4(FP), R2
	MOVW	y+8(FP), R3
	ADD	R5<<2, R1, R5
	MOVW	$0, R4
	B E9

L9:	MOVW.P	4(R2), R6
	MULLU	R6, R3, (R7, R6)
	ADD.S	R4, R6
	ADC	R0, R7
	MOVW	0(R1), R4
	ADD.S	R4, R6
	ADC	R0, R7
	MOVW.P	R6, 4(R1)
	MOVW	R7, R4

E9:	TEQ	R1, R5
	BNE	L9

	MOVW	R4, c+12(FP)

	MOVH.S	0xaaaa(R2), R3     // ERROR "invalid .S suffix"
	MOVW.S	0xaaaa(R2), R3     // ERROR "invalid .S suffix"
	MOVW.S	CPSR, R1           // ERROR "invalid .S suffix"
	MOVW.S	R3, CPSR           // ERROR "invalid .S suffix"
	MOVW.S	$0, CPSR           // ERROR "invalid .S suffix"
	MOVM.S	(R0), [R2-R4]      // ERROR "invalid .S suffix"
	MOVM.S	[R1-R6], (R9)      // ERROR "invalid .S suffix"
	SWPW.S	R1, (R2), R3       // ERROR "invalid .S suffix"

//go:build !purego

// This is an optimized implementation of AES-GCM using AES-NI and CLMUL-NI
// The implementation uses some optimization as described in:
// [1] Gueron, S., Kounavis, M.E.: Intel® Carry-Less Multiplication
//     Instruction and its Usage for Computing the GCM Mode rev. 2.02
// [2] Gueron, S., Krasnov, V.: Speeding up Counter Mode in Software and
//     Hardware

#include "textflag.h"

#define B0 X0
#define B1 X1
#define B2 X2

	// f := f1 - 1
	SUBSD   X0, X2 // x1= k, x2= f
	// s := f / (2 + f)
	MOVSD   $2.0, X0
	ADDSD   X2, X0
	MOVAPD  X2, X3
	DIVSD   X0, X3 // x1=k, x2= f, x3= s
	// s2 := s * s
	MOVAPD  X3, X4 // x1= k, x2= f, x3= s
	MULSD   X4, X4 // x1= k, x2= f, x3= s, x4= s2
	// s4 := s2 * s2
	MOVAPD  X4, X5 // x1= k, x2= f, x3= s, x4= s2
	MULSD   X5, X5 // x1= k, x2= f, x3= s, x4= s2, x5= s4
	// t1 := s2 * (L1 + s4*(L3+s4*(L5+s4*L7)))

	MOVW	p+4(FP), Rdata	// pointer to the data
	MOVW	p_len+8(FP), Rt0	// number of bytes
	ADD	Rdata, Rt0
	MOVW	Rt0, p_end	// pointer to end of data

loop:
	MOVW	Rdata, p_data	// Save Rdata
	AND.S	$3, Rdata, Rt0	// TST $3, Rdata not working see issue 5921
	BEQ	aligned			// aligned detected - skip copy

	// Copy the unaligned source data into the aligned temporary buffer