diff --git a/.github/workflows/windows-arm64.yml b/.github/workflows/windows-arm64.yml
new file mode 100644
index 0000000000..41627a4343
--- /dev/null
+++ b/.github/workflows/windows-arm64.yml
@@ -0,0 +1,57 @@
+name: Windows ARM64 Test
+
+# Builds and tests wolfSSL on a native Windows-on-ARM64 runner.  Unlike the
+# cross-compiled ARM64 job in os-check.yml (which runs on an x64 runner and can
+# only build), this runs on GitHub's native windows-11-arm image so the test
+# suite executes on the target ISA.  The WolfSSLAarch64Asm=true leg assembles
+# the ARMv8 crypto .asm (armasm64) and enables the WOLFSSL_ARMASM code paths.
+
+on:
+  push:
+    branches: [ 'release/**' ]
+    paths-ignore:
+      - '**/*.md'
+      - 'doc/**'
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ '*' ]
+    paths-ignore:
+      - '**/*.md'
+      - 'doc/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  windows_arm64_build:
+    name: Windows ARM64 Build Test
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    runs-on: windows-11-arm
+    strategy:
+      fail-fast: false
+      matrix:
+        # false: pure-C ARM64 build.  true: assemble the ARMv8 crypto .asm and
+        # enable the matching WOLFSSL_ARMASM code paths.
+        asm: [ false, true ]
+    timeout-minutes: 10
+    env:
+      SOLUTION_FILE_PATH: wolfssl64.sln
+      BUILD_CONFIGURATION: Release
+    steps:
+    - uses: actions/checkout@v5
+
+    - name: Add MSBuild to PATH
+      uses: microsoft/setup-msbuild@v3
+
+    - name: Restore NuGet packages
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      run: nuget restore ${{env.SOLUTION_FILE_PATH}}
+
+    - name: Build
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      run: msbuild /m /p:PlatformToolset=v143 /p:Platform=ARM64 /p:Configuration=${{env.BUILD_CONFIGURATION}} /p:WolfSSLAarch64Asm=${{matrix.asm}} ${{env.SOLUTION_FILE_PATH}}
+
+    - name: Run Test
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      run: Release/ARM64/testsuite.exe
diff --git a/examples/client/client.vcxproj b/examples/client/client.vcxproj
index d6a21467c1..67c3a89b4c 100644
--- a/examples/client/client.vcxproj
+++ b/examples/client/client.vcxproj
@@ -486,6 +486,13 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <!-- Keep WOLFSSL_ARMASM consistent with the library (set by
+       /p:WolfSSLAarch64Asm=true) so struct layouts match. -->
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/examples/echoclient/echoclient.vcxproj b/examples/echoclient/echoclient.vcxproj
index 233b1cdbd2..4adfb1d222 100644
--- a/examples/echoclient/echoclient.vcxproj
+++ b/examples/echoclient/echoclient.vcxproj
@@ -486,6 +486,13 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <!-- Keep WOLFSSL_ARMASM consistent with the library (set by
+       /p:WolfSSLAarch64Asm=true) so struct layouts match. -->
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/examples/echoserver/echoserver.vcxproj b/examples/echoserver/echoserver.vcxproj
index 29f440f56c..ad8b11e133 100644
--- a/examples/echoserver/echoserver.vcxproj
+++ b/examples/echoserver/echoserver.vcxproj
@@ -486,6 +486,13 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <!-- Keep WOLFSSL_ARMASM consistent with the library (set by
+       /p:WolfSSLAarch64Asm=true) so struct layouts match. -->
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/examples/server/server.vcxproj b/examples/server/server.vcxproj
index 9343976a6d..f29a5e3a41 100644
--- a/examples/server/server.vcxproj
+++ b/examples/server/server.vcxproj
@@ -486,6 +486,13 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <!-- Keep WOLFSSL_ARMASM consistent with the library (set by
+       /p:WolfSSLAarch64Asm=true) so struct layouts match. -->
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/sslSniffer/sslSniffer.vcxproj b/sslSniffer/sslSniffer.vcxproj
index 4925b99b83..e4f758ed25 100644
--- a/sslSniffer/sslSniffer.vcxproj
+++ b/sslSniffer/sslSniffer.vcxproj
@@ -264,6 +264,13 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <!-- Keep WOLFSSL_ARMASM consistent with the library (set by
+       /p:WolfSSLAarch64Asm=true) so struct layouts match. -->
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/sslSniffer/sslSnifferTest/sslSniffTest.vcxproj b/sslSniffer/sslSnifferTest/sslSniffTest.vcxproj
index f98f33cc1f..e60a5da82a 100644
--- a/sslSniffer/sslSnifferTest/sslSniffTest.vcxproj
+++ b/sslSniffer/sslSnifferTest/sslSniffTest.vcxproj
@@ -265,6 +265,13 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <!-- Keep WOLFSSL_ARMASM consistent with the library (set by
+       /p:WolfSSLAarch64Asm=true) so struct layouts match. -->
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/testsuite/testsuite.vcxproj b/testsuite/testsuite.vcxproj
index 8bc4242f0a..c01794d93e 100644
--- a/testsuite/testsuite.vcxproj
+++ b/testsuite/testsuite.vcxproj
@@ -492,6 +492,13 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <!-- Keep WOLFSSL_ARMASM consistent with the library (set by
+       /p:WolfSSLAarch64Asm=true) so struct layouts match. -->
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/wolfcrypt/src/cpuid.c b/wolfcrypt/src/cpuid.c
index 807658152b..db9dce5911 100644
--- a/wolfcrypt/src/cpuid.c
+++ b/wolfcrypt/src/cpuid.c
@@ -403,6 +403,73 @@
                 new_cpuid_flags |= CPUID_SM4;
         #endif
 
+            (void)wolfSSL_Atomic_Uint_CompareExchange
+                (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
+        }
+    }
+#elif defined(_WIN32)
+    /* Windows on ARM64.  IsProcessorFeaturePresent() is the documented way to
+     * query instruction-set extensions: NEON (the 32x64-bit VFP register bank),
+     * the mandatory ARMv8 crypto extension (AES / PMULL / SHA-1 / SHA-256,
+     * reported as one feature), and the optional FEAT_SHA3 / FEAT_SHA512
+     * extensions each have their own flag.  FEAT_RDM (SQRDMLSH, ARMv8.1) has no
+     * dedicated flag, so it is gated on the ARMv8.2 dot-product feature. */
+    #include <windows.h>
+
+    /* Older Windows SDKs may not define these processor-feature constants. */
+    #ifndef PF_ARM_VFP_32_REGISTERS_AVAILABLE
+        #define PF_ARM_VFP_32_REGISTERS_AVAILABLE       18
+    #endif
+    #ifndef PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE
+        #define PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE 30
+    #endif
+    #ifndef PF_ARM_SHA3_INSTRUCTIONS_AVAILABLE
+        #define PF_ARM_SHA3_INSTRUCTIONS_AVAILABLE      64
+    #endif
+    #ifndef PF_ARM_SHA512_INSTRUCTIONS_AVAILABLE
+        #define PF_ARM_SHA512_INSTRUCTIONS_AVAILABLE    65
+    #endif
+    /* No dedicated flag for FEAT_RDM (ARMv8.1); gate on ARMv8.2 dot-product -
+     * a CPU reporting v8.2 DP necessarily implements the v8.1 RDM (SQRDMLSH)
+     * instructions the ML-KEM assembly uses. */
+    #ifndef PF_ARM_V82_DP_INSTRUCTIONS_AVAILABLE
+        #define PF_ARM_V82_DP_INSTRUCTIONS_AVAILABLE    43
+    #endif
+
+    static WC_INLINE void cpuid_set_flags(void)
+    {
+        if (WOLFSSL_ATOMIC_LOAD(cpuid_flags) == WC_CPUID_INITIALIZER) {
+            cpuid_flags_t new_cpuid_flags = 0,
+                old_cpuid_flags = WC_CPUID_INITIALIZER;
+
+        #ifndef WOLFSSL_ARMASM_NO_NEON
+            if (IsProcessorFeaturePresent(PF_ARM_VFP_32_REGISTERS_AVAILABLE))
+                new_cpuid_flags |= CPUID_ASIMD;
+        #endif
+        #ifndef WOLFSSL_ARMASM_NO_HW_CRYPTO
+            if (IsProcessorFeaturePresent(
+                    PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE)) {
+                new_cpuid_flags |= CPUID_AES;
+                new_cpuid_flags |= CPUID_PMULL;
+                new_cpuid_flags |= CPUID_SHA256;
+            }
+        #endif
+        #ifdef WOLFSSL_ARMASM_CRYPTO_SHA512
+            if (IsProcessorFeaturePresent(
+                    PF_ARM_SHA512_INSTRUCTIONS_AVAILABLE))
+                new_cpuid_flags |= CPUID_SHA512;
+        #endif
+        #if !defined(WOLFSSL_AARCH64_NO_SQRDMLSH)
+            if (IsProcessorFeaturePresent(
+                    PF_ARM_V82_DP_INSTRUCTIONS_AVAILABLE))
+                new_cpuid_flags |= CPUID_RDM;
+        #endif
+        #ifdef WOLFSSL_ARMASM_CRYPTO_SHA3
+            if (IsProcessorFeaturePresent(
+                    PF_ARM_SHA3_INSTRUCTIONS_AVAILABLE))
+                new_cpuid_flags |= CPUID_SHA3;
+        #endif
+
             (void)wolfSSL_Atomic_Uint_CompareExchange
                 (&cpuid_flags, &old_cpuid_flags, new_cpuid_flags);
         }
diff --git a/wolfcrypt/src/include.am b/wolfcrypt/src/include.am
index dba03978c4..0004fbedec 100644
--- a/wolfcrypt/src/include.am
+++ b/wolfcrypt/src/include.am
@@ -28,6 +28,14 @@ EXTRA_DIST += wolfcrypt/src/sha512_asm.asm
 EXTRA_DIST += wolfcrypt/src/sha3_asm.asm
 EXTRA_DIST += wolfcrypt/src/wc_mlkem_asm.asm
 EXTRA_DIST += wolfcrypt/src/wc_mldsa_asm.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-aes-asm.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-chacha-asm.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-curve25519.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-mlkem-asm.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-poly1305-asm.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-sha256-asm.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-sha3-asm.asm
+EXTRA_DIST += wolfcrypt/src/port/arm/armv8-sha512-asm.asm
 EXTRA_DIST += wolfcrypt/src/wc_dsp.c
 EXTRA_DIST += wolfcrypt/src/sp_dsp32.c
 EXTRA_DIST += wolfcrypt/src/sp_x86_64_asm.asm
diff --git a/wolfcrypt/src/port/arm/armv8-aes-asm.asm b/wolfcrypt/src/port/arm/armv8-aes-asm.asm
new file mode 100644
index 0000000000..d202cded52
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-aes-asm.asm
@@ -0,0 +1,55923 @@
+; /* armv8-aes-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./aes/aes.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-aes-asm.asm
+	IF :LNOT::DEF:NO_AES :LAND: {TRUE}
+	IF :LNOT::DEF:WOLFSSL_ARMASM_NO_HW_CRYPTO
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_set_key_AARCH64
+AES_set_key_AARCH64 PROC
+	cmp	x1, #24
+	blt	L_aes_set_key_arm64_crypto_start_128
+	bgt	L_aes_set_key_arm64_crypto_start_256
+	ldr	x4, [x0], #8
+	ldr	x6, [x0], #8
+	ldr	x8, [x0], #8
+	stp	x4, x6, [x2], #16
+	str	x8, [x2], #8
+	lsr	x5, x4, #32
+	lsr	x7, x6, #32
+	lsr	x9, x8, #32
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #1
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #2
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #4
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #8
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #16
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #32
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #0x40
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	dup	v1.4s, w9
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #0x80
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	cmp	x3, #0
+	beq	L_aes_set_key_arm64_crypto_done
+	sub	x2, x2, #0xd0
+	ldur	q0, [x2]
+	ldur	q1, [x2, #192]
+	stur	q1, [x2]
+	stur	q0, [x2, #192]
+	ldur	q0, [x2, #16]
+	ldur	q1, [x2, #176]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #16]
+	stur	q0, [x2, #176]
+	ldur	q0, [x2, #32]
+	ldur	q1, [x2, #160]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #32]
+	stur	q0, [x2, #160]
+	ldur	q0, [x2, #48]
+	ldur	q1, [x2, #144]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #48]
+	stur	q0, [x2, #144]
+	ldur	q0, [x2, #64]
+	ldur	q1, [x2, #128]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #64]
+	stur	q0, [x2, #128]
+	ldur	q0, [x2, #80]
+	ldur	q1, [x2, #112]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #80]
+	stur	q0, [x2, #112]
+	ldur	q0, [x2, #96]
+	aesimc	v0.16b, v0.16b
+	stur	q0, [x2, #96]
+	b	L_aes_set_key_arm64_crypto_done
+L_aes_set_key_arm64_crypto_start_256
+	ldr	x4, [x0], #8
+	ldr	x6, [x0], #8
+	ldr	x8, [x0], #8
+	ldr	x10, [x0], #8
+	stp	x4, x6, [x2], #16
+	stp	x8, x10, [x2], #16
+	lsr	x5, x4, #32
+	lsr	x7, x6, #32
+	lsr	x9, x8, #32
+	lsr	x11, x10, #32
+	dup	v1.4s, w11
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #1
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	eor	w8, w8, w12
+	eor	w9, w9, w8
+	eor	w10, w10, w9
+	eor	w11, w11, w10
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	stp	w10, w11, [x2], #8
+	dup	v1.4s, w11
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #2
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	eor	w8, w8, w12
+	eor	w9, w9, w8
+	eor	w10, w10, w9
+	eor	w11, w11, w10
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	stp	w10, w11, [x2], #8
+	dup	v1.4s, w11
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #4
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	eor	w8, w8, w12
+	eor	w9, w9, w8
+	eor	w10, w10, w9
+	eor	w11, w11, w10
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	stp	w10, w11, [x2], #8
+	dup	v1.4s, w11
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #8
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	eor	w8, w8, w12
+	eor	w9, w9, w8
+	eor	w10, w10, w9
+	eor	w11, w11, w10
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	stp	w10, w11, [x2], #8
+	dup	v1.4s, w11
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #16
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	eor	w8, w8, w12
+	eor	w9, w9, w8
+	eor	w10, w10, w9
+	eor	w11, w11, w10
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	stp	w10, w11, [x2], #8
+	dup	v1.4s, w11
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #32
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	eor	w8, w8, w12
+	eor	w9, w9, w8
+	eor	w10, w10, w9
+	eor	w11, w11, w10
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	stp	w10, w11, [x2], #8
+	dup	v1.4s, w11
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #0x40
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	cmp	x3, #0
+	beq	L_aes_set_key_arm64_crypto_done
+	sub	x2, x2, #0xf0
+	ldur	q0, [x2]
+	ldur	q1, [x2, #224]
+	stur	q1, [x2]
+	stur	q0, [x2, #224]
+	ldur	q0, [x2, #16]
+	ldur	q1, [x2, #208]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #16]
+	stur	q0, [x2, #208]
+	ldur	q0, [x2, #32]
+	ldur	q1, [x2, #192]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #32]
+	stur	q0, [x2, #192]
+	ldur	q0, [x2, #48]
+	ldur	q1, [x2, #176]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #48]
+	stur	q0, [x2, #176]
+	ldur	q0, [x2, #64]
+	ldur	q1, [x2, #160]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #64]
+	stur	q0, [x2, #160]
+	ldur	q0, [x2, #80]
+	ldur	q1, [x2, #144]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #80]
+	stur	q0, [x2, #144]
+	ldur	q0, [x2, #96]
+	ldur	q1, [x2, #128]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #96]
+	stur	q0, [x2, #128]
+	ldur	q0, [x2, #112]
+	aesimc	v0.16b, v0.16b
+	stur	q0, [x2, #112]
+	b	L_aes_set_key_arm64_crypto_done
+L_aes_set_key_arm64_crypto_start_128
+	ldr	x4, [x0], #8
+	ldr	x6, [x0], #8
+	stp	x4, x6, [x2], #16
+	lsr	x5, x4, #32
+	lsr	x7, x6, #32
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #1
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #2
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #4
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #8
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #16
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #32
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #0x40
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	ror	w12, w12, #8
+	eor	w4, w4, #0x80
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	mov	w13, #27
+	ror	w12, w12, #8
+	eor	w4, w4, w13
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	dup	v1.4s, w7
+	movi	v0.16b, #0
+	aese	v0.16b, v1.16b
+	mov	w12, v0.s[0]
+	mov	w13, #54
+	ror	w12, w12, #8
+	eor	w4, w4, w13
+	eor	w4, w4, w12
+	eor	w5, w5, w4
+	eor	w6, w6, w5
+	eor	w7, w7, w6
+	stp	w4, w5, [x2], #8
+	stp	w6, w7, [x2], #8
+	cmp	x3, #0
+	beq	L_aes_set_key_arm64_crypto_done
+	sub	x2, x2, #0xb0
+	ldur	q0, [x2]
+	ldur	q1, [x2, #160]
+	stur	q1, [x2]
+	stur	q0, [x2, #160]
+	ldur	q0, [x2, #16]
+	ldur	q1, [x2, #144]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #16]
+	stur	q0, [x2, #144]
+	ldur	q0, [x2, #32]
+	ldur	q1, [x2, #128]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #32]
+	stur	q0, [x2, #128]
+	ldur	q0, [x2, #48]
+	ldur	q1, [x2, #112]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #48]
+	stur	q0, [x2, #112]
+	ldur	q0, [x2, #64]
+	ldur	q1, [x2, #96]
+	aesimc	v0.16b, v0.16b
+	aesimc	v1.16b, v1.16b
+	stur	q1, [x2, #64]
+	stur	q0, [x2, #96]
+	ldur	q0, [x2, #80]
+	aesimc	v0.16b, v0.16b
+	stur	q0, [x2, #80]
+L_aes_set_key_arm64_crypto_done
+	ret
+	ENDP
+	IF :DEF:HAVE_AESCCM :LOR: :DEF:HAVE_AESGCM :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER :LOR: :DEF:HAVE_AES_CBC
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_encrypt_AARCH64
+AES_encrypt_AARCH64 PROC
+	ld1	{v0.16b}, [x0]
+	ld1	{v1.2d, v2.2d, v3.2d, v4.2d}, [x2], #0x40
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v3.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v4.16b
+	aesmc	v0.16b, v0.16b
+	ld1	{v1.2d, v2.2d, v3.2d, v4.2d}, [x2], #0x40
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v3.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v4.16b
+	aesmc	v0.16b, v0.16b
+	subs	w3, w3, #10
+	ld1	{v1.2d, v2.2d}, [x2], #32
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	beq	L_aes_encrypt_arm64_crypto_round_done
+	ld1	{v1.2d, v2.2d}, [x2], #32
+	subs	w3, w3, #2
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	beq	L_aes_encrypt_arm64_crypto_round_done
+	ld1	{v1.2d, v2.2d}, [x2], #32
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+L_aes_encrypt_arm64_crypto_round_done
+	ld1	{v1.2d}, [x2]
+	eor	v0.16b, v0.16b, v1.16b
+	st1	{v0.16b}, [x1]
+	ret
+	ENDP
+	ENDIF
+	IF :LNOT::DEF:WC_AES_BITSLICED :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_decrypt_AARCH64
+AES_decrypt_AARCH64 PROC
+	ld1	{v0.16b}, [x0]
+	ld1	{v1.2d, v2.2d, v3.2d, v4.2d}, [x2], #0x40
+	aesd	v0.16b, v1.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v2.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v3.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v4.16b
+	aesimc	v0.16b, v0.16b
+	ld1	{v1.2d, v2.2d, v3.2d, v4.2d}, [x2], #0x40
+	aesd	v0.16b, v1.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v2.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v3.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v4.16b
+	aesimc	v0.16b, v0.16b
+	ld1	{v1.2d, v2.2d}, [x2], #32
+	aesd	v0.16b, v1.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v2.16b
+	subs	w3, w3, #10
+	beq	L_aes_decrypt_arm64_crypto_round_done
+	ld1	{v1.2d, v2.2d}, [x2], #32
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v1.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v2.16b
+	subs	w3, w3, #2
+	beq	L_aes_decrypt_arm64_crypto_round_done
+	ld1	{v1.2d, v2.2d}, [x2], #32
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v1.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v2.16b
+L_aes_decrypt_arm64_crypto_round_done
+	ld1	{v1.2d}, [x2]
+	eor	v0.16b, v0.16b, v1.16b
+	st1	{v0.16b}, [x1]
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	IF :DEF:HAVE_AES_ECB
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_encrypt_blocks_AARCH64
+AES_encrypt_blocks_AARCH64 PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x3], #0x40
+	ld1	{v24.2d, v25.2d, v26.2d}, [x3], #48
+	lsr	w2, w2, #4
+	cmp	w4, #12
+	blt	L_aes_encrypt_blocks_arm64_crypto_start_128
+	bgt	L_aes_encrypt_blocks_arm64_crypto_start_256
+	; AES_ECB_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{v27.2d, v28.2d}, [x3], #32
+	cmp	w2, #1
+	beq	L_aes_encrypt_blocks_arm64_crypto_192_start_1
+	cmp	w2, #8
+	blt	L_aes_encrypt_blocks_arm64_crypto_192_start_4
+L_aes_encrypt_blocks_arm64_crypto_192_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v16.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v16.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v16.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v17.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v17.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v17.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v18.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v18.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v18.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v19.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v19.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v19.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v20.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v20.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v20.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v21.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v21.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v21.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v22.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v22.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v22.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v23.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v23.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v23.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v24.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v24.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v24.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v25.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v25.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v25.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v25.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v25.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v25.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v26.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v26.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v26.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v26.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v26.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v26.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aese	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	aese	v2.16b, v27.16b
+	eor	v2.16b, v2.16b, v28.16b
+	aese	v3.16b, v27.16b
+	eor	v3.16b, v3.16b, v28.16b
+	aese	v4.16b, v27.16b
+	eor	v4.16b, v4.16b, v28.16b
+	aese	v5.16b, v27.16b
+	eor	v5.16b, v5.16b, v28.16b
+	aese	v6.16b, v27.16b
+	eor	v6.16b, v6.16b, v28.16b
+	aese	v7.16b, v27.16b
+	eor	v7.16b, v7.16b, v28.16b
+	sub	w2, w2, #8
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	st1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	cmp	w2, #8
+	bge	L_aes_encrypt_blocks_arm64_crypto_192_start_8
+L_aes_encrypt_blocks_arm64_crypto_192_start_4
+	cmp	w2, #4
+	blt	L_aes_encrypt_blocks_arm64_crypto_192_start_2
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v25.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v25.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v26.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v26.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aese	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	aese	v2.16b, v27.16b
+	eor	v2.16b, v2.16b, v28.16b
+	aese	v3.16b, v27.16b
+	eor	v3.16b, v3.16b, v28.16b
+	sub	w2, w2, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+L_aes_encrypt_blocks_arm64_crypto_192_start_2
+	cmp	w2, #2
+	blt	L_aes_encrypt_blocks_arm64_crypto_192_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aese	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	sub	w2, w2, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_encrypt_blocks_arm64_crypto_192_start_1
+	cbz	w2, L_aes_encrypt_blocks_arm64_crypto_192_done
+	ld1	{v0.16b}, [x0], #16
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	st1	{v0.16b}, [x1], #16
+L_aes_encrypt_blocks_arm64_crypto_192_done
+	ENDIF
+	b	L_aes_encrypt_blocks_arm64_crypto_done
+	; AES_ECB_256
+L_aes_encrypt_blocks_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{v27.2d, v28.2d, v29.2d, v30.2d}, [x3], #0x40
+	cmp	w2, #1
+	beq	L_aes_encrypt_blocks_arm64_crypto_256_start_1
+	cmp	w2, #8
+	blt	L_aes_encrypt_blocks_arm64_crypto_256_start_4
+L_aes_encrypt_blocks_arm64_crypto_256_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v16.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v16.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v16.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v17.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v17.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v17.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v18.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v18.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v18.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v19.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v19.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v19.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v20.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v20.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v20.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v21.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v21.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v21.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v22.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v22.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v22.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v23.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v23.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v23.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v24.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v24.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v24.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v25.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v25.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v25.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v25.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v25.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v25.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v26.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v26.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v26.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v26.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v26.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v26.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v27.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v27.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v27.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v27.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v27.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v27.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v27.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v28.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v28.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v28.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v28.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v28.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v28.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v28.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aese	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	aese	v2.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	aese	v3.16b, v29.16b
+	eor	v3.16b, v3.16b, v30.16b
+	aese	v4.16b, v29.16b
+	eor	v4.16b, v4.16b, v30.16b
+	aese	v5.16b, v29.16b
+	eor	v5.16b, v5.16b, v30.16b
+	aese	v6.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	aese	v7.16b, v29.16b
+	eor	v7.16b, v7.16b, v30.16b
+	sub	w2, w2, #8
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	st1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	cmp	w2, #8
+	bge	L_aes_encrypt_blocks_arm64_crypto_256_start_8
+L_aes_encrypt_blocks_arm64_crypto_256_start_4
+	cmp	w2, #4
+	blt	L_aes_encrypt_blocks_arm64_crypto_256_start_2
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v25.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v25.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v26.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v26.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v27.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v27.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v27.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v28.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v28.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v28.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aese	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	aese	v2.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	aese	v3.16b, v29.16b
+	eor	v3.16b, v3.16b, v30.16b
+	sub	w2, w2, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+L_aes_encrypt_blocks_arm64_crypto_256_start_2
+	cmp	w2, #2
+	blt	L_aes_encrypt_blocks_arm64_crypto_256_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v27.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v28.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aese	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	sub	w2, w2, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_encrypt_blocks_arm64_crypto_256_start_1
+	cbz	w2, L_aes_encrypt_blocks_arm64_crypto_256_done
+	ld1	{v0.16b}, [x0], #16
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	st1	{v0.16b}, [x1], #16
+L_aes_encrypt_blocks_arm64_crypto_256_done
+	ENDIF
+	b	L_aes_encrypt_blocks_arm64_crypto_done
+	; AES_ECB_128
+L_aes_encrypt_blocks_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w2, #1
+	beq	L_aes_encrypt_blocks_arm64_crypto_128_start_1
+	cmp	w2, #8
+	blt	L_aes_encrypt_blocks_arm64_crypto_128_start_4
+L_aes_encrypt_blocks_arm64_crypto_128_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v16.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v16.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v16.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v17.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v17.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v17.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v18.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v18.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v18.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v19.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v19.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v19.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v20.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v20.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v20.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v21.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v21.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v21.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v22.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v22.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v22.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v23.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v23.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v23.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v5.16b, v24.16b
+	aesmc	v5.16b, v5.16b
+	aese	v6.16b, v24.16b
+	aesmc	v6.16b, v6.16b
+	aese	v7.16b, v24.16b
+	aesmc	v7.16b, v7.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aese	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	aese	v2.16b, v25.16b
+	eor	v2.16b, v2.16b, v26.16b
+	aese	v3.16b, v25.16b
+	eor	v3.16b, v3.16b, v26.16b
+	aese	v4.16b, v25.16b
+	eor	v4.16b, v4.16b, v26.16b
+	aese	v5.16b, v25.16b
+	eor	v5.16b, v5.16b, v26.16b
+	aese	v6.16b, v25.16b
+	eor	v6.16b, v6.16b, v26.16b
+	aese	v7.16b, v25.16b
+	eor	v7.16b, v7.16b, v26.16b
+	sub	w2, w2, #8
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	st1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	cmp	w2, #8
+	bge	L_aes_encrypt_blocks_arm64_crypto_128_start_8
+L_aes_encrypt_blocks_arm64_crypto_128_start_4
+	cmp	w2, #4
+	blt	L_aes_encrypt_blocks_arm64_crypto_128_start_2
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aese	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	aese	v2.16b, v25.16b
+	eor	v2.16b, v2.16b, v26.16b
+	aese	v3.16b, v25.16b
+	eor	v3.16b, v3.16b, v26.16b
+	sub	w2, w2, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+L_aes_encrypt_blocks_arm64_crypto_128_start_2
+	cmp	w2, #2
+	blt	L_aes_encrypt_blocks_arm64_crypto_128_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aese	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	sub	w2, w2, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_encrypt_blocks_arm64_crypto_128_start_1
+	cbz	w2, L_aes_encrypt_blocks_arm64_crypto_128_done
+	ld1	{v0.16b}, [x0], #16
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	st1	{v0.16b}, [x1], #16
+L_aes_encrypt_blocks_arm64_crypto_128_done
+	ENDIF
+L_aes_encrypt_blocks_arm64_crypto_done
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_decrypt_blocks_AARCH64
+AES_decrypt_blocks_AARCH64 PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x3], #0x40
+	ld1	{v24.2d, v25.2d, v26.2d}, [x3], #48
+	lsr	w2, w2, #4
+	cmp	w4, #12
+	blt	L_aes_decrypt_blocks_arm64_crypto_start_128
+	bgt	L_aes_decrypt_blocks_arm64_crypto_start_256
+	; AES_ECB_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{v27.2d, v28.2d}, [x3], #32
+	cmp	w2, #1
+	beq	L_aes_decrypt_blocks_arm64_crypto_192_start_1
+	cmp	w2, #8
+	blt	L_aes_decrypt_blocks_arm64_crypto_192_start_4
+L_aes_decrypt_blocks_arm64_crypto_192_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v16.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v16.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v16.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v16.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v17.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v17.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v17.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v17.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v18.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v18.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v18.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v18.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v19.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v19.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v19.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v19.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v20.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v20.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v20.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v20.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v21.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v21.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v21.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v21.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v22.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v22.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v22.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v22.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v23.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v23.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v23.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v23.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v24.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v24.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v24.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v24.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v25.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v25.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v25.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v25.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v25.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v25.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v26.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v26.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v26.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v26.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v26.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v26.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aesd	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	aesd	v2.16b, v27.16b
+	eor	v2.16b, v2.16b, v28.16b
+	aesd	v3.16b, v27.16b
+	eor	v3.16b, v3.16b, v28.16b
+	aesd	v4.16b, v27.16b
+	eor	v4.16b, v4.16b, v28.16b
+	aesd	v5.16b, v27.16b
+	eor	v5.16b, v5.16b, v28.16b
+	aesd	v6.16b, v27.16b
+	eor	v6.16b, v6.16b, v28.16b
+	aesd	v7.16b, v27.16b
+	eor	v7.16b, v7.16b, v28.16b
+	sub	w2, w2, #8
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	st1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	cmp	w2, #8
+	bge	L_aes_decrypt_blocks_arm64_crypto_192_start_8
+L_aes_decrypt_blocks_arm64_crypto_192_start_4
+	cmp	w2, #4
+	blt	L_aes_decrypt_blocks_arm64_crypto_192_start_2
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v25.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v25.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v26.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v26.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aesd	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	aesd	v2.16b, v27.16b
+	eor	v2.16b, v2.16b, v28.16b
+	aesd	v3.16b, v27.16b
+	eor	v3.16b, v3.16b, v28.16b
+	sub	w2, w2, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+L_aes_decrypt_blocks_arm64_crypto_192_start_2
+	cmp	w2, #2
+	blt	L_aes_decrypt_blocks_arm64_crypto_192_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aesd	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	sub	w2, w2, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_decrypt_blocks_arm64_crypto_192_start_1
+	cbz	w2, L_aes_decrypt_blocks_arm64_crypto_192_done
+	ld1	{v0.16b}, [x0], #16
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	st1	{v0.16b}, [x1], #16
+L_aes_decrypt_blocks_arm64_crypto_192_done
+	ENDIF
+	b	L_aes_decrypt_blocks_arm64_crypto_done
+	; AES_ECB_256
+L_aes_decrypt_blocks_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{v27.2d, v28.2d, v29.2d, v30.2d}, [x3], #0x40
+	cmp	w2, #1
+	beq	L_aes_decrypt_blocks_arm64_crypto_256_start_1
+	cmp	w2, #8
+	blt	L_aes_decrypt_blocks_arm64_crypto_256_start_4
+L_aes_decrypt_blocks_arm64_crypto_256_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v16.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v16.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v16.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v16.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v17.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v17.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v17.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v17.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v18.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v18.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v18.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v18.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v19.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v19.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v19.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v19.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v20.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v20.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v20.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v20.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v21.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v21.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v21.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v21.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v22.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v22.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v22.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v22.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v23.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v23.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v23.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v23.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v24.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v24.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v24.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v24.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v25.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v25.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v25.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v25.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v25.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v25.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v26.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v26.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v26.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v26.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v26.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v26.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v27.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v27.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v27.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v27.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v27.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v27.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v27.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v28.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v28.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v28.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v28.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v28.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v28.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v28.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aesd	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	aesd	v2.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	aesd	v3.16b, v29.16b
+	eor	v3.16b, v3.16b, v30.16b
+	aesd	v4.16b, v29.16b
+	eor	v4.16b, v4.16b, v30.16b
+	aesd	v5.16b, v29.16b
+	eor	v5.16b, v5.16b, v30.16b
+	aesd	v6.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	aesd	v7.16b, v29.16b
+	eor	v7.16b, v7.16b, v30.16b
+	sub	w2, w2, #8
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	st1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	cmp	w2, #8
+	bge	L_aes_decrypt_blocks_arm64_crypto_256_start_8
+L_aes_decrypt_blocks_arm64_crypto_256_start_4
+	cmp	w2, #4
+	blt	L_aes_decrypt_blocks_arm64_crypto_256_start_2
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v25.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v25.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v26.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v26.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v27.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v27.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v27.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v28.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v28.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v28.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aesd	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	aesd	v2.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	aesd	v3.16b, v29.16b
+	eor	v3.16b, v3.16b, v30.16b
+	sub	w2, w2, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+L_aes_decrypt_blocks_arm64_crypto_256_start_2
+	cmp	w2, #2
+	blt	L_aes_decrypt_blocks_arm64_crypto_256_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v27.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v28.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aesd	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	sub	w2, w2, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_decrypt_blocks_arm64_crypto_256_start_1
+	cbz	w2, L_aes_decrypt_blocks_arm64_crypto_256_done
+	ld1	{v0.16b}, [x0], #16
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	st1	{v0.16b}, [x1], #16
+L_aes_decrypt_blocks_arm64_crypto_256_done
+	ENDIF
+	b	L_aes_decrypt_blocks_arm64_crypto_done
+	; AES_ECB_128
+L_aes_decrypt_blocks_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w2, #1
+	beq	L_aes_decrypt_blocks_arm64_crypto_128_start_1
+	cmp	w2, #8
+	blt	L_aes_decrypt_blocks_arm64_crypto_128_start_4
+L_aes_decrypt_blocks_arm64_crypto_128_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v16.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v16.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v16.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v16.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v17.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v17.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v17.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v17.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v18.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v18.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v18.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v18.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v19.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v19.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v19.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v19.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v20.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v20.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v20.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v20.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v21.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v21.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v21.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v21.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v22.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v22.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v22.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v22.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v23.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v23.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v23.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v23.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v4.16b, v24.16b
+	aesimc	v4.16b, v4.16b
+	aesd	v5.16b, v24.16b
+	aesimc	v5.16b, v5.16b
+	aesd	v6.16b, v24.16b
+	aesimc	v6.16b, v6.16b
+	aesd	v7.16b, v24.16b
+	aesimc	v7.16b, v7.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aesd	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	aesd	v2.16b, v25.16b
+	eor	v2.16b, v2.16b, v26.16b
+	aesd	v3.16b, v25.16b
+	eor	v3.16b, v3.16b, v26.16b
+	aesd	v4.16b, v25.16b
+	eor	v4.16b, v4.16b, v26.16b
+	aesd	v5.16b, v25.16b
+	eor	v5.16b, v5.16b, v26.16b
+	aesd	v6.16b, v25.16b
+	eor	v6.16b, v6.16b, v26.16b
+	aesd	v7.16b, v25.16b
+	eor	v7.16b, v7.16b, v26.16b
+	sub	w2, w2, #8
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	st1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	cmp	w2, #8
+	bge	L_aes_decrypt_blocks_arm64_crypto_128_start_8
+L_aes_decrypt_blocks_arm64_crypto_128_start_4
+	cmp	w2, #4
+	blt	L_aes_decrypt_blocks_arm64_crypto_128_start_2
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aesd	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	aesd	v2.16b, v25.16b
+	eor	v2.16b, v2.16b, v26.16b
+	aesd	v3.16b, v25.16b
+	eor	v3.16b, v3.16b, v26.16b
+	sub	w2, w2, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+L_aes_decrypt_blocks_arm64_crypto_128_start_2
+	cmp	w2, #2
+	blt	L_aes_decrypt_blocks_arm64_crypto_128_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aesd	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	sub	w2, w2, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_decrypt_blocks_arm64_crypto_128_start_1
+	cbz	w2, L_aes_decrypt_blocks_arm64_crypto_128_done
+	ld1	{v0.16b}, [x0], #16
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	st1	{v0.16b}, [x1], #16
+L_aes_decrypt_blocks_arm64_crypto_128_done
+	ENDIF
+L_aes_decrypt_blocks_arm64_crypto_done
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	IF :DEF:HAVE_AES_CBC
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CBC_encrypt_AARCH64
+AES_CBC_encrypt_AARCH64 PROC
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v0.2d}, [x3]
+	subs	w5, w5, #12
+	lsr	w2, w2, #4
+	blt	L_aes_cbc_encrypt_arm64_crypto_start_128
+	bgt	L_aes_cbc_encrypt_arm64_crypto_start_256
+	; AES_CBC_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+L_aes_cbc_encrypt_arm64_crypto_loop_192
+	ld1	{v28.2d}, [x4]
+	ld1	{v1.16b}, [x0], #16
+	subs	w2, w2, #1
+	eor	v0.16b, v0.16b, v1.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	st1	{v0.16b}, [x1], #16
+	bne	L_aes_cbc_encrypt_arm64_crypto_loop_192
+	ENDIF
+	b	L_aes_cbc_encrypt_arm64_crypto_done
+	; AES_CBC_256
+L_aes_cbc_encrypt_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+	ld1	{v28.2d, v29.2d}, [x4], #32
+L_aes_cbc_encrypt_arm64_crypto_loop_256
+	ld1	{v30.2d}, [x4]
+	ld1	{v1.16b}, [x0], #16
+	subs	w2, w2, #1
+	eor	v0.16b, v0.16b, v1.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	st1	{v0.16b}, [x1], #16
+	bne	L_aes_cbc_encrypt_arm64_crypto_loop_256
+	ENDIF
+	b	L_aes_cbc_encrypt_arm64_crypto_done
+	; AES_CBC_128
+L_aes_cbc_encrypt_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	ld1	{v24.2d, v25.2d}, [x4], #32
+L_aes_cbc_encrypt_arm64_crypto_loop_128
+	ld1	{v26.2d}, [x4]
+	ld1	{v1.16b}, [x0], #16
+	subs	w2, w2, #1
+	eor	v0.16b, v0.16b, v1.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	st1	{v0.16b}, [x1], #16
+	bne	L_aes_cbc_encrypt_arm64_crypto_loop_128
+	ENDIF
+L_aes_cbc_encrypt_arm64_crypto_done
+	st1	{v0.2d}, [x3]
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CBC_decrypt_AARCH64
+AES_CBC_decrypt_AARCH64 PROC
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v0.2d}, [x3]
+	lsr	w2, w2, #4
+	cmp	w5, #12
+	blt	L_aes_cbc_decrypt_blocks_arm64_crypto_start_128
+	bgt	L_aes_cbc_decrypt_blocks_arm64_crypto_start_256
+	; AES_CBC_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+	ld1	{v28.2d}, [x4]
+	cmp	w2, #10
+	ble	L_aes_cbc_decrypt_blocks_arm64_crypto_192_start_1
+L_aes_cbc_decrypt_blocks_arm64_crypto_192_start_1_long
+	ld1	{v1.16b}, [x0], #16
+	sub	w2, w2, #1
+	mov	v2.16b, v1.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v1.16b, v1.16b, v0.16b
+	mov	v0.16b, v2.16b
+	st1	{v1.16b}, [x1], #16
+	cmp	w2, #1
+	bge	L_aes_cbc_decrypt_blocks_arm64_crypto_192_start_1_long
+	b	L_aes_cbc_decrypt_blocks_arm64_crypto_done
+L_aes_cbc_decrypt_blocks_arm64_crypto_192_start_1
+	ld1	{v1.16b}, [x0], #16
+	sub	w2, w2, #1
+	eor	v2.16b, v0.16b, v28.16b
+	mov	v0.16b, v1.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v2.16b
+	st1	{v1.16b}, [x1], #16
+	cmp	w2, #1
+	bge	L_aes_cbc_decrypt_blocks_arm64_crypto_192_start_1
+	ENDIF
+	b	L_aes_cbc_decrypt_blocks_arm64_crypto_done
+	; AES_CBC_256
+L_aes_cbc_decrypt_blocks_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+	ld1	{v28.2d, v29.2d}, [x4], #32
+	ld1	{v30.2d}, [x4]
+	cmp	w2, #5
+	ble	L_aes_cbc_decrypt_blocks_arm64_crypto_256_start_1
+L_aes_cbc_decrypt_blocks_arm64_crypto_256_start_1_long
+	ld1	{v1.16b}, [x0], #16
+	sub	w2, w2, #1
+	mov	v2.16b, v1.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v27.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v28.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	eor	v1.16b, v1.16b, v0.16b
+	mov	v0.16b, v2.16b
+	st1	{v1.16b}, [x1], #16
+	cmp	w2, #1
+	bge	L_aes_cbc_decrypt_blocks_arm64_crypto_256_start_1_long
+	b	L_aes_cbc_decrypt_blocks_arm64_crypto_done
+L_aes_cbc_decrypt_blocks_arm64_crypto_256_start_1
+	ld1	{v1.16b}, [x0], #16
+	sub	w2, w2, #1
+	eor	v2.16b, v0.16b, v30.16b
+	mov	v0.16b, v1.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v27.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v28.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v2.16b
+	st1	{v1.16b}, [x1], #16
+	cmp	w2, #1
+	bge	L_aes_cbc_decrypt_blocks_arm64_crypto_256_start_1
+	ENDIF
+	b	L_aes_cbc_decrypt_blocks_arm64_crypto_done
+	; AES_CBC_128
+L_aes_cbc_decrypt_blocks_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	ld1	{v24.2d, v25.2d}, [x4], #32
+	ld1	{v26.2d}, [x4]
+	cmp	w2, #24
+	ble	L_aes_cbc_decrypt_blocks_arm64_crypto_128_start_1
+L_aes_cbc_decrypt_blocks_arm64_crypto_128_start_1_long
+	ld1	{v1.16b}, [x0], #16
+	sub	w2, w2, #1
+	mov	v2.16b, v1.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	eor	v1.16b, v1.16b, v0.16b
+	mov	v0.16b, v2.16b
+	st1	{v1.16b}, [x1], #16
+	cmp	w2, #1
+	bge	L_aes_cbc_decrypt_blocks_arm64_crypto_128_start_1_long
+	b	L_aes_cbc_decrypt_blocks_arm64_crypto_done
+L_aes_cbc_decrypt_blocks_arm64_crypto_128_start_1
+	ld1	{v1.16b}, [x0], #16
+	sub	w2, w2, #1
+	eor	v2.16b, v0.16b, v26.16b
+	mov	v0.16b, v1.16b
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v2.16b
+	st1	{v1.16b}, [x1], #16
+	cmp	w2, #1
+	bge	L_aes_cbc_decrypt_blocks_arm64_crypto_128_start_1
+	ENDIF
+L_aes_cbc_decrypt_blocks_arm64_crypto_done
+	st1	{v0.2d}, [x3]
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	IF :DEF:WOLFSSL_AES_COUNTER
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CTR_encrypt_AARCH64
+AES_CTR_encrypt_AARCH64 PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	stp	x22, x23, [x29, #48]
+	stp	x24, x25, [x29, #64]
+	stp	d8, d9, [x29, #80]
+	stp	d10, d11, [x29, #96]
+	stp	d12, d13, [x29, #112]
+	stp	d14, d15, [x29, #128]
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x4], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x4], #0x40
+	ld1	{v15.2d}, [x3]
+	rev64	v16.16b, v15.16b
+	lsr	w8, w2, #4
+	and	w2, w2, #15
+	mov	x9, v16.d[1]
+	mov	x10, v16.d[0]
+	cmp	w7, #12
+	blt	L_aes_ctr_encrypt_arm64_crypto_start_128
+	bgt	L_aes_ctr_encrypt_arm64_crypto_start_256
+	; AES_CTR_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x4], #0x40
+	ld1	{v12.2d}, [x4]
+	cmp	w8, #1
+	ble	L_aes_ctr_encrypt_arm64_crypto_192_start_1
+	adds	x11, x9, #1
+	adc	x12, x10, xzr
+	cmp	w8, #8
+	blt	L_aes_ctr_encrypt_arm64_crypto_192_start_4
+	adds	x13, x9, #2
+	adc	x14, x10, xzr
+	adds	x15, x9, #3
+	adc	x16, x10, xzr
+L_aes_ctr_encrypt_arm64_crypto_192_start_8
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x0], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x0], #0x40
+	mov	v17.d[0], x12
+	mov	v17.d[1], x11
+	mov	v18.d[0], x14
+	mov	v18.d[1], x13
+	adds	x17, x9, #4
+	mov	v19.d[0], x16
+	adc	x19, x10, xzr
+	mov	v19.d[1], x15
+	adds	x20, x9, #5
+	mov	v20.d[0], x19
+	adc	x21, x10, xzr
+	mov	v20.d[1], x17
+	adds	x22, x9, #6
+	mov	v21.d[0], x21
+	adc	x23, x10, xzr
+	mov	v21.d[1], x20
+	adds	x24, x9, #7
+	mov	v22.d[0], x23
+	adc	x25, x10, xzr
+	mov	v22.d[1], x22
+	mov	v23.d[0], x25
+	mov	v23.d[1], x24
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	rev64	v18.16b, v18.16b
+	rev64	v19.16b, v19.16b
+	rev64	v20.16b, v20.16b
+	rev64	v21.16b, v21.16b
+	rev64	v22.16b, v22.16b
+	rev64	v23.16b, v23.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v0.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v0.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v0.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v0.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v0.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v0.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v1.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v1.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v1.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v1.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v1.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v1.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v2.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v2.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v2.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v2.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v2.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v2.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v3.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v3.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v3.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v3.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v3.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v3.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v4.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v4.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v4.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v4.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v4.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v4.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v5.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v5.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v5.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v5.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v5.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v5.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v6.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v6.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v6.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v6.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v6.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v6.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v7.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v7.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v7.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v7.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v7.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v7.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v8.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v8.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v8.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v8.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v8.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v8.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v9.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v9.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v9.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v9.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v9.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v9.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v10.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v10.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v10.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v10.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v10.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v10.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v18.16b, v11.16b
+	eor	v18.16b, v18.16b, v12.16b
+	aese	v19.16b, v11.16b
+	eor	v19.16b, v19.16b, v12.16b
+	aese	v20.16b, v11.16b
+	eor	v20.16b, v20.16b, v12.16b
+	aese	v21.16b, v11.16b
+	eor	v21.16b, v21.16b, v12.16b
+	aese	v22.16b, v11.16b
+	eor	v22.16b, v22.16b, v12.16b
+	aese	v23.16b, v11.16b
+	eor	v23.16b, v23.16b, v12.16b
+	adds	x9, x9, #8
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	adds	x11, x11, #8
+	eor	v26.16b, v26.16b, v18.16b
+	adc	x12, x12, xzr
+	eor	v27.16b, v27.16b, v19.16b
+	adds	x13, x13, #8
+	eor	v28.16b, v28.16b, v20.16b
+	adc	x14, x14, xzr
+	eor	v29.16b, v29.16b, v21.16b
+	adds	x15, x15, #8
+	eor	v30.16b, v30.16b, v22.16b
+	adc	x16, x16, xzr
+	eor	v31.16b, v31.16b, v23.16b
+	sub	w8, w8, #8
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	st1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x1], #0x40
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+	cmp	w8, #8
+	bge	L_aes_ctr_encrypt_arm64_crypto_192_start_8
+L_aes_ctr_encrypt_arm64_crypto_192_start_4
+	cmp	w8, #4
+	blt	L_aes_ctr_encrypt_arm64_crypto_192_start_2
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x0], #0x40
+	adds	x13, x9, #2
+	mov	v17.d[0], x12
+	adc	x14, x10, xzr
+	mov	v17.d[1], x11
+	adds	x15, x9, #3
+	mov	v18.d[0], x14
+	adc	x16, x10, xzr
+	mov	v18.d[1], x13
+	mov	v19.d[0], x16
+	mov	v19.d[1], x15
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	rev64	v18.16b, v18.16b
+	rev64	v19.16b, v19.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v0.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v0.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v1.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v1.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v2.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v2.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v3.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v3.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v4.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v4.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v5.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v5.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v6.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v6.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v7.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v7.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v8.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v8.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v9.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v9.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v10.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v10.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v18.16b, v11.16b
+	eor	v18.16b, v18.16b, v12.16b
+	aese	v19.16b, v11.16b
+	eor	v19.16b, v19.16b, v12.16b
+	adds	x9, x9, #4
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	adds	x11, x11, #4
+	eor	v26.16b, v26.16b, v18.16b
+	adc	x12, x12, xzr
+	eor	v27.16b, v27.16b, v19.16b
+	sub	w8, w8, #4
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+L_aes_ctr_encrypt_arm64_crypto_192_start_2
+	cmp	w8, #2
+	blt	L_aes_ctr_encrypt_arm64_crypto_192_start_1
+	ld1	{v24.16b, v25.16b}, [x0], #32
+	eor	v20.16b, v20.16b, v20.16b
+	ext	v19.16b, v16.16b, v16.16b, #8
+	movi	v18.16b, #1
+	ext	v18.16b, v18.16b, v20.16b, #15
+	add	v17.2d, v19.2d, v18.2d
+	cmeq	v19.2d, v17.2d, #0
+	ext	v19.16b, v20.16b, v19.16b, #8
+	sub	v17.2d, v17.2d, v19.2d
+	ext	v17.16b, v17.16b, v17.16b, #8
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	adds	x9, x9, #2
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	sub	w8, w8, #2
+	st1	{v24.16b, v25.16b}, [x1], #32
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+L_aes_ctr_encrypt_arm64_crypto_192_start_1
+	cbz	w8, L_aes_ctr_encrypt_arm64_crypto_192_done
+	ld1	{v24.16b}, [x0], #16
+	rev64	v16.16b, v16.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	adds	x9, x9, #1
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	st1	{v24.16b}, [x1], #16
+L_aes_ctr_encrypt_arm64_crypto_192_done
+	cbz	w2, L_aes_ctr_encrypt_arm64_crypto_192_partial_done
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+	rev64	v16.16b, v16.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	adds	x9, x9, #1
+	adc	x10, x10, xzr
+	st1	{v16.2d}, [x5]
+	mov	w13, #16
+	sub	w13, w13, w2
+L_aes_ctr_encrypt_arm64_crypto_192_start_byte
+	ldrb	w11, [x5], #1
+	ldrb	w12, [x0], #1
+	eor	w11, w11, w12
+	subs	w2, w2, #1
+	strb	w11, [x1], #1
+	bgt	L_aes_ctr_encrypt_arm64_crypto_192_start_byte
+	str	w13, [x6]
+L_aes_ctr_encrypt_arm64_crypto_192_partial_done
+	ENDIF
+	b	L_aes_ctr_encrypt_arm64_crypto_done
+	; AES_CTR_256
+L_aes_ctr_encrypt_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x4], #0x40
+	ld1	{v12.2d, v13.2d}, [x4], #32
+	ld1	{v14.2d}, [x4]
+	cmp	w8, #1
+	ble	L_aes_ctr_encrypt_arm64_crypto_256_start_1
+	adds	x11, x9, #1
+	adc	x12, x10, xzr
+	cmp	w8, #8
+	blt	L_aes_ctr_encrypt_arm64_crypto_256_start_4
+	adds	x13, x9, #2
+	adc	x14, x10, xzr
+	adds	x15, x9, #3
+	adc	x16, x10, xzr
+L_aes_ctr_encrypt_arm64_crypto_256_start_8
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x0], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x0], #0x40
+	mov	v17.d[0], x12
+	mov	v17.d[1], x11
+	mov	v18.d[0], x14
+	mov	v18.d[1], x13
+	adds	x17, x9, #4
+	mov	v19.d[0], x16
+	adc	x19, x10, xzr
+	mov	v19.d[1], x15
+	adds	x20, x9, #5
+	mov	v20.d[0], x19
+	adc	x21, x10, xzr
+	mov	v20.d[1], x17
+	adds	x22, x9, #6
+	mov	v21.d[0], x21
+	adc	x23, x10, xzr
+	mov	v21.d[1], x20
+	adds	x24, x9, #7
+	mov	v22.d[0], x23
+	adc	x25, x10, xzr
+	mov	v22.d[1], x22
+	mov	v23.d[0], x25
+	mov	v23.d[1], x24
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	rev64	v18.16b, v18.16b
+	rev64	v19.16b, v19.16b
+	rev64	v20.16b, v20.16b
+	rev64	v21.16b, v21.16b
+	rev64	v22.16b, v22.16b
+	rev64	v23.16b, v23.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v0.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v0.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v0.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v0.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v0.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v0.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v1.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v1.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v1.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v1.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v1.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v1.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v2.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v2.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v2.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v2.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v2.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v2.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v3.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v3.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v3.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v3.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v3.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v3.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v4.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v4.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v4.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v4.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v4.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v4.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v5.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v5.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v5.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v5.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v5.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v5.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v6.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v6.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v6.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v6.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v6.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v6.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v7.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v7.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v7.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v7.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v7.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v7.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v8.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v8.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v8.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v8.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v8.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v8.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v9.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v9.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v9.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v9.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v9.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v9.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v10.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v10.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v10.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v10.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v10.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v10.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v11.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v11.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v11.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v11.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v11.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v11.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v12.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v12.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v12.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v12.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v12.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v12.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v14.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v14.16b
+	aese	v18.16b, v13.16b
+	eor	v18.16b, v18.16b, v14.16b
+	aese	v19.16b, v13.16b
+	eor	v19.16b, v19.16b, v14.16b
+	aese	v20.16b, v13.16b
+	eor	v20.16b, v20.16b, v14.16b
+	aese	v21.16b, v13.16b
+	eor	v21.16b, v21.16b, v14.16b
+	aese	v22.16b, v13.16b
+	eor	v22.16b, v22.16b, v14.16b
+	aese	v23.16b, v13.16b
+	eor	v23.16b, v23.16b, v14.16b
+	adds	x9, x9, #8
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	adds	x11, x11, #8
+	eor	v26.16b, v26.16b, v18.16b
+	adc	x12, x12, xzr
+	eor	v27.16b, v27.16b, v19.16b
+	adds	x13, x13, #8
+	eor	v28.16b, v28.16b, v20.16b
+	adc	x14, x14, xzr
+	eor	v29.16b, v29.16b, v21.16b
+	adds	x15, x15, #8
+	eor	v30.16b, v30.16b, v22.16b
+	adc	x16, x16, xzr
+	eor	v31.16b, v31.16b, v23.16b
+	sub	w8, w8, #8
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	st1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x1], #0x40
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+	cmp	w8, #8
+	bge	L_aes_ctr_encrypt_arm64_crypto_256_start_8
+L_aes_ctr_encrypt_arm64_crypto_256_start_4
+	cmp	w8, #4
+	blt	L_aes_ctr_encrypt_arm64_crypto_256_start_2
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x0], #0x40
+	adds	x13, x9, #2
+	mov	v17.d[0], x12
+	adc	x14, x10, xzr
+	mov	v17.d[1], x11
+	adds	x15, x9, #3
+	mov	v18.d[0], x14
+	adc	x16, x10, xzr
+	mov	v18.d[1], x13
+	mov	v19.d[0], x16
+	mov	v19.d[1], x15
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	rev64	v18.16b, v18.16b
+	rev64	v19.16b, v19.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v0.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v0.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v1.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v1.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v2.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v2.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v3.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v3.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v4.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v4.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v5.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v5.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v6.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v6.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v7.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v7.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v8.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v8.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v9.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v9.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v10.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v10.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v11.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v11.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v12.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v12.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v14.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v14.16b
+	aese	v18.16b, v13.16b
+	eor	v18.16b, v18.16b, v14.16b
+	aese	v19.16b, v13.16b
+	eor	v19.16b, v19.16b, v14.16b
+	adds	x9, x9, #4
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	adds	x11, x11, #4
+	eor	v26.16b, v26.16b, v18.16b
+	adc	x12, x12, xzr
+	eor	v27.16b, v27.16b, v19.16b
+	sub	w8, w8, #4
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+L_aes_ctr_encrypt_arm64_crypto_256_start_2
+	cmp	w8, #2
+	blt	L_aes_ctr_encrypt_arm64_crypto_256_start_1
+	ld1	{v24.16b, v25.16b}, [x0], #32
+	eor	v20.16b, v20.16b, v20.16b
+	ext	v19.16b, v16.16b, v16.16b, #8
+	movi	v18.16b, #1
+	ext	v18.16b, v18.16b, v20.16b, #15
+	add	v17.2d, v19.2d, v18.2d
+	cmeq	v19.2d, v17.2d, #0
+	ext	v19.16b, v20.16b, v19.16b, #8
+	sub	v17.2d, v17.2d, v19.2d
+	ext	v17.16b, v17.16b, v17.16b, #8
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v14.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v14.16b
+	adds	x9, x9, #2
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	sub	w8, w8, #2
+	st1	{v24.16b, v25.16b}, [x1], #32
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+L_aes_ctr_encrypt_arm64_crypto_256_start_1
+	cbz	w8, L_aes_ctr_encrypt_arm64_crypto_256_done
+	ld1	{v24.16b}, [x0], #16
+	rev64	v16.16b, v16.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v14.16b
+	adds	x9, x9, #1
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	st1	{v24.16b}, [x1], #16
+L_aes_ctr_encrypt_arm64_crypto_256_done
+	cbz	w2, L_aes_ctr_encrypt_arm64_crypto_256_partial_done
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+	rev64	v16.16b, v16.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v14.16b
+	adds	x9, x9, #1
+	adc	x10, x10, xzr
+	st1	{v16.2d}, [x5]
+	mov	w13, #16
+	sub	w13, w13, w2
+L_aes_ctr_encrypt_arm64_crypto_256_start_byte
+	ldrb	w11, [x5], #1
+	ldrb	w12, [x0], #1
+	eor	w11, w11, w12
+	subs	w2, w2, #1
+	strb	w11, [x1], #1
+	bgt	L_aes_ctr_encrypt_arm64_crypto_256_start_byte
+	str	w13, [x6]
+L_aes_ctr_encrypt_arm64_crypto_256_partial_done
+	ENDIF
+	b	L_aes_ctr_encrypt_arm64_crypto_done
+	; AES_CTR_128
+L_aes_ctr_encrypt_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	ld1	{v8.2d, v9.2d}, [x4], #32
+	ld1	{v10.2d}, [x4]
+	cmp	w8, #1
+	ble	L_aes_ctr_encrypt_arm64_crypto_128_start_1
+	adds	x11, x9, #1
+	adc	x12, x10, xzr
+	cmp	w8, #8
+	blt	L_aes_ctr_encrypt_arm64_crypto_128_start_4
+	adds	x13, x9, #2
+	adc	x14, x10, xzr
+	adds	x15, x9, #3
+	adc	x16, x10, xzr
+L_aes_ctr_encrypt_arm64_crypto_128_start_8
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x0], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x0], #0x40
+	mov	v17.d[0], x12
+	mov	v17.d[1], x11
+	mov	v18.d[0], x14
+	mov	v18.d[1], x13
+	adds	x17, x9, #4
+	mov	v19.d[0], x16
+	adc	x19, x10, xzr
+	mov	v19.d[1], x15
+	adds	x20, x9, #5
+	mov	v20.d[0], x19
+	adc	x21, x10, xzr
+	mov	v20.d[1], x17
+	adds	x22, x9, #6
+	mov	v21.d[0], x21
+	adc	x23, x10, xzr
+	mov	v21.d[1], x20
+	adds	x24, x9, #7
+	mov	v22.d[0], x23
+	adc	x25, x10, xzr
+	mov	v22.d[1], x22
+	mov	v23.d[0], x25
+	mov	v23.d[1], x24
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	rev64	v18.16b, v18.16b
+	rev64	v19.16b, v19.16b
+	rev64	v20.16b, v20.16b
+	rev64	v21.16b, v21.16b
+	rev64	v22.16b, v22.16b
+	rev64	v23.16b, v23.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v0.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v0.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v0.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v0.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v0.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v0.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v1.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v1.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v1.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v1.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v1.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v1.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v2.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v2.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v2.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v2.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v2.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v2.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v3.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v3.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v3.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v3.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v3.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v3.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v4.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v4.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v4.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v4.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v4.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v4.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v5.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v5.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v5.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v5.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v5.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v5.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v6.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v6.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v6.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v6.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v6.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v6.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v7.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v7.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v7.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v7.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v7.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v7.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v8.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v8.16b
+	aesmc	v19.16b, v19.16b
+	aese	v20.16b, v8.16b
+	aesmc	v20.16b, v20.16b
+	aese	v21.16b, v8.16b
+	aesmc	v21.16b, v21.16b
+	aese	v22.16b, v8.16b
+	aesmc	v22.16b, v22.16b
+	aese	v23.16b, v8.16b
+	aesmc	v23.16b, v23.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	aese	v18.16b, v9.16b
+	eor	v18.16b, v18.16b, v10.16b
+	aese	v19.16b, v9.16b
+	eor	v19.16b, v19.16b, v10.16b
+	aese	v20.16b, v9.16b
+	eor	v20.16b, v20.16b, v10.16b
+	aese	v21.16b, v9.16b
+	eor	v21.16b, v21.16b, v10.16b
+	aese	v22.16b, v9.16b
+	eor	v22.16b, v22.16b, v10.16b
+	aese	v23.16b, v9.16b
+	eor	v23.16b, v23.16b, v10.16b
+	adds	x9, x9, #8
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	adds	x11, x11, #8
+	eor	v26.16b, v26.16b, v18.16b
+	adc	x12, x12, xzr
+	eor	v27.16b, v27.16b, v19.16b
+	adds	x13, x13, #8
+	eor	v28.16b, v28.16b, v20.16b
+	adc	x14, x14, xzr
+	eor	v29.16b, v29.16b, v21.16b
+	adds	x15, x15, #8
+	eor	v30.16b, v30.16b, v22.16b
+	adc	x16, x16, xzr
+	eor	v31.16b, v31.16b, v23.16b
+	sub	w8, w8, #8
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	st1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x1], #0x40
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+	cmp	w8, #8
+	bge	L_aes_ctr_encrypt_arm64_crypto_128_start_8
+L_aes_ctr_encrypt_arm64_crypto_128_start_4
+	cmp	w8, #4
+	blt	L_aes_ctr_encrypt_arm64_crypto_128_start_2
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x0], #0x40
+	adds	x13, x9, #2
+	mov	v17.d[0], x12
+	adc	x14, x10, xzr
+	mov	v17.d[1], x11
+	adds	x15, x9, #3
+	mov	v18.d[0], x14
+	adc	x16, x10, xzr
+	mov	v18.d[1], x13
+	mov	v19.d[0], x16
+	mov	v19.d[1], x15
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	rev64	v18.16b, v18.16b
+	rev64	v19.16b, v19.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v0.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v0.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v1.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v1.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v2.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v2.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v3.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v3.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v4.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v4.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v5.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v5.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v6.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v6.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v7.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v7.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v18.16b, v8.16b
+	aesmc	v18.16b, v18.16b
+	aese	v19.16b, v8.16b
+	aesmc	v19.16b, v19.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	aese	v18.16b, v9.16b
+	eor	v18.16b, v18.16b, v10.16b
+	aese	v19.16b, v9.16b
+	eor	v19.16b, v19.16b, v10.16b
+	adds	x9, x9, #4
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	adds	x11, x11, #4
+	eor	v26.16b, v26.16b, v18.16b
+	adc	x12, x12, xzr
+	eor	v27.16b, v27.16b, v19.16b
+	sub	w8, w8, #4
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+L_aes_ctr_encrypt_arm64_crypto_128_start_2
+	cmp	w8, #2
+	blt	L_aes_ctr_encrypt_arm64_crypto_128_start_1
+	ld1	{v24.16b, v25.16b}, [x0], #32
+	eor	v20.16b, v20.16b, v20.16b
+	ext	v19.16b, v16.16b, v16.16b, #8
+	movi	v18.16b, #1
+	ext	v18.16b, v18.16b, v20.16b, #15
+	add	v17.2d, v19.2d, v18.2d
+	cmeq	v19.2d, v17.2d, #0
+	ext	v19.16b, v20.16b, v19.16b, #8
+	sub	v17.2d, v17.2d, v19.2d
+	ext	v17.16b, v17.16b, v17.16b, #8
+	rev64	v16.16b, v16.16b
+	rev64	v17.16b, v17.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	adds	x9, x9, #2
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	eor	v25.16b, v25.16b, v17.16b
+	sub	w8, w8, #2
+	st1	{v24.16b, v25.16b}, [x1], #32
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+L_aes_ctr_encrypt_arm64_crypto_128_start_1
+	cbz	w8, L_aes_ctr_encrypt_arm64_crypto_128_done
+	ld1	{v24.16b}, [x0], #16
+	rev64	v16.16b, v16.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	adds	x9, x9, #1
+	eor	v24.16b, v24.16b, v16.16b
+	adc	x10, x10, xzr
+	st1	{v24.16b}, [x1], #16
+L_aes_ctr_encrypt_arm64_crypto_128_done
+	cbz	w2, L_aes_ctr_encrypt_arm64_crypto_128_partial_done
+	mov	v16.d[0], x10
+	mov	v16.d[1], x9
+	rev64	v16.16b, v16.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	adds	x9, x9, #1
+	adc	x10, x10, xzr
+	st1	{v16.2d}, [x5]
+	mov	w13, #16
+	sub	w13, w13, w2
+L_aes_ctr_encrypt_arm64_crypto_128_start_byte
+	ldrb	w11, [x5], #1
+	ldrb	w12, [x0], #1
+	eor	w11, w11, w12
+	subs	w2, w2, #1
+	strb	w11, [x1], #1
+	bgt	L_aes_ctr_encrypt_arm64_crypto_128_start_byte
+	str	w13, [x6]
+L_aes_ctr_encrypt_arm64_crypto_128_partial_done
+	ENDIF
+L_aes_ctr_encrypt_arm64_crypto_done
+	rev	x11, x10
+	rev	x12, x9
+	stp	x11, x12, [x3]
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x22, x23, [x29, #48]
+	ldp	x24, x25, [x29, #64]
+	ldp	d8, d9, [x29, #80]
+	ldp	d10, d11, [x29, #96]
+	ldp	d12, d13, [x29, #112]
+	ldp	d14, d15, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:HAVE_AESGCM
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_set_key_AARCH64
+AES_GCM_set_key_AARCH64 PROC
+	ld1	{v0.16b}, [x0]
+	ld1	{v1.2d, v2.2d, v3.2d, v4.2d}, [x1], #0x40
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v3.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v4.16b
+	aesmc	v0.16b, v0.16b
+	ld1	{v1.2d, v2.2d, v3.2d, v4.2d}, [x1], #0x40
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v3.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v4.16b
+	aesmc	v0.16b, v0.16b
+	subs	w3, w3, #10
+	ld1	{v1.2d, v2.2d}, [x1], #32
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	beq	L_aes_gcm_set_key_arm64_crypto_round_done
+	ld1	{v1.2d, v2.2d}, [x1], #32
+	subs	w3, w3, #2
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+	beq	L_aes_gcm_set_key_arm64_crypto_round_done
+	ld1	{v1.2d, v2.2d}, [x1], #32
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v1.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v2.16b
+L_aes_gcm_set_key_arm64_crypto_round_done
+	ld1	{v1.2d}, [x1]
+	eor	v0.16b, v0.16b, v1.16b
+	rbit	v0.16b, v0.16b
+	st1	{v0.2d}, [x2]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_AARCH64
+AES_GCM_encrypt_AARCH64 PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	str	x24, [x29, #72]
+	stp	d8, d9, [x29, #80]
+	stp	d10, d11, [x29, #96]
+	stp	d12, d13, [x29, #112]
+	stp	d14, d15, [x29, #128]
+	ldr	w8, [x29, #144]
+	ldr	x9, [x29, #152]
+	ldr	x10, [x29, #160]
+	ldr	x11, [x29, #168]
+	ldr	x12, [x29, #176]
+	ldr	w13, [x29, #184]
+	movi	v27.16b, #0x87
+	eor	v26.16b, v26.16b, v26.16b
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x10]
+	cmp	w8, #0x40
+	csetm	x16, lt
+	cmp	w2, #32
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_encrypt_arm64_crypto_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w8, #0x100
+	csetm	x16, lt
+	cmp	w2, #0x40
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_encrypt_arm64_crypto_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w8, #0x400
+	csetm	x16, lt
+	cmp	w2, #0x200
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_encrypt_arm64_crypto_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_encrypt_arm64_crypto_h_done
+	lsr	w14, w8, #4
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_start_2
+	cmp	w14, #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_start_4
+L_aes_gcm_encrypt_arm64_crypto_aad_start_8
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #8
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_aad_start_8
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_start_2
+L_aes_gcm_encrypt_arm64_crypto_aad_start_4
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #4
+	cmp	w14, #4
+	bge	L_aes_gcm_encrypt_arm64_crypto_aad_start_4
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_aad_start_1
+L_aes_gcm_encrypt_arm64_crypto_aad_start_2
+	ld1	{v18.16b, v19.16b}, [x7], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #2
+	cmp	w14, #1
+	bgt	L_aes_gcm_encrypt_arm64_crypto_aad_start_2
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_done
+L_aes_gcm_encrypt_arm64_crypto_aad_start_1
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_aad_done
+L_aes_gcm_encrypt_arm64_crypto_aad_both_1
+	ld1	{v18.16b}, [x7], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_aad_both_1
+L_aes_gcm_encrypt_arm64_crypto_aad_done
+	and	w14, w8, #15
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_aad_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w14
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_start_dw
+	ldr	x19, [x7], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_aad_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_start_sw
+	ldr	w19, [x7], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_aad_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_aad_start_byte
+	ldrh	w19, [x7], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_aad_start_byte
+	cbz	w20, L_aes_gcm_encrypt_arm64_crypto_aad_end_bytes
+	ldrb	w19, [x7], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_aad_start_byte
+L_aes_gcm_encrypt_arm64_crypto_aad_end_bytes
+	sub	x11, x11, x14
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_aad_partial_done
+	; Load Nonce
+	cmp	w4, #12
+	bne	L_aes_gcm_encrypt_arm64_crypto_ghash_nonce
+	ldr	x16, [x3]
+	movi	v13.4s, #1, lsl 24
+	ldr	w17, [x3, #8]
+	mov	v13.d[0], x16
+	mov	v13.s[2], w17
+	mov	w15, #1
+	b	L_aes_gcm_encrypt_arm64_crypto_done_nonce
+L_aes_gcm_encrypt_arm64_crypto_ghash_nonce
+	eor	v13.16b, v13.16b, v13.16b
+	lsr	w14, w4, #4
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_nonce_done
+L_aes_gcm_encrypt_arm64_crypto_nonce_start_1
+	ld1	{v18.16b}, [x3], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_nonce_start_1
+L_aes_gcm_encrypt_arm64_crypto_nonce_done
+	and	w24, w4, #15
+	cbz	x24, L_aes_gcm_encrypt_arm64_crypto_nonce_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w24
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_nonce_start_dw
+	ldr	x19, [x3], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_nonce_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_nonce_start_sw
+	ldr	w19, [x3], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_nonce_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_nonce_start_byte
+	ldrh	w19, [x3], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_nonce_start_byte
+	cbz	w20, L_aes_gcm_encrypt_arm64_crypto_nonce_end_bytes
+	ldrb	w19, [x3], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_nonce_start_byte
+L_aes_gcm_encrypt_arm64_crypto_nonce_end_bytes
+	sub	x11, x11, x24
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_nonce_partial_done
+	eor	x14, x14, x14
+	ubfiz	x24, x4, #3, #32
+	mov	v28.d[0], x14
+	mov	v28.d[1], x24
+	rev64	v28.16b, v28.16b
+	rbit	v28.16b, v28.16b
+	eor	v13.16b, v13.16b, v28.16b
+	pmull	v28.1q, v13.1d, v22.1d
+	pmull2	v29.1q, v13.2d, v22.2d
+	ext	v31.16b, v13.16b, v13.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	rbit	v13.16b, v13.16b
+	mov	w15, v13.s[3]
+	rev	w15, w15
+L_aes_gcm_encrypt_arm64_crypto_done_nonce
+	st1	{v13.2d}, [x12]
+	lsr	w14, w2, #4
+	cmp	w13, #12
+	blt	L_aes_gcm_encrypt_arm64_crypto_start_128
+	bgt	L_aes_gcm_encrypt_arm64_crypto_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w14, #32
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_start_4
+L_aes_gcm_encrypt_arm64_crypto_192_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	rev	w23, w23
+	rev	w22, w22
+	rev	w21, w21
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_end_8
+L_aes_gcm_encrypt_arm64_crypto_192_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_192_both_8
+L_aes_gcm_encrypt_arm64_crypto_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_192_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_end_4
+L_aes_gcm_encrypt_arm64_crypto_192_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	bge	L_aes_gcm_encrypt_arm64_crypto_192_both_4
+L_aes_gcm_encrypt_arm64_crypto_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_encrypt_arm64_crypto_192_start_1
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_done
+L_aes_gcm_encrypt_arm64_crypto_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_192_done
+L_aes_gcm_encrypt_arm64_crypto_192_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_192_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_encrypt_arm64_crypto_192_partial_done
+	eor	v16.16b, v16.16b, v16.16b
+	mov	w19, w14
+	st1	{v16.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_192_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_192_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_192_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_192_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_192_start_byte
+L_aes_gcm_encrypt_arm64_crypto_192_end_bytes
+	sub	x11, x11, x14
+	ld1	{v16.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v16.16b, v16.16b, v14.16b
+	st1	{v16.2d}, [x11]
+	mov	w19, w14
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_out_start_dw
+	ldr	x17, [x11], #8
+	sub	x19, x19, #8
+	str	x17, [x1], #8
+L_aes_gcm_encrypt_arm64_crypto_192_out_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_out_start_sw
+	ldr	w17, [x11], #4
+	sub	x19, x19, #4
+	str	w17, [x1], #4
+L_aes_gcm_encrypt_arm64_crypto_192_out_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	x19, x19, #2
+	strh	w17, [x1], #2
+L_aes_gcm_encrypt_arm64_crypto_192_out_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_192_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	x19, x19, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_192_out_start_byte
+L_aes_gcm_encrypt_arm64_crypto_192_out_end_bytes
+	mov	x17, #16
+	sub	x17, x17, x14
+L_aes_gcm_encrypt_arm64_crypto_192_start_zero
+	subs	x17, x17, #1
+	strb	wzr, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_192_start_zero
+	sub	x11, x11, #16
+	ld1	{v14.2d}, [x11]
+	rbit	v14.16b, v14.16b
+	eor	v15.16b, v26.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v15.1d, v22.1d
+	pmull2	v29.1q, v15.2d, v22.2d
+	ext	v31.16b, v15.16b, v15.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_192_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	bne	L_aes_gcm_encrypt_arm64_crypto_192_tag_partial
+	st1	{v26.16b}, [x5]
+	b	L_aes_gcm_encrypt_arm64_crypto_done
+L_aes_gcm_encrypt_arm64_crypto_192_tag_partial
+	st1	{v26.16b}, [x11]
+	cmp	w6, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_tag_start_dw
+	ldr	x16, [x11], #8
+	sub	w6, w6, #8
+	str	x16, [x5], #8
+L_aes_gcm_encrypt_arm64_crypto_192_tag_start_dw
+	cmp	w6, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_tag_start_sw
+	ldr	w16, [x11], #4
+	sub	w6, w6, #4
+	str	w16, [x5], #4
+L_aes_gcm_encrypt_arm64_crypto_192_tag_start_sw
+	cmp	w6, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_192_tag_start_byte
+	ldrh	w16, [x11], #2
+	sub	w6, w6, #2
+	strh	w16, [x5], #2
+L_aes_gcm_encrypt_arm64_crypto_192_tag_start_byte
+	cbz	w6, L_aes_gcm_encrypt_arm64_crypto_192_tag_end_bytes
+	ldrb	w16, [x11], #1
+	subs	w6, w6, #1
+	strb	w16, [x5], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_192_tag_start_byte
+L_aes_gcm_encrypt_arm64_crypto_192_tag_end_bytes
+	ENDIF
+	b	L_aes_gcm_encrypt_arm64_crypto_done
+	; AES_GCM_256
+L_aes_gcm_encrypt_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w14, #32
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_start_4
+L_aes_gcm_encrypt_arm64_crypto_256_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	rev	w23, w23
+	rev	w22, w22
+	rev	w21, w21
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_end_8
+L_aes_gcm_encrypt_arm64_crypto_256_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_256_both_8
+L_aes_gcm_encrypt_arm64_crypto_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9], #16
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_256_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_end_4
+L_aes_gcm_encrypt_arm64_crypto_256_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	bge	L_aes_gcm_encrypt_arm64_crypto_256_both_4
+L_aes_gcm_encrypt_arm64_crypto_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_encrypt_arm64_crypto_256_start_1
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_done
+L_aes_gcm_encrypt_arm64_crypto_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_256_done
+L_aes_gcm_encrypt_arm64_crypto_256_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_256_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_encrypt_arm64_crypto_256_partial_done
+	eor	v16.16b, v16.16b, v16.16b
+	mov	w19, w14
+	st1	{v16.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_256_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_256_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_256_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_256_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_256_start_byte
+L_aes_gcm_encrypt_arm64_crypto_256_end_bytes
+	sub	x11, x11, x14
+	ld1	{v16.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v16.16b, v16.16b, v14.16b
+	st1	{v16.2d}, [x11]
+	mov	w19, w14
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_out_start_dw
+	ldr	x17, [x11], #8
+	sub	x19, x19, #8
+	str	x17, [x1], #8
+L_aes_gcm_encrypt_arm64_crypto_256_out_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_out_start_sw
+	ldr	w17, [x11], #4
+	sub	x19, x19, #4
+	str	w17, [x1], #4
+L_aes_gcm_encrypt_arm64_crypto_256_out_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	x19, x19, #2
+	strh	w17, [x1], #2
+L_aes_gcm_encrypt_arm64_crypto_256_out_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_256_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	x19, x19, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_256_out_start_byte
+L_aes_gcm_encrypt_arm64_crypto_256_out_end_bytes
+	mov	x17, #16
+	sub	x17, x17, x14
+L_aes_gcm_encrypt_arm64_crypto_256_start_zero
+	subs	x17, x17, #1
+	strb	wzr, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_256_start_zero
+	sub	x11, x11, #16
+	ld1	{v14.2d}, [x11]
+	rbit	v14.16b, v14.16b
+	eor	v15.16b, v26.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v15.1d, v22.1d
+	pmull2	v29.1q, v15.2d, v22.2d
+	ext	v31.16b, v15.16b, v15.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_256_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v28.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	ldr	q11, [x9, #-32]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	ldr	q12, [x9, #-16]
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	bne	L_aes_gcm_encrypt_arm64_crypto_256_tag_partial
+	st1	{v26.16b}, [x5]
+	b	L_aes_gcm_encrypt_arm64_crypto_done
+L_aes_gcm_encrypt_arm64_crypto_256_tag_partial
+	st1	{v26.16b}, [x11]
+	cmp	w6, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_tag_start_dw
+	ldr	x16, [x11], #8
+	sub	w6, w6, #8
+	str	x16, [x5], #8
+L_aes_gcm_encrypt_arm64_crypto_256_tag_start_dw
+	cmp	w6, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_tag_start_sw
+	ldr	w16, [x11], #4
+	sub	w6, w6, #4
+	str	w16, [x5], #4
+L_aes_gcm_encrypt_arm64_crypto_256_tag_start_sw
+	cmp	w6, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_256_tag_start_byte
+	ldrh	w16, [x11], #2
+	sub	w6, w6, #2
+	strh	w16, [x5], #2
+L_aes_gcm_encrypt_arm64_crypto_256_tag_start_byte
+	cbz	w6, L_aes_gcm_encrypt_arm64_crypto_256_tag_end_bytes
+	ldrb	w16, [x11], #1
+	subs	w6, w6, #1
+	strb	w16, [x5], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_256_tag_start_byte
+L_aes_gcm_encrypt_arm64_crypto_256_tag_end_bytes
+	ENDIF
+	b	L_aes_gcm_encrypt_arm64_crypto_done
+	; AES_GCM_128
+L_aes_gcm_encrypt_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w14, #32
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_start_4
+L_aes_gcm_encrypt_arm64_crypto_128_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	rev	w23, w23
+	rev	w22, w22
+	rev	w21, w21
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_end_8
+L_aes_gcm_encrypt_arm64_crypto_128_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_128_both_8
+L_aes_gcm_encrypt_arm64_crypto_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d}, [x9], #32
+	ld1	{v10.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_128_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_end_4
+L_aes_gcm_encrypt_arm64_crypto_128_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	bge	L_aes_gcm_encrypt_arm64_crypto_128_both_4
+L_aes_gcm_encrypt_arm64_crypto_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_encrypt_arm64_crypto_128_start_1
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_done
+L_aes_gcm_encrypt_arm64_crypto_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_128_done
+L_aes_gcm_encrypt_arm64_crypto_128_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x0], #16
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_128_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_encrypt_arm64_crypto_128_partial_done
+	eor	v16.16b, v16.16b, v16.16b
+	mov	w19, w14
+	st1	{v16.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_128_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_128_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_128_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_128_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_128_start_byte
+L_aes_gcm_encrypt_arm64_crypto_128_end_bytes
+	sub	x11, x11, x14
+	ld1	{v16.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v16.16b, v16.16b, v14.16b
+	st1	{v16.2d}, [x11]
+	mov	w19, w14
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_out_start_dw
+	ldr	x17, [x11], #8
+	sub	x19, x19, #8
+	str	x17, [x1], #8
+L_aes_gcm_encrypt_arm64_crypto_128_out_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_out_start_sw
+	ldr	w17, [x11], #4
+	sub	x19, x19, #4
+	str	w17, [x1], #4
+L_aes_gcm_encrypt_arm64_crypto_128_out_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	x19, x19, #2
+	strh	w17, [x1], #2
+L_aes_gcm_encrypt_arm64_crypto_128_out_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_128_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	x19, x19, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_128_out_start_byte
+L_aes_gcm_encrypt_arm64_crypto_128_out_end_bytes
+	mov	x17, #16
+	sub	x17, x17, x14
+L_aes_gcm_encrypt_arm64_crypto_128_start_zero
+	subs	x17, x17, #1
+	strb	wzr, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_128_start_zero
+	sub	x11, x11, #16
+	ld1	{v14.2d}, [x11]
+	rbit	v14.16b, v14.16b
+	eor	v15.16b, v26.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v15.1d, v22.1d
+	pmull2	v29.1q, v15.2d, v22.2d
+	ext	v31.16b, v15.16b, v15.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_128_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	ext	v31.16b, v26.16b, v26.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	bne	L_aes_gcm_encrypt_arm64_crypto_128_tag_partial
+	st1	{v26.16b}, [x5]
+	b	L_aes_gcm_encrypt_arm64_crypto_done
+L_aes_gcm_encrypt_arm64_crypto_128_tag_partial
+	st1	{v26.16b}, [x11]
+	cmp	w6, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_tag_start_dw
+	ldr	x16, [x11], #8
+	sub	w6, w6, #8
+	str	x16, [x5], #8
+L_aes_gcm_encrypt_arm64_crypto_128_tag_start_dw
+	cmp	w6, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_tag_start_sw
+	ldr	w16, [x11], #4
+	sub	w6, w6, #4
+	str	w16, [x5], #4
+L_aes_gcm_encrypt_arm64_crypto_128_tag_start_sw
+	cmp	w6, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_128_tag_start_byte
+	ldrh	w16, [x11], #2
+	sub	w6, w6, #2
+	strh	w16, [x5], #2
+L_aes_gcm_encrypt_arm64_crypto_128_tag_start_byte
+	cbz	w6, L_aes_gcm_encrypt_arm64_crypto_128_tag_end_bytes
+	ldrb	w16, [x11], #1
+	subs	w6, w6, #1
+	strb	w16, [x5], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_128_tag_start_byte
+L_aes_gcm_encrypt_arm64_crypto_128_tag_end_bytes
+	ENDIF
+L_aes_gcm_encrypt_arm64_crypto_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldr	x24, [x29, #72]
+	ldp	d8, d9, [x29, #80]
+	ldp	d10, d11, [x29, #96]
+	ldp	d12, d13, [x29, #112]
+	ldp	d14, d15, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_decrypt_AARCH64
+AES_GCM_decrypt_AARCH64 PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	str	x24, [x29, #72]
+	stp	d8, d9, [x29, #80]
+	stp	d10, d11, [x29, #96]
+	stp	d12, d13, [x29, #112]
+	stp	d14, d15, [x29, #128]
+	ldr	w8, [x29, #144]
+	ldr	x9, [x29, #152]
+	ldr	x10, [x29, #160]
+	ldr	x11, [x29, #168]
+	ldr	x12, [x29, #176]
+	ldr	w13, [x29, #184]
+	movi	v27.16b, #0x87
+	eor	v26.16b, v26.16b, v26.16b
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x10]
+	cmp	w8, #0x40
+	csetm	x16, lt
+	cmp	w2, #32
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_decrypt_arm64_crypto_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w8, #0x100
+	csetm	x16, lt
+	cmp	w2, #0x40
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_decrypt_arm64_crypto_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w8, #0x400
+	csetm	x16, lt
+	cmp	w2, #0x200
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_decrypt_arm64_crypto_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_decrypt_arm64_crypto_h_done
+	lsr	w14, w8, #4
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_start_2
+	cmp	w14, #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_start_4
+L_aes_gcm_decrypt_arm64_crypto_aad_start_8
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #8
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_aad_start_8
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_start_2
+L_aes_gcm_decrypt_arm64_crypto_aad_start_4
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #4
+	cmp	w14, #4
+	bge	L_aes_gcm_decrypt_arm64_crypto_aad_start_4
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_aad_start_1
+L_aes_gcm_decrypt_arm64_crypto_aad_start_2
+	ld1	{v18.16b, v19.16b}, [x7], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #2
+	cmp	w14, #1
+	bgt	L_aes_gcm_decrypt_arm64_crypto_aad_start_2
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_done
+L_aes_gcm_decrypt_arm64_crypto_aad_start_1
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_aad_done
+L_aes_gcm_decrypt_arm64_crypto_aad_both_1
+	ld1	{v18.16b}, [x7], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_aad_both_1
+L_aes_gcm_decrypt_arm64_crypto_aad_done
+	and	w14, w8, #15
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_aad_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w14
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_start_dw
+	ldr	x19, [x7], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_aad_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_start_sw
+	ldr	w19, [x7], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_aad_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_aad_start_byte
+	ldrh	w19, [x7], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_aad_start_byte
+	cbz	w20, L_aes_gcm_decrypt_arm64_crypto_aad_end_bytes
+	ldrb	w19, [x7], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_aad_start_byte
+L_aes_gcm_decrypt_arm64_crypto_aad_end_bytes
+	sub	x11, x11, x14
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_aad_partial_done
+	; Load Nonce
+	cmp	w4, #12
+	bne	L_aes_gcm_decrypt_arm64_crypto_ghash_nonce
+	ldr	x16, [x3]
+	movi	v13.4s, #1, lsl 24
+	ldr	w17, [x3, #8]
+	mov	v13.d[0], x16
+	mov	v13.s[2], w17
+	mov	w15, #1
+	b	L_aes_gcm_decrypt_arm64_crypto_done_nonce
+L_aes_gcm_decrypt_arm64_crypto_ghash_nonce
+	eor	v13.16b, v13.16b, v13.16b
+	lsr	w14, w4, #4
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_nonce_done
+L_aes_gcm_decrypt_arm64_crypto_nonce_start_1
+	ld1	{v18.16b}, [x3], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_nonce_start_1
+L_aes_gcm_decrypt_arm64_crypto_nonce_done
+	and	w24, w4, #15
+	cbz	x24, L_aes_gcm_decrypt_arm64_crypto_nonce_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w24
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_nonce_start_dw
+	ldr	x19, [x3], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_nonce_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_nonce_start_sw
+	ldr	w19, [x3], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_nonce_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_nonce_start_byte
+	ldrh	w19, [x3], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_nonce_start_byte
+	cbz	w20, L_aes_gcm_decrypt_arm64_crypto_nonce_end_bytes
+	ldrb	w19, [x3], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_nonce_start_byte
+L_aes_gcm_decrypt_arm64_crypto_nonce_end_bytes
+	sub	x11, x11, x24
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_nonce_partial_done
+	eor	x14, x14, x14
+	ubfiz	x24, x4, #3, #32
+	mov	v28.d[0], x14
+	mov	v28.d[1], x24
+	rev64	v28.16b, v28.16b
+	rbit	v28.16b, v28.16b
+	eor	v13.16b, v13.16b, v28.16b
+	pmull	v28.1q, v13.1d, v22.1d
+	pmull2	v29.1q, v13.2d, v22.2d
+	ext	v31.16b, v13.16b, v13.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	rbit	v13.16b, v13.16b
+	mov	w15, v13.s[3]
+	rev	w15, w15
+L_aes_gcm_decrypt_arm64_crypto_done_nonce
+	st1	{v13.2d}, [x12]
+	lsr	w14, w2, #4
+	cmp	w13, #12
+	blt	L_aes_gcm_decrypt_arm64_crypto_start_128
+	bgt	L_aes_gcm_decrypt_arm64_crypto_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w14, #32
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_start_4
+L_aes_gcm_decrypt_arm64_crypto_192_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	mov	v14.s[3], w24
+	rev	w23, w23
+	mov	v15.s[3], w23
+	rev	w22, w22
+	mov	v16.s[3], w22
+	rev	w21, w21
+	mov	v17.s[3], w21
+	rev	w20, w20
+	mov	v8.s[3], w20
+	rev	w19, w19
+	mov	v9.s[3], w19
+	rev	w17, w17
+	mov	v10.s[3], w17
+	rev	w16, w15
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_end_8
+L_aes_gcm_decrypt_arm64_crypto_192_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w24
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w23
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w22
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w21
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w20
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w19
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w17
+	rev	w16, w15
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_192_both_8
+L_aes_gcm_decrypt_arm64_crypto_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_192_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w19, w19
+	mov	v15.s[3], w19
+	rev	w17, w17
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_end_4
+L_aes_gcm_decrypt_arm64_crypto_192_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w20
+	rev	w19, w19
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w19
+	rev	w17, w17
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	bge	L_aes_gcm_decrypt_arm64_crypto_192_both_4
+L_aes_gcm_decrypt_arm64_crypto_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_decrypt_arm64_crypto_192_start_1
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_done
+L_aes_gcm_decrypt_arm64_crypto_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w16, w15
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_192_done
+L_aes_gcm_decrypt_arm64_crypto_192_start_1
+	ld1	{v15.16b}, [x0], #16
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.16b}, [x1], #16
+L_aes_gcm_decrypt_arm64_crypto_192_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_decrypt_arm64_crypto_192_partial_done
+	eor	v15.16b, v15.16b, v15.16b
+	mov	w19, w14
+	st1	{v15.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_192_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_192_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_192_start_byte
+	cbz	x19, L_aes_gcm_decrypt_arm64_crypto_192_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_192_start_byte
+L_aes_gcm_decrypt_arm64_crypto_192_end_bytes
+	sub	x11, x11, x14
+	ld1	{v15.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.2d}, [x11]
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_out_start_dw
+	ldr	x17, [x11], #8
+	sub	w14, w14, #8
+	str	x17, [x1], #8
+L_aes_gcm_decrypt_arm64_crypto_192_out_start_dw
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_out_start_sw
+	ldr	w17, [x11], #4
+	sub	w14, w14, #4
+	str	w17, [x1], #4
+L_aes_gcm_decrypt_arm64_crypto_192_out_start_sw
+	cmp	w14, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	w14, w14, #2
+	strh	w17, [x1], #2
+L_aes_gcm_decrypt_arm64_crypto_192_out_start_byte
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_192_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	w14, w14, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_192_out_start_byte
+L_aes_gcm_decrypt_arm64_crypto_192_out_end_bytes
+L_aes_gcm_decrypt_arm64_crypto_192_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_part_tag
+	ld1	{v28.16b}, [x5]
+	b	L_aes_gcm_decrypt_arm64_crypto_192_tag_loaded
+L_aes_gcm_decrypt_arm64_crypto_192_part_tag
+	ubfiz	x6, x6, #0, #32
+	eor	v28.16b, v28.16b, v28.16b
+	mov	x17, x6
+	st1	{v28.2d}, [x11]
+	cmp	x17, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_tag_start_dw
+	ldr	x16, [x5], #8
+	sub	x17, x17, #8
+	str	x16, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_192_tag_start_dw
+	cmp	x17, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_tag_start_sw
+	ldr	w16, [x5], #4
+	sub	x17, x17, #4
+	str	w16, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_192_tag_start_sw
+	cmp	x17, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_192_tag_start_byte
+	ldrh	w16, [x5], #2
+	sub	x17, x17, #2
+	strh	w16, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_192_tag_start_byte
+	cbz	x17, L_aes_gcm_decrypt_arm64_crypto_192_tag_end_bytes
+	ldrb	w16, [x5], #1
+	subs	x17, x17, #1
+	strb	w16, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_192_tag_start_byte
+L_aes_gcm_decrypt_arm64_crypto_192_tag_end_bytes
+	sub	x11, x11, x6
+	ld1	{v28.2d}, [x11]
+	mov	x17, #16
+	st1	{v26.2d}, [x11]
+	sub	x17, x17, x6
+	add	x11, x11, x6
+L_aes_gcm_decrypt_arm64_crypto_192_calc_tag_byte
+	strb	wzr, [x11], #1
+	subs	x17, x17, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_192_calc_tag_byte
+	subs	x11, x11, #16
+	ld1	{v26.2d}, [x11]
+L_aes_gcm_decrypt_arm64_crypto_192_tag_loaded
+	eor	v28.16b, v28.16b, v26.16b
+	mov	x16, v28.d[0]
+	mov	x17, v28.d[1]
+	mov	w19, #-180
+	orr	x16, x16, x17
+	cmp	x16, #0
+	csetm	x0, ne
+	and	x0, x0, x19
+	ENDIF
+	b	L_aes_gcm_decrypt_arm64_crypto_done
+	; AES_GCM_256
+L_aes_gcm_decrypt_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w14, #32
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_start_4
+L_aes_gcm_decrypt_arm64_crypto_256_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	mov	v14.s[3], w24
+	rev	w23, w23
+	mov	v15.s[3], w23
+	rev	w22, w22
+	mov	v16.s[3], w22
+	rev	w21, w21
+	mov	v17.s[3], w21
+	rev	w20, w20
+	mov	v8.s[3], w20
+	rev	w19, w19
+	mov	v9.s[3], w19
+	rev	w17, w17
+	mov	v10.s[3], w17
+	rev	w16, w15
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_end_8
+L_aes_gcm_decrypt_arm64_crypto_256_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w24
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w23
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w22
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w21
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w20
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w19
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w17
+	rev	w16, w15
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_256_both_8
+L_aes_gcm_decrypt_arm64_crypto_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9], #16
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_256_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w19, w19
+	mov	v15.s[3], w19
+	rev	w17, w17
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_end_4
+L_aes_gcm_decrypt_arm64_crypto_256_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w20
+	rev	w19, w19
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w19
+	rev	w17, w17
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	bge	L_aes_gcm_decrypt_arm64_crypto_256_both_4
+L_aes_gcm_decrypt_arm64_crypto_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_decrypt_arm64_crypto_256_start_1
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_done
+L_aes_gcm_decrypt_arm64_crypto_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w16, w15
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_256_done
+L_aes_gcm_decrypt_arm64_crypto_256_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_256_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_decrypt_arm64_crypto_256_partial_done
+	eor	v15.16b, v15.16b, v15.16b
+	mov	w19, w14
+	st1	{v15.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_256_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_256_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_256_start_byte
+	cbz	x19, L_aes_gcm_decrypt_arm64_crypto_256_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_256_start_byte
+L_aes_gcm_decrypt_arm64_crypto_256_end_bytes
+	sub	x11, x11, x14
+	ld1	{v15.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.2d}, [x11]
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_out_start_dw
+	ldr	x17, [x11], #8
+	sub	w14, w14, #8
+	str	x17, [x1], #8
+L_aes_gcm_decrypt_arm64_crypto_256_out_start_dw
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_out_start_sw
+	ldr	w17, [x11], #4
+	sub	w14, w14, #4
+	str	w17, [x1], #4
+L_aes_gcm_decrypt_arm64_crypto_256_out_start_sw
+	cmp	w14, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	w14, w14, #2
+	strh	w17, [x1], #2
+L_aes_gcm_decrypt_arm64_crypto_256_out_start_byte
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_256_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	w14, w14, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_256_out_start_byte
+L_aes_gcm_decrypt_arm64_crypto_256_out_end_bytes
+L_aes_gcm_decrypt_arm64_crypto_256_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v28.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	ldr	q11, [x9, #-32]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	ldr	q12, [x9, #-16]
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_part_tag
+	ld1	{v28.16b}, [x5]
+	b	L_aes_gcm_decrypt_arm64_crypto_256_tag_loaded
+L_aes_gcm_decrypt_arm64_crypto_256_part_tag
+	ubfiz	x6, x6, #0, #32
+	eor	v28.16b, v28.16b, v28.16b
+	mov	x17, x6
+	st1	{v28.2d}, [x11]
+	cmp	x17, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_tag_start_dw
+	ldr	x16, [x5], #8
+	sub	x17, x17, #8
+	str	x16, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_256_tag_start_dw
+	cmp	x17, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_tag_start_sw
+	ldr	w16, [x5], #4
+	sub	x17, x17, #4
+	str	w16, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_256_tag_start_sw
+	cmp	x17, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_256_tag_start_byte
+	ldrh	w16, [x5], #2
+	sub	x17, x17, #2
+	strh	w16, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_256_tag_start_byte
+	cbz	x17, L_aes_gcm_decrypt_arm64_crypto_256_tag_end_bytes
+	ldrb	w16, [x5], #1
+	subs	x17, x17, #1
+	strb	w16, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_256_tag_start_byte
+L_aes_gcm_decrypt_arm64_crypto_256_tag_end_bytes
+	sub	x11, x11, x6
+	ld1	{v28.2d}, [x11]
+	mov	x17, #16
+	st1	{v26.2d}, [x11]
+	sub	x17, x17, x6
+	add	x11, x11, x6
+L_aes_gcm_decrypt_arm64_crypto_256_calc_tag_byte
+	strb	wzr, [x11], #1
+	subs	x17, x17, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_256_calc_tag_byte
+	subs	x11, x11, #16
+	ld1	{v26.2d}, [x11]
+L_aes_gcm_decrypt_arm64_crypto_256_tag_loaded
+	eor	v28.16b, v28.16b, v26.16b
+	mov	x16, v28.d[0]
+	mov	x17, v28.d[1]
+	mov	w19, #-180
+	orr	x16, x16, x17
+	cmp	x16, #0
+	csetm	x0, ne
+	and	x0, x0, x19
+	ENDIF
+	b	L_aes_gcm_decrypt_arm64_crypto_done
+	; AES_GCM_128
+L_aes_gcm_decrypt_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w14, #32
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_start_4
+L_aes_gcm_decrypt_arm64_crypto_128_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	mov	v14.s[3], w24
+	rev	w23, w23
+	mov	v15.s[3], w23
+	rev	w22, w22
+	mov	v16.s[3], w22
+	rev	w21, w21
+	mov	v17.s[3], w21
+	rev	w20, w20
+	mov	v8.s[3], w20
+	rev	w19, w19
+	mov	v9.s[3], w19
+	rev	w17, w17
+	mov	v10.s[3], w17
+	rev	w16, w15
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_end_8
+L_aes_gcm_decrypt_arm64_crypto_128_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w24
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w23
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w22
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w21
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w20
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w19
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w17
+	rev	w16, w15
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_128_both_8
+L_aes_gcm_decrypt_arm64_crypto_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d}, [x9], #32
+	ld1	{v10.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_128_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w19, w19
+	mov	v15.s[3], w19
+	rev	w17, w17
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_end_4
+L_aes_gcm_decrypt_arm64_crypto_128_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w20
+	rev	w19, w19
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w19
+	rev	w17, w17
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	bge	L_aes_gcm_decrypt_arm64_crypto_128_both_4
+L_aes_gcm_decrypt_arm64_crypto_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_decrypt_arm64_crypto_128_start_1
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_done
+L_aes_gcm_decrypt_arm64_crypto_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w16, w15
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_128_done
+L_aes_gcm_decrypt_arm64_crypto_128_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x0], #16
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_128_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_decrypt_arm64_crypto_128_partial_done
+	eor	v15.16b, v15.16b, v15.16b
+	mov	w19, w14
+	st1	{v15.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_128_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_128_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_128_start_byte
+	cbz	x19, L_aes_gcm_decrypt_arm64_crypto_128_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_128_start_byte
+L_aes_gcm_decrypt_arm64_crypto_128_end_bytes
+	sub	x11, x11, x14
+	ld1	{v15.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.2d}, [x11]
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_out_start_dw
+	ldr	x17, [x11], #8
+	sub	w14, w14, #8
+	str	x17, [x1], #8
+L_aes_gcm_decrypt_arm64_crypto_128_out_start_dw
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_out_start_sw
+	ldr	w17, [x11], #4
+	sub	w14, w14, #4
+	str	w17, [x1], #4
+L_aes_gcm_decrypt_arm64_crypto_128_out_start_sw
+	cmp	w14, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	w14, w14, #2
+	strh	w17, [x1], #2
+L_aes_gcm_decrypt_arm64_crypto_128_out_start_byte
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_128_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	w14, w14, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_128_out_start_byte
+L_aes_gcm_decrypt_arm64_crypto_128_out_end_bytes
+L_aes_gcm_decrypt_arm64_crypto_128_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	ext	v31.16b, v26.16b, v26.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_part_tag
+	ld1	{v28.16b}, [x5]
+	b	L_aes_gcm_decrypt_arm64_crypto_128_tag_loaded
+L_aes_gcm_decrypt_arm64_crypto_128_part_tag
+	ubfiz	x6, x6, #0, #32
+	eor	v28.16b, v28.16b, v28.16b
+	mov	x17, x6
+	st1	{v28.2d}, [x11]
+	cmp	x17, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_tag_start_dw
+	ldr	x16, [x5], #8
+	sub	x17, x17, #8
+	str	x16, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_128_tag_start_dw
+	cmp	x17, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_tag_start_sw
+	ldr	w16, [x5], #4
+	sub	x17, x17, #4
+	str	w16, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_128_tag_start_sw
+	cmp	x17, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_128_tag_start_byte
+	ldrh	w16, [x5], #2
+	sub	x17, x17, #2
+	strh	w16, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_128_tag_start_byte
+	cbz	x17, L_aes_gcm_decrypt_arm64_crypto_128_tag_end_bytes
+	ldrb	w16, [x5], #1
+	subs	x17, x17, #1
+	strb	w16, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_128_tag_start_byte
+L_aes_gcm_decrypt_arm64_crypto_128_tag_end_bytes
+	sub	x11, x11, x6
+	ld1	{v28.2d}, [x11]
+	mov	x17, #16
+	st1	{v26.2d}, [x11]
+	sub	x17, x17, x6
+	add	x11, x11, x6
+L_aes_gcm_decrypt_arm64_crypto_128_calc_tag_byte
+	strb	wzr, [x11], #1
+	subs	x17, x17, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_128_calc_tag_byte
+	subs	x11, x11, #16
+	ld1	{v26.2d}, [x11]
+L_aes_gcm_decrypt_arm64_crypto_128_tag_loaded
+	eor	v28.16b, v28.16b, v26.16b
+	mov	x16, v28.d[0]
+	mov	x17, v28.d[1]
+	mov	w19, #-180
+	orr	x16, x16, x17
+	cmp	x16, #0
+	csetm	x0, ne
+	and	x0, x0, x19
+	ENDIF
+L_aes_gcm_decrypt_arm64_crypto_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldr	x24, [x29, #72]
+	ldp	d8, d9, [x29, #80]
+	ldp	d10, d11, [x29, #96]
+	ldp	d12, d13, [x29, #112]
+	ldp	d14, d15, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_AARCH64_EOR3
+AES_GCM_encrypt_AARCH64_EOR3 PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	str	x24, [x29, #72]
+	stp	d8, d9, [x29, #80]
+	stp	d10, d11, [x29, #96]
+	stp	d12, d13, [x29, #112]
+	stp	d14, d15, [x29, #128]
+	ldr	w8, [x29, #144]
+	ldr	x9, [x29, #152]
+	ldr	x10, [x29, #160]
+	ldr	x11, [x29, #168]
+	ldr	x12, [x29, #176]
+	ldr	w13, [x29, #184]
+	movi	v27.16b, #0x87
+	eor	v26.16b, v26.16b, v26.16b
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x10]
+	cmp	w8, #0x40
+	csetm	x16, lt
+	cmp	w2, #32
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w8, #0x100
+	csetm	x16, lt
+	cmp	w2, #0x40
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w8, #0x400
+	csetm	x16, lt
+	cmp	w2, #0x200
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_encrypt_arm64_crypto_eor3_h_done
+	lsr	w14, w8, #4
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_2
+	cmp	w14, #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_8
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #8
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_8
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_2
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_4
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #4
+	cmp	w14, #4
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_4
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_1
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_2
+	ld1	{v18.16b, v19.16b}, [x7], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #2
+	cmp	w14, #1
+	bgt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_1
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_eor3_aad_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_both_1
+	ld1	{v18.16b}, [x7], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_both_1
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_done
+	and	w14, w8, #15
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_eor3_aad_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w14
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_dw
+	ldr	x19, [x7], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_sw
+	ldr	w19, [x7], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_byte
+	ldrh	w19, [x7], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_byte
+	cbz	w20, L_aes_gcm_encrypt_arm64_crypto_eor3_aad_end_bytes
+	ldrb	w19, [x7], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_aad_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_end_bytes
+	sub	x11, x11, x14
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_aad_partial_done
+	; Load Nonce
+	cmp	w4, #12
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_ghash_nonce
+	ldr	x16, [x3]
+	movi	v13.4s, #1, lsl 24
+	ldr	w17, [x3, #8]
+	mov	v13.d[0], x16
+	mov	v13.s[2], w17
+	mov	w15, #1
+	b	L_aes_gcm_encrypt_arm64_crypto_eor3_done_nonce
+L_aes_gcm_encrypt_arm64_crypto_eor3_ghash_nonce
+	eor	v13.16b, v13.16b, v13.16b
+	lsr	w14, w4, #4
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_1
+	ld1	{v18.16b}, [x3], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_1
+L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_done
+	and	w24, w4, #15
+	cbz	x24, L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w24
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_dw
+	ldr	x19, [x3], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_sw
+	ldr	w19, [x3], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_byte
+	ldrh	w19, [x3], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_byte
+	cbz	w20, L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_end_bytes
+	ldrb	w19, [x3], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_end_bytes
+	sub	x11, x11, x24
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_nonce_partial_done
+	eor	x14, x14, x14
+	ubfiz	x24, x4, #3, #32
+	mov	v28.d[0], x14
+	mov	v28.d[1], x24
+	rev64	v28.16b, v28.16b
+	rbit	v28.16b, v28.16b
+	eor	v13.16b, v13.16b, v28.16b
+	pmull	v28.1q, v13.1d, v22.1d
+	pmull2	v29.1q, v13.2d, v22.2d
+	ext	v31.16b, v13.16b, v13.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	rbit	v13.16b, v13.16b
+	mov	w15, v13.s[3]
+	rev	w15, w15
+L_aes_gcm_encrypt_arm64_crypto_eor3_done_nonce
+	st1	{v13.2d}, [x12]
+	lsr	w14, w2, #4
+	cmp	w13, #12
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_start_128
+	bgt	L_aes_gcm_encrypt_arm64_crypto_eor3_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w14, #32
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	rev	w23, w23
+	rev	w22, w22
+	rev	w21, w21
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_end_8
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_192_both_8
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_end_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_192_both_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_eor3_192_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_192_partial_done
+	eor	v16.16b, v16.16b, v16.16b
+	mov	w19, w14
+	st1	{v16.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_eor3_192_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_end_bytes
+	sub	x11, x11, x14
+	ld1	{v16.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v16.16b, v16.16b, v14.16b
+	st1	{v16.2d}, [x11]
+	mov	w19, w14
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_start_dw
+	ldr	x17, [x11], #8
+	sub	x19, x19, #8
+	str	x17, [x1], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_start_sw
+	ldr	w17, [x11], #4
+	sub	x19, x19, #4
+	str	w17, [x1], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	x19, x19, #2
+	strh	w17, [x1], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	x19, x19, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_out_end_bytes
+	mov	x17, #16
+	sub	x17, x17, x14
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_zero
+	subs	x17, x17, #1
+	strb	wzr, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_192_start_zero
+	sub	x11, x11, #16
+	ld1	{v14.2d}, [x11]
+	rbit	v14.16b, v14.16b
+	eor	v15.16b, v26.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v15.1d, v22.1d
+	pmull2	v29.1q, v15.2d, v22.2d
+	ext	v31.16b, v15.16b, v15.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_partial
+	st1	{v26.16b}, [x5]
+	b	L_aes_gcm_encrypt_arm64_crypto_eor3_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_partial
+	st1	{v26.16b}, [x11]
+	cmp	w6, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_start_dw
+	ldr	x16, [x11], #8
+	sub	w6, w6, #8
+	str	x16, [x5], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_start_dw
+	cmp	w6, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_start_sw
+	ldr	w16, [x11], #4
+	sub	w6, w6, #4
+	str	w16, [x5], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_start_sw
+	cmp	w6, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_start_byte
+	ldrh	w16, [x11], #2
+	sub	w6, w6, #2
+	strh	w16, [x5], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_start_byte
+	cbz	w6, L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_end_bytes
+	ldrb	w16, [x11], #1
+	subs	w6, w6, #1
+	strb	w16, [x5], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_192_tag_end_bytes
+	ENDIF
+	b	L_aes_gcm_encrypt_arm64_crypto_eor3_done
+	; AES_GCM_256
+L_aes_gcm_encrypt_arm64_crypto_eor3_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w14, #32
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	rev	w23, w23
+	rev	w22, w22
+	rev	w21, w21
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_end_8
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_256_both_8
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9], #16
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_end_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_256_both_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_eor3_256_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_256_partial_done
+	eor	v16.16b, v16.16b, v16.16b
+	mov	w19, w14
+	st1	{v16.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_eor3_256_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_end_bytes
+	sub	x11, x11, x14
+	ld1	{v16.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v16.16b, v16.16b, v14.16b
+	st1	{v16.2d}, [x11]
+	mov	w19, w14
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_start_dw
+	ldr	x17, [x11], #8
+	sub	x19, x19, #8
+	str	x17, [x1], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_start_sw
+	ldr	w17, [x11], #4
+	sub	x19, x19, #4
+	str	w17, [x1], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	x19, x19, #2
+	strh	w17, [x1], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	x19, x19, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_out_end_bytes
+	mov	x17, #16
+	sub	x17, x17, x14
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_zero
+	subs	x17, x17, #1
+	strb	wzr, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_256_start_zero
+	sub	x11, x11, #16
+	ld1	{v14.2d}, [x11]
+	rbit	v14.16b, v14.16b
+	eor	v15.16b, v26.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v15.1d, v22.1d
+	pmull2	v29.1q, v15.2d, v22.2d
+	ext	v31.16b, v15.16b, v15.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v28.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	ldr	q11, [x9, #-32]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	ldr	q12, [x9, #-16]
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_partial
+	st1	{v26.16b}, [x5]
+	b	L_aes_gcm_encrypt_arm64_crypto_eor3_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_partial
+	st1	{v26.16b}, [x11]
+	cmp	w6, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_start_dw
+	ldr	x16, [x11], #8
+	sub	w6, w6, #8
+	str	x16, [x5], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_start_dw
+	cmp	w6, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_start_sw
+	ldr	w16, [x11], #4
+	sub	w6, w6, #4
+	str	w16, [x5], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_start_sw
+	cmp	w6, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_start_byte
+	ldrh	w16, [x11], #2
+	sub	w6, w6, #2
+	strh	w16, [x5], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_start_byte
+	cbz	w6, L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_end_bytes
+	ldrb	w16, [x11], #1
+	subs	w6, w6, #1
+	strb	w16, [x5], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_256_tag_end_bytes
+	ENDIF
+	b	L_aes_gcm_encrypt_arm64_crypto_eor3_done
+	; AES_GCM_128
+L_aes_gcm_encrypt_arm64_crypto_eor3_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w14, #32
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	rev	w23, w23
+	rev	w22, w22
+	rev	w21, w21
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_end_8
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	rev	w16, w15
+	mov	v14.s[3], w24
+	mov	v15.s[3], w23
+	mov	v16.s[3], w22
+	mov	v17.s[3], w21
+	mov	v8.s[3], w20
+	mov	v9.s[3], w19
+	mov	v10.s[3], w17
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_128_both_8
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d}, [x9], #32
+	ld1	{v10.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_done
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_end_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rev	w19, w19
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w19
+	mov	v16.s[3], w17
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w14, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x1], #0x40
+	bge	L_aes_gcm_encrypt_arm64_crypto_eor3_128_both_4
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_1
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	rev	w16, w15
+	mov	v14.s[3], w20
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_encrypt_arm64_crypto_eor3_128_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x0], #16
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_encrypt_arm64_crypto_eor3_128_partial_done
+	eor	v16.16b, v16.16b, v16.16b
+	mov	w19, w14
+	st1	{v16.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_eor3_128_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_end_bytes
+	sub	x11, x11, x14
+	ld1	{v16.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v16.16b, v16.16b, v14.16b
+	st1	{v16.2d}, [x11]
+	mov	w19, w14
+	cmp	x19, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_start_dw
+	ldr	x17, [x11], #8
+	sub	x19, x19, #8
+	str	x17, [x1], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_start_sw
+	ldr	w17, [x11], #4
+	sub	x19, x19, #4
+	str	w17, [x1], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	x19, x19, #2
+	strh	w17, [x1], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_start_byte
+	cbz	x19, L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	x19, x19, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_out_end_bytes
+	mov	x17, #16
+	sub	x17, x17, x14
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_zero
+	subs	x17, x17, #1
+	strb	wzr, [x11], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_128_start_zero
+	sub	x11, x11, #16
+	ld1	{v14.2d}, [x11]
+	rbit	v14.16b, v14.16b
+	eor	v15.16b, v26.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v15.1d, v22.1d
+	pmull2	v29.1q, v15.2d, v22.2d
+	ext	v31.16b, v15.16b, v15.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	ext	v31.16b, v26.16b, v26.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_partial
+	st1	{v26.16b}, [x5]
+	b	L_aes_gcm_encrypt_arm64_crypto_eor3_done
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_partial
+	st1	{v26.16b}, [x11]
+	cmp	w6, #8
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_start_dw
+	ldr	x16, [x11], #8
+	sub	w6, w6, #8
+	str	x16, [x5], #8
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_start_dw
+	cmp	w6, #4
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_start_sw
+	ldr	w16, [x11], #4
+	sub	w6, w6, #4
+	str	w16, [x5], #4
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_start_sw
+	cmp	w6, #2
+	blt	L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_start_byte
+	ldrh	w16, [x11], #2
+	sub	w6, w6, #2
+	strh	w16, [x5], #2
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_start_byte
+	cbz	w6, L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_end_bytes
+	ldrb	w16, [x11], #1
+	subs	w6, w6, #1
+	strb	w16, [x5], #1
+	bne	L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_start_byte
+L_aes_gcm_encrypt_arm64_crypto_eor3_128_tag_end_bytes
+	ENDIF
+L_aes_gcm_encrypt_arm64_crypto_eor3_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldr	x24, [x29, #72]
+	ldp	d8, d9, [x29, #80]
+	ldp	d10, d11, [x29, #96]
+	ldp	d12, d13, [x29, #112]
+	ldp	d14, d15, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_decrypt_AARCH64_EOR3
+AES_GCM_decrypt_AARCH64_EOR3 PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	str	x24, [x29, #72]
+	stp	d8, d9, [x29, #80]
+	stp	d10, d11, [x29, #96]
+	stp	d12, d13, [x29, #112]
+	stp	d14, d15, [x29, #128]
+	ldr	w8, [x29, #144]
+	ldr	x9, [x29, #152]
+	ldr	x10, [x29, #160]
+	ldr	x11, [x29, #168]
+	ldr	x12, [x29, #176]
+	ldr	w13, [x29, #184]
+	movi	v27.16b, #0x87
+	eor	v26.16b, v26.16b, v26.16b
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x10]
+	cmp	w8, #0x40
+	csetm	x16, lt
+	cmp	w2, #32
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w8, #0x100
+	csetm	x16, lt
+	cmp	w2, #0x40
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w8, #0x400
+	csetm	x16, lt
+	cmp	w2, #0x200
+	csetm	x17, lt
+	ands	x16, x16, x17
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_decrypt_arm64_crypto_eor3_h_done
+	lsr	w14, w8, #4
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_2
+	cmp	w14, #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_8
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #8
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_8
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_1
+	cmp	w14, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_2
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_4
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x7], #0x40
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #4
+	cmp	w14, #4
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_4
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_1
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_2
+	ld1	{v18.16b, v19.16b}, [x7], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	sub	w14, w14, #2
+	cmp	w14, #1
+	bgt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_1
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_aad_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_both_1
+	ld1	{v18.16b}, [x7], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_both_1
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_done
+	and	w14, w8, #15
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_aad_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w14
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_dw
+	ldr	x19, [x7], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_sw
+	ldr	w19, [x7], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_byte
+	ldrh	w19, [x7], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_byte
+	cbz	w20, L_aes_gcm_decrypt_arm64_crypto_eor3_aad_end_bytes
+	ldrb	w19, [x7], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_aad_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_end_bytes
+	sub	x11, x11, x14
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_eor3_aad_partial_done
+	; Load Nonce
+	cmp	w4, #12
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_ghash_nonce
+	ldr	x16, [x3]
+	movi	v13.4s, #1, lsl 24
+	ldr	w17, [x3, #8]
+	mov	v13.d[0], x16
+	mov	v13.s[2], w17
+	mov	w15, #1
+	b	L_aes_gcm_decrypt_arm64_crypto_eor3_done_nonce
+L_aes_gcm_decrypt_arm64_crypto_eor3_ghash_nonce
+	eor	v13.16b, v13.16b, v13.16b
+	lsr	w14, w4, #4
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_1
+	ld1	{v18.16b}, [x3], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+	subs	w14, w14, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_1
+L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_done
+	and	w24, w4, #15
+	cbz	x24, L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_partial_done
+	eor	v28.16b, v28.16b, v28.16b
+	mov	w20, w24
+	st1	{v28.2d}, [x11]
+	cmp	w20, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_dw
+	ldr	x19, [x3], #8
+	sub	w20, w20, #8
+	str	x19, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_dw
+	cmp	w20, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_sw
+	ldr	w19, [x3], #4
+	sub	w20, w20, #4
+	str	w19, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_sw
+	cmp	w20, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_byte
+	ldrh	w19, [x3], #2
+	sub	w20, w20, #2
+	strh	w19, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_byte
+	cbz	w20, L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_end_bytes
+	ldrb	w19, [x3], #1
+	subs	w20, w20, #1
+	strb	w19, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_end_bytes
+	sub	x11, x11, x24
+	ld1	{v18.2d}, [x11]
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v13.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_eor3_nonce_partial_done
+	eor	x14, x14, x14
+	ubfiz	x24, x4, #3, #32
+	mov	v28.d[0], x14
+	mov	v28.d[1], x24
+	rev64	v28.16b, v28.16b
+	rbit	v28.16b, v28.16b
+	eor	v13.16b, v13.16b, v28.16b
+	pmull	v28.1q, v13.1d, v22.1d
+	pmull2	v29.1q, v13.2d, v22.2d
+	ext	v31.16b, v13.16b, v13.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v13.16b, v28.16b, v30.16b
+	rbit	v13.16b, v13.16b
+	mov	w15, v13.s[3]
+	rev	w15, w15
+L_aes_gcm_decrypt_arm64_crypto_eor3_done_nonce
+	st1	{v13.2d}, [x12]
+	lsr	w14, w2, #4
+	cmp	w13, #12
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_start_128
+	bgt	L_aes_gcm_decrypt_arm64_crypto_eor3_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w14, #32
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	mov	v14.s[3], w24
+	rev	w23, w23
+	mov	v15.s[3], w23
+	rev	w22, w22
+	mov	v16.s[3], w22
+	rev	w21, w21
+	mov	v17.s[3], w21
+	rev	w20, w20
+	mov	v8.s[3], w20
+	rev	w19, w19
+	mov	v9.s[3], w19
+	rev	w17, w17
+	mov	v10.s[3], w17
+	rev	w16, w15
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_end_8
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w24
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w23
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w22
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w21
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w20
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w19
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w17
+	rev	w16, w15
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_192_both_8
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w19, w19
+	mov	v15.s[3], w19
+	rev	w17, w17
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_end_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w20
+	rev	w19, w19
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w19
+	rev	w17, w17
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_192_both_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w16, w15
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_192_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_1
+	ld1	{v15.16b}, [x0], #16
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.16b}, [x1], #16
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_192_partial_done
+	eor	v15.16b, v15.16b, v15.16b
+	mov	w19, w14
+	st1	{v15.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_byte
+	cbz	x19, L_aes_gcm_decrypt_arm64_crypto_eor3_192_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_192_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_end_bytes
+	sub	x11, x11, x14
+	ld1	{v15.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.2d}, [x11]
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_start_dw
+	ldr	x17, [x11], #8
+	sub	w14, w14, #8
+	str	x17, [x1], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_start_dw
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_start_sw
+	ldr	w17, [x11], #4
+	sub	w14, w14, #4
+	str	w17, [x1], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_start_sw
+	cmp	w14, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	w14, w14, #2
+	strh	w17, [x1], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_start_byte
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	w14, w14, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_out_end_bytes
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_part_tag
+	ld1	{v28.16b}, [x5]
+	b	L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_loaded
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_part_tag
+	ubfiz	x6, x6, #0, #32
+	eor	v28.16b, v28.16b, v28.16b
+	mov	x17, x6
+	st1	{v28.2d}, [x11]
+	cmp	x17, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_start_dw
+	ldr	x16, [x5], #8
+	sub	x17, x17, #8
+	str	x16, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_start_dw
+	cmp	x17, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_start_sw
+	ldr	w16, [x5], #4
+	sub	x17, x17, #4
+	str	w16, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_start_sw
+	cmp	x17, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_start_byte
+	ldrh	w16, [x5], #2
+	sub	x17, x17, #2
+	strh	w16, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_start_byte
+	cbz	x17, L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_end_bytes
+	ldrb	w16, [x5], #1
+	subs	x17, x17, #1
+	strb	w16, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_end_bytes
+	sub	x11, x11, x6
+	ld1	{v28.2d}, [x11]
+	mov	x17, #16
+	st1	{v26.2d}, [x11]
+	sub	x17, x17, x6
+	add	x11, x11, x6
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_calc_tag_byte
+	strb	wzr, [x11], #1
+	subs	x17, x17, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_192_calc_tag_byte
+	subs	x11, x11, #16
+	ld1	{v26.2d}, [x11]
+L_aes_gcm_decrypt_arm64_crypto_eor3_192_tag_loaded
+	eor	v28.16b, v28.16b, v26.16b
+	mov	x16, v28.d[0]
+	mov	x17, v28.d[1]
+	mov	w19, #-180
+	orr	x16, x16, x17
+	cmp	x16, #0
+	csetm	x0, ne
+	and	x0, x0, x19
+	ENDIF
+	b	L_aes_gcm_decrypt_arm64_crypto_eor3_done
+	; AES_GCM_256
+L_aes_gcm_decrypt_arm64_crypto_eor3_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w14, #32
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	mov	v14.s[3], w24
+	rev	w23, w23
+	mov	v15.s[3], w23
+	rev	w22, w22
+	mov	v16.s[3], w22
+	rev	w21, w21
+	mov	v17.s[3], w21
+	rev	w20, w20
+	mov	v8.s[3], w20
+	rev	w19, w19
+	mov	v9.s[3], w19
+	rev	w17, w17
+	mov	v10.s[3], w17
+	rev	w16, w15
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_end_8
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w24
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w23
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w22
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w21
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w20
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w19
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w17
+	rev	w16, w15
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_256_both_8
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x9], #0x40
+	ld1	{v12.2d}, [x9], #16
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w19, w19
+	mov	v15.s[3], w19
+	rev	w17, w17
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_end_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w20
+	rev	w19, w19
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w19
+	rev	w17, w17
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_256_both_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w16, w15
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_256_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_256_partial_done
+	eor	v15.16b, v15.16b, v15.16b
+	mov	w19, w14
+	st1	{v15.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_byte
+	cbz	x19, L_aes_gcm_decrypt_arm64_crypto_eor3_256_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_256_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_end_bytes
+	sub	x11, x11, x14
+	ld1	{v15.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	; Done GHASH
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.2d}, [x11]
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_start_dw
+	ldr	x17, [x11], #8
+	sub	w14, w14, #8
+	str	x17, [x1], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_start_dw
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_start_sw
+	ldr	w17, [x11], #4
+	sub	w14, w14, #4
+	str	w17, [x1], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_start_sw
+	cmp	w14, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	w14, w14, #2
+	strh	w17, [x1], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_start_byte
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	w14, w14, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_out_end_bytes
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v28.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v26.16b, v26.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	ldr	q11, [x9, #-32]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	ldr	q12, [x9, #-16]
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x9]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	ldr	q30, [x9, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_part_tag
+	ld1	{v28.16b}, [x5]
+	b	L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_loaded
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_part_tag
+	ubfiz	x6, x6, #0, #32
+	eor	v28.16b, v28.16b, v28.16b
+	mov	x17, x6
+	st1	{v28.2d}, [x11]
+	cmp	x17, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_start_dw
+	ldr	x16, [x5], #8
+	sub	x17, x17, #8
+	str	x16, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_start_dw
+	cmp	x17, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_start_sw
+	ldr	w16, [x5], #4
+	sub	x17, x17, #4
+	str	w16, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_start_sw
+	cmp	x17, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_start_byte
+	ldrh	w16, [x5], #2
+	sub	x17, x17, #2
+	strh	w16, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_start_byte
+	cbz	x17, L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_end_bytes
+	ldrb	w16, [x5], #1
+	subs	x17, x17, #1
+	strb	w16, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_end_bytes
+	sub	x11, x11, x6
+	ld1	{v28.2d}, [x11]
+	mov	x17, #16
+	st1	{v26.2d}, [x11]
+	sub	x17, x17, x6
+	add	x11, x11, x6
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_calc_tag_byte
+	strb	wzr, [x11], #1
+	subs	x17, x17, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_256_calc_tag_byte
+	subs	x11, x11, #16
+	ld1	{v26.2d}, [x11]
+L_aes_gcm_decrypt_arm64_crypto_eor3_256_tag_loaded
+	eor	v28.16b, v28.16b, v26.16b
+	mov	x16, v28.d[0]
+	mov	x17, v28.d[1]
+	mov	w19, #-180
+	orr	x16, x16, x17
+	cmp	x16, #0
+	csetm	x0, ne
+	and	x0, x0, x19
+	ENDIF
+	b	L_aes_gcm_decrypt_arm64_crypto_eor3_done
+	; AES_GCM_128
+L_aes_gcm_decrypt_arm64_crypto_eor3_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w14, #32
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rev	w24, w24
+	mov	v14.s[3], w24
+	rev	w23, w23
+	mov	v15.s[3], w23
+	rev	w22, w22
+	mov	v16.s[3], w22
+	rev	w21, w21
+	mov	v17.s[3], w21
+	rev	w20, w20
+	mov	v8.s[3], w20
+	rev	w19, w19
+	mov	v9.s[3], w19
+	rev	w17, w17
+	mov	v10.s[3], w17
+	rev	w16, w15
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x12]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_end_8
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_both_8
+	ldr	q12, [x9]
+	add	w24, w15, #1
+	mov	v14.16b, v13.16b
+	add	w23, w15, #2
+	mov	v15.16b, v13.16b
+	add	w22, w15, #3
+	mov	v16.16b, v13.16b
+	add	w21, w15, #4
+	mov	v17.16b, v13.16b
+	add	w20, w15, #5
+	mov	v8.16b, v13.16b
+	add	w19, w15, #6
+	mov	v9.16b, v13.16b
+	add	w17, w15, #7
+	mov	v10.16b, v13.16b
+	add	w15, w15, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w24, w24
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w24
+	rev	w23, w23
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w23
+	rev	w22, w22
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w22
+	rev	w21, w21
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w21
+	rev	w20, w20
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w20
+	rev	w19, w19
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w19
+	rev	w17, w17
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w17
+	rev	w16, w15
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w16
+	ldr	q13, [x9, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w14, w14, #8
+	ldr	q12, [x9, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x9, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x0], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x0], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x0], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x0], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x9, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x12]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x1], #0x40
+	cmp	w14, #8
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_128_both_8
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x9], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x9], #0x40
+	ld1	{v8.2d, v9.2d}, [x9], #32
+	ld1	{v10.2d}, [x9]
+	cmp	w14, #1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_done
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_1
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w19, w19
+	mov	v15.s[3], w19
+	rev	w17, w17
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x0], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x0], #16
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_end_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_both_4
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w19, w15, #2
+	mov	v15.16b, v13.16b
+	add	w17, w15, #3
+	mov	v16.16b, v13.16b
+	add	w15, w15, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w20, w20
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w20
+	rev	w19, w19
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w19
+	rev	w17, w17
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w17
+	rev	w16, w15
+	mov	v17.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w14, w14, #4
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x0], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w14, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x1], #0x40
+	bge	L_aes_gcm_decrypt_arm64_crypto_eor3_128_both_4
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w14, #1
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_1
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_2
+	add	w20, w15, #1
+	mov	v14.16b, v13.16b
+	add	w15, w15, #2
+	mov	v15.16b, v13.16b
+	rev	w20, w20
+	mov	v14.s[3], w20
+	rev	w16, w15
+	mov	v15.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w14, w14, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x0], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x0], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x1], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_128_done
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_1
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x0], #16
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x1], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_done
+	ands	w14, w2, #15
+	beq	L_aes_gcm_decrypt_arm64_crypto_eor3_128_partial_done
+	eor	v15.16b, v15.16b, v15.16b
+	mov	w19, w14
+	st1	{v15.2d}, [x11]
+	cmp	x19, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_dw
+	ldr	x17, [x0], #8
+	sub	x19, x19, #8
+	str	x17, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_dw
+	cmp	x19, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_sw
+	ldr	w17, [x0], #4
+	sub	x19, x19, #4
+	str	w17, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_sw
+	cmp	x19, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_byte
+	ldrh	w17, [x0], #2
+	sub	x19, x19, #2
+	strh	w17, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_byte
+	cbz	x19, L_aes_gcm_decrypt_arm64_crypto_eor3_128_end_bytes
+	ldrb	w17, [x0], #1
+	subs	x19, x19, #1
+	strb	w17, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_128_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_end_bytes
+	sub	x11, x11, x14
+	ld1	{v15.2d}, [x11]
+	add	w15, w15, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w16, w15
+	mov	v14.s[3], w16
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.2d}, [x11]
+	cmp	w14, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_start_dw
+	ldr	x17, [x11], #8
+	sub	w14, w14, #8
+	str	x17, [x1], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_start_dw
+	cmp	w14, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_start_sw
+	ldr	w17, [x11], #4
+	sub	w14, w14, #4
+	str	w17, [x1], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_start_sw
+	cmp	w14, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_start_byte
+	ldrh	w17, [x11], #2
+	sub	w14, w14, #2
+	strh	w17, [x1], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_start_byte
+	cbz	w14, L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_end_bytes
+	ldrb	w17, [x11], #1
+	subs	w14, w14, #1
+	strb	w17, [x1], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_out_end_bytes
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_partial_done
+	ld1	{v14.2d}, [x12]
+	ubfiz	x8, x8, #3, #32
+	rbit	x8, x8
+	mov	v28.d[0], x8
+	ubfiz	x2, x2, #3, #32
+	rbit	x2, x2
+	mov	v28.d[1], x2
+	eor	v26.16b, v26.16b, v28.16b
+	pmull	v28.1q, v26.1d, v22.1d
+	pmull2	v29.1q, v26.2d, v22.2d
+	ext	v31.16b, v26.16b, v26.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v26.16b, v26.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v26.16b, v26.16b, v14.16b
+	cmp	w6, #16
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_part_tag
+	ld1	{v28.16b}, [x5]
+	b	L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_loaded
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_part_tag
+	ubfiz	x6, x6, #0, #32
+	eor	v28.16b, v28.16b, v28.16b
+	mov	x17, x6
+	st1	{v28.2d}, [x11]
+	cmp	x17, #8
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_start_dw
+	ldr	x16, [x5], #8
+	sub	x17, x17, #8
+	str	x16, [x11], #8
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_start_dw
+	cmp	x17, #4
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_start_sw
+	ldr	w16, [x5], #4
+	sub	x17, x17, #4
+	str	w16, [x11], #4
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_start_sw
+	cmp	x17, #2
+	blt	L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_start_byte
+	ldrh	w16, [x5], #2
+	sub	x17, x17, #2
+	strh	w16, [x11], #2
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_start_byte
+	cbz	x17, L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_end_bytes
+	ldrb	w16, [x5], #1
+	subs	x17, x17, #1
+	strb	w16, [x11], #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_start_byte
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_end_bytes
+	sub	x11, x11, x6
+	ld1	{v28.2d}, [x11]
+	mov	x17, #16
+	st1	{v26.2d}, [x11]
+	sub	x17, x17, x6
+	add	x11, x11, x6
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_calc_tag_byte
+	strb	wzr, [x11], #1
+	subs	x17, x17, #1
+	bne	L_aes_gcm_decrypt_arm64_crypto_eor3_128_calc_tag_byte
+	subs	x11, x11, #16
+	ld1	{v26.2d}, [x11]
+L_aes_gcm_decrypt_arm64_crypto_eor3_128_tag_loaded
+	eor	v28.16b, v28.16b, v26.16b
+	mov	x16, v28.d[0]
+	mov	x17, v28.d[1]
+	mov	w19, #-180
+	orr	x16, x16, x17
+	cmp	x16, #0
+	csetm	x0, ne
+	and	x0, x0, x19
+	ENDIF
+L_aes_gcm_decrypt_arm64_crypto_eor3_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldr	x24, [x29, #72]
+	ldp	d8, d9, [x29, #80]
+	ldp	d10, d11, [x29, #96]
+	ldp	d12, d13, [x29, #112]
+	ldp	d14, d15, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	IF :DEF:WOLFSSL_AESGCM_STREAM
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_init_AARCH64
+AES_GCM_init_AARCH64 PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	movi	v6.16b, #0x87
+	ld1	{v5.2d}, [x4]
+	ushr	v6.2d, v6.2d, #56
+	; Load Nonce
+	cmp	w3, #12
+	bne	L_aes_gcm_init_arm64_crypto_ghash_nonce
+	ldr	x9, [x2]
+	movi	v4.4s, #1, lsl 24
+	ldr	w10, [x2, #8]
+	mov	v4.d[0], x9
+	mov	v4.s[2], w10
+	mov	w8, #1
+	b	L_aes_gcm_init_arm64_crypto_done_nonce
+L_aes_gcm_init_arm64_crypto_ghash_nonce
+	eor	v4.16b, v4.16b, v4.16b
+	lsr	w7, w3, #4
+	cbz	w7, L_aes_gcm_init_arm64_crypto_done
+L_aes_gcm_init_arm64_crypto_start_1
+	ld1	{v0.16b}, [x2], #16
+	rbit	v0.16b, v0.16b
+	eor	v3.16b, v4.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v7.1q, v3.1d, v5.1d
+	pmull2	v8.1q, v3.2d, v5.2d
+	ext	v10.16b, v3.16b, v3.16b, #8
+	pmull	v9.1q, v10.1d, v5.1d
+	pmull2	v10.1q, v10.2d, v5.2d
+	eor	v9.16b, v9.16b, v10.16b
+	;   Reduce
+	ext	v10.16b, v7.16b, v8.16b, #8
+	pmull2	v8.1q, v8.2d, v6.2d
+	eor	v10.16b, v10.16b, v8.16b
+	eor	v10.16b, v10.16b, v9.16b
+	pmull2	v9.1q, v10.2d, v6.2d
+	mov	v7.d[1], v10.d[0]
+	eor	v4.16b, v7.16b, v9.16b
+	; Done GHASH
+	subs	w7, w7, #1
+	bne	L_aes_gcm_init_arm64_crypto_start_1
+L_aes_gcm_init_arm64_crypto_done
+	and	w13, w3, #15
+	cbz	x13, L_aes_gcm_init_arm64_crypto_partial_done
+	eor	v7.16b, v7.16b, v7.16b
+	mov	w12, w13
+	st1	{v7.2d}, [x6]
+	cmp	w12, #8
+	blt	L_aes_gcm_init_arm64_crypto_start_dw
+	ldr	x11, [x2], #8
+	sub	w12, w12, #8
+	str	x11, [x6], #8
+L_aes_gcm_init_arm64_crypto_start_dw
+	cmp	w12, #4
+	blt	L_aes_gcm_init_arm64_crypto_start_sw
+	ldr	w11, [x2], #4
+	sub	w12, w12, #4
+	str	w11, [x6], #4
+L_aes_gcm_init_arm64_crypto_start_sw
+	cmp	w12, #2
+	blt	L_aes_gcm_init_arm64_crypto_start_byte
+	ldrh	w11, [x2], #2
+	sub	w12, w12, #2
+	strh	w11, [x6], #2
+L_aes_gcm_init_arm64_crypto_start_byte
+	cbz	w12, L_aes_gcm_init_arm64_crypto_end_bytes
+	ldrb	w11, [x2], #1
+	subs	w12, w12, #1
+	strb	w11, [x6], #1
+	bne	L_aes_gcm_init_arm64_crypto_start_byte
+L_aes_gcm_init_arm64_crypto_end_bytes
+	sub	x6, x6, x13
+	ld1	{v0.2d}, [x6]
+	rbit	v0.16b, v0.16b
+	eor	v3.16b, v4.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v7.1q, v3.1d, v5.1d
+	pmull2	v8.1q, v3.2d, v5.2d
+	ext	v10.16b, v3.16b, v3.16b, #8
+	pmull	v9.1q, v10.1d, v5.1d
+	pmull2	v10.1q, v10.2d, v5.2d
+	eor	v9.16b, v9.16b, v10.16b
+	;   Reduce
+	ext	v10.16b, v7.16b, v8.16b, #8
+	pmull2	v8.1q, v8.2d, v6.2d
+	eor	v10.16b, v10.16b, v8.16b
+	eor	v10.16b, v10.16b, v9.16b
+	pmull2	v9.1q, v10.2d, v6.2d
+	mov	v7.d[1], v10.d[0]
+	eor	v4.16b, v7.16b, v9.16b
+	; Done GHASH
+L_aes_gcm_init_arm64_crypto_partial_done
+	eor	x7, x7, x7
+	ubfiz	x13, x3, #3, #32
+	mov	v7.d[0], x7
+	mov	v7.d[1], x13
+	rev64	v7.16b, v7.16b
+	rbit	v7.16b, v7.16b
+	eor	v4.16b, v4.16b, v7.16b
+	pmull	v7.1q, v4.1d, v5.1d
+	pmull2	v8.1q, v4.2d, v5.2d
+	ext	v10.16b, v4.16b, v4.16b, #8
+	pmull	v9.1q, v10.1d, v5.1d
+	pmull2	v10.1q, v10.2d, v5.2d
+	eor	v9.16b, v9.16b, v10.16b
+	ext	v10.16b, v7.16b, v8.16b, #8
+	pmull2	v8.1q, v8.2d, v6.2d
+	eor	v10.16b, v10.16b, v8.16b
+	eor	v10.16b, v10.16b, v9.16b
+	pmull2	v9.1q, v10.2d, v6.2d
+	mov	v7.d[1], v10.d[0]
+	eor	v4.16b, v7.16b, v9.16b
+	rbit	v4.16b, v4.16b
+	mov	w8, v4.s[3]
+	rev	w8, w8
+L_aes_gcm_init_arm64_crypto_done_nonce
+	st1	{v4.2d}, [x5]
+	ld1	{v7.2d, v8.2d, v9.2d, v10.2d}, [x0], #0x40
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v9.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v10.16b
+	aesmc	v4.16b, v4.16b
+	ld1	{v7.2d, v8.2d, v9.2d, v10.2d}, [x0], #0x40
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v9.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v10.16b
+	aesmc	v4.16b, v4.16b
+	subs	w1, w1, #10
+	ld1	{v7.2d, v8.2d}, [x0], #32
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	beq	L_aes_gcm_init_arm64_crypto_round_done
+	ld1	{v7.2d, v8.2d}, [x0], #32
+	subs	w1, w1, #2
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	beq	L_aes_gcm_init_arm64_crypto_round_done
+	ld1	{v7.2d, v8.2d}, [x0], #32
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+L_aes_gcm_init_arm64_crypto_round_done
+	ld1	{v7.2d}, [x0]
+	eor	v4.16b, v4.16b, v7.16b
+	st1	{v4.2d}, [x6]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_ghash_block_AARCH64
+AES_GCM_ghash_block_AARCH64 PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	ld1	{v6.2d}, [x1]
+	movi	v7.16b, #0x87
+	ld1	{v5.2d}, [x2]
+	ushr	v7.2d, v7.2d, #56
+	ld1	{v4.2d}, [x0]
+	rbit	v4.16b, v4.16b
+	eor	v8.16b, v6.16b, v4.16b
+	;   X  = C * H^1
+	pmull	v0.1q, v8.1d, v5.1d
+	pmull2	v1.1q, v8.2d, v5.2d
+	ext	v3.16b, v8.16b, v8.16b, #8
+	pmull	v2.1q, v3.1d, v5.1d
+	pmull2	v3.1q, v3.2d, v5.2d
+	eor	v2.16b, v2.16b, v3.16b
+	;   Reduce
+	ext	v3.16b, v0.16b, v1.16b, #8
+	pmull2	v1.1q, v1.2d, v7.2d
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v3.16b, v3.16b, v2.16b
+	pmull2	v2.1q, v3.2d, v7.2d
+	mov	v0.d[1], v3.d[0]
+	eor	v6.16b, v0.16b, v2.16b
+	; Done GHASH
+	st1	{v6.2d}, [x1]
+	ldp	d8, d9, [x29, #16]
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_aad_update_AARCH64
+AES_GCM_aad_update_AARCH64 PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	ld1	{v20.2d}, [x2]
+	movi	v21.16b, #0x87
+	ld1	{v12.2d}, [x3]
+	ushr	v21.2d, v21.2d, #56
+	cmp	x1, #0x40
+	blt	L_aes_gcm_aad_update_arm64_crypto_h_done
+	; Square H => H^2
+	pmull2	v11.1q, v12.2d, v12.2d
+	pmull	v10.1q, v12.1d, v12.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v13.16b, v10.16b, v11.16b
+	cmp	x1, #0x100
+	blt	L_aes_gcm_aad_update_arm64_crypto_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v8.1q, v12.1d, v13.1d
+	pmull2	v9.1q, v12.2d, v13.2d
+	ext	v11.16b, v12.16b, v12.16b, #8
+	pmull	v10.1q, v11.1d, v13.1d
+	pmull2	v11.1q, v11.2d, v13.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v14.16b, v8.16b, v10.16b
+	; Square H^2 => H^4
+	pmull2	v11.1q, v13.2d, v13.2d
+	pmull	v10.1q, v13.1d, v13.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v15.16b, v10.16b, v11.16b
+	; Done
+	cmp	x1, #0x400
+	blt	L_aes_gcm_aad_update_arm64_crypto_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v8.1q, v12.1d, v15.1d
+	pmull2	v9.1q, v12.2d, v15.2d
+	ext	v11.16b, v12.16b, v12.16b, #8
+	pmull	v10.1q, v11.1d, v15.1d
+	pmull2	v11.1q, v11.2d, v15.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v16.16b, v8.16b, v10.16b
+	; Square H^3 => H^6
+	pmull2	v11.1q, v14.2d, v14.2d
+	pmull	v10.1q, v14.1d, v14.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v17.16b, v10.16b, v11.16b
+	; Multiply H and H^6  => H^7
+	pmull	v8.1q, v12.1d, v17.1d
+	pmull2	v9.1q, v12.2d, v17.2d
+	ext	v11.16b, v12.16b, v12.16b, #8
+	pmull	v10.1q, v11.1d, v17.1d
+	pmull2	v11.1q, v11.2d, v17.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v18.16b, v8.16b, v10.16b
+	; Square H^4 => H^8
+	pmull2	v11.1q, v15.2d, v15.2d
+	pmull	v10.1q, v15.1d, v15.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v19.16b, v10.16b, v11.16b
+	; Done
+L_aes_gcm_aad_update_arm64_crypto_h_done
+	lsr	x1, x1, #4
+	cmp	x1, #4
+	blt	L_aes_gcm_aad_update_arm64_crypto_start_1
+	cmp	x1, #16
+	blt	L_aes_gcm_aad_update_arm64_crypto_start_2
+	cmp	x1, #0x40
+	blt	L_aes_gcm_aad_update_arm64_crypto_start_4
+L_aes_gcm_aad_update_arm64_crypto_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	rbit	v4.16b, v4.16b
+	rbit	v5.16b, v5.16b
+	rbit	v6.16b, v6.16b
+	rbit	v7.16b, v7.16b
+	eor	v0.16b, v0.16b, v20.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v7.1d, v12.1d
+	pmull2	v9.1q, v7.2d, v12.2d
+	ext	v11.16b, v7.16b, v7.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   X += C * H^2
+	pmull	v11.1q, v13.1d, v6.1d
+	pmull2	v20.1q, v13.2d, v6.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v6.16b, v6.16b, #8
+	pmull	v11.1q, v20.1d, v13.1d
+	pmull2	v20.1q, v20.2d, v13.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^3
+	pmull	v11.1q, v14.1d, v5.1d
+	pmull2	v20.1q, v14.2d, v5.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v5.16b, v5.16b, #8
+	pmull	v11.1q, v20.1d, v14.1d
+	pmull2	v20.1q, v20.2d, v14.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^4
+	pmull	v11.1q, v15.1d, v4.1d
+	pmull2	v20.1q, v15.2d, v4.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v4.16b, v4.16b, #8
+	pmull	v11.1q, v20.1d, v15.1d
+	pmull2	v20.1q, v20.2d, v15.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^5
+	pmull	v11.1q, v16.1d, v3.1d
+	pmull2	v20.1q, v16.2d, v3.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v3.16b, v3.16b, #8
+	pmull	v11.1q, v20.1d, v16.1d
+	pmull2	v20.1q, v20.2d, v16.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^6
+	pmull	v11.1q, v17.1d, v2.1d
+	pmull2	v20.1q, v17.2d, v2.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v2.16b, v2.16b, #8
+	pmull	v11.1q, v20.1d, v17.1d
+	pmull2	v20.1q, v20.2d, v17.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^7
+	pmull	v11.1q, v18.1d, v1.1d
+	pmull2	v20.1q, v18.2d, v1.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v1.16b, v1.16b, #8
+	pmull	v11.1q, v20.1d, v18.1d
+	pmull2	v20.1q, v20.2d, v18.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^8
+	pmull	v11.1q, v19.1d, v0.1d
+	pmull2	v20.1q, v19.2d, v0.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v0.16b, v0.16b, #8
+	pmull	v11.1q, v20.1d, v19.1d
+	pmull2	v20.1q, v20.2d, v19.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	sub	x1, x1, #8
+	cmp	x1, #8
+	bge	L_aes_gcm_aad_update_arm64_crypto_start_8
+	cmp	x1, #1
+	blt	L_aes_gcm_aad_update_arm64_crypto_done
+	beq	L_aes_gcm_aad_update_arm64_crypto_start_1
+	cmp	x1, #16
+	blt	L_aes_gcm_aad_update_arm64_crypto_start_2
+L_aes_gcm_aad_update_arm64_crypto_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v0.16b, v0.16b, v20.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v3.1d, v12.1d
+	pmull2	v9.1q, v3.2d, v12.2d
+	ext	v11.16b, v3.16b, v3.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   X += C * H^2
+	pmull	v11.1q, v13.1d, v2.1d
+	pmull2	v20.1q, v13.2d, v2.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v2.16b, v2.16b, #8
+	pmull	v11.1q, v20.1d, v13.1d
+	pmull2	v20.1q, v20.2d, v13.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^3
+	pmull	v11.1q, v14.1d, v1.1d
+	pmull2	v20.1q, v14.2d, v1.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v1.16b, v1.16b, #8
+	pmull	v11.1q, v20.1d, v14.1d
+	pmull2	v20.1q, v20.2d, v14.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   X += C * H^4
+	pmull	v11.1q, v15.1d, v0.1d
+	pmull2	v20.1q, v15.2d, v0.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v0.16b, v0.16b, #8
+	pmull	v11.1q, v20.1d, v15.1d
+	pmull2	v20.1q, v20.2d, v15.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	sub	x1, x1, #4
+	cmp	x1, #4
+	bge	L_aes_gcm_aad_update_arm64_crypto_start_4
+	cmp	x1, #1
+	blt	L_aes_gcm_aad_update_arm64_crypto_done
+	beq	L_aes_gcm_aad_update_arm64_crypto_start_1
+L_aes_gcm_aad_update_arm64_crypto_start_2
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	eor	v3.16b, v20.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v1.1d, v12.1d
+	pmull2	v9.1q, v1.2d, v12.2d
+	ext	v11.16b, v1.16b, v1.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   X += C * H^2
+	pmull	v11.1q, v13.1d, v3.1d
+	pmull2	v20.1q, v13.2d, v3.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v3.16b, v3.16b, #8
+	pmull	v11.1q, v20.1d, v13.1d
+	pmull2	v20.1q, v20.2d, v13.2d
+	eor	v20.16b, v20.16b, v11.16b
+	eor	v10.16b, v10.16b, v20.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	sub	x1, x1, #2
+	cmp	x1, #1
+	bgt	L_aes_gcm_aad_update_arm64_crypto_start_2
+	blt	L_aes_gcm_aad_update_arm64_crypto_done
+L_aes_gcm_aad_update_arm64_crypto_start_1
+	cbz	x1, L_aes_gcm_aad_update_arm64_crypto_done
+L_aes_gcm_aad_update_arm64_crypto_both_1
+	ld1	{v0.16b}, [x0], #16
+	rbit	v0.16b, v0.16b
+	eor	v3.16b, v20.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v3.1d, v12.1d
+	pmull2	v9.1q, v3.2d, v12.2d
+	ext	v11.16b, v3.16b, v3.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v11.16b, v11.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	subs	x1, x1, #1
+	bne	L_aes_gcm_aad_update_arm64_crypto_both_1
+L_aes_gcm_aad_update_arm64_crypto_done
+	st1	{v20.2d}, [x2]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_block_AARCH64
+AES_GCM_encrypt_block_AARCH64 PROC
+	ld1	{v5.2d}, [x4]
+	ld1	{v4.2d}, [x3]
+	mov	w5, v5.s[3]
+	rev	w5, w5
+	add	w5, w5, #1
+	rev	w5, w5
+	mov	v5.s[3], w5
+	st1	{v5.2d}, [x4]
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v2.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v3.16b
+	aesmc	v5.16b, v5.16b
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v2.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v3.16b
+	aesmc	v5.16b, v5.16b
+	subs	w1, w1, #10
+	ld1	{v0.2d, v1.2d}, [x0], #32
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	beq	L_aes_gcm_encrypt_block_arm64_crypto_round_done
+	ld1	{v0.2d, v1.2d}, [x0], #32
+	subs	w1, w1, #2
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	beq	L_aes_gcm_encrypt_block_arm64_crypto_round_done
+	ld1	{v0.2d, v1.2d}, [x0], #32
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+L_aes_gcm_encrypt_block_arm64_crypto_round_done
+	ld1	{v0.2d}, [x0]
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v5.16b
+	st1	{v4.2d}, [x2]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_update_AARCH64
+AES_GCM_encrypt_update_AARCH64 PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	stp	d8, d9, [x29, #32]
+	stp	d10, d11, [x29, #48]
+	stp	d12, d13, [x29, #64]
+	stp	d14, d15, [x29, #80]
+	ld1	{v13.2d}, [x7]
+	movi	v27.16b, #0x87
+	ld1	{v26.2d}, [x5]
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x6]
+	mov	w9, v13.s[3]
+	rev	w9, w9
+	cmp	w4, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w4, #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w4, #0x200
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_encrypt_update_arm64_crypto_h_done
+	lsr	w8, w4, #4
+	cmp	x1, #12
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_start_128
+	bgt	L_aes_gcm_encrypt_update_arm64_crypto_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w8, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_192_start_4
+L_aes_gcm_encrypt_update_arm64_crypto_192_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	rev	w16, w16
+	rev	w15, w15
+	rev	w14, w14
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_192_end_8
+L_aes_gcm_encrypt_update_arm64_crypto_192_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_192_both_8
+L_aes_gcm_encrypt_update_arm64_crypto_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_192_done
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_192_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_192_end_4
+L_aes_gcm_encrypt_update_arm64_crypto_192_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rbit	v19.16b, v19.16b
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_192_both_4
+L_aes_gcm_encrypt_update_arm64_crypto_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_192_start_1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_192_done
+L_aes_gcm_encrypt_update_arm64_crypto_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_encrypt_update_arm64_crypto_192_done
+L_aes_gcm_encrypt_update_arm64_crypto_192_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_192_done
+	ENDIF
+	b	L_aes_gcm_encrypt_update_arm64_crypto_done
+	; AES_GCM_256
+L_aes_gcm_encrypt_update_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w8, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_256_start_4
+L_aes_gcm_encrypt_update_arm64_crypto_256_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	rev	w16, w16
+	rev	w15, w15
+	rev	w14, w14
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_256_end_8
+L_aes_gcm_encrypt_update_arm64_crypto_256_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_256_both_8
+L_aes_gcm_encrypt_update_arm64_crypto_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0], #16
+	cmp	w8, #1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_256_done
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_256_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_256_end_4
+L_aes_gcm_encrypt_update_arm64_crypto_256_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rbit	v19.16b, v19.16b
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_256_both_4
+L_aes_gcm_encrypt_update_arm64_crypto_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_256_start_1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_256_done
+L_aes_gcm_encrypt_update_arm64_crypto_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_encrypt_update_arm64_crypto_256_done
+L_aes_gcm_encrypt_update_arm64_crypto_256_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x0, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_256_done
+	ENDIF
+	b	L_aes_gcm_encrypt_update_arm64_crypto_done
+	; AES_GCM_128
+L_aes_gcm_encrypt_update_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w8, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_128_start_4
+L_aes_gcm_encrypt_update_arm64_crypto_128_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	rev	w16, w16
+	rev	w15, w15
+	rev	w14, w14
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_128_end_8
+L_aes_gcm_encrypt_update_arm64_crypto_128_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_128_both_8
+L_aes_gcm_encrypt_update_arm64_crypto_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d}, [x0], #32
+	ld1	{v10.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_128_done
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_128_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_128_end_4
+L_aes_gcm_encrypt_update_arm64_crypto_128_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rbit	v19.16b, v19.16b
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_128_both_4
+L_aes_gcm_encrypt_update_arm64_crypto_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_128_start_1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_128_done
+L_aes_gcm_encrypt_update_arm64_crypto_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_encrypt_update_arm64_crypto_128_done
+L_aes_gcm_encrypt_update_arm64_crypto_128_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x3], #16
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_128_done
+	ENDIF
+L_aes_gcm_encrypt_update_arm64_crypto_done
+	rev	w9, w9
+	mov	v13.s[3], w9
+	st1	{v26.2d}, [x5]
+	st1	{v13.2d}, [x7]
+	ldr	x17, [x29, #24]
+	ldp	d8, d9, [x29, #32]
+	ldp	d10, d11, [x29, #48]
+	ldp	d12, d13, [x29, #64]
+	ldp	d14, d15, [x29, #80]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_final_AARCH64
+AES_GCM_encrypt_final_AARCH64 PROC
+	ld1	{v5.2d}, [x0]
+	movi	v6.16b, #0x87
+	ld1	{v4.2d}, [x5]
+	ushr	v6.2d, v6.2d, #56
+	ld1	{v7.2d}, [x6]
+	ubfiz	x4, x4, #3, #32
+	rbit	x4, x4
+	mov	v0.d[0], x4
+	ubfiz	x3, x3, #3, #32
+	rbit	x3, x3
+	mov	v0.d[1], x3
+	eor	v5.16b, v5.16b, v0.16b
+	pmull	v0.1q, v5.1d, v4.1d
+	pmull2	v1.1q, v5.2d, v4.2d
+	ext	v3.16b, v5.16b, v5.16b, #8
+	pmull	v2.1q, v3.1d, v4.1d
+	pmull2	v3.1q, v3.2d, v4.2d
+	eor	v2.16b, v2.16b, v3.16b
+	;   Reduce
+	ext	v3.16b, v0.16b, v1.16b, #8
+	pmull2	v1.1q, v1.2d, v6.2d
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v3.16b, v3.16b, v2.16b
+	pmull2	v2.1q, v3.2d, v6.2d
+	mov	v0.d[1], v3.d[0]
+	eor	v5.16b, v0.16b, v2.16b
+	rbit	v5.16b, v5.16b
+	eor	v5.16b, v5.16b, v7.16b
+	cmp	w2, #16
+	bne	L_aes_gcm_encrypt_final_arm64_crypto_tag_partial
+	st1	{v5.16b}, [x1]
+	b	L_aes_gcm_encrypt_final_arm64_crypto_done
+L_aes_gcm_encrypt_final_arm64_crypto_tag_partial
+	st1	{v5.16b}, [x0]
+	cmp	w2, #8
+	blt	L_aes_gcm_encrypt_final_arm64_crypto_tag_start_dw
+	ldr	x8, [x0], #8
+	sub	w2, w2, #8
+	str	x8, [x1], #8
+L_aes_gcm_encrypt_final_arm64_crypto_tag_start_dw
+	cmp	w2, #4
+	blt	L_aes_gcm_encrypt_final_arm64_crypto_tag_start_sw
+	ldr	w8, [x0], #4
+	sub	w2, w2, #4
+	str	w8, [x1], #4
+L_aes_gcm_encrypt_final_arm64_crypto_tag_start_sw
+	cmp	w2, #2
+	blt	L_aes_gcm_encrypt_final_arm64_crypto_tag_start_byte
+	ldrh	w8, [x0], #2
+	sub	w2, w2, #2
+	strh	w8, [x1], #2
+L_aes_gcm_encrypt_final_arm64_crypto_tag_start_byte
+	cbz	w2, L_aes_gcm_encrypt_final_arm64_crypto_tag_end_bytes
+	ldrb	w8, [x0], #1
+	subs	w2, w2, #1
+	strb	w8, [x1], #1
+	bne	L_aes_gcm_encrypt_final_arm64_crypto_tag_start_byte
+L_aes_gcm_encrypt_final_arm64_crypto_tag_end_bytes
+L_aes_gcm_encrypt_final_arm64_crypto_done
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_decrypt_update_AARCH64
+AES_GCM_decrypt_update_AARCH64 PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	stp	d8, d9, [x29, #32]
+	stp	d10, d11, [x29, #48]
+	stp	d12, d13, [x29, #64]
+	stp	d14, d15, [x29, #80]
+	ld1	{v13.2d}, [x7]
+	movi	v27.16b, #0x87
+	ld1	{v26.2d}, [x5]
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x6]
+	mov	w9, v13.s[3]
+	rev	w9, w9
+	cmp	w4, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w4, #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w4, #0x200
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_decrypt_update_arm64_crypto_h_done
+	lsr	w8, w4, #4
+	cmp	x1, #12
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_start_128
+	bgt	L_aes_gcm_decrypt_update_arm64_crypto_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w8, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_192_start_4
+L_aes_gcm_decrypt_update_arm64_crypto_192_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	mov	v14.s[3], w17
+	rev	w16, w16
+	mov	v15.s[3], w16
+	rev	w15, w15
+	mov	v16.s[3], w15
+	rev	w14, w14
+	mov	v17.s[3], w14
+	rev	w13, w13
+	mov	v8.s[3], w13
+	rev	w12, w12
+	mov	v9.s[3], w12
+	rev	w11, w11
+	mov	v10.s[3], w11
+	rev	w10, w9
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_192_end_8
+L_aes_gcm_decrypt_update_arm64_crypto_192_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w17
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w16
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w15
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w14
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w13
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w12
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w11
+	rev	w10, w9
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_192_both_8
+L_aes_gcm_decrypt_update_arm64_crypto_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_192_done
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_192_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w12, w12
+	mov	v15.s[3], w12
+	rev	w11, w11
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_192_end_4
+L_aes_gcm_decrypt_update_arm64_crypto_192_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w13
+	rev	w12, w12
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w12
+	rev	w11, w11
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_192_both_4
+L_aes_gcm_decrypt_update_arm64_crypto_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_192_start_1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_192_done
+L_aes_gcm_decrypt_update_arm64_crypto_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w10, w9
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_decrypt_update_arm64_crypto_192_done
+L_aes_gcm_decrypt_update_arm64_crypto_192_start_1
+	ld1	{v15.16b}, [x3], #16
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.16b}, [x2], #16
+L_aes_gcm_decrypt_update_arm64_crypto_192_done
+	ENDIF
+	b	L_aes_gcm_decrypt_update_arm64_crypto_done
+	; AES_GCM_256
+L_aes_gcm_decrypt_update_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w8, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_256_start_4
+L_aes_gcm_decrypt_update_arm64_crypto_256_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	mov	v14.s[3], w17
+	rev	w16, w16
+	mov	v15.s[3], w16
+	rev	w15, w15
+	mov	v16.s[3], w15
+	rev	w14, w14
+	mov	v17.s[3], w14
+	rev	w13, w13
+	mov	v8.s[3], w13
+	rev	w12, w12
+	mov	v9.s[3], w12
+	rev	w11, w11
+	mov	v10.s[3], w11
+	rev	w10, w9
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_256_end_8
+L_aes_gcm_decrypt_update_arm64_crypto_256_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w17
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w16
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w15
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w14
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w13
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w12
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w11
+	rev	w10, w9
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_256_both_8
+L_aes_gcm_decrypt_update_arm64_crypto_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0], #16
+	cmp	w8, #1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_256_done
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_256_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w12, w12
+	mov	v15.s[3], w12
+	rev	w11, w11
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_256_end_4
+L_aes_gcm_decrypt_update_arm64_crypto_256_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w13
+	rev	w12, w12
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w12
+	rev	w11, w11
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_256_both_4
+L_aes_gcm_decrypt_update_arm64_crypto_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_256_start_1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_256_done
+L_aes_gcm_decrypt_update_arm64_crypto_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w10, w9
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_decrypt_update_arm64_crypto_256_done
+L_aes_gcm_decrypt_update_arm64_crypto_256_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x0, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_256_done
+	ENDIF
+	b	L_aes_gcm_decrypt_update_arm64_crypto_done
+	; AES_GCM_128
+L_aes_gcm_decrypt_update_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w8, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_128_start_4
+L_aes_gcm_decrypt_update_arm64_crypto_128_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	mov	v14.s[3], w17
+	rev	w16, w16
+	mov	v15.s[3], w16
+	rev	w15, w15
+	mov	v16.s[3], w15
+	rev	w14, w14
+	mov	v17.s[3], w14
+	rev	w13, w13
+	mov	v8.s[3], w13
+	rev	w12, w12
+	mov	v9.s[3], w12
+	rev	w11, w11
+	mov	v10.s[3], w11
+	rev	w10, w9
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_128_end_8
+L_aes_gcm_decrypt_update_arm64_crypto_128_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w17
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w16
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w15
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w14
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w13
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w12
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w11
+	rev	w10, w9
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_128_both_8
+L_aes_gcm_decrypt_update_arm64_crypto_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d}, [x0], #32
+	ld1	{v10.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_128_done
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_128_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w12, w12
+	mov	v15.s[3], w12
+	rev	w11, w11
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_128_end_4
+L_aes_gcm_decrypt_update_arm64_crypto_128_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w13
+	rev	w12, w12
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w12
+	rev	w11, w11
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v26.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor	v31.16b, v31.16b, v29.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	eor	v31.16b, v31.16b, v30.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_128_both_4
+L_aes_gcm_decrypt_update_arm64_crypto_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_128_start_1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_128_done
+L_aes_gcm_decrypt_update_arm64_crypto_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w10, w9
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor	v26.16b, v26.16b, v31.16b
+	eor	v30.16b, v30.16b, v26.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_decrypt_update_arm64_crypto_128_done
+L_aes_gcm_decrypt_update_arm64_crypto_128_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x3], #16
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor	v31.16b, v31.16b, v29.16b
+	eor	v31.16b, v31.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_128_done
+	ENDIF
+L_aes_gcm_decrypt_update_arm64_crypto_done
+	rev	w9, w9
+	mov	v13.s[3], w9
+	st1	{v26.2d}, [x5]
+	st1	{v13.2d}, [x7]
+	ldr	x17, [x29, #24]
+	ldp	d8, d9, [x29, #32]
+	ldp	d10, d11, [x29, #48]
+	ldp	d12, d13, [x29, #64]
+	ldp	d14, d15, [x29, #80]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_decrypt_final_AARCH64
+AES_GCM_decrypt_final_AARCH64 PROC
+	ld1	{v5.2d}, [x0]
+	movi	v6.16b, #0x87
+	ld1	{v4.2d}, [x5]
+	ushr	v6.2d, v6.2d, #56
+	ld1	{v7.2d}, [x6]
+	ubfiz	x4, x4, #3, #32
+	rbit	x4, x4
+	mov	v0.d[0], x4
+	ubfiz	x3, x3, #3, #32
+	rbit	x3, x3
+	mov	v0.d[1], x3
+	eor	v5.16b, v5.16b, v0.16b
+	pmull	v0.1q, v5.1d, v4.1d
+	pmull2	v1.1q, v5.2d, v4.2d
+	ext	v3.16b, v5.16b, v5.16b, #8
+	pmull	v2.1q, v3.1d, v4.1d
+	pmull2	v3.1q, v3.2d, v4.2d
+	eor	v2.16b, v2.16b, v3.16b
+	;   Reduce
+	ext	v3.16b, v0.16b, v1.16b, #8
+	pmull2	v1.1q, v1.2d, v6.2d
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v3.16b, v3.16b, v2.16b
+	pmull2	v2.1q, v3.2d, v6.2d
+	mov	v0.d[1], v3.d[0]
+	eor	v5.16b, v0.16b, v2.16b
+	rbit	v5.16b, v5.16b
+	eor	v5.16b, v5.16b, v7.16b
+	cmp	w2, #16
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_part_tag
+	ld1	{v0.16b}, [x1]
+	b	L_aes_gcm_decrypt_final_arm64_crypto_tag_loaded
+L_aes_gcm_decrypt_final_arm64_crypto_part_tag
+	ubfiz	x2, x2, #0, #32
+	eor	v0.16b, v0.16b, v0.16b
+	mov	x10, x2
+	st1	{v0.2d}, [x0]
+	cmp	x10, #8
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_tag_start_dw
+	ldr	x9, [x1], #8
+	sub	x10, x10, #8
+	str	x9, [x0], #8
+L_aes_gcm_decrypt_final_arm64_crypto_tag_start_dw
+	cmp	x10, #4
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_tag_start_sw
+	ldr	w9, [x1], #4
+	sub	x10, x10, #4
+	str	w9, [x0], #4
+L_aes_gcm_decrypt_final_arm64_crypto_tag_start_sw
+	cmp	x10, #2
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_tag_start_byte
+	ldrh	w9, [x1], #2
+	sub	x10, x10, #2
+	strh	w9, [x0], #2
+L_aes_gcm_decrypt_final_arm64_crypto_tag_start_byte
+	cbz	x10, L_aes_gcm_decrypt_final_arm64_crypto_tag_end_bytes
+	ldrb	w9, [x1], #1
+	subs	x10, x10, #1
+	strb	w9, [x0], #1
+	bne	L_aes_gcm_decrypt_final_arm64_crypto_tag_start_byte
+L_aes_gcm_decrypt_final_arm64_crypto_tag_end_bytes
+	sub	x0, x0, x2
+	ld1	{v0.2d}, [x0]
+	mov	x10, #16
+	st1	{v5.2d}, [x0]
+	sub	x10, x10, x2
+	add	x0, x0, x2
+L_aes_gcm_decrypt_final_arm64_crypto_calc_tag_byte
+	strb	wzr, [x0], #1
+	subs	x10, x10, #1
+	bne	L_aes_gcm_decrypt_final_arm64_crypto_calc_tag_byte
+	subs	x0, x0, #16
+	ld1	{v5.2d}, [x0]
+L_aes_gcm_decrypt_final_arm64_crypto_tag_loaded
+	eor	v0.16b, v0.16b, v5.16b
+	mov	x9, v0.d[0]
+	mov	x10, v0.d[1]
+	mov	w11, #-180
+	orr	x9, x9, x10
+	cmp	x9, #0
+	csetm	x8, ne
+	and	x8, x8, x11
+	add	w8, w8, #0xb4
+	str	w8, [x7]
+	ret
+	ENDP
+	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_init_AARCH64_EOR3
+AES_GCM_init_AARCH64_EOR3 PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	movi	v6.16b, #0x87
+	ld1	{v5.2d}, [x4]
+	ushr	v6.2d, v6.2d, #56
+	; Load Nonce
+	cmp	w3, #12
+	bne	L_aes_gcm_init_arm64_crypto_eor3_ghash_nonce
+	ldr	x9, [x2]
+	movi	v4.4s, #1, lsl 24
+	ldr	w10, [x2, #8]
+	mov	v4.d[0], x9
+	mov	v4.s[2], w10
+	mov	w8, #1
+	b	L_aes_gcm_init_arm64_crypto_eor3_done_nonce
+L_aes_gcm_init_arm64_crypto_eor3_ghash_nonce
+	eor	v4.16b, v4.16b, v4.16b
+	lsr	w7, w3, #4
+	cbz	w7, L_aes_gcm_init_arm64_crypto_eor3_done
+L_aes_gcm_init_arm64_crypto_eor3_start_1
+	ld1	{v0.16b}, [x2], #16
+	rbit	v0.16b, v0.16b
+	eor	v3.16b, v4.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v7.1q, v3.1d, v5.1d
+	pmull2	v8.1q, v3.2d, v5.2d
+	ext	v10.16b, v3.16b, v3.16b, #8
+	pmull	v9.1q, v10.1d, v5.1d
+	pmull2	v10.1q, v10.2d, v5.2d
+	eor	v9.16b, v9.16b, v10.16b
+	;   Reduce
+	ext	v10.16b, v7.16b, v8.16b, #8
+	pmull2	v8.1q, v8.2d, v6.2d
+	eor3	v10.16b, v10.16b, v8.16b, v9.16b
+	pmull2	v9.1q, v10.2d, v6.2d
+	mov	v7.d[1], v10.d[0]
+	eor	v4.16b, v7.16b, v9.16b
+	; Done GHASH
+	subs	w7, w7, #1
+	bne	L_aes_gcm_init_arm64_crypto_eor3_start_1
+L_aes_gcm_init_arm64_crypto_eor3_done
+	and	w13, w3, #15
+	cbz	x13, L_aes_gcm_init_arm64_crypto_eor3_partial_done
+	eor	v7.16b, v7.16b, v7.16b
+	mov	w12, w13
+	st1	{v7.2d}, [x6]
+	cmp	w12, #8
+	blt	L_aes_gcm_init_arm64_crypto_eor3_start_dw
+	ldr	x11, [x2], #8
+	sub	w12, w12, #8
+	str	x11, [x6], #8
+L_aes_gcm_init_arm64_crypto_eor3_start_dw
+	cmp	w12, #4
+	blt	L_aes_gcm_init_arm64_crypto_eor3_start_sw
+	ldr	w11, [x2], #4
+	sub	w12, w12, #4
+	str	w11, [x6], #4
+L_aes_gcm_init_arm64_crypto_eor3_start_sw
+	cmp	w12, #2
+	blt	L_aes_gcm_init_arm64_crypto_eor3_start_byte
+	ldrh	w11, [x2], #2
+	sub	w12, w12, #2
+	strh	w11, [x6], #2
+L_aes_gcm_init_arm64_crypto_eor3_start_byte
+	cbz	w12, L_aes_gcm_init_arm64_crypto_eor3_end_bytes
+	ldrb	w11, [x2], #1
+	subs	w12, w12, #1
+	strb	w11, [x6], #1
+	bne	L_aes_gcm_init_arm64_crypto_eor3_start_byte
+L_aes_gcm_init_arm64_crypto_eor3_end_bytes
+	sub	x6, x6, x13
+	ld1	{v0.2d}, [x6]
+	rbit	v0.16b, v0.16b
+	eor	v3.16b, v4.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v7.1q, v3.1d, v5.1d
+	pmull2	v8.1q, v3.2d, v5.2d
+	ext	v10.16b, v3.16b, v3.16b, #8
+	pmull	v9.1q, v10.1d, v5.1d
+	pmull2	v10.1q, v10.2d, v5.2d
+	eor	v9.16b, v9.16b, v10.16b
+	;   Reduce
+	ext	v10.16b, v7.16b, v8.16b, #8
+	pmull2	v8.1q, v8.2d, v6.2d
+	eor3	v10.16b, v10.16b, v8.16b, v9.16b
+	pmull2	v9.1q, v10.2d, v6.2d
+	mov	v7.d[1], v10.d[0]
+	eor	v4.16b, v7.16b, v9.16b
+	; Done GHASH
+L_aes_gcm_init_arm64_crypto_eor3_partial_done
+	eor	x7, x7, x7
+	ubfiz	x13, x3, #3, #32
+	mov	v7.d[0], x7
+	mov	v7.d[1], x13
+	rev64	v7.16b, v7.16b
+	rbit	v7.16b, v7.16b
+	eor	v4.16b, v4.16b, v7.16b
+	pmull	v7.1q, v4.1d, v5.1d
+	pmull2	v8.1q, v4.2d, v5.2d
+	ext	v10.16b, v4.16b, v4.16b, #8
+	pmull	v9.1q, v10.1d, v5.1d
+	pmull2	v10.1q, v10.2d, v5.2d
+	eor	v9.16b, v9.16b, v10.16b
+	ext	v10.16b, v7.16b, v8.16b, #8
+	pmull2	v8.1q, v8.2d, v6.2d
+	eor3	v10.16b, v10.16b, v8.16b, v9.16b
+	pmull2	v9.1q, v10.2d, v6.2d
+	mov	v7.d[1], v10.d[0]
+	eor	v4.16b, v7.16b, v9.16b
+	rbit	v4.16b, v4.16b
+	mov	w8, v4.s[3]
+	rev	w8, w8
+L_aes_gcm_init_arm64_crypto_eor3_done_nonce
+	st1	{v4.2d}, [x5]
+	ld1	{v7.2d, v8.2d, v9.2d, v10.2d}, [x0], #0x40
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v9.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v10.16b
+	aesmc	v4.16b, v4.16b
+	ld1	{v7.2d, v8.2d, v9.2d, v10.2d}, [x0], #0x40
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v9.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v10.16b
+	aesmc	v4.16b, v4.16b
+	subs	w1, w1, #10
+	ld1	{v7.2d, v8.2d}, [x0], #32
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	beq	L_aes_gcm_init_arm64_crypto_eor3_round_done
+	ld1	{v7.2d, v8.2d}, [x0], #32
+	subs	w1, w1, #2
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+	beq	L_aes_gcm_init_arm64_crypto_eor3_round_done
+	ld1	{v7.2d, v8.2d}, [x0], #32
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v7.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v8.16b
+L_aes_gcm_init_arm64_crypto_eor3_round_done
+	ld1	{v7.2d}, [x0]
+	eor	v4.16b, v4.16b, v7.16b
+	st1	{v4.2d}, [x6]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_ghash_block_AARCH64_EOR3
+AES_GCM_ghash_block_AARCH64_EOR3 PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	ld1	{v6.2d}, [x1]
+	movi	v7.16b, #0x87
+	ld1	{v5.2d}, [x2]
+	ushr	v7.2d, v7.2d, #56
+	ld1	{v4.2d}, [x0]
+	rbit	v4.16b, v4.16b
+	eor	v8.16b, v6.16b, v4.16b
+	;   X  = C * H^1
+	pmull	v0.1q, v8.1d, v5.1d
+	pmull2	v1.1q, v8.2d, v5.2d
+	ext	v3.16b, v8.16b, v8.16b, #8
+	pmull	v2.1q, v3.1d, v5.1d
+	pmull2	v3.1q, v3.2d, v5.2d
+	eor	v2.16b, v2.16b, v3.16b
+	;   Reduce
+	ext	v3.16b, v0.16b, v1.16b, #8
+	pmull2	v1.1q, v1.2d, v7.2d
+	eor3	v3.16b, v3.16b, v1.16b, v2.16b
+	pmull2	v2.1q, v3.2d, v7.2d
+	mov	v0.d[1], v3.d[0]
+	eor	v6.16b, v0.16b, v2.16b
+	; Done GHASH
+	st1	{v6.2d}, [x1]
+	ldp	d8, d9, [x29, #16]
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_aad_update_AARCH64_EOR3
+AES_GCM_aad_update_AARCH64_EOR3 PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	ld1	{v20.2d}, [x2]
+	movi	v21.16b, #0x87
+	ld1	{v12.2d}, [x3]
+	ushr	v21.2d, v21.2d, #56
+	cmp	x1, #0x40
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_h_done
+	; Square H => H^2
+	pmull2	v11.1q, v12.2d, v12.2d
+	pmull	v10.1q, v12.1d, v12.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v13.16b, v10.16b, v11.16b
+	cmp	x1, #0x100
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v8.1q, v12.1d, v13.1d
+	pmull2	v9.1q, v12.2d, v13.2d
+	ext	v11.16b, v12.16b, v12.16b, #8
+	pmull	v10.1q, v11.1d, v13.1d
+	pmull2	v11.1q, v11.2d, v13.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor3	v11.16b, v11.16b, v9.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v14.16b, v8.16b, v10.16b
+	; Square H^2 => H^4
+	pmull2	v11.1q, v13.2d, v13.2d
+	pmull	v10.1q, v13.1d, v13.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v15.16b, v10.16b, v11.16b
+	; Done
+	cmp	x1, #0x400
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v8.1q, v12.1d, v15.1d
+	pmull2	v9.1q, v12.2d, v15.2d
+	ext	v11.16b, v12.16b, v12.16b, #8
+	pmull	v10.1q, v11.1d, v15.1d
+	pmull2	v11.1q, v11.2d, v15.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor3	v11.16b, v11.16b, v9.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v16.16b, v8.16b, v10.16b
+	; Square H^3 => H^6
+	pmull2	v11.1q, v14.2d, v14.2d
+	pmull	v10.1q, v14.1d, v14.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v17.16b, v10.16b, v11.16b
+	; Multiply H and H^6  => H^7
+	pmull	v8.1q, v12.1d, v17.1d
+	pmull2	v9.1q, v12.2d, v17.2d
+	ext	v11.16b, v12.16b, v12.16b, #8
+	pmull	v10.1q, v11.1d, v17.1d
+	pmull2	v11.1q, v11.2d, v17.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor3	v11.16b, v11.16b, v9.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v18.16b, v8.16b, v10.16b
+	; Square H^4 => H^8
+	pmull2	v11.1q, v15.2d, v15.2d
+	pmull	v10.1q, v15.1d, v15.1d
+	pmull2	v8.1q, v11.2d, v21.2d
+	ext	v9.16b, v10.16b, v11.16b, #8
+	eor	v9.16b, v9.16b, v8.16b
+	pmull2	v11.1q, v9.2d, v21.2d
+	mov	v10.d[1], v9.d[0]
+	eor	v19.16b, v10.16b, v11.16b
+	; Done
+L_aes_gcm_aad_update_arm64_crypto_eor3_h_done
+	lsr	x1, x1, #4
+	cmp	x1, #4
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_start_1
+	cmp	x1, #16
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_start_2
+	cmp	x1, #0x40
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_start_4
+L_aes_gcm_aad_update_arm64_crypto_eor3_start_8
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	rbit	v4.16b, v4.16b
+	rbit	v5.16b, v5.16b
+	rbit	v6.16b, v6.16b
+	rbit	v7.16b, v7.16b
+	eor	v0.16b, v0.16b, v20.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v7.1d, v12.1d
+	pmull2	v9.1q, v7.2d, v12.2d
+	ext	v11.16b, v7.16b, v7.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   X += C * H^2
+	pmull	v11.1q, v13.1d, v6.1d
+	pmull2	v20.1q, v13.2d, v6.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v6.16b, v6.16b, #8
+	pmull	v11.1q, v20.1d, v13.1d
+	pmull2	v20.1q, v20.2d, v13.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^3
+	pmull	v11.1q, v14.1d, v5.1d
+	pmull2	v20.1q, v14.2d, v5.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v5.16b, v5.16b, #8
+	pmull	v11.1q, v20.1d, v14.1d
+	pmull2	v20.1q, v20.2d, v14.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^4
+	pmull	v11.1q, v15.1d, v4.1d
+	pmull2	v20.1q, v15.2d, v4.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v4.16b, v4.16b, #8
+	pmull	v11.1q, v20.1d, v15.1d
+	pmull2	v20.1q, v20.2d, v15.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^5
+	pmull	v11.1q, v16.1d, v3.1d
+	pmull2	v20.1q, v16.2d, v3.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v3.16b, v3.16b, #8
+	pmull	v11.1q, v20.1d, v16.1d
+	pmull2	v20.1q, v20.2d, v16.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^6
+	pmull	v11.1q, v17.1d, v2.1d
+	pmull2	v20.1q, v17.2d, v2.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v2.16b, v2.16b, #8
+	pmull	v11.1q, v20.1d, v17.1d
+	pmull2	v20.1q, v20.2d, v17.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^7
+	pmull	v11.1q, v18.1d, v1.1d
+	pmull2	v20.1q, v18.2d, v1.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v1.16b, v1.16b, #8
+	pmull	v11.1q, v20.1d, v18.1d
+	pmull2	v20.1q, v20.2d, v18.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^8
+	pmull	v11.1q, v19.1d, v0.1d
+	pmull2	v20.1q, v19.2d, v0.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v0.16b, v0.16b, #8
+	pmull	v11.1q, v20.1d, v19.1d
+	pmull2	v20.1q, v20.2d, v19.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor3	v11.16b, v11.16b, v9.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	sub	x1, x1, #8
+	cmp	x1, #8
+	bge	L_aes_gcm_aad_update_arm64_crypto_eor3_start_8
+	cmp	x1, #1
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_done
+	beq	L_aes_gcm_aad_update_arm64_crypto_eor3_start_1
+	cmp	x1, #16
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_start_2
+L_aes_gcm_aad_update_arm64_crypto_eor3_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v0.16b, v0.16b, v20.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v3.1d, v12.1d
+	pmull2	v9.1q, v3.2d, v12.2d
+	ext	v11.16b, v3.16b, v3.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   X += C * H^2
+	pmull	v11.1q, v13.1d, v2.1d
+	pmull2	v20.1q, v13.2d, v2.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v2.16b, v2.16b, #8
+	pmull	v11.1q, v20.1d, v13.1d
+	pmull2	v20.1q, v20.2d, v13.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^3
+	pmull	v11.1q, v14.1d, v1.1d
+	pmull2	v20.1q, v14.2d, v1.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v1.16b, v1.16b, #8
+	pmull	v11.1q, v20.1d, v14.1d
+	pmull2	v20.1q, v20.2d, v14.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   X += C * H^4
+	pmull	v11.1q, v15.1d, v0.1d
+	pmull2	v20.1q, v15.2d, v0.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v0.16b, v0.16b, #8
+	pmull	v11.1q, v20.1d, v15.1d
+	pmull2	v20.1q, v20.2d, v15.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor3	v11.16b, v11.16b, v9.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	sub	x1, x1, #4
+	cmp	x1, #4
+	bge	L_aes_gcm_aad_update_arm64_crypto_eor3_start_4
+	cmp	x1, #1
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_done
+	beq	L_aes_gcm_aad_update_arm64_crypto_eor3_start_1
+L_aes_gcm_aad_update_arm64_crypto_eor3_start_2
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	eor	v3.16b, v20.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v1.1d, v12.1d
+	pmull2	v9.1q, v1.2d, v12.2d
+	ext	v11.16b, v1.16b, v1.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   X += C * H^2
+	pmull	v11.1q, v13.1d, v3.1d
+	pmull2	v20.1q, v13.2d, v3.2d
+	eor	v8.16b, v8.16b, v11.16b
+	eor	v9.16b, v9.16b, v20.16b
+	ext	v20.16b, v3.16b, v3.16b, #8
+	pmull	v11.1q, v20.1d, v13.1d
+	pmull2	v20.1q, v20.2d, v13.2d
+	eor3	v10.16b, v10.16b, v20.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor3	v11.16b, v11.16b, v9.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	sub	x1, x1, #2
+	cmp	x1, #1
+	bgt	L_aes_gcm_aad_update_arm64_crypto_eor3_start_2
+	blt	L_aes_gcm_aad_update_arm64_crypto_eor3_done
+L_aes_gcm_aad_update_arm64_crypto_eor3_start_1
+	cbz	x1, L_aes_gcm_aad_update_arm64_crypto_eor3_done
+L_aes_gcm_aad_update_arm64_crypto_eor3_both_1
+	ld1	{v0.16b}, [x0], #16
+	rbit	v0.16b, v0.16b
+	eor	v3.16b, v20.16b, v0.16b
+	;   X  = C * H^1
+	pmull	v8.1q, v3.1d, v12.1d
+	pmull2	v9.1q, v3.2d, v12.2d
+	ext	v11.16b, v3.16b, v3.16b, #8
+	pmull	v10.1q, v11.1d, v12.1d
+	pmull2	v11.1q, v11.2d, v12.2d
+	eor	v10.16b, v10.16b, v11.16b
+	;   Reduce
+	ext	v11.16b, v8.16b, v9.16b, #8
+	pmull2	v9.1q, v9.2d, v21.2d
+	eor3	v11.16b, v11.16b, v9.16b, v10.16b
+	pmull2	v10.1q, v11.2d, v21.2d
+	mov	v8.d[1], v11.d[0]
+	eor	v20.16b, v8.16b, v10.16b
+	; Done GHASH
+	subs	x1, x1, #1
+	bne	L_aes_gcm_aad_update_arm64_crypto_eor3_both_1
+L_aes_gcm_aad_update_arm64_crypto_eor3_done
+	st1	{v20.2d}, [x2]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_block_AARCH64_EOR3
+AES_GCM_encrypt_block_AARCH64_EOR3 PROC
+	ld1	{v5.2d}, [x4]
+	ld1	{v4.2d}, [x3]
+	mov	w5, v5.s[3]
+	rev	w5, w5
+	add	w5, w5, #1
+	rev	w5, w5
+	mov	v5.s[3], w5
+	st1	{v5.2d}, [x4]
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v2.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v3.16b
+	aesmc	v5.16b, v5.16b
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v2.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v3.16b
+	aesmc	v5.16b, v5.16b
+	subs	w1, w1, #10
+	ld1	{v0.2d, v1.2d}, [x0], #32
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	beq	L_aes_gcm_encrypt_block_arm64_crypto_eor3_round_done
+	ld1	{v0.2d, v1.2d}, [x0], #32
+	subs	w1, w1, #2
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+	beq	L_aes_gcm_encrypt_block_arm64_crypto_eor3_round_done
+	ld1	{v0.2d, v1.2d}, [x0], #32
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v0.16b
+	aesmc	v5.16b, v5.16b
+	aese	v5.16b, v1.16b
+L_aes_gcm_encrypt_block_arm64_crypto_eor3_round_done
+	ld1	{v0.2d}, [x0]
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v5.16b
+	st1	{v4.2d}, [x2]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_update_AARCH64_EOR3
+AES_GCM_encrypt_update_AARCH64_EOR3 PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	stp	d8, d9, [x29, #32]
+	stp	d10, d11, [x29, #48]
+	stp	d12, d13, [x29, #64]
+	stp	d14, d15, [x29, #80]
+	ld1	{v13.2d}, [x7]
+	movi	v27.16b, #0x87
+	ld1	{v26.2d}, [x5]
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x6]
+	mov	w9, v13.s[3]
+	rev	w9, w9
+	cmp	w4, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w4, #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w4, #0x200
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_h_done
+	lsr	w8, w4, #4
+	cmp	x1, #12
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_start_128
+	bgt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w8, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	rev	w16, w16
+	rev	w15, w15
+	rev	w14, w14
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_end_8
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_both_8
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_done
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_end_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rbit	v19.16b, v19.16b
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_both_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_done
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_done
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_192_done
+	ENDIF
+	b	L_aes_gcm_encrypt_update_arm64_crypto_eor3_done
+	; AES_GCM_256
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w8, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	rev	w16, w16
+	rev	w15, w15
+	rev	w14, w14
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_end_8
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_both_8
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0], #16
+	cmp	w8, #1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_done
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_end_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rbit	v19.16b, v19.16b
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_both_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_done
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_done
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x0, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_256_done
+	ENDIF
+	b	L_aes_gcm_encrypt_update_arm64_crypto_eor3_done
+	; AES_GCM_128
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w8, #32
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	rev	w16, w16
+	rev	w15, w15
+	rev	w14, w14
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_end_8
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	rev	w10, w9
+	mov	v14.s[3], w17
+	mov	v15.s[3], w16
+	mov	v16.s[3], w15
+	mov	v17.s[3], w14
+	mov	v8.s[3], w13
+	mov	v9.s[3], w12
+	mov	v10.s[3], w11
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	; Done GHASH
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_both_8
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d}, [x0], #32
+	ld1	{v10.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_done
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_end_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rev	w12, w12
+	rev	w11, w11
+	rbit	v19.16b, v19.16b
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w12
+	mov	v16.s[3], w11
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	rbit	v20.16b, v20.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	rbit	v21.16b, v21.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	eor	v20.16b, v20.16b, v16.16b
+	eor	v21.16b, v21.16b, v17.16b
+	cmp	w8, #4
+	st1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x2], #0x40
+	bge	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_both_4
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_1
+	blt	L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_done
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	rev	w10, w9
+	mov	v14.s[3], w13
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v18.16b, v18.16b, v14.16b
+	eor	v19.16b, v19.16b, v15.16b
+	st1	{v18.16b, v19.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_done
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x3], #16
+	eor	v18.16b, v18.16b, v14.16b
+	st1	{v18.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_128_done
+	ENDIF
+L_aes_gcm_encrypt_update_arm64_crypto_eor3_done
+	rev	w9, w9
+	mov	v13.s[3], w9
+	st1	{v26.2d}, [x5]
+	st1	{v13.2d}, [x7]
+	ldr	x17, [x29, #24]
+	ldp	d8, d9, [x29, #32]
+	ldp	d10, d11, [x29, #48]
+	ldp	d12, d13, [x29, #64]
+	ldp	d14, d15, [x29, #80]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_final_AARCH64_EOR3
+AES_GCM_encrypt_final_AARCH64_EOR3 PROC
+	ld1	{v5.2d}, [x0]
+	movi	v6.16b, #0x87
+	ld1	{v4.2d}, [x5]
+	ushr	v6.2d, v6.2d, #56
+	ld1	{v7.2d}, [x6]
+	ubfiz	x4, x4, #3, #32
+	rbit	x4, x4
+	mov	v0.d[0], x4
+	ubfiz	x3, x3, #3, #32
+	rbit	x3, x3
+	mov	v0.d[1], x3
+	eor	v5.16b, v5.16b, v0.16b
+	pmull	v0.1q, v5.1d, v4.1d
+	pmull2	v1.1q, v5.2d, v4.2d
+	ext	v3.16b, v5.16b, v5.16b, #8
+	pmull	v2.1q, v3.1d, v4.1d
+	pmull2	v3.1q, v3.2d, v4.2d
+	eor	v2.16b, v2.16b, v3.16b
+	;   Reduce
+	ext	v3.16b, v0.16b, v1.16b, #8
+	pmull2	v1.1q, v1.2d, v6.2d
+	eor3	v3.16b, v3.16b, v1.16b, v2.16b
+	pmull2	v2.1q, v3.2d, v6.2d
+	mov	v0.d[1], v3.d[0]
+	eor	v5.16b, v0.16b, v2.16b
+	rbit	v5.16b, v5.16b
+	eor	v5.16b, v5.16b, v7.16b
+	cmp	w2, #16
+	bne	L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_partial
+	st1	{v5.16b}, [x1]
+	b	L_aes_gcm_encrypt_final_arm64_crypto_eor3_done
+L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_partial
+	st1	{v5.16b}, [x0]
+	cmp	w2, #8
+	blt	L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_start_dw
+	ldr	x8, [x0], #8
+	sub	w2, w2, #8
+	str	x8, [x1], #8
+L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_start_dw
+	cmp	w2, #4
+	blt	L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_start_sw
+	ldr	w8, [x0], #4
+	sub	w2, w2, #4
+	str	w8, [x1], #4
+L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_start_sw
+	cmp	w2, #2
+	blt	L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_start_byte
+	ldrh	w8, [x0], #2
+	sub	w2, w2, #2
+	strh	w8, [x1], #2
+L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_start_byte
+	cbz	w2, L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_end_bytes
+	ldrb	w8, [x0], #1
+	subs	w2, w2, #1
+	strb	w8, [x1], #1
+	bne	L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_start_byte
+L_aes_gcm_encrypt_final_arm64_crypto_eor3_tag_end_bytes
+L_aes_gcm_encrypt_final_arm64_crypto_eor3_done
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_decrypt_update_AARCH64_EOR3
+AES_GCM_decrypt_update_AARCH64_EOR3 PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	stp	d8, d9, [x29, #32]
+	stp	d10, d11, [x29, #48]
+	stp	d12, d13, [x29, #64]
+	stp	d14, d15, [x29, #80]
+	ld1	{v13.2d}, [x7]
+	movi	v27.16b, #0x87
+	ld1	{v26.2d}, [x5]
+	ushr	v27.2d, v27.2d, #56
+	ld1	{v22.2d}, [x6]
+	mov	w9, v13.s[3]
+	rev	w9, w9
+	cmp	w4, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_h_done
+	; Square H => H^2
+	pmull2	v31.1q, v22.2d, v22.2d
+	pmull	v30.1q, v22.1d, v22.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v23.16b, v30.16b, v31.16b
+	cmp	w4, #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_h_done
+	; Multiply H and H^2  => H^3
+	pmull	v28.1q, v22.1d, v23.1d
+	pmull2	v29.1q, v22.2d, v23.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v23.1d
+	pmull2	v31.1q, v31.2d, v23.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v24.16b, v28.16b, v30.16b
+	; Square H^2 => H^4
+	pmull2	v31.1q, v23.2d, v23.2d
+	pmull	v30.1q, v23.1d, v23.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v25.16b, v30.16b, v31.16b
+	; Done
+	cmp	w4, #0x200
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_h_done
+	; Multiply H and H^4  => H^5
+	pmull	v28.1q, v22.1d, v25.1d
+	pmull2	v29.1q, v22.2d, v25.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v25.1d
+	pmull2	v31.1q, v31.2d, v25.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v4.16b, v28.16b, v30.16b
+	; Square H^3 => H^6
+	pmull2	v31.1q, v24.2d, v24.2d
+	pmull	v30.1q, v24.1d, v24.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v5.16b, v30.16b, v31.16b
+	; Multiply H and H^6  => H^7
+	pmull	v28.1q, v22.1d, v5.1d
+	pmull2	v29.1q, v22.2d, v5.2d
+	ext	v31.16b, v22.16b, v22.16b, #8
+	pmull	v30.1q, v31.1d, v5.1d
+	pmull2	v31.1q, v31.2d, v5.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v6.16b, v28.16b, v30.16b
+	; Square H^4 => H^8
+	pmull2	v31.1q, v25.2d, v25.2d
+	pmull	v30.1q, v25.1d, v25.1d
+	pmull2	v28.1q, v31.2d, v27.2d
+	ext	v29.16b, v30.16b, v31.16b, #8
+	eor	v29.16b, v29.16b, v28.16b
+	pmull2	v31.1q, v29.2d, v27.2d
+	mov	v30.d[1], v29.d[0]
+	eor	v7.16b, v30.16b, v31.16b
+	; Done
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_h_done
+	lsr	w8, w4, #4
+	cmp	x1, #12
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_start_128
+	bgt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_start_256
+	; AES_GCM_192
+	IF :LNOT::DEF:NO_AES_192
+	cmp	w8, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	mov	v14.s[3], w17
+	rev	w16, w16
+	mov	v15.s[3], w16
+	rev	w15, w15
+	mov	v16.s[3], w15
+	rev	w14, w14
+	mov	v17.s[3], w14
+	rev	w13, w13
+	mov	v8.s[3], w13
+	rev	w12, w12
+	mov	v9.s[3], w12
+	rev	w11, w11
+	mov	v10.s[3], w11
+	rev	w10, w9
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_end_8
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w17
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w16
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w15
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w14
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w13
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w12
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w11
+	rev	w10, w9
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_both_8
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_done
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w12, w12
+	mov	v15.s[3], w12
+	rev	w11, w11
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_end_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w13
+	rev	w12, w12
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w12
+	rev	w11, w11
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v11.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v11.16b
+	eor	v17.16b, v17.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_both_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_done
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w10, w9
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v11.16b
+	eor	v15.16b, v15.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_done
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_start_1
+	ld1	{v15.16b}, [x3], #16
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rbit	v15.16b, v15.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v16.16b, v26.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v16.1d, v22.1d
+	pmull2	v29.1q, v16.2d, v22.2d
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	ext	v31.16b, v16.16b, v16.16b, #8
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v14.16b, v11.16b
+	eor	v14.16b, v14.16b, v12.16b
+	; Done GHASH
+	rbit	v15.16b, v15.16b
+	eor	v14.16b, v14.16b, v15.16b
+	st1	{v14.16b}, [x2], #16
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_192_done
+	ENDIF
+	b	L_aes_gcm_decrypt_update_arm64_crypto_eor3_done
+	; AES_GCM_256
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_start_256
+	IF :LNOT::DEF:NO_AES_256
+	cmp	w8, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	mov	v14.s[3], w17
+	rev	w16, w16
+	mov	v15.s[3], w16
+	rev	w15, w15
+	mov	v16.s[3], w15
+	rev	w14, w14
+	mov	v17.s[3], w14
+	rev	w13, w13
+	mov	v8.s[3], w13
+	rev	w12, w12
+	mov	v9.s[3], w12
+	rev	w11, w11
+	mov	v10.s[3], w11
+	rev	w10, w9
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_end_8
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w17
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w16
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w15
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w14
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w13
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w12
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w11
+	rev	w10, w9
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #176]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #192]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #208]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #224]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_both_8
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x0], #0x40
+	ld1	{v12.2d}, [x0], #16
+	cmp	w8, #1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_done
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w12, w12
+	mov	v15.s[3], w12
+	rev	w11, w11
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_end_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w13
+	rev	w12, w12
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w12
+	rev	w11, w11
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v9.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v9.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v10.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v10.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v11.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v11.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	aese	v16.16b, v29.16b
+	eor	v16.16b, v16.16b, v30.16b
+	aese	v17.16b, v29.16b
+	eor	v17.16b, v17.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_both_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_done
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w10, w9
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v10.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v11.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v29.2d, v30.2d}, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	aese	v15.16b, v29.16b
+	eor	v15.16b, v15.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_done
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v10.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v14.16b, v11.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q29, [x0]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ldr	q30, [x0, #16]
+	aese	v14.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_256_done
+	ENDIF
+	b	L_aes_gcm_decrypt_update_arm64_crypto_eor3_done
+	; AES_GCM_128
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_start_128
+	IF :LNOT::DEF:NO_AES_128
+	cmp	w8, #32
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rev	w17, w17
+	mov	v14.s[3], w17
+	rev	w16, w16
+	mov	v15.s[3], w16
+	rev	w15, w15
+	mov	v16.s[3], w15
+	rev	w14, w14
+	mov	v17.s[3], w14
+	rev	w13, w13
+	mov	v8.s[3], w13
+	rev	w12, w12
+	mov	v9.s[3], w12
+	rev	w11, w11
+	mov	v10.s[3], w11
+	rev	w10, w9
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	ld1	{v13.2d}, [x7]
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_end_8
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_both_8
+	ldr	q12, [x0]
+	add	w17, w9, #1
+	mov	v14.16b, v13.16b
+	add	w16, w9, #2
+	mov	v15.16b, v13.16b
+	add	w15, w9, #3
+	mov	v16.16b, v13.16b
+	add	w14, w9, #4
+	mov	v17.16b, v13.16b
+	add	w13, w9, #5
+	mov	v8.16b, v13.16b
+	add	w12, w9, #6
+	mov	v9.16b, v13.16b
+	add	w11, w9, #7
+	mov	v10.16b, v13.16b
+	add	w9, w9, #8
+	mov	v11.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w17, w17
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w17
+	rev	w16, w16
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w16
+	rev	w15, w15
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w15
+	rev	w14, w14
+	rbit	v0.16b, v0.16b
+	mov	v17.s[3], w14
+	rev	w13, w13
+	rbit	v1.16b, v1.16b
+	mov	v8.s[3], w13
+	rev	w12, w12
+	rbit	v2.16b, v2.16b
+	mov	v9.s[3], w12
+	rev	w11, w11
+	rbit	v3.16b, v3.16b
+	mov	v10.s[3], w11
+	rev	w10, w9
+	eor	v18.16b, v18.16b, v26.16b
+	mov	v11.s[3], w10
+	ldr	q13, [x0, #16]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ext	v31.16b, v3.16b, v3.16b, #8
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #32]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #48]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #64]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #80]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #96]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #112]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	subs	w8, w8, #8
+	ldr	q12, [x0, #128]
+	aese	v14.16b, v13.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v15.16b, v13.16b
+	aesmc	v15.16b, v15.16b
+	mov	v28.d[1], v31.d[0]
+	aese	v16.16b, v13.16b
+	aesmc	v16.16b, v16.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v17.16b, v13.16b
+	aesmc	v17.16b, v17.16b
+	; Done GHASH
+	aese	v8.16b, v13.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v9.16b, v13.16b
+	aesmc	v9.16b, v9.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v10.16b, v13.16b
+	aesmc	v10.16b, v10.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v11.16b, v13.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q13, [x0, #144]
+	aese	v14.16b, v12.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v15.16b, v12.16b
+	aesmc	v15.16b, v15.16b
+	ld1	{v0.16b}, [x3], #16
+	aese	v16.16b, v12.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v1.16b}, [x3], #16
+	aese	v17.16b, v12.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v2.16b}, [x3], #16
+	aese	v8.16b, v12.16b
+	aesmc	v8.16b, v8.16b
+	ld1	{v3.16b}, [x3], #16
+	aese	v9.16b, v12.16b
+	aesmc	v9.16b, v9.16b
+	aese	v10.16b, v12.16b
+	aesmc	v10.16b, v10.16b
+	aese	v11.16b, v12.16b
+	aesmc	v11.16b, v11.16b
+	ldr	q12, [x0, #160]
+	aese	v14.16b, v13.16b
+	eor	v14.16b, v14.16b, v12.16b
+	aese	v15.16b, v13.16b
+	eor	v15.16b, v15.16b, v12.16b
+	aese	v16.16b, v13.16b
+	eor	v16.16b, v16.16b, v12.16b
+	aese	v17.16b, v13.16b
+	eor	v17.16b, v17.16b, v12.16b
+	aese	v8.16b, v13.16b
+	eor	v8.16b, v8.16b, v12.16b
+	aese	v9.16b, v13.16b
+	eor	v9.16b, v9.16b, v12.16b
+	aese	v10.16b, v13.16b
+	eor	v10.16b, v10.16b, v12.16b
+	aese	v11.16b, v13.16b
+	eor	v11.16b, v11.16b, v12.16b
+	ld1	{v13.2d}, [x7]
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	st1	{v8.16b, v9.16b, v10.16b, v11.16b}, [x2], #0x40
+	cmp	w8, #8
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_both_8
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_end_8
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	rbit	v0.16b, v0.16b
+	rbit	v1.16b, v1.16b
+	rbit	v2.16b, v2.16b
+	rbit	v3.16b, v3.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v3.1d, v22.1d
+	pmull2	v29.1q, v3.2d, v22.2d
+	ext	v31.16b, v3.16b, v3.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v2.1d
+	pmull2	v26.1q, v23.2d, v2.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v2.16b, v2.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v1.1d
+	pmull2	v26.1q, v24.2d, v1.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v1.16b, v1.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v0.1d
+	pmull2	v26.1q, v25.2d, v0.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v0.16b, v0.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^5
+	pmull	v31.1q, v4.1d, v21.1d
+	pmull2	v26.1q, v4.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v4.1d
+	pmull2	v26.1q, v26.2d, v4.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^6
+	pmull	v31.1q, v5.1d, v20.1d
+	pmull2	v26.1q, v5.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v5.1d
+	pmull2	v26.1q, v26.2d, v5.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^7
+	pmull	v31.1q, v6.1d, v19.1d
+	pmull2	v26.1q, v6.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v6.1d
+	pmull2	v26.1q, v26.2d, v6.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^8
+	pmull	v31.1q, v7.1d, v18.1d
+	pmull2	v26.1q, v7.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v7.1d
+	pmull2	v26.1q, v26.2d, v7.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_4
+	ld1	{v0.2d, v1.2d, v2.2d, v3.2d}, [x0], #0x40
+	ld1	{v4.2d, v5.2d, v6.2d, v7.2d}, [x0], #0x40
+	ld1	{v8.2d, v9.2d}, [x0], #32
+	ld1	{v10.2d}, [x0]
+	cmp	w8, #1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_done
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_1
+	cmp	w8, #4
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w12, w12
+	mov	v15.s[3], w12
+	rev	w11, w11
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	ld1	{v20.16b}, [x3], #16
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	ld1	{v21.16b}, [x3], #16
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_end_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_both_4
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w12, w9, #2
+	mov	v15.16b, v13.16b
+	add	w11, w9, #3
+	mov	v16.16b, v13.16b
+	add	w9, w9, #4
+	mov	v17.16b, v13.16b
+	rbit	v18.16b, v18.16b
+	rev	w13, w13
+	rbit	v19.16b, v19.16b
+	mov	v14.s[3], w13
+	rev	w12, w12
+	rbit	v20.16b, v20.16b
+	mov	v15.s[3], w12
+	rev	w11, w11
+	rbit	v21.16b, v21.16b
+	mov	v16.s[3], w11
+	rev	w10, w9
+	mov	v17.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	eor	v18.16b, v18.16b, v26.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	aese	v16.16b, v0.16b
+	aesmc	v16.16b, v16.16b
+	ext	v31.16b, v21.16b, v21.16b, #8
+	aese	v17.16b, v0.16b
+	aesmc	v17.16b, v17.16b
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	eor	v30.16b, v30.16b, v31.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	aese	v16.16b, v1.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v1.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v2.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v2.16b
+	aesmc	v17.16b, v17.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	aese	v16.16b, v3.16b
+	aesmc	v16.16b, v16.16b
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	aese	v17.16b, v3.16b
+	aesmc	v17.16b, v17.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	aese	v16.16b, v4.16b
+	aesmc	v16.16b, v16.16b
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	aese	v17.16b, v4.16b
+	aesmc	v17.16b, v17.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	aese	v16.16b, v5.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v5.16b
+	aesmc	v17.16b, v17.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	pmull2	v29.1q, v29.2d, v27.2d
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	aese	v16.16b, v6.16b
+	aesmc	v16.16b, v16.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	aese	v17.16b, v6.16b
+	aesmc	v17.16b, v17.16b
+	subs	w8, w8, #4
+	mov	v28.d[1], v31.d[0]
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	eor	v26.16b, v28.16b, v30.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	; Done GHASH
+	aese	v16.16b, v7.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v7.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x3], #0x40
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v16.16b, v8.16b
+	aesmc	v16.16b, v16.16b
+	aese	v17.16b, v8.16b
+	aesmc	v17.16b, v17.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	aese	v16.16b, v9.16b
+	eor	v16.16b, v16.16b, v10.16b
+	aese	v17.16b, v9.16b
+	eor	v17.16b, v17.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	eor	v16.16b, v16.16b, v20.16b
+	eor	v17.16b, v17.16b, v21.16b
+	cmp	w8, #4
+	st1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x2], #0x40
+	bge	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_both_4
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_end_4
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	rbit	v20.16b, v20.16b
+	rbit	v21.16b, v21.16b
+	eor	v18.16b, v18.16b, v26.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v20.1d
+	pmull2	v26.1q, v23.2d, v20.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v20.16b, v20.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^3
+	pmull	v31.1q, v24.1d, v19.1d
+	pmull2	v26.1q, v24.2d, v19.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v19.16b, v19.16b, #8
+	pmull	v31.1q, v26.1d, v24.1d
+	pmull2	v26.1q, v26.2d, v24.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   X += C * H^4
+	pmull	v31.1q, v25.1d, v18.1d
+	pmull2	v26.1q, v25.2d, v18.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v18.16b, v18.16b, #8
+	pmull	v31.1q, v26.1d, v25.1d
+	pmull2	v26.1q, v26.2d, v25.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cmp	w8, #1
+	beq	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_1
+	blt	L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_done
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_2
+	add	w13, w9, #1
+	mov	v14.16b, v13.16b
+	add	w9, w9, #2
+	mov	v15.16b, v13.16b
+	rev	w13, w13
+	mov	v14.s[3], w13
+	rev	w10, w9
+	mov	v15.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v0.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v1.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v2.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v3.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v4.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v5.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v6.16b
+	aesmc	v15.16b, v15.16b
+	subs	w8, w8, #2
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v15.16b, v7.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	ld1	{v18.16b}, [x3], #16
+	aese	v15.16b, v8.16b
+	aesmc	v15.16b, v15.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v19.16b}, [x3], #16
+	aese	v15.16b, v9.16b
+	eor	v15.16b, v15.16b, v10.16b
+	eor	v14.16b, v14.16b, v18.16b
+	eor	v15.16b, v15.16b, v19.16b
+	st1	{v14.16b, v15.16b}, [x2], #32
+	rbit	v18.16b, v18.16b
+	rbit	v19.16b, v19.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v19.1d, v22.1d
+	pmull2	v29.1q, v19.2d, v22.2d
+	ext	v31.16b, v19.16b, v19.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   X += C * H^2
+	pmull	v31.1q, v23.1d, v21.1d
+	pmull2	v26.1q, v23.2d, v21.2d
+	eor	v28.16b, v28.16b, v31.16b
+	eor	v29.16b, v29.16b, v26.16b
+	ext	v26.16b, v21.16b, v21.16b, #8
+	pmull	v31.1q, v26.1d, v23.1d
+	pmull2	v26.1q, v26.2d, v23.2d
+	eor3	v30.16b, v30.16b, v26.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+	cbz	w8, L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_done
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_start_1
+	add	w9, w9, #1
+	mov	v14.16b, v13.16b
+	rev	w10, w9
+	mov	v14.s[3], w10
+	aese	v14.16b, v0.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v1.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v2.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v3.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v4.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v5.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v6.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v7.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v8.16b
+	aesmc	v14.16b, v14.16b
+	aese	v14.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	ld1	{v18.16b}, [x3], #16
+	eor	v14.16b, v14.16b, v18.16b
+	st1	{v14.16b}, [x2], #16
+	rbit	v18.16b, v18.16b
+	eor	v21.16b, v26.16b, v18.16b
+	;   X  = C * H^1
+	pmull	v28.1q, v21.1d, v22.1d
+	pmull2	v29.1q, v21.2d, v22.2d
+	ext	v31.16b, v21.16b, v21.16b, #8
+	pmull	v30.1q, v31.1d, v22.1d
+	pmull2	v31.1q, v31.2d, v22.2d
+	eor	v30.16b, v30.16b, v31.16b
+	;   Reduce
+	ext	v31.16b, v28.16b, v29.16b, #8
+	pmull2	v29.1q, v29.2d, v27.2d
+	eor3	v31.16b, v31.16b, v29.16b, v30.16b
+	pmull2	v30.1q, v31.2d, v27.2d
+	mov	v28.d[1], v31.d[0]
+	eor	v26.16b, v28.16b, v30.16b
+	; Done GHASH
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_128_done
+	ENDIF
+L_aes_gcm_decrypt_update_arm64_crypto_eor3_done
+	rev	w9, w9
+	mov	v13.s[3], w9
+	st1	{v26.2d}, [x5]
+	st1	{v13.2d}, [x7]
+	ldr	x17, [x29, #24]
+	ldp	d8, d9, [x29, #32]
+	ldp	d10, d11, [x29, #48]
+	ldp	d12, d13, [x29, #64]
+	ldp	d14, d15, [x29, #80]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_decrypt_final_AARCH64_EOR3
+AES_GCM_decrypt_final_AARCH64_EOR3 PROC
+	ld1	{v5.2d}, [x0]
+	movi	v6.16b, #0x87
+	ld1	{v4.2d}, [x5]
+	ushr	v6.2d, v6.2d, #56
+	ld1	{v7.2d}, [x6]
+	ubfiz	x4, x4, #3, #32
+	rbit	x4, x4
+	mov	v0.d[0], x4
+	ubfiz	x3, x3, #3, #32
+	rbit	x3, x3
+	mov	v0.d[1], x3
+	eor	v5.16b, v5.16b, v0.16b
+	pmull	v0.1q, v5.1d, v4.1d
+	pmull2	v1.1q, v5.2d, v4.2d
+	ext	v3.16b, v5.16b, v5.16b, #8
+	pmull	v2.1q, v3.1d, v4.1d
+	pmull2	v3.1q, v3.2d, v4.2d
+	eor	v2.16b, v2.16b, v3.16b
+	;   Reduce
+	ext	v3.16b, v0.16b, v1.16b, #8
+	pmull2	v1.1q, v1.2d, v6.2d
+	eor3	v3.16b, v3.16b, v1.16b, v2.16b
+	pmull2	v2.1q, v3.2d, v6.2d
+	mov	v0.d[1], v3.d[0]
+	eor	v5.16b, v0.16b, v2.16b
+	rbit	v5.16b, v5.16b
+	eor	v5.16b, v5.16b, v7.16b
+	cmp	w2, #16
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_eor3_part_tag
+	ld1	{v0.16b}, [x1]
+	b	L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_loaded
+L_aes_gcm_decrypt_final_arm64_crypto_eor3_part_tag
+	ubfiz	x2, x2, #0, #32
+	eor	v0.16b, v0.16b, v0.16b
+	mov	x10, x2
+	st1	{v0.2d}, [x0]
+	cmp	x10, #8
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_start_dw
+	ldr	x9, [x1], #8
+	sub	x10, x10, #8
+	str	x9, [x0], #8
+L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_start_dw
+	cmp	x10, #4
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_start_sw
+	ldr	w9, [x1], #4
+	sub	x10, x10, #4
+	str	w9, [x0], #4
+L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_start_sw
+	cmp	x10, #2
+	blt	L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_start_byte
+	ldrh	w9, [x1], #2
+	sub	x10, x10, #2
+	strh	w9, [x0], #2
+L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_start_byte
+	cbz	x10, L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_end_bytes
+	ldrb	w9, [x1], #1
+	subs	x10, x10, #1
+	strb	w9, [x0], #1
+	bne	L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_start_byte
+L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_end_bytes
+	sub	x0, x0, x2
+	ld1	{v0.2d}, [x0]
+	mov	x10, #16
+	st1	{v5.2d}, [x0]
+	sub	x10, x10, x2
+	add	x0, x0, x2
+L_aes_gcm_decrypt_final_arm64_crypto_eor3_calc_tag_byte
+	strb	wzr, [x0], #1
+	subs	x10, x10, #1
+	bne	L_aes_gcm_decrypt_final_arm64_crypto_eor3_calc_tag_byte
+	subs	x0, x0, #16
+	ld1	{v5.2d}, [x0]
+L_aes_gcm_decrypt_final_arm64_crypto_eor3_tag_loaded
+	eor	v0.16b, v0.16b, v5.16b
+	mov	x9, v0.d[0]
+	mov	x10, v0.d[1]
+	mov	w11, #-180
+	orr	x9, x9, x10
+	cmp	x9, #0
+	csetm	x8, ne
+	and	x8, x8, x11
+	add	w8, w8, #0xb4
+	str	w8, [x7]
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	ENDIF
+	IF :DEF:WOLFSSL_AES_XTS
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_encrypt_AARCH64
+AES_XTS_encrypt_AARCH64 PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x5], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x5], #0x40
+	ld1	{v4.16b}, [x3]
+	lsr	w8, w2, #4
+	and	w2, w2, #15
+	mov	x19, #0x87
+	cmp	x7, #12
+	blt	L_aes_xts_encrypt_arm64_crypto_start_128
+	bgt	L_aes_xts_encrypt_arm64_crypto_start_256
+	; AES_XTS_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x5], #0x40
+	ld1	{v28.2d}, [x5]
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v25.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v26.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v27.16b
+	eor	v4.16b, v4.16b, v28.16b
+	mov	x10, v4.d[0]
+	mov	x11, v4.d[1]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+	ld1	{v28.2d}, [x4]
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	and	x9, x19, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x9, x12, lsl 1
+	and	x9, x19, x15, asr 63
+	extr	x17, x15, x14, #63
+	eor	x16, x9, x14, lsl 1
+	cmp	w8, #4
+	blt	L_aes_xts_encrypt_arm64_crypto_192_start_2
+L_aes_xts_encrypt_arm64_crypto_192_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	mov	v6.d[0], x14
+	mov	v6.d[1], x15
+	mov	v7.d[0], x16
+	mov	v7.d[1], x17
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x17, asr 63
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	extr	x11, x17, x16, #63
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x16, lsl 1
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	and	x9, x19, x11, asr 63
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	eor	x12, x9, x10, lsl 1
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	extr	x15, x13, x12, #63
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	eor	x14, x9, x12, lsl 1
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	and	x9, x19, x15, asr 63
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	extr	x17, x15, x14, #63
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	eor	x16, x9, x14, lsl 1
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v25.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v25.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v26.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v26.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aese	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	aese	v2.16b, v27.16b
+	eor	v2.16b, v2.16b, v28.16b
+	aese	v3.16b, v27.16b
+	eor	v3.16b, v3.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w8, #4
+	bge	L_aes_xts_encrypt_arm64_crypto_192_start_4
+L_aes_xts_encrypt_arm64_crypto_192_start_2
+	cmp	w8, #2
+	blt	L_aes_xts_encrypt_arm64_crypto_192_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	extr	x11, x13, x12, #63
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x12, lsl 1
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	eor	x12, x9, x10, lsl 1
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aese	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_xts_encrypt_arm64_crypto_192_start_1
+	cbz	w8, L_aes_xts_encrypt_arm64_crypto_192_done
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	extr	x11, x11, x10, #63
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x10, lsl 1
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	st1	{v0.16b}, [x1], #16
+L_aes_xts_encrypt_arm64_crypto_192_done
+	cbz	w2, L_aes_xts_encrypt_arm64_crypto_192_partial_done
+	sub	x1, x1, #16
+	ld1	{v0.16b}, [x1], #16
+	st1	{v0.2d}, [x6]
+	mov	w9, w2
+L_aes_xts_encrypt_arm64_crypto_192_start_byte
+	ldrb	w12, [x6]
+	ldrb	w13, [x0], #1
+	strb	w12, [x1], #1
+	strb	w13, [x6], #1
+	subs	w9, w9, #1
+	bgt	L_aes_xts_encrypt_arm64_crypto_192_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ld1	{v0.2d}, [x6]
+	eor	v0.16b, v0.16b, v4.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1]
+L_aes_xts_encrypt_arm64_crypto_192_partial_done
+	ENDIF
+	b	L_aes_xts_encrypt_arm64_crypto_done
+	; AES_XTS_256
+L_aes_xts_encrypt_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x5], #0x40
+	ld1	{v28.2d, v29.2d}, [x5], #32
+	ld1	{v30.2d}, [x5]
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v25.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v26.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v27.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v28.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v29.16b
+	eor	v4.16b, v4.16b, v30.16b
+	mov	x10, v4.d[0]
+	mov	x11, v4.d[1]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+	ld1	{v28.2d, v29.2d}, [x4], #32
+	ld1	{v30.2d}, [x4]
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	and	x9, x19, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x9, x12, lsl 1
+	and	x9, x19, x15, asr 63
+	extr	x17, x15, x14, #63
+	eor	x16, x9, x14, lsl 1
+	cmp	w8, #4
+	blt	L_aes_xts_encrypt_arm64_crypto_256_start_2
+L_aes_xts_encrypt_arm64_crypto_256_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	mov	v6.d[0], x14
+	mov	v6.d[1], x15
+	mov	v7.d[0], x16
+	mov	v7.d[1], x17
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x17, asr 63
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	extr	x11, x17, x16, #63
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x16, lsl 1
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	and	x9, x19, x11, asr 63
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	eor	x12, x9, x10, lsl 1
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	extr	x15, x13, x12, #63
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	eor	x14, x9, x12, lsl 1
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	and	x9, x19, x15, asr 63
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	extr	x17, x15, x14, #63
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	eor	x16, x9, x14, lsl 1
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v25.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v25.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v26.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v26.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v27.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v27.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v27.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v28.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v28.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v28.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aese	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	aese	v2.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	aese	v3.16b, v29.16b
+	eor	v3.16b, v3.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w8, #4
+	bge	L_aes_xts_encrypt_arm64_crypto_256_start_4
+L_aes_xts_encrypt_arm64_crypto_256_start_2
+	cmp	w8, #2
+	blt	L_aes_xts_encrypt_arm64_crypto_256_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	extr	x11, x13, x12, #63
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x12, lsl 1
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	eor	x12, x9, x10, lsl 1
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v25.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v26.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v27.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v28.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aese	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_xts_encrypt_arm64_crypto_256_start_1
+	cbz	w8, L_aes_xts_encrypt_arm64_crypto_256_done
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	extr	x11, x11, x10, #63
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x10, lsl 1
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	st1	{v0.16b}, [x1], #16
+L_aes_xts_encrypt_arm64_crypto_256_done
+	cbz	w2, L_aes_xts_encrypt_arm64_crypto_256_partial_done
+	sub	x1, x1, #16
+	ld1	{v0.16b}, [x1], #16
+	st1	{v0.2d}, [x6]
+	mov	w9, w2
+L_aes_xts_encrypt_arm64_crypto_256_start_byte
+	ldrb	w12, [x6]
+	ldrb	w13, [x0], #1
+	strb	w12, [x1], #1
+	strb	w13, [x6], #1
+	subs	w9, w9, #1
+	bgt	L_aes_xts_encrypt_arm64_crypto_256_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ld1	{v0.2d}, [x6]
+	eor	v0.16b, v0.16b, v4.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v26.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v27.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v28.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1]
+L_aes_xts_encrypt_arm64_crypto_256_partial_done
+	ENDIF
+	b	L_aes_xts_encrypt_arm64_crypto_done
+	; AES_XTS_128
+L_aes_xts_encrypt_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	ld1	{v24.2d, v25.2d}, [x5], #32
+	ld1	{v26.2d}, [x5]
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v25.16b
+	eor	v4.16b, v4.16b, v26.16b
+	mov	x10, v4.d[0]
+	mov	x11, v4.d[1]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v24.2d, v25.2d}, [x4], #32
+	ld1	{v26.2d}, [x4]
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	and	x9, x19, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x9, x12, lsl 1
+	and	x9, x19, x15, asr 63
+	extr	x17, x15, x14, #63
+	eor	x16, x9, x14, lsl 1
+	cmp	w8, #4
+	blt	L_aes_xts_encrypt_arm64_crypto_128_start_2
+L_aes_xts_encrypt_arm64_crypto_128_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	mov	v6.d[0], x14
+	mov	v6.d[1], x15
+	mov	v7.d[0], x16
+	mov	v7.d[1], x17
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x17, asr 63
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v16.16b
+	aesmc	v2.16b, v2.16b
+	extr	x11, x17, x16, #63
+	aese	v3.16b, v16.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x16, lsl 1
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v17.16b
+	aesmc	v2.16b, v2.16b
+	and	x9, x19, x11, asr 63
+	aese	v3.16b, v17.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v18.16b
+	aesmc	v2.16b, v2.16b
+	eor	x12, x9, x10, lsl 1
+	aese	v3.16b, v18.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v19.16b
+	aesmc	v2.16b, v2.16b
+	extr	x15, x13, x12, #63
+	aese	v3.16b, v19.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	eor	x14, x9, x12, lsl 1
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v20.16b
+	aesmc	v2.16b, v2.16b
+	and	x9, x19, x15, asr 63
+	aese	v3.16b, v20.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	extr	x17, x15, x14, #63
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v21.16b
+	aesmc	v2.16b, v2.16b
+	eor	x16, x9, x14, lsl 1
+	aese	v3.16b, v21.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v22.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v22.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v23.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v23.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v2.16b, v24.16b
+	aesmc	v2.16b, v2.16b
+	aese	v3.16b, v24.16b
+	aesmc	v3.16b, v3.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aese	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	aese	v2.16b, v25.16b
+	eor	v2.16b, v2.16b, v26.16b
+	aese	v3.16b, v25.16b
+	eor	v3.16b, v3.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w8, #4
+	bge	L_aes_xts_encrypt_arm64_crypto_128_start_4
+L_aes_xts_encrypt_arm64_crypto_128_start_2
+	cmp	w8, #2
+	blt	L_aes_xts_encrypt_arm64_crypto_128_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aese	v1.16b, v16.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	extr	x11, x13, x12, #63
+	aese	v1.16b, v17.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x12, lsl 1
+	aese	v1.16b, v18.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aese	v1.16b, v19.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aese	v1.16b, v20.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	eor	x12, x9, x10, lsl 1
+	aese	v1.16b, v21.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v22.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v23.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v1.16b, v24.16b
+	aesmc	v1.16b, v1.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aese	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_xts_encrypt_arm64_crypto_128_start_1
+	cbz	w8, L_aes_xts_encrypt_arm64_crypto_128_done
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	extr	x11, x11, x10, #63
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	eor	x10, x9, x10, lsl 1
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	st1	{v0.16b}, [x1], #16
+L_aes_xts_encrypt_arm64_crypto_128_done
+	cbz	w2, L_aes_xts_encrypt_arm64_crypto_128_partial_done
+	sub	x1, x1, #16
+	ld1	{v0.16b}, [x1], #16
+	st1	{v0.2d}, [x6]
+	mov	w9, w2
+L_aes_xts_encrypt_arm64_crypto_128_start_byte
+	ldrb	w12, [x6]
+	ldrb	w13, [x0], #1
+	strb	w12, [x1], #1
+	strb	w13, [x6], #1
+	subs	w9, w9, #1
+	bgt	L_aes_xts_encrypt_arm64_crypto_128_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ld1	{v0.2d}, [x6]
+	eor	v0.16b, v0.16b, v4.16b
+	aese	v0.16b, v16.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v17.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v18.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v19.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v20.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v21.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v22.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v23.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v24.16b
+	aesmc	v0.16b, v0.16b
+	aese	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1]
+L_aes_xts_encrypt_arm64_crypto_128_partial_done
+	ENDIF
+L_aes_xts_encrypt_arm64_crypto_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_decrypt_AARCH64
+AES_XTS_decrypt_AARCH64 PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x5], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x5], #0x40
+	ld1	{v4.16b}, [x3]
+	lsr	w8, w2, #4
+	ands	w2, w2, #15
+	mov	x19, #0x87
+	cset	w9, ne
+	sub	w8, w8, w9
+	cmp	x7, #12
+	blt	L_aes_xts_decrypt_arm64_crypto_start_128
+	bgt	L_aes_xts_decrypt_arm64_crypto_start_256
+	; AES_XTS_192
+	IF :LNOT::DEF:NO_AES_192
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x5], #0x40
+	ld1	{v28.2d}, [x5]
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v25.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v26.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v27.16b
+	eor	v4.16b, v4.16b, v28.16b
+	mov	x10, v4.d[0]
+	mov	x11, v4.d[1]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+	ld1	{v28.2d}, [x4]
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	and	x9, x19, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x9, x12, lsl 1
+	and	x9, x19, x15, asr 63
+	extr	x17, x15, x14, #63
+	eor	x16, x9, x14, lsl 1
+	cmp	w8, #4
+	blt	L_aes_xts_decrypt_arm64_crypto_192_start_2
+L_aes_xts_decrypt_arm64_crypto_192_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	mov	v6.d[0], x14
+	mov	v6.d[1], x15
+	mov	v7.d[0], x16
+	mov	v7.d[1], x17
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x17, asr 63
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	extr	x11, x17, x16, #63
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x16, lsl 1
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	and	x9, x19, x11, asr 63
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	eor	x12, x9, x10, lsl 1
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	extr	x15, x13, x12, #63
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	eor	x14, x9, x12, lsl 1
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	and	x9, x19, x15, asr 63
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	extr	x17, x15, x14, #63
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	eor	x16, x9, x14, lsl 1
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v25.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v25.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v26.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v26.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aesd	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	aesd	v2.16b, v27.16b
+	eor	v2.16b, v2.16b, v28.16b
+	aesd	v3.16b, v27.16b
+	eor	v3.16b, v3.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w8, #4
+	bge	L_aes_xts_decrypt_arm64_crypto_192_start_4
+L_aes_xts_decrypt_arm64_crypto_192_start_2
+	cmp	w8, #2
+	blt	L_aes_xts_decrypt_arm64_crypto_192_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	extr	x11, x13, x12, #63
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x12, lsl 1
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	eor	x12, x9, x10, lsl 1
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	aesd	v1.16b, v27.16b
+	eor	v1.16b, v1.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_xts_decrypt_arm64_crypto_192_start_1
+	cbz	w8, L_aes_xts_decrypt_arm64_crypto_192_done
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	extr	x11, x11, x10, #63
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x10, lsl 1
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	st1	{v0.16b}, [x1], #16
+L_aes_xts_decrypt_arm64_crypto_192_done
+	cbz	w2, L_aes_xts_decrypt_arm64_crypto_192_partial_done
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v5.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v0.16b, v0.16b, v5.16b
+	st1	{v0.2d}, [x6]
+	add	x1, x1, #16
+	mov	w9, w2
+L_aes_xts_decrypt_arm64_crypto_192_start_byte
+	ldrb	w12, [x6]
+	ldrb	w13, [x0], #1
+	strb	w12, [x1], #1
+	strb	w13, [x6], #1
+	subs	w9, w9, #1
+	bgt	L_aes_xts_decrypt_arm64_crypto_192_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ld1	{v0.2d}, [x6]
+	eor	v0.16b, v0.16b, v4.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1]
+L_aes_xts_decrypt_arm64_crypto_192_partial_done
+	ENDIF
+	b	L_aes_xts_decrypt_arm64_crypto_done
+	; AES_XTS_256
+L_aes_xts_decrypt_arm64_crypto_start_256
+	IF :LNOT::DEF:NO_AES_256
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x5], #0x40
+	ld1	{v28.2d, v29.2d}, [x5], #32
+	ld1	{v30.2d}, [x5]
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v25.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v26.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v27.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v28.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v29.16b
+	eor	v4.16b, v4.16b, v30.16b
+	mov	x10, v4.d[0]
+	mov	x11, v4.d[1]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x4], #0x40
+	ld1	{v28.2d, v29.2d}, [x4], #32
+	ld1	{v30.2d}, [x4]
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	and	x9, x19, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x9, x12, lsl 1
+	and	x9, x19, x15, asr 63
+	extr	x17, x15, x14, #63
+	eor	x16, x9, x14, lsl 1
+	cmp	w8, #4
+	blt	L_aes_xts_decrypt_arm64_crypto_256_start_2
+L_aes_xts_decrypt_arm64_crypto_256_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	mov	v6.d[0], x14
+	mov	v6.d[1], x15
+	mov	v7.d[0], x16
+	mov	v7.d[1], x17
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x17, asr 63
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	extr	x11, x17, x16, #63
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x16, lsl 1
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	and	x9, x19, x11, asr 63
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	eor	x12, x9, x10, lsl 1
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	extr	x15, x13, x12, #63
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	eor	x14, x9, x12, lsl 1
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	and	x9, x19, x15, asr 63
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	extr	x17, x15, x14, #63
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	eor	x16, x9, x14, lsl 1
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v25.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v25.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v26.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v26.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v27.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v27.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v27.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v28.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v28.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v28.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aesd	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	aesd	v2.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	aesd	v3.16b, v29.16b
+	eor	v3.16b, v3.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w8, #4
+	bge	L_aes_xts_decrypt_arm64_crypto_256_start_4
+L_aes_xts_decrypt_arm64_crypto_256_start_2
+	cmp	w8, #2
+	blt	L_aes_xts_decrypt_arm64_crypto_256_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	extr	x11, x13, x12, #63
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x12, lsl 1
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	eor	x12, x9, x10, lsl 1
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v25.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v26.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v27.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v28.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	aesd	v1.16b, v29.16b
+	eor	v1.16b, v1.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_xts_decrypt_arm64_crypto_256_start_1
+	cbz	w8, L_aes_xts_decrypt_arm64_crypto_256_done
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	extr	x11, x11, x10, #63
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x10, lsl 1
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	st1	{v0.16b}, [x1], #16
+L_aes_xts_decrypt_arm64_crypto_256_done
+	cbz	w2, L_aes_xts_decrypt_arm64_crypto_256_partial_done
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v5.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	eor	v0.16b, v0.16b, v5.16b
+	st1	{v0.2d}, [x6]
+	add	x1, x1, #16
+	mov	w9, w2
+L_aes_xts_decrypt_arm64_crypto_256_start_byte
+	ldrb	w12, [x6]
+	ldrb	w13, [x0], #1
+	strb	w12, [x1], #1
+	strb	w13, [x6], #1
+	subs	w9, w9, #1
+	bgt	L_aes_xts_decrypt_arm64_crypto_256_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ld1	{v0.2d}, [x6]
+	eor	v0.16b, v0.16b, v4.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v26.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v27.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v28.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v29.16b
+	eor	v0.16b, v0.16b, v30.16b
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1]
+L_aes_xts_decrypt_arm64_crypto_256_partial_done
+	ENDIF
+	b	L_aes_xts_decrypt_arm64_crypto_done
+	; AES_XTS_128
+L_aes_xts_decrypt_arm64_crypto_start_128
+	IF :LNOT::DEF:NO_AES_128
+	ld1	{v24.2d, v25.2d}, [x5], #32
+	ld1	{v26.2d}, [x5]
+	aese	v4.16b, v16.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v17.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v18.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v19.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v20.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v21.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v22.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v23.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v24.16b
+	aesmc	v4.16b, v4.16b
+	aese	v4.16b, v25.16b
+	eor	v4.16b, v4.16b, v26.16b
+	mov	x10, v4.d[0]
+	mov	x11, v4.d[1]
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x4], #0x40
+	ld1	{v20.2d, v21.2d, v22.2d, v23.2d}, [x4], #0x40
+	ld1	{v24.2d, v25.2d}, [x4], #32
+	ld1	{v26.2d}, [x4]
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	and	x9, x19, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x9, x12, lsl 1
+	and	x9, x19, x15, asr 63
+	extr	x17, x15, x14, #63
+	eor	x16, x9, x14, lsl 1
+	cmp	w8, #4
+	blt	L_aes_xts_decrypt_arm64_crypto_128_start_2
+L_aes_xts_decrypt_arm64_crypto_128_start_4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	mov	v6.d[0], x14
+	mov	v6.d[1], x15
+	mov	v7.d[0], x16
+	mov	v7.d[1], x17
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x17, asr 63
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v16.16b
+	aesimc	v2.16b, v2.16b
+	extr	x11, x17, x16, #63
+	aesd	v3.16b, v16.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x16, lsl 1
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v17.16b
+	aesimc	v2.16b, v2.16b
+	and	x9, x19, x11, asr 63
+	aesd	v3.16b, v17.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v18.16b
+	aesimc	v2.16b, v2.16b
+	eor	x12, x9, x10, lsl 1
+	aesd	v3.16b, v18.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v19.16b
+	aesimc	v2.16b, v2.16b
+	extr	x15, x13, x12, #63
+	aesd	v3.16b, v19.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	eor	x14, x9, x12, lsl 1
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v20.16b
+	aesimc	v2.16b, v2.16b
+	and	x9, x19, x15, asr 63
+	aesd	v3.16b, v20.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	extr	x17, x15, x14, #63
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v21.16b
+	aesimc	v2.16b, v2.16b
+	eor	x16, x9, x14, lsl 1
+	aesd	v3.16b, v21.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v22.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v22.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v23.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v23.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v2.16b, v24.16b
+	aesimc	v2.16b, v2.16b
+	aesd	v3.16b, v24.16b
+	aesimc	v3.16b, v3.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aesd	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	aesd	v2.16b, v25.16b
+	eor	v2.16b, v2.16b, v26.16b
+	aesd	v3.16b, v25.16b
+	eor	v3.16b, v3.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #4
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	cmp	w8, #4
+	bge	L_aes_xts_decrypt_arm64_crypto_128_start_4
+L_aes_xts_decrypt_arm64_crypto_128_start_2
+	cmp	w8, #2
+	blt	L_aes_xts_decrypt_arm64_crypto_128_start_1
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x13, asr 63
+	aesd	v1.16b, v16.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	extr	x11, x13, x12, #63
+	aesd	v1.16b, v17.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x12, lsl 1
+	aesd	v1.16b, v18.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aesd	v1.16b, v19.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	extr	x13, x11, x10, #63
+	aesd	v1.16b, v20.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	eor	x12, x9, x10, lsl 1
+	aesd	v1.16b, v21.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v22.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v23.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v1.16b, v24.16b
+	aesimc	v1.16b, v1.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	aesd	v1.16b, v25.16b
+	eor	v1.16b, v1.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	sub	w8, w8, #2
+	st1	{v0.16b, v1.16b}, [x1], #32
+L_aes_xts_decrypt_arm64_crypto_128_start_1
+	cbz	w8, L_aes_xts_decrypt_arm64_crypto_128_done
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	and	x9, x19, x11, asr 63
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	extr	x11, x11, x10, #63
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	eor	x10, x9, x10, lsl 1
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	mov	v4.d[0], x10
+	mov	v4.d[1], x11
+	st1	{v0.16b}, [x1], #16
+L_aes_xts_decrypt_arm64_crypto_128_done
+	cbz	w2, L_aes_xts_decrypt_arm64_crypto_128_partial_done
+	and	x9, x19, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x9, x10, lsl 1
+	mov	v5.d[0], x12
+	mov	v5.d[1], x13
+	ld1	{v0.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v5.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	eor	v0.16b, v0.16b, v5.16b
+	st1	{v0.2d}, [x6]
+	add	x1, x1, #16
+	mov	w9, w2
+L_aes_xts_decrypt_arm64_crypto_128_start_byte
+	ldrb	w12, [x6]
+	ldrb	w13, [x0], #1
+	strb	w12, [x1], #1
+	strb	w13, [x6], #1
+	subs	w9, w9, #1
+	bgt	L_aes_xts_decrypt_arm64_crypto_128_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ld1	{v0.2d}, [x6]
+	eor	v0.16b, v0.16b, v4.16b
+	aesd	v0.16b, v16.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v17.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v18.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v19.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v20.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v21.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v22.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v23.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v24.16b
+	aesimc	v0.16b, v0.16b
+	aesd	v0.16b, v25.16b
+	eor	v0.16b, v0.16b, v26.16b
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1]
+L_aes_xts_decrypt_arm64_crypto_128_partial_done
+	ENDIF
+L_aes_xts_decrypt_arm64_crypto_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	ENDIF
+	IF :LNOT::DEF:WOLFSSL_ARMASM_NO_NEON
+	IF :DEF:HAVE_AES_DECRYPT :LOR: :DEF:HAVE_AES_CBC :LOR: :DEF:HAVE_AESCCM :LOR: :DEF:HAVE_AESGCM :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_NEON_te
+	DCB	0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5
+	DCB	0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76
+	DCB	0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0
+	DCB	0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0
+	DCB	0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc
+	DCB	0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15
+	DCB	0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a
+	DCB	0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75
+	DCB	0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0
+	DCB	0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84
+	DCB	0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b
+	DCB	0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf
+	DCB	0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85
+	DCB	0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8
+	DCB	0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5
+	DCB	0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2
+	DCB	0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17
+	DCB	0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73
+	DCB	0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88
+	DCB	0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb
+	DCB	0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c
+	DCB	0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79
+	DCB	0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9
+	DCB	0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08
+	DCB	0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6
+	DCB	0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a
+	DCB	0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e
+	DCB	0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e
+	DCB	0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94
+	DCB	0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf
+	DCB	0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68
+	DCB	0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_NEON_shift_rows_shuffle
+	DCB	0x0c, 0x09, 0x06, 0x03, 0x00, 0x0d, 0x0a, 0x07
+	DCB	0x04, 0x01, 0x0e, 0x0b, 0x08, 0x05, 0x02, 0x0f
+	ENDIF
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_invert_key_NEON
+AES_invert_key_NEON PROC
+	add	x3, x0, x1, lsl 4
+	mov	x2, x0
+	mov	w4, w1
+L_AES_invert_key_NEON_loop
+	ld1	{v0.2d}, [x2]
+	ld1	{v1.2d}, [x3]
+	st1	{v0.2d}, [x3]
+	st1	{v1.2d}, [x2], #16
+	subs	w4, w4, #2
+	sub	x3, x3, #16
+	bne	L_AES_invert_key_NEON_loop
+	movi	v2.16b, #27
+	add	x2, x0, #16
+	sub	w4, w1, #1
+L_AES_invert_key_NEON_mix_loop
+	ld1	{v0.2d}, [x2]
+	sshr	v5.16b, v0.16b, #7
+	ushr	v6.16b, v0.16b, #6
+	ushr	v3.16b, v0.16b, #5
+	and	v5.16b, v5.16b, v2.16b
+	pmul	v6.16b, v6.16b, v2.16b
+	pmul	v3.16b, v3.16b, v2.16b
+	shl	v4.16b, v0.16b, #1
+	eor	v5.16b, v5.16b, v4.16b
+	shl	v4.16b, v0.16b, #3
+	eor	v3.16b, v3.16b, v4.16b
+	shl	v4.16b, v0.16b, #2
+	eor	v6.16b, v6.16b, v4.16b
+	eor	v4.16b, v5.16b, v3.16b
+	eor	v3.16b, v3.16b, v0.16b
+	eor	v5.16b, v6.16b, v3.16b
+	eor	v6.16b, v6.16b, v4.16b
+	eor	v4.16b, v4.16b, v0.16b
+	shl	v0.4s, v4.4s, #8
+	rev32	v5.8h, v5.8h
+	sri	v0.4s, v4.4s, #24
+	eor	v0.16b, v0.16b, v6.16b
+	shl	v4.4s, v3.4s, #24
+	eor	v0.16b, v0.16b, v5.16b
+	sri	v4.4s, v3.4s, #8
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.2d}, [x2], #16
+	subs	w4, w4, #1
+	bne	L_AES_invert_key_NEON_mix_loop
+	ret
+	ENDP
+	ENDIF
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_NEON_rcon
+	DCD	0x01000000, 0x02000000, 0x04000000, 0x08000000
+	DCD	0x10000000, 0x20000000, 0x40000000, 0x80000000
+	DCD	0x1b000000, 0x36000000
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_set_encrypt_key_NEON
+AES_set_encrypt_key_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x4, L_AES_ARM64_NEON_rcon
+	add	x4, x4, L_AES_ARM64_NEON_rcon
+	adrp	x5, L_AES_ARM64_NEON_te
+	add	x5, x5, L_AES_ARM64_NEON_te
+	ld1	{v6.16b, v7.16b, v8.16b, v9.16b}, [x5], #0x40
+	ld1	{v10.16b, v11.16b, v12.16b, v13.16b}, [x5], #0x40
+	ld1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x5], #0x40
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x5]
+	movi	v2.16b, #0x40
+	movi	v3.16b, #0x80
+	movi	v4.16b, #0xc0
+	movi	v5.16b, #27
+	eor	v26.16b, v26.16b, v26.16b
+	cmp	x1, #0x80
+	beq	L_AES_set_encrypt_key_NEON_start_128
+	cmp	x1, #0xc0
+	beq	L_AES_set_encrypt_key_NEON_start_192
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v1.16b}, [x0]
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	st1	{v0.2d}, [x2], #16
+	st1	{v1.2d}, [x2], #16
+	mov	x3, #6
+L_AES_set_encrypt_key_NEON_loop_256
+	eor	v22.16b, v1.16b, v2.16b
+	eor	v23.16b, v1.16b, v3.16b
+	eor	v24.16b, v1.16b, v4.16b
+	tbl	v25.16b, {v6.16b, v7.16b, v8.16b, v9.16b}, v1.16b
+	tbl	v22.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v22.16b
+	tbl	v23.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v23.16b
+	tbl	v24.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v24.16b
+	orr	v25.16b, v25.16b, v22.16b
+	orr	v23.16b, v23.16b, v24.16b
+	orr	v25.16b, v25.16b, v23.16b
+	ext	v25.16b, v25.16b, v26.16b, #12
+	shl	v22.4s, v25.4s, #8
+	sri	v22.4s, v25.4s, #24
+	eor	v0.16b, v0.16b, v22.16b
+	ld1r	{v25.4s}, [x4], #4
+	dup	v22.4s, v0.s[0]
+	dup	v23.2s, v0.s[1]
+	dup	v24.2s, v0.s[2]
+	ext	v22.16b, v26.16b, v22.16b, #12
+	ext	v23.16b, v26.16b, v23.16b, #8
+	eor	v0.16b, v0.16b, v22.16b
+	ext	v24.16b, v26.16b, v24.16b, #4
+	eor	v0.16b, v0.16b, v23.16b
+	eor	v0.16b, v0.16b, v24.16b
+	eor	v0.16b, v0.16b, v25.16b
+	st1	{v0.2d}, [x2], #16
+	eor	v22.16b, v0.16b, v2.16b
+	eor	v23.16b, v0.16b, v3.16b
+	eor	v24.16b, v0.16b, v4.16b
+	tbl	v25.16b, {v6.16b, v7.16b, v8.16b, v9.16b}, v0.16b
+	tbl	v22.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v22.16b
+	tbl	v23.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v23.16b
+	tbl	v24.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v24.16b
+	orr	v25.16b, v25.16b, v22.16b
+	orr	v23.16b, v23.16b, v24.16b
+	orr	v25.16b, v25.16b, v23.16b
+	ext	v25.16b, v25.16b, v26.16b, #12
+	eor	v1.16b, v1.16b, v25.16b
+	dup	v22.4s, v1.s[0]
+	dup	v23.2s, v1.s[1]
+	dup	v24.2s, v1.s[2]
+	ext	v22.16b, v26.16b, v22.16b, #12
+	ext	v23.16b, v26.16b, v23.16b, #8
+	eor	v1.16b, v1.16b, v22.16b
+	ext	v24.16b, v26.16b, v24.16b, #4
+	eor	v1.16b, v1.16b, v23.16b
+	eor	v1.16b, v1.16b, v24.16b
+	st1	{v1.2d}, [x2], #16
+	subs	x3, x3, #1
+	bne	L_AES_set_encrypt_key_NEON_loop_256
+	eor	v22.16b, v1.16b, v2.16b
+	eor	v23.16b, v1.16b, v3.16b
+	eor	v24.16b, v1.16b, v4.16b
+	tbl	v25.16b, {v6.16b, v7.16b, v8.16b, v9.16b}, v1.16b
+	tbl	v22.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v22.16b
+	tbl	v23.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v23.16b
+	tbl	v24.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v24.16b
+	orr	v25.16b, v25.16b, v22.16b
+	orr	v23.16b, v23.16b, v24.16b
+	orr	v25.16b, v25.16b, v23.16b
+	ext	v25.16b, v25.16b, v26.16b, #12
+	shl	v22.4s, v25.4s, #8
+	sri	v22.4s, v25.4s, #24
+	eor	v0.16b, v0.16b, v22.16b
+	ld1r	{v25.4s}, [x4], #4
+	dup	v22.4s, v0.s[0]
+	dup	v23.2s, v0.s[1]
+	dup	v24.2s, v0.s[2]
+	ext	v22.16b, v26.16b, v22.16b, #12
+	ext	v23.16b, v26.16b, v23.16b, #8
+	eor	v0.16b, v0.16b, v22.16b
+	ext	v24.16b, v26.16b, v24.16b, #4
+	eor	v0.16b, v0.16b, v23.16b
+	eor	v0.16b, v0.16b, v24.16b
+	eor	v0.16b, v0.16b, v25.16b
+	st1	{v0.2d}, [x2], #16
+	b	L_AES_set_encrypt_key_NEON_end
+L_AES_set_encrypt_key_NEON_start_192
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v1.8b}, [x0]
+	rev32	v0.16b, v0.16b
+	rev32	v1.8b, v1.8b
+	st1	{v0.16b}, [x2], #16
+	st1	{v1.8b}, [x2], #8
+	ext	v1.16b, v1.16b, v1.16b, #8
+	mov	x3, #7
+L_AES_set_encrypt_key_NEON_loop_192
+	eor	v22.16b, v1.16b, v2.16b
+	eor	v23.16b, v1.16b, v3.16b
+	eor	v24.16b, v1.16b, v4.16b
+	tbl	v25.16b, {v6.16b, v7.16b, v8.16b, v9.16b}, v1.16b
+	tbl	v22.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v22.16b
+	tbl	v23.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v23.16b
+	tbl	v24.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v24.16b
+	orr	v25.16b, v25.16b, v22.16b
+	orr	v23.16b, v23.16b, v24.16b
+	orr	v25.16b, v25.16b, v23.16b
+	ext	v25.16b, v25.16b, v26.16b, #12
+	shl	v22.4s, v25.4s, #8
+	sri	v22.4s, v25.4s, #24
+	eor	v0.16b, v0.16b, v22.16b
+	ld1r	{v25.4s}, [x4], #4
+	dup	v22.4s, v0.s[0]
+	dup	v23.2s, v0.s[1]
+	dup	v24.2s, v0.s[2]
+	ext	v22.16b, v26.16b, v22.16b, #12
+	ext	v23.16b, v26.16b, v23.16b, #8
+	eor	v0.16b, v0.16b, v22.16b
+	ext	v24.16b, v26.16b, v24.16b, #4
+	eor	v0.16b, v0.16b, v23.16b
+	eor	v0.16b, v0.16b, v24.16b
+	eor	v0.16b, v0.16b, v25.16b
+	st1	{v0.2d}, [x2], #16
+	mov	v23.16b, v26.16b
+	mov	v23.s[2], v0.s[3]
+	eor	v1.16b, v1.16b, v23.16b
+	mov	v23.16b, v26.16b
+	mov	v23.s[3], v1.s[2]
+	eor	v1.16b, v1.16b, v23.16b
+	st1	{v1.d}[1], [x2], #8
+	subs	x3, x3, #1
+	bne	L_AES_set_encrypt_key_NEON_loop_192
+	eor	v22.16b, v1.16b, v2.16b
+	eor	v23.16b, v1.16b, v3.16b
+	eor	v24.16b, v1.16b, v4.16b
+	tbl	v25.16b, {v6.16b, v7.16b, v8.16b, v9.16b}, v1.16b
+	tbl	v22.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v22.16b
+	tbl	v23.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v23.16b
+	tbl	v24.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v24.16b
+	orr	v25.16b, v25.16b, v22.16b
+	orr	v23.16b, v23.16b, v24.16b
+	orr	v25.16b, v25.16b, v23.16b
+	ext	v25.16b, v25.16b, v26.16b, #12
+	shl	v22.4s, v25.4s, #8
+	sri	v22.4s, v25.4s, #24
+	eor	v0.16b, v0.16b, v22.16b
+	ld1r	{v25.4s}, [x4], #4
+	dup	v22.4s, v0.s[0]
+	dup	v23.2s, v0.s[1]
+	dup	v24.2s, v0.s[2]
+	ext	v22.16b, v26.16b, v22.16b, #12
+	ext	v23.16b, v26.16b, v23.16b, #8
+	eor	v0.16b, v0.16b, v22.16b
+	ext	v24.16b, v26.16b, v24.16b, #4
+	eor	v0.16b, v0.16b, v23.16b
+	eor	v0.16b, v0.16b, v24.16b
+	eor	v0.16b, v0.16b, v25.16b
+	st1	{v0.2d}, [x2], #16
+	b	L_AES_set_encrypt_key_NEON_end
+L_AES_set_encrypt_key_NEON_start_128
+	ld1	{v0.16b}, [x0]
+	rev32	v0.16b, v0.16b
+	st1	{v0.2d}, [x2], #16
+	mov	x3, #10
+L_AES_set_encrypt_key_NEON_loop_128
+	eor	v22.16b, v0.16b, v2.16b
+	eor	v23.16b, v0.16b, v3.16b
+	eor	v24.16b, v0.16b, v4.16b
+	tbl	v25.16b, {v6.16b, v7.16b, v8.16b, v9.16b}, v0.16b
+	tbl	v22.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v22.16b
+	tbl	v23.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v23.16b
+	tbl	v24.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v24.16b
+	orr	v25.16b, v25.16b, v22.16b
+	orr	v23.16b, v23.16b, v24.16b
+	orr	v25.16b, v25.16b, v23.16b
+	ext	v25.16b, v25.16b, v26.16b, #12
+	shl	v22.4s, v25.4s, #8
+	sri	v22.4s, v25.4s, #24
+	eor	v0.16b, v0.16b, v22.16b
+	ld1r	{v25.4s}, [x4], #4
+	dup	v22.4s, v0.s[0]
+	dup	v23.2s, v0.s[1]
+	dup	v24.2s, v0.s[2]
+	ext	v22.16b, v26.16b, v22.16b, #12
+	ext	v23.16b, v26.16b, v23.16b, #8
+	eor	v0.16b, v0.16b, v22.16b
+	ext	v24.16b, v26.16b, v24.16b, #4
+	eor	v0.16b, v0.16b, v23.16b
+	eor	v0.16b, v0.16b, v24.16b
+	eor	v0.16b, v0.16b, v25.16b
+	st1	{v0.2d}, [x2], #16
+	subs	x3, x3, #1
+	bne	L_AES_set_encrypt_key_NEON_loop_128
+L_AES_set_encrypt_key_NEON_end
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	IF :DEF:HAVE_AESCCM :LOR: :DEF:HAVE_AESGCM :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER :LOR: :DEF:HAVE_AES_ECB
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_ECB_encrypt_NEON
+AES_ECB_encrypt_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x5, L_AES_ARM64_NEON_te
+	add	x5, x5, L_AES_ARM64_NEON_te
+	adrp	x6, L_AES_ARM64_NEON_shift_rows_shuffle
+	add	x6, x6, L_AES_ARM64_NEON_shift_rows_shuffle
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x5], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x5], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x5], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x5]
+	cmp	x2, #0x40
+	blt	L_AES_ECB_encrypt_NEON_start_2
+L_AES_ECB_encrypt_NEON_loop_4
+	mov	x8, x3
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.2d}, [x8], #16
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	sub	w7, w4, #2
+L_AES_ECB_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	sshr	v10.16b, v2.16b, #7
+	sshr	v11.16b, v3.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	shl	v14.16b, v2.16b, #1
+	shl	v15.16b, v3.16b, #1
+	movi	v4.16b, #27
+	and	v8.16b, v8.16b, v4.16b
+	and	v9.16b, v9.16b, v4.16b
+	and	v10.16b, v10.16b, v4.16b
+	and	v11.16b, v11.16b, v4.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	eor	v6.16b, v10.16b, v2.16b
+	eor	v7.16b, v11.16b, v3.16b
+	shl	v12.4s, v4.4s, #8
+	shl	v13.4s, v5.4s, #8
+	shl	v14.4s, v6.4s, #8
+	shl	v15.4s, v7.4s, #8
+	sri	v12.4s, v4.4s, #24
+	sri	v13.4s, v5.4s, #24
+	sri	v14.4s, v6.4s, #24
+	sri	v15.4s, v7.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	shl	v6.4s, v2.4s, #24
+	shl	v7.4s, v3.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	sri	v6.4s, v2.4s, #8
+	sri	v7.4s, v3.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	rev32	v2.8h, v2.8h
+	rev32	v3.8h, v3.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	; Round Done
+	subs	w7, w7, #2
+	bne	L_AES_ECB_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	sub	x2, x2, #0x40
+	cmp	x2, #0x40
+	bge	L_AES_ECB_encrypt_NEON_loop_4
+L_AES_ECB_encrypt_NEON_start_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+	cmp	x2, #16
+	beq	L_AES_ECB_encrypt_NEON_start_1
+	blt	L_AES_ECB_encrypt_NEON_data_done
+L_AES_ECB_encrypt_NEON_loop_2
+	mov	x8, x3
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	ld1	{v4.2d}, [x8], #16
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	sub	w7, w4, #2
+L_AES_ECB_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	shl	v10.16b, v0.16b, #1
+	shl	v11.16b, v1.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	shl	v10.4s, v4.4s, #8
+	shl	v11.4s, v5.4s, #8
+	sri	v10.4s, v4.4s, #24
+	sri	v11.4s, v5.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	; Round Done
+	subs	w7, w7, #2
+	bne	L_AES_ECB_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	st1	{v0.16b, v1.16b}, [x1], #32
+	sub	x2, x2, #32
+	cmp	x2, #0
+	beq	L_AES_ECB_encrypt_NEON_data_done
+L_AES_ECB_encrypt_NEON_start_1
+	ld1	{v3.2d}, [x6]
+	mov	x8, x3
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v4.2d}, [x8], #16
+	rev32	v0.16b, v0.16b
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v0.16b, v4.16b
+	sub	w7, w4, #2
+L_AES_ECB_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x8], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x8], #16
+	sshr	v10.16b, v0.16b, #7
+	shl	v9.16b, v0.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v0.8h
+	eor	v11.16b, v10.16b, v0.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v0.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v4.16b
+	sri	v9.4s, v0.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v0.16b, v10.16b, v9.16b
+	eor	v0.16b, v0.16b, v8.16b
+	subs	w7, w7, #2
+	bne	L_AES_ECB_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x8], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x8], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	st1	{v0.16b}, [x1], #16
+L_AES_ECB_encrypt_NEON_data_done
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:HAVE_AES_CBC
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CBC_encrypt_NEON
+AES_CBC_encrypt_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x6, L_AES_ARM64_NEON_te
+	add	x6, x6, L_AES_ARM64_NEON_te
+	adrp	x7, L_AES_ARM64_NEON_shift_rows_shuffle
+	add	x7, x7, L_AES_ARM64_NEON_shift_rows_shuffle
+	ld1	{v10.16b, v11.16b, v12.16b, v13.16b}, [x6], #0x40
+	ld1	{v14.16b, v15.16b, v16.16b, v17.16b}, [x6], #0x40
+	ld1	{v18.16b, v19.16b, v20.16b, v21.16b}, [x6], #0x40
+	ld1	{v22.16b, v23.16b, v24.16b, v25.16b}, [x6]
+	movi	v6.16b, #0x40
+	movi	v7.16b, #0x80
+	movi	v8.16b, #0xc0
+	movi	v9.16b, #27
+	ld1	{v0.2d}, [x5]
+	ld1	{v26.2d}, [x7]
+L_AES_CBC_encrypt_NEON_loop_block
+	add	x9, x3, #16
+	ld1	{v1.16b}, [x0], #16
+	ld1	{v2.16b}, [x3]
+	eor	v0.16b, v0.16b, v1.16b
+	rev32	v0.16b, v0.16b
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v0.16b, v2.16b
+	sub	w8, w4, #2
+L_AES_CBC_encrypt_NEON_loop_nr
+	eor	v2.16b, v0.16b, v6.16b
+	eor	v3.16b, v0.16b, v7.16b
+	eor	v4.16b, v0.16b, v8.16b
+	tbl	v1.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v0.16b
+	tbl	v2.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v2.16b
+	tbl	v3.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v3.16b
+	tbl	v4.16b, {v22.16b, v23.16b, v24.16b, v25.16b}, v4.16b
+	orr	v1.16b, v1.16b, v2.16b
+	orr	v3.16b, v3.16b, v4.16b
+	orr	v1.16b, v1.16b, v3.16b
+	tbl	v1.16b, {v1.16b}, v26.16b
+	ld1	{v0.2d}, [x9], #16
+	sshr	v4.16b, v1.16b, #7
+	shl	v3.16b, v1.16b, #1
+	and	v4.16b, v4.16b, v9.16b
+	eor	v4.16b, v4.16b, v3.16b
+	rev32	v2.8h, v1.8h
+	eor	v5.16b, v4.16b, v1.16b
+	eor	v4.16b, v4.16b, v2.16b
+	shl	v3.4s, v1.4s, #24
+	shl	v2.4s, v5.4s, #8
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	sri	v3.4s, v1.4s, #8
+	sri	v2.4s, v5.4s, #24
+	eor	v1.16b, v4.16b, v3.16b
+	eor	v1.16b, v1.16b, v2.16b
+	eor	v2.16b, v1.16b, v6.16b
+	eor	v3.16b, v1.16b, v7.16b
+	eor	v4.16b, v1.16b, v8.16b
+	tbl	v0.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v1.16b
+	tbl	v2.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v2.16b
+	tbl	v3.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v3.16b
+	tbl	v4.16b, {v22.16b, v23.16b, v24.16b, v25.16b}, v4.16b
+	orr	v0.16b, v0.16b, v2.16b
+	orr	v3.16b, v3.16b, v4.16b
+	orr	v0.16b, v0.16b, v3.16b
+	tbl	v0.16b, {v0.16b}, v26.16b
+	ld1	{v1.2d}, [x9], #16
+	sshr	v4.16b, v0.16b, #7
+	shl	v3.16b, v0.16b, #1
+	and	v4.16b, v4.16b, v9.16b
+	eor	v4.16b, v4.16b, v3.16b
+	rev32	v2.8h, v0.8h
+	eor	v5.16b, v4.16b, v0.16b
+	eor	v4.16b, v4.16b, v2.16b
+	shl	v3.4s, v0.4s, #24
+	shl	v2.4s, v5.4s, #8
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v1.16b
+	sri	v3.4s, v0.4s, #8
+	sri	v2.4s, v5.4s, #24
+	eor	v0.16b, v4.16b, v3.16b
+	eor	v0.16b, v0.16b, v2.16b
+	subs	w8, w8, #2
+	bne	L_AES_CBC_encrypt_NEON_loop_nr
+	eor	v2.16b, v0.16b, v6.16b
+	eor	v3.16b, v0.16b, v7.16b
+	eor	v4.16b, v0.16b, v8.16b
+	tbl	v1.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v0.16b
+	tbl	v2.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v2.16b
+	tbl	v3.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v3.16b
+	tbl	v4.16b, {v22.16b, v23.16b, v24.16b, v25.16b}, v4.16b
+	orr	v1.16b, v1.16b, v2.16b
+	orr	v3.16b, v3.16b, v4.16b
+	orr	v1.16b, v1.16b, v3.16b
+	tbl	v1.16b, {v1.16b}, v26.16b
+	ld1	{v0.2d}, [x9], #16
+	sshr	v4.16b, v1.16b, #7
+	shl	v3.16b, v1.16b, #1
+	and	v4.16b, v4.16b, v9.16b
+	eor	v4.16b, v4.16b, v3.16b
+	rev32	v2.8h, v1.8h
+	eor	v5.16b, v4.16b, v1.16b
+	eor	v4.16b, v4.16b, v2.16b
+	shl	v3.4s, v1.4s, #24
+	shl	v2.4s, v5.4s, #8
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	sri	v3.4s, v1.4s, #8
+	sri	v2.4s, v5.4s, #24
+	eor	v1.16b, v4.16b, v3.16b
+	eor	v1.16b, v1.16b, v2.16b
+	eor	v2.16b, v1.16b, v6.16b
+	eor	v3.16b, v1.16b, v7.16b
+	eor	v4.16b, v1.16b, v8.16b
+	tbl	v0.16b, {v10.16b, v11.16b, v12.16b, v13.16b}, v1.16b
+	tbl	v2.16b, {v14.16b, v15.16b, v16.16b, v17.16b}, v2.16b
+	tbl	v3.16b, {v18.16b, v19.16b, v20.16b, v21.16b}, v3.16b
+	tbl	v4.16b, {v22.16b, v23.16b, v24.16b, v25.16b}, v4.16b
+	orr	v0.16b, v0.16b, v2.16b
+	orr	v3.16b, v3.16b, v4.16b
+	orr	v0.16b, v0.16b, v3.16b
+	tbl	v0.16b, {v0.16b}, v26.16b
+	ld1	{v1.2d}, [x9], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v1.16b
+	rev32	v0.16b, v0.16b
+	st1	{v0.16b}, [x1], #16
+	subs	x2, x2, #16
+	bne	L_AES_CBC_encrypt_NEON_loop_block
+	st1	{v0.2d}, [x5]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:WOLFSSL_AES_COUNTER
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CTR_encrypt_NEON
+AES_CTR_encrypt_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x6, L_AES_ARM64_NEON_te
+	add	x6, x6, L_AES_ARM64_NEON_te
+	adrp	x7, L_AES_ARM64_NEON_shift_rows_shuffle
+	add	x7, x7, L_AES_ARM64_NEON_shift_rows_shuffle
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x6], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x6], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x6], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x6]
+	ld1	{v2.2d}, [x5]
+	rev64	v8.16b, v2.16b
+	rev32	v2.16b, v2.16b
+	mov	x10, v8.d[1]
+	mov	x11, v8.d[0]
+	cmp	x2, #0x40
+	blt	L_AES_CTR_encrypt_NEON_start_2
+L_AES_CTR_encrypt_NEON_loop_4
+	mov	x9, x3
+	ld1	{v4.2d}, [x9], #16
+	mov	v8.d[1], x10
+	mov	v8.d[0], x11
+	rev64	v8.4s, v8.4s
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v8.16b, v4.16b
+	adds	x10, x10, #1
+	adc	x11, x11, xzr
+	mov	v8.d[1], x10
+	mov	v8.d[0], x11
+	rev64	v8.4s, v8.4s
+	eor	v1.16b, v8.16b, v4.16b
+	adds	x10, x10, #1
+	adc	x11, x11, xzr
+	mov	v8.d[1], x10
+	mov	v8.d[0], x11
+	rev64	v8.4s, v8.4s
+	eor	v2.16b, v8.16b, v4.16b
+	adds	x10, x10, #1
+	adc	x11, x11, xzr
+	mov	v8.d[1], x10
+	mov	v8.d[0], x11
+	rev64	v8.4s, v8.4s
+	eor	v3.16b, v8.16b, v4.16b
+	adds	x10, x10, #1
+	adc	x11, x11, xzr
+	mov	v8.d[1], x10
+	mov	v8.d[0], x11
+	rev64	v8.4s, v8.4s
+	sub	w8, w4, #2
+L_AES_CTR_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	sshr	v10.16b, v2.16b, #7
+	sshr	v11.16b, v3.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	shl	v14.16b, v2.16b, #1
+	shl	v15.16b, v3.16b, #1
+	movi	v4.16b, #27
+	and	v8.16b, v8.16b, v4.16b
+	and	v9.16b, v9.16b, v4.16b
+	and	v10.16b, v10.16b, v4.16b
+	and	v11.16b, v11.16b, v4.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	eor	v6.16b, v10.16b, v2.16b
+	eor	v7.16b, v11.16b, v3.16b
+	shl	v12.4s, v4.4s, #8
+	shl	v13.4s, v5.4s, #8
+	shl	v14.4s, v6.4s, #8
+	shl	v15.4s, v7.4s, #8
+	sri	v12.4s, v4.4s, #24
+	sri	v13.4s, v5.4s, #24
+	sri	v14.4s, v6.4s, #24
+	sri	v15.4s, v7.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	shl	v6.4s, v2.4s, #24
+	shl	v7.4s, v3.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	sri	v6.4s, v2.4s, #8
+	sri	v7.4s, v3.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	rev32	v2.8h, v2.8h
+	rev32	v3.8h, v3.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	; Round Done
+	subs	w8, w8, #2
+	bne	L_AES_CTR_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	sub	x2, x2, #0x40
+	cmp	x2, #0x40
+	bge	L_AES_CTR_encrypt_NEON_loop_4
+	mov	v2.d[1], x10
+	mov	v2.d[0], x11
+	rev64	v2.4s, v2.4s
+L_AES_CTR_encrypt_NEON_start_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+	cmp	x2, #16
+	beq	L_AES_CTR_encrypt_NEON_start_1
+	blt	L_AES_CTR_encrypt_NEON_data_done
+L_AES_CTR_encrypt_NEON_loop_2
+	mov	x9, x3
+	ld1	{v4.2d}, [x9], #16
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v2.16b, v4.16b
+	adds	x10, x10, #1
+	adc	x11, x11, xzr
+	mov	v2.d[1], x10
+	mov	v2.d[0], x11
+	rev64	v2.4s, v2.4s
+	eor	v1.16b, v2.16b, v4.16b
+	adds	x10, x10, #1
+	adc	x11, x11, xzr
+	mov	v2.d[1], x10
+	mov	v2.d[0], x11
+	rev64	v2.4s, v2.4s
+	sub	w8, w4, #2
+L_AES_CTR_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	shl	v10.16b, v0.16b, #1
+	shl	v11.16b, v1.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	shl	v10.4s, v4.4s, #8
+	shl	v11.4s, v5.4s, #8
+	sri	v10.4s, v4.4s, #24
+	sri	v11.4s, v5.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	; Round Done
+	subs	w8, w8, #2
+	bne	L_AES_CTR_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	ld1	{v4.16b, v5.16b}, [x0], #32
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	st1	{v0.16b, v1.16b}, [x1], #32
+	sub	x2, x2, #32
+	cmp	x2, #0
+	beq	L_AES_CTR_encrypt_NEON_data_done
+L_AES_CTR_encrypt_NEON_start_1
+	ld1	{v3.2d}, [x7]
+	mov	x9, x3
+	ld1	{v4.2d}, [x9], #16
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v2.16b, v4.16b
+	sub	w8, w4, #2
+L_AES_CTR_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x9], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x9], #16
+	sshr	v10.16b, v0.16b, #7
+	shl	v9.16b, v0.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v0.8h
+	eor	v11.16b, v10.16b, v0.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v0.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v4.16b
+	sri	v9.4s, v0.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v0.16b, v10.16b, v9.16b
+	eor	v0.16b, v0.16b, v8.16b
+	subs	w8, w8, #2
+	bne	L_AES_CTR_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x9], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x9], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	ld1	{v4.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1], #16
+	adds	x10, x10, #1
+	adc	x11, x11, xzr
+	mov	v2.d[1], x10
+	mov	v2.d[0], x11
+	rev64	v2.4s, v2.4s
+L_AES_CTR_encrypt_NEON_data_done
+	rev32	v2.16b, v2.16b
+	st1	{v2.2d}, [x5]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:HAVE_AES_DECRYPT
+	IF :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER :LOR: :DEF:HAVE_AES_CBC :LOR: :DEF:HAVE_AES_ECB
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_NEON_td
+	DCB	0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38
+	DCB	0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb
+	DCB	0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87
+	DCB	0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb
+	DCB	0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d
+	DCB	0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e
+	DCB	0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2
+	DCB	0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25
+	DCB	0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16
+	DCB	0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92
+	DCB	0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda
+	DCB	0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84
+	DCB	0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a
+	DCB	0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06
+	DCB	0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02
+	DCB	0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b
+	DCB	0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea
+	DCB	0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73
+	DCB	0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85
+	DCB	0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e
+	DCB	0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89
+	DCB	0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b
+	DCB	0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20
+	DCB	0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4
+	DCB	0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31
+	DCB	0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f
+	DCB	0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d
+	DCB	0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef
+	DCB	0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0
+	DCB	0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61
+	DCB	0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26
+	DCB	0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_NEON_shift_rows_invshuffle
+	DCB	0x04, 0x09, 0x0e, 0x03, 0x08, 0x0d, 0x02, 0x07
+	DCB	0x0c, 0x01, 0x06, 0x0b, 0x00, 0x05, 0x0a, 0x0f
+	IF :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER :LOR: :DEF:HAVE_AES_ECB
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_ECB_decrypt_NEON
+AES_ECB_decrypt_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x5, L_AES_ARM64_NEON_td
+	add	x5, x5, L_AES_ARM64_NEON_td
+	adrp	x6, L_AES_ARM64_NEON_shift_rows_invshuffle
+	add	x6, x6, L_AES_ARM64_NEON_shift_rows_invshuffle
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x5], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x5], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x5], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x5]
+	cmp	x2, #0x40
+	blt	L_AES_ECB_decrypt_NEON_start_2
+L_AES_ECB_decrypt_NEON_loop_4
+	mov	x8, x3
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.2d}, [x8], #16
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	sub	w7, w4, #2
+L_AES_ECB_decrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	movi	v28.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	and	v8.16b, v8.16b, v28.16b
+	and	v9.16b, v9.16b, v28.16b
+	and	v10.16b, v10.16b, v28.16b
+	and	v11.16b, v11.16b, v28.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	ushr	v14.16b, v6.16b, #6
+	ushr	v15.16b, v7.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	shl	v2.16b, v6.16b, #2
+	shl	v3.16b, v7.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	eor	v14.16b, v14.16b, v2.16b
+	eor	v15.16b, v15.16b, v3.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	ushr	v2.16b, v6.16b, #5
+	ushr	v3.16b, v7.16b, #5
+	pmul	v0.16b, v0.16b, v28.16b
+	pmul	v1.16b, v1.16b, v28.16b
+	pmul	v2.16b, v2.16b, v28.16b
+	pmul	v3.16b, v3.16b, v28.16b
+	shl	v28.16b, v4.16b, #3
+	shl	v29.16b, v5.16b, #3
+	shl	v30.16b, v6.16b, #3
+	shl	v31.16b, v7.16b, #3
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v1.16b, v1.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	eor	v3.16b, v3.16b, v31.16b
+	eor	v28.16b, v8.16b, v0.16b
+	eor	v29.16b, v9.16b, v1.16b
+	eor	v30.16b, v10.16b, v2.16b
+	eor	v31.16b, v11.16b, v3.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v10.16b, v14.16b, v2.16b
+	eor	v11.16b, v15.16b, v3.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v4.16b
+	eor	v29.16b, v29.16b, v5.16b
+	eor	v30.16b, v30.16b, v6.16b
+	eor	v31.16b, v31.16b, v7.16b
+	shl	v4.4s, v28.4s, #8
+	shl	v5.4s, v29.4s, #8
+	shl	v6.4s, v30.4s, #8
+	shl	v7.4s, v31.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	rev32	v10.8h, v10.8h
+	rev32	v11.8h, v11.8h
+	sri	v4.4s, v28.4s, #24
+	sri	v5.4s, v29.4s, #24
+	sri	v6.4s, v30.4s, #24
+	sri	v7.4s, v31.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	shl	v28.4s, v0.4s, #24
+	shl	v29.4s, v1.4s, #24
+	shl	v30.4s, v2.4s, #24
+	shl	v31.4s, v3.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	sri	v28.4s, v0.4s, #8
+	sri	v29.4s, v1.4s, #8
+	sri	v30.4s, v2.4s, #8
+	sri	v31.4s, v3.4s, #8
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x5]
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	movi	v28.16b, #27
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	sshr	v10.16b, v2.16b, #7
+	sshr	v11.16b, v3.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	shl	v14.16b, v2.16b, #1
+	shl	v15.16b, v3.16b, #1
+	and	v8.16b, v8.16b, v28.16b
+	and	v9.16b, v9.16b, v28.16b
+	and	v10.16b, v10.16b, v28.16b
+	and	v11.16b, v11.16b, v28.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	ushr	v12.16b, v0.16b, #6
+	ushr	v13.16b, v1.16b, #6
+	ushr	v14.16b, v2.16b, #6
+	ushr	v15.16b, v3.16b, #6
+	shl	v4.16b, v0.16b, #2
+	shl	v5.16b, v1.16b, #2
+	shl	v6.16b, v2.16b, #2
+	shl	v7.16b, v3.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	eor	v14.16b, v14.16b, v6.16b
+	eor	v15.16b, v15.16b, v7.16b
+	ushr	v4.16b, v0.16b, #5
+	ushr	v5.16b, v1.16b, #5
+	ushr	v6.16b, v2.16b, #5
+	ushr	v7.16b, v3.16b, #5
+	pmul	v4.16b, v4.16b, v28.16b
+	pmul	v5.16b, v5.16b, v28.16b
+	pmul	v6.16b, v6.16b, v28.16b
+	pmul	v7.16b, v7.16b, v28.16b
+	shl	v28.16b, v0.16b, #3
+	shl	v29.16b, v1.16b, #3
+	shl	v30.16b, v2.16b, #3
+	shl	v31.16b, v3.16b, #3
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	eor	v28.16b, v8.16b, v4.16b
+	eor	v29.16b, v9.16b, v5.16b
+	eor	v30.16b, v10.16b, v6.16b
+	eor	v31.16b, v11.16b, v7.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	eor	v8.16b, v12.16b, v4.16b
+	eor	v9.16b, v13.16b, v5.16b
+	eor	v10.16b, v14.16b, v6.16b
+	eor	v11.16b, v15.16b, v7.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v0.16b
+	eor	v29.16b, v29.16b, v1.16b
+	eor	v30.16b, v30.16b, v2.16b
+	eor	v31.16b, v31.16b, v3.16b
+	shl	v0.4s, v28.4s, #8
+	shl	v1.4s, v29.4s, #8
+	shl	v2.4s, v30.4s, #8
+	shl	v3.4s, v31.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	rev32	v10.8h, v10.8h
+	rev32	v11.8h, v11.8h
+	sri	v0.4s, v28.4s, #24
+	sri	v1.4s, v29.4s, #24
+	sri	v2.4s, v30.4s, #24
+	sri	v3.4s, v31.4s, #24
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	shl	v28.4s, v4.4s, #24
+	shl	v29.4s, v5.4s, #24
+	shl	v30.4s, v6.4s, #24
+	shl	v31.4s, v7.4s, #24
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	sri	v28.4s, v4.4s, #8
+	sri	v29.4s, v5.4s, #8
+	sri	v30.4s, v6.4s, #8
+	sri	v31.4s, v7.4s, #8
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v1.16b, v1.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	eor	v3.16b, v3.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x5]
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	subs	w7, w7, #2
+	bne	L_AES_ECB_decrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	movi	v28.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	and	v8.16b, v8.16b, v28.16b
+	and	v9.16b, v9.16b, v28.16b
+	and	v10.16b, v10.16b, v28.16b
+	and	v11.16b, v11.16b, v28.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	ushr	v14.16b, v6.16b, #6
+	ushr	v15.16b, v7.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	shl	v2.16b, v6.16b, #2
+	shl	v3.16b, v7.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	eor	v14.16b, v14.16b, v2.16b
+	eor	v15.16b, v15.16b, v3.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	ushr	v2.16b, v6.16b, #5
+	ushr	v3.16b, v7.16b, #5
+	pmul	v0.16b, v0.16b, v28.16b
+	pmul	v1.16b, v1.16b, v28.16b
+	pmul	v2.16b, v2.16b, v28.16b
+	pmul	v3.16b, v3.16b, v28.16b
+	shl	v28.16b, v4.16b, #3
+	shl	v29.16b, v5.16b, #3
+	shl	v30.16b, v6.16b, #3
+	shl	v31.16b, v7.16b, #3
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v1.16b, v1.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	eor	v3.16b, v3.16b, v31.16b
+	eor	v28.16b, v8.16b, v0.16b
+	eor	v29.16b, v9.16b, v1.16b
+	eor	v30.16b, v10.16b, v2.16b
+	eor	v31.16b, v11.16b, v3.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v10.16b, v14.16b, v2.16b
+	eor	v11.16b, v15.16b, v3.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v4.16b
+	eor	v29.16b, v29.16b, v5.16b
+	eor	v30.16b, v30.16b, v6.16b
+	eor	v31.16b, v31.16b, v7.16b
+	shl	v4.4s, v28.4s, #8
+	shl	v5.4s, v29.4s, #8
+	shl	v6.4s, v30.4s, #8
+	shl	v7.4s, v31.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	rev32	v10.8h, v10.8h
+	rev32	v11.8h, v11.8h
+	sri	v4.4s, v28.4s, #24
+	sri	v5.4s, v29.4s, #24
+	sri	v6.4s, v30.4s, #24
+	sri	v7.4s, v31.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	shl	v28.4s, v0.4s, #24
+	shl	v29.4s, v1.4s, #24
+	shl	v30.4s, v2.4s, #24
+	shl	v31.4s, v3.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	sri	v28.4s, v0.4s, #8
+	sri	v29.4s, v1.4s, #8
+	sri	v30.4s, v2.4s, #8
+	sri	v31.4s, v3.4s, #8
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x5]
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	sub	x2, x2, #0x40
+	cmp	x2, #0x40
+	bge	L_AES_ECB_decrypt_NEON_loop_4
+L_AES_ECB_decrypt_NEON_start_2
+	cmp	x2, #16
+	beq	L_AES_ECB_decrypt_NEON_start_1
+	blt	L_AES_ECB_decrypt_NEON_data_done
+L_AES_ECB_decrypt_NEON_loop_2
+	mov	x8, x3
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	ld1	{v4.2d}, [x8], #16
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	sub	w7, w4, #2
+L_AES_ECB_decrypt_NEON_loop_nr_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	movi	v10.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v10.16b
+	and	v9.16b, v9.16b, v10.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	pmul	v12.16b, v12.16b, v10.16b
+	pmul	v13.16b, v13.16b, v10.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	pmul	v0.16b, v0.16b, v10.16b
+	pmul	v1.16b, v1.16b, v10.16b
+	shl	v10.16b, v4.16b, #3
+	shl	v11.16b, v5.16b, #3
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	eor	v10.16b, v8.16b, v0.16b
+	eor	v11.16b, v9.16b, v1.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v11.16b
+	eor	v10.16b, v10.16b, v4.16b
+	eor	v11.16b, v11.16b, v5.16b
+	shl	v4.4s, v10.4s, #8
+	shl	v5.4s, v11.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	sri	v4.4s, v10.4s, #24
+	sri	v5.4s, v11.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	shl	v10.4s, v0.4s, #24
+	shl	v11.4s, v1.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	sri	v10.4s, v0.4s, #8
+	sri	v11.4s, v1.4s, #8
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	; Round Done
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	movi	v10.16b, #27
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	and	v8.16b, v8.16b, v10.16b
+	and	v9.16b, v9.16b, v10.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	ushr	v12.16b, v0.16b, #6
+	ushr	v13.16b, v1.16b, #6
+	shl	v4.16b, v0.16b, #2
+	shl	v5.16b, v1.16b, #2
+	pmul	v12.16b, v12.16b, v10.16b
+	pmul	v13.16b, v13.16b, v10.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	ushr	v4.16b, v0.16b, #5
+	ushr	v5.16b, v1.16b, #5
+	pmul	v4.16b, v4.16b, v10.16b
+	pmul	v5.16b, v5.16b, v10.16b
+	shl	v10.16b, v0.16b, #3
+	shl	v11.16b, v1.16b, #3
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v10.16b, v8.16b, v4.16b
+	eor	v11.16b, v9.16b, v5.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v8.16b, v12.16b, v4.16b
+	eor	v9.16b, v13.16b, v5.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v11.16b
+	eor	v10.16b, v10.16b, v0.16b
+	eor	v11.16b, v11.16b, v1.16b
+	shl	v0.4s, v10.4s, #8
+	shl	v1.4s, v11.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	sri	v0.4s, v10.4s, #24
+	sri	v1.4s, v11.4s, #24
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	shl	v10.4s, v4.4s, #24
+	shl	v11.4s, v5.4s, #24
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	sri	v10.4s, v4.4s, #8
+	sri	v11.4s, v5.4s, #8
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	subs	w7, w7, #2
+	bne	L_AES_ECB_decrypt_NEON_loop_nr_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x6]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	movi	v10.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v10.16b
+	and	v9.16b, v9.16b, v10.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	pmul	v12.16b, v12.16b, v10.16b
+	pmul	v13.16b, v13.16b, v10.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	pmul	v0.16b, v0.16b, v10.16b
+	pmul	v1.16b, v1.16b, v10.16b
+	shl	v10.16b, v4.16b, #3
+	shl	v11.16b, v5.16b, #3
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	eor	v10.16b, v8.16b, v0.16b
+	eor	v11.16b, v9.16b, v1.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v11.16b
+	eor	v10.16b, v10.16b, v4.16b
+	eor	v11.16b, v11.16b, v5.16b
+	shl	v4.4s, v10.4s, #8
+	shl	v5.4s, v11.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	sri	v4.4s, v10.4s, #24
+	sri	v5.4s, v11.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	shl	v10.4s, v0.4s, #24
+	shl	v11.4s, v1.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	sri	v10.4s, v0.4s, #8
+	sri	v11.4s, v1.4s, #8
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x8], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	; Round Done
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x6]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x8], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	st1	{v0.16b, v1.16b}, [x1], #32
+	sub	x2, x2, #32
+	cmp	x2, #0
+	beq	L_AES_ECB_decrypt_NEON_data_done
+L_AES_ECB_decrypt_NEON_start_1
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+	ld1	{v3.2d}, [x6]
+	mov	x8, x3
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v4.2d}, [x8], #16
+	rev32	v0.16b, v0.16b
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v0.16b, v4.16b
+	sub	w7, w4, #2
+L_AES_ECB_decrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x8], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	sshr	v10.16b, v0.16b, #7
+	ushr	v11.16b, v0.16b, #6
+	ushr	v8.16b, v0.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v0.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v0.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v0.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v0.16b
+	shl	v0.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v0.4s, v9.4s, #24
+	eor	v0.16b, v0.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v0.16b, v0.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v0.16b, v0.16b, v9.16b
+	ld1	{v4.2d}, [x8], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	subs	w7, w7, #2
+	bne	L_AES_ECB_decrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x8], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x8], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	st1	{v0.16b}, [x1], #16
+L_AES_ECB_decrypt_NEON_data_done
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:HAVE_AES_CBC
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CBC_decrypt_NEON
+AES_CBC_decrypt_NEON PROC
+	stp	x29, x30, [sp, #-160]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #96]
+	stp	d10, d11, [x29, #112]
+	stp	d12, d13, [x29, #128]
+	stp	d14, d15, [x29, #144]
+	adrp	x6, L_AES_ARM64_NEON_td
+	add	x6, x6, L_AES_ARM64_NEON_td
+	adrp	x7, L_AES_ARM64_NEON_shift_rows_invshuffle
+	add	x7, x7, L_AES_ARM64_NEON_shift_rows_invshuffle
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x6], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x6], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x6], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x6]
+	ld1	{v3.2d}, [x5]
+	add	x10, x29, #16
+	cmp	x2, #0x40
+	blt	L_AES_CBC_decrypt_NEON_start_2
+L_AES_CBC_decrypt_NEON_loop_4
+	mov	x9, x3
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	st1	{v3.2d, v4.2d, v5.2d, v6.2d}, [x10]
+	str	q7, [x10, #64]
+	ld1	{v8.2d}, [x9], #16
+	rev32	v4.16b, v4.16b
+	rev32	v5.16b, v5.16b
+	rev32	v6.16b, v6.16b
+	rev32	v7.16b, v7.16b
+	; Round: 0 - XOR in key schedule
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v8.16b
+	eor	v6.16b, v6.16b, v8.16b
+	eor	v7.16b, v7.16b, v8.16b
+	sub	w8, w4, #2
+L_AES_CBC_decrypt_NEON_loop_nr_4
+	tbl	v8.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v9.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v10.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v11.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v4.16b, v12.16b
+	eor	v1.16b, v5.16b, v12.16b
+	eor	v2.16b, v6.16b, v12.16b
+	eor	v3.16b, v7.16b, v12.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	tbl	v2.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v2.16b
+	tbl	v3.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	eor	v0.16b, v4.16b, v13.16b
+	eor	v1.16b, v5.16b, v13.16b
+	eor	v2.16b, v6.16b, v13.16b
+	eor	v3.16b, v7.16b, v13.16b
+	tbl	v0.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	eor	v0.16b, v4.16b, v14.16b
+	eor	v1.16b, v5.16b, v14.16b
+	eor	v2.16b, v6.16b, v14.16b
+	eor	v3.16b, v7.16b, v14.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	tbl	v3.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v8.16b, {v8.16b}, v4.16b
+	tbl	v9.16b, {v9.16b}, v4.16b
+	tbl	v10.16b, {v10.16b}, v4.16b
+	tbl	v11.16b, {v11.16b}, v4.16b
+	movi	v28.16b, #27
+	sshr	v0.16b, v8.16b, #7
+	sshr	v1.16b, v9.16b, #7
+	sshr	v2.16b, v10.16b, #7
+	sshr	v3.16b, v11.16b, #7
+	shl	v12.16b, v8.16b, #1
+	shl	v13.16b, v9.16b, #1
+	shl	v14.16b, v10.16b, #1
+	shl	v15.16b, v11.16b, #1
+	and	v0.16b, v0.16b, v28.16b
+	and	v1.16b, v1.16b, v28.16b
+	and	v2.16b, v2.16b, v28.16b
+	and	v3.16b, v3.16b, v28.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	ushr	v12.16b, v8.16b, #6
+	ushr	v13.16b, v9.16b, #6
+	ushr	v14.16b, v10.16b, #6
+	ushr	v15.16b, v11.16b, #6
+	shl	v4.16b, v8.16b, #2
+	shl	v5.16b, v9.16b, #2
+	shl	v6.16b, v10.16b, #2
+	shl	v7.16b, v11.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	eor	v14.16b, v14.16b, v6.16b
+	eor	v15.16b, v15.16b, v7.16b
+	ushr	v4.16b, v8.16b, #5
+	ushr	v5.16b, v9.16b, #5
+	ushr	v6.16b, v10.16b, #5
+	ushr	v7.16b, v11.16b, #5
+	pmul	v4.16b, v4.16b, v28.16b
+	pmul	v5.16b, v5.16b, v28.16b
+	pmul	v6.16b, v6.16b, v28.16b
+	pmul	v7.16b, v7.16b, v28.16b
+	shl	v28.16b, v8.16b, #3
+	shl	v29.16b, v9.16b, #3
+	shl	v30.16b, v10.16b, #3
+	shl	v31.16b, v11.16b, #3
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	eor	v28.16b, v0.16b, v4.16b
+	eor	v29.16b, v1.16b, v5.16b
+	eor	v30.16b, v2.16b, v6.16b
+	eor	v31.16b, v3.16b, v7.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v0.16b, v12.16b, v4.16b
+	eor	v1.16b, v13.16b, v5.16b
+	eor	v2.16b, v14.16b, v6.16b
+	eor	v3.16b, v15.16b, v7.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v8.16b
+	eor	v29.16b, v29.16b, v9.16b
+	eor	v30.16b, v30.16b, v10.16b
+	eor	v31.16b, v31.16b, v11.16b
+	shl	v8.4s, v28.4s, #8
+	shl	v9.4s, v29.4s, #8
+	shl	v10.4s, v30.4s, #8
+	shl	v11.4s, v31.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	rev32	v2.8h, v2.8h
+	rev32	v3.8h, v3.8h
+	sri	v8.4s, v28.4s, #24
+	sri	v9.4s, v29.4s, #24
+	sri	v10.4s, v30.4s, #24
+	sri	v11.4s, v31.4s, #24
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	shl	v28.4s, v4.4s, #24
+	shl	v29.4s, v5.4s, #24
+	shl	v30.4s, v6.4s, #24
+	shl	v31.4s, v7.4s, #24
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	sri	v28.4s, v4.4s, #8
+	sri	v29.4s, v5.4s, #8
+	sri	v30.4s, v6.4s, #8
+	sri	v31.4s, v7.4s, #8
+	eor	v8.16b, v8.16b, v28.16b
+	eor	v9.16b, v9.16b, v29.16b
+	eor	v10.16b, v10.16b, v30.16b
+	eor	v11.16b, v11.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x6]
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v9.16b, v9.16b, v4.16b
+	eor	v10.16b, v10.16b, v4.16b
+	eor	v11.16b, v11.16b, v4.16b
+	; Round Done
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v8.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v9.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v10.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v11.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v8.16b, v12.16b
+	eor	v1.16b, v9.16b, v12.16b
+	eor	v2.16b, v10.16b, v12.16b
+	eor	v3.16b, v11.16b, v12.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	tbl	v2.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v2.16b
+	tbl	v3.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	orr	v6.16b, v6.16b, v2.16b
+	orr	v7.16b, v7.16b, v3.16b
+	eor	v0.16b, v8.16b, v13.16b
+	eor	v1.16b, v9.16b, v13.16b
+	eor	v2.16b, v10.16b, v13.16b
+	eor	v3.16b, v11.16b, v13.16b
+	tbl	v0.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	orr	v6.16b, v6.16b, v2.16b
+	orr	v7.16b, v7.16b, v3.16b
+	eor	v0.16b, v8.16b, v14.16b
+	eor	v1.16b, v9.16b, v14.16b
+	eor	v2.16b, v10.16b, v14.16b
+	eor	v3.16b, v11.16b, v14.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	tbl	v3.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	orr	v6.16b, v6.16b, v2.16b
+	orr	v7.16b, v7.16b, v3.16b
+	ld1	{v8.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v8.16b
+	tbl	v5.16b, {v5.16b}, v8.16b
+	tbl	v6.16b, {v6.16b}, v8.16b
+	tbl	v7.16b, {v7.16b}, v8.16b
+	movi	v28.16b, #27
+	sshr	v0.16b, v4.16b, #7
+	sshr	v1.16b, v5.16b, #7
+	sshr	v2.16b, v6.16b, #7
+	sshr	v3.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	and	v0.16b, v0.16b, v28.16b
+	and	v1.16b, v1.16b, v28.16b
+	and	v2.16b, v2.16b, v28.16b
+	and	v3.16b, v3.16b, v28.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	ushr	v14.16b, v6.16b, #6
+	ushr	v15.16b, v7.16b, #6
+	shl	v8.16b, v4.16b, #2
+	shl	v9.16b, v5.16b, #2
+	shl	v10.16b, v6.16b, #2
+	shl	v11.16b, v7.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v8.16b
+	eor	v13.16b, v13.16b, v9.16b
+	eor	v14.16b, v14.16b, v10.16b
+	eor	v15.16b, v15.16b, v11.16b
+	ushr	v8.16b, v4.16b, #5
+	ushr	v9.16b, v5.16b, #5
+	ushr	v10.16b, v6.16b, #5
+	ushr	v11.16b, v7.16b, #5
+	pmul	v8.16b, v8.16b, v28.16b
+	pmul	v9.16b, v9.16b, v28.16b
+	pmul	v10.16b, v10.16b, v28.16b
+	pmul	v11.16b, v11.16b, v28.16b
+	shl	v28.16b, v4.16b, #3
+	shl	v29.16b, v5.16b, #3
+	shl	v30.16b, v6.16b, #3
+	shl	v31.16b, v7.16b, #3
+	eor	v8.16b, v8.16b, v28.16b
+	eor	v9.16b, v9.16b, v29.16b
+	eor	v10.16b, v10.16b, v30.16b
+	eor	v11.16b, v11.16b, v31.16b
+	eor	v28.16b, v0.16b, v8.16b
+	eor	v29.16b, v1.16b, v9.16b
+	eor	v30.16b, v2.16b, v10.16b
+	eor	v31.16b, v3.16b, v11.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v9.16b, v9.16b, v5.16b
+	eor	v10.16b, v10.16b, v6.16b
+	eor	v11.16b, v11.16b, v7.16b
+	eor	v0.16b, v12.16b, v8.16b
+	eor	v1.16b, v13.16b, v9.16b
+	eor	v2.16b, v14.16b, v10.16b
+	eor	v3.16b, v15.16b, v11.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v4.16b
+	eor	v29.16b, v29.16b, v5.16b
+	eor	v30.16b, v30.16b, v6.16b
+	eor	v31.16b, v31.16b, v7.16b
+	shl	v4.4s, v28.4s, #8
+	shl	v5.4s, v29.4s, #8
+	shl	v6.4s, v30.4s, #8
+	shl	v7.4s, v31.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	rev32	v2.8h, v2.8h
+	rev32	v3.8h, v3.8h
+	sri	v4.4s, v28.4s, #24
+	sri	v5.4s, v29.4s, #24
+	sri	v6.4s, v30.4s, #24
+	sri	v7.4s, v31.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	shl	v28.4s, v8.4s, #24
+	shl	v29.4s, v9.4s, #24
+	shl	v30.4s, v10.4s, #24
+	shl	v31.4s, v11.4s, #24
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	sri	v28.4s, v8.4s, #8
+	sri	v29.4s, v9.4s, #8
+	sri	v30.4s, v10.4s, #8
+	sri	v31.4s, v11.4s, #8
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x6]
+	;   XOR in Key Schedule
+	ld1	{v8.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v8.16b
+	eor	v6.16b, v6.16b, v8.16b
+	eor	v7.16b, v7.16b, v8.16b
+	; Round Done
+	subs	w8, w8, #2
+	bne	L_AES_CBC_decrypt_NEON_loop_nr_4
+	tbl	v8.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v9.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v10.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v11.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v4.16b, v12.16b
+	eor	v1.16b, v5.16b, v12.16b
+	eor	v2.16b, v6.16b, v12.16b
+	eor	v3.16b, v7.16b, v12.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	tbl	v2.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v2.16b
+	tbl	v3.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	eor	v0.16b, v4.16b, v13.16b
+	eor	v1.16b, v5.16b, v13.16b
+	eor	v2.16b, v6.16b, v13.16b
+	eor	v3.16b, v7.16b, v13.16b
+	tbl	v0.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	eor	v0.16b, v4.16b, v14.16b
+	eor	v1.16b, v5.16b, v14.16b
+	eor	v2.16b, v6.16b, v14.16b
+	eor	v3.16b, v7.16b, v14.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	tbl	v3.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v8.16b, {v8.16b}, v4.16b
+	tbl	v9.16b, {v9.16b}, v4.16b
+	tbl	v10.16b, {v10.16b}, v4.16b
+	tbl	v11.16b, {v11.16b}, v4.16b
+	movi	v28.16b, #27
+	sshr	v0.16b, v8.16b, #7
+	sshr	v1.16b, v9.16b, #7
+	sshr	v2.16b, v10.16b, #7
+	sshr	v3.16b, v11.16b, #7
+	shl	v12.16b, v8.16b, #1
+	shl	v13.16b, v9.16b, #1
+	shl	v14.16b, v10.16b, #1
+	shl	v15.16b, v11.16b, #1
+	and	v0.16b, v0.16b, v28.16b
+	and	v1.16b, v1.16b, v28.16b
+	and	v2.16b, v2.16b, v28.16b
+	and	v3.16b, v3.16b, v28.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	ushr	v12.16b, v8.16b, #6
+	ushr	v13.16b, v9.16b, #6
+	ushr	v14.16b, v10.16b, #6
+	ushr	v15.16b, v11.16b, #6
+	shl	v4.16b, v8.16b, #2
+	shl	v5.16b, v9.16b, #2
+	shl	v6.16b, v10.16b, #2
+	shl	v7.16b, v11.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	eor	v14.16b, v14.16b, v6.16b
+	eor	v15.16b, v15.16b, v7.16b
+	ushr	v4.16b, v8.16b, #5
+	ushr	v5.16b, v9.16b, #5
+	ushr	v6.16b, v10.16b, #5
+	ushr	v7.16b, v11.16b, #5
+	pmul	v4.16b, v4.16b, v28.16b
+	pmul	v5.16b, v5.16b, v28.16b
+	pmul	v6.16b, v6.16b, v28.16b
+	pmul	v7.16b, v7.16b, v28.16b
+	shl	v28.16b, v8.16b, #3
+	shl	v29.16b, v9.16b, #3
+	shl	v30.16b, v10.16b, #3
+	shl	v31.16b, v11.16b, #3
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	eor	v28.16b, v0.16b, v4.16b
+	eor	v29.16b, v1.16b, v5.16b
+	eor	v30.16b, v2.16b, v6.16b
+	eor	v31.16b, v3.16b, v7.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v0.16b, v12.16b, v4.16b
+	eor	v1.16b, v13.16b, v5.16b
+	eor	v2.16b, v14.16b, v6.16b
+	eor	v3.16b, v15.16b, v7.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v8.16b
+	eor	v29.16b, v29.16b, v9.16b
+	eor	v30.16b, v30.16b, v10.16b
+	eor	v31.16b, v31.16b, v11.16b
+	shl	v8.4s, v28.4s, #8
+	shl	v9.4s, v29.4s, #8
+	shl	v10.4s, v30.4s, #8
+	shl	v11.4s, v31.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	rev32	v2.8h, v2.8h
+	rev32	v3.8h, v3.8h
+	sri	v8.4s, v28.4s, #24
+	sri	v9.4s, v29.4s, #24
+	sri	v10.4s, v30.4s, #24
+	sri	v11.4s, v31.4s, #24
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	shl	v28.4s, v4.4s, #24
+	shl	v29.4s, v5.4s, #24
+	shl	v30.4s, v6.4s, #24
+	shl	v31.4s, v7.4s, #24
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	eor	v10.16b, v10.16b, v2.16b
+	eor	v11.16b, v11.16b, v3.16b
+	sri	v28.4s, v4.4s, #8
+	sri	v29.4s, v5.4s, #8
+	sri	v30.4s, v6.4s, #8
+	sri	v31.4s, v7.4s, #8
+	eor	v8.16b, v8.16b, v28.16b
+	eor	v9.16b, v9.16b, v29.16b
+	eor	v10.16b, v10.16b, v30.16b
+	eor	v11.16b, v11.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x6]
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v9.16b, v9.16b, v4.16b
+	eor	v10.16b, v10.16b, v4.16b
+	eor	v11.16b, v11.16b, v4.16b
+	; Round Done
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v8.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v9.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v10.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v11.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v8.16b, v12.16b
+	eor	v1.16b, v9.16b, v12.16b
+	eor	v2.16b, v10.16b, v12.16b
+	eor	v3.16b, v11.16b, v12.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	tbl	v2.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v2.16b
+	tbl	v3.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	orr	v6.16b, v6.16b, v2.16b
+	orr	v7.16b, v7.16b, v3.16b
+	eor	v0.16b, v8.16b, v13.16b
+	eor	v1.16b, v9.16b, v13.16b
+	eor	v2.16b, v10.16b, v13.16b
+	eor	v3.16b, v11.16b, v13.16b
+	tbl	v0.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	orr	v6.16b, v6.16b, v2.16b
+	orr	v7.16b, v7.16b, v3.16b
+	eor	v0.16b, v8.16b, v14.16b
+	eor	v1.16b, v9.16b, v14.16b
+	eor	v2.16b, v10.16b, v14.16b
+	eor	v3.16b, v11.16b, v14.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	tbl	v3.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	orr	v6.16b, v6.16b, v2.16b
+	orr	v7.16b, v7.16b, v3.16b
+	ld1	{v8.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v8.16b
+	tbl	v5.16b, {v5.16b}, v8.16b
+	tbl	v6.16b, {v6.16b}, v8.16b
+	tbl	v7.16b, {v7.16b}, v8.16b
+	;   XOR in Key Schedule
+	ld1	{v8.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v8.16b
+	eor	v6.16b, v6.16b, v8.16b
+	eor	v7.16b, v7.16b, v8.16b
+	; Round Done
+	rev32	v4.16b, v4.16b
+	rev32	v5.16b, v5.16b
+	rev32	v6.16b, v6.16b
+	rev32	v7.16b, v7.16b
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x10]
+	ldr	q3, [x10, #64]
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	st1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	sub	x2, x2, #0x40
+	cmp	x2, #0x40
+	bge	L_AES_CBC_decrypt_NEON_loop_4
+L_AES_CBC_decrypt_NEON_start_2
+	cmp	x2, #16
+	beq	L_AES_CBC_decrypt_NEON_start_1
+	blt	L_AES_CBC_decrypt_NEON_data_done
+L_AES_CBC_decrypt_NEON_loop_2
+	mov	x9, x3
+	ld1	{v4.16b, v5.16b}, [x0], #32
+	st1	{v3.2d, v4.2d, v5.2d}, [x10]
+	ld1	{v8.2d}, [x9], #16
+	rev32	v4.16b, v4.16b
+	rev32	v5.16b, v5.16b
+	; Round: 0 - XOR in key schedule
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v8.16b
+	sub	w8, w4, #2
+L_AES_CBC_decrypt_NEON_loop_nr_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v4.16b, v12.16b
+	eor	v1.16b, v5.16b, v12.16b
+	tbl	v8.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v9.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	eor	v2.16b, v4.16b, v13.16b
+	eor	v3.16b, v5.16b, v13.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	eor	v0.16b, v4.16b, v14.16b
+	eor	v1.16b, v5.16b, v14.16b
+	orr	v8.16b, v8.16b, v2.16b
+	orr	v9.16b, v9.16b, v3.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v8.16b, {v8.16b}, v4.16b
+	tbl	v9.16b, {v9.16b}, v4.16b
+	movi	v2.16b, #27
+	sshr	v0.16b, v8.16b, #7
+	sshr	v1.16b, v9.16b, #7
+	shl	v12.16b, v8.16b, #1
+	shl	v13.16b, v9.16b, #1
+	and	v0.16b, v0.16b, v2.16b
+	and	v1.16b, v1.16b, v2.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	ushr	v12.16b, v8.16b, #6
+	ushr	v13.16b, v9.16b, #6
+	shl	v4.16b, v8.16b, #2
+	shl	v5.16b, v9.16b, #2
+	pmul	v12.16b, v12.16b, v2.16b
+	pmul	v13.16b, v13.16b, v2.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	ushr	v4.16b, v8.16b, #5
+	ushr	v5.16b, v9.16b, #5
+	pmul	v4.16b, v4.16b, v2.16b
+	pmul	v5.16b, v5.16b, v2.16b
+	shl	v2.16b, v8.16b, #3
+	shl	v3.16b, v9.16b, #3
+	eor	v4.16b, v4.16b, v2.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v2.16b, v0.16b, v4.16b
+	eor	v3.16b, v1.16b, v5.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v0.16b, v12.16b, v4.16b
+	eor	v1.16b, v13.16b, v5.16b
+	eor	v12.16b, v12.16b, v2.16b
+	eor	v13.16b, v13.16b, v3.16b
+	eor	v2.16b, v2.16b, v8.16b
+	eor	v3.16b, v3.16b, v9.16b
+	shl	v8.4s, v2.4s, #8
+	shl	v9.4s, v3.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	sri	v8.4s, v2.4s, #24
+	sri	v9.4s, v3.4s, #24
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	shl	v2.4s, v4.4s, #24
+	shl	v3.4s, v5.4s, #24
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	sri	v2.4s, v4.4s, #8
+	sri	v3.4s, v5.4s, #8
+	eor	v8.16b, v8.16b, v2.16b
+	eor	v9.16b, v9.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v9.16b, v9.16b, v4.16b
+	; Round Done
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v8.16b, v12.16b
+	eor	v1.16b, v9.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v8.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v9.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	eor	v2.16b, v8.16b, v13.16b
+	eor	v3.16b, v9.16b, v13.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	eor	v0.16b, v8.16b, v14.16b
+	eor	v1.16b, v9.16b, v14.16b
+	orr	v4.16b, v4.16b, v2.16b
+	orr	v5.16b, v5.16b, v3.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	ld1	{v8.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v8.16b
+	tbl	v5.16b, {v5.16b}, v8.16b
+	movi	v2.16b, #27
+	sshr	v0.16b, v4.16b, #7
+	sshr	v1.16b, v5.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	and	v0.16b, v0.16b, v2.16b
+	and	v1.16b, v1.16b, v2.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	shl	v8.16b, v4.16b, #2
+	shl	v9.16b, v5.16b, #2
+	pmul	v12.16b, v12.16b, v2.16b
+	pmul	v13.16b, v13.16b, v2.16b
+	eor	v12.16b, v12.16b, v8.16b
+	eor	v13.16b, v13.16b, v9.16b
+	ushr	v8.16b, v4.16b, #5
+	ushr	v9.16b, v5.16b, #5
+	pmul	v8.16b, v8.16b, v2.16b
+	pmul	v9.16b, v9.16b, v2.16b
+	shl	v2.16b, v4.16b, #3
+	shl	v3.16b, v5.16b, #3
+	eor	v8.16b, v8.16b, v2.16b
+	eor	v9.16b, v9.16b, v3.16b
+	eor	v2.16b, v0.16b, v8.16b
+	eor	v3.16b, v1.16b, v9.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v9.16b, v9.16b, v5.16b
+	eor	v0.16b, v12.16b, v8.16b
+	eor	v1.16b, v13.16b, v9.16b
+	eor	v12.16b, v12.16b, v2.16b
+	eor	v13.16b, v13.16b, v3.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v5.16b
+	shl	v4.4s, v2.4s, #8
+	shl	v5.4s, v3.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	sri	v4.4s, v2.4s, #24
+	sri	v5.4s, v3.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	shl	v2.4s, v8.4s, #24
+	shl	v3.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	sri	v2.4s, v8.4s, #8
+	sri	v3.4s, v9.4s, #8
+	eor	v4.16b, v4.16b, v2.16b
+	eor	v5.16b, v5.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v8.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v8.16b
+	; Round Done
+	subs	w8, w8, #2
+	bne	L_AES_CBC_decrypt_NEON_loop_nr_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v4.16b, v12.16b
+	eor	v1.16b, v5.16b, v12.16b
+	tbl	v8.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v9.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	eor	v2.16b, v4.16b, v13.16b
+	eor	v3.16b, v5.16b, v13.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	eor	v0.16b, v4.16b, v14.16b
+	eor	v1.16b, v5.16b, v14.16b
+	orr	v8.16b, v8.16b, v2.16b
+	orr	v9.16b, v9.16b, v3.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	ld1	{v4.16b}, [x7]
+	tbl	v8.16b, {v8.16b}, v4.16b
+	tbl	v9.16b, {v9.16b}, v4.16b
+	movi	v2.16b, #27
+	sshr	v0.16b, v8.16b, #7
+	sshr	v1.16b, v9.16b, #7
+	shl	v12.16b, v8.16b, #1
+	shl	v13.16b, v9.16b, #1
+	and	v0.16b, v0.16b, v2.16b
+	and	v1.16b, v1.16b, v2.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	ushr	v12.16b, v8.16b, #6
+	ushr	v13.16b, v9.16b, #6
+	shl	v4.16b, v8.16b, #2
+	shl	v5.16b, v9.16b, #2
+	pmul	v12.16b, v12.16b, v2.16b
+	pmul	v13.16b, v13.16b, v2.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	ushr	v4.16b, v8.16b, #5
+	ushr	v5.16b, v9.16b, #5
+	pmul	v4.16b, v4.16b, v2.16b
+	pmul	v5.16b, v5.16b, v2.16b
+	shl	v2.16b, v8.16b, #3
+	shl	v3.16b, v9.16b, #3
+	eor	v4.16b, v4.16b, v2.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v2.16b, v0.16b, v4.16b
+	eor	v3.16b, v1.16b, v5.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v0.16b, v12.16b, v4.16b
+	eor	v1.16b, v13.16b, v5.16b
+	eor	v12.16b, v12.16b, v2.16b
+	eor	v13.16b, v13.16b, v3.16b
+	eor	v2.16b, v2.16b, v8.16b
+	eor	v3.16b, v3.16b, v9.16b
+	shl	v8.4s, v2.4s, #8
+	shl	v9.4s, v3.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	sri	v8.4s, v2.4s, #24
+	sri	v9.4s, v3.4s, #24
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	shl	v2.4s, v4.4s, #24
+	shl	v3.4s, v5.4s, #24
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v9.16b, v9.16b, v1.16b
+	sri	v2.4s, v4.4s, #8
+	sri	v3.4s, v5.4s, #8
+	eor	v8.16b, v8.16b, v2.16b
+	eor	v9.16b, v9.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x9], #16
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v9.16b, v9.16b, v4.16b
+	; Round Done
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v0.16b, v8.16b, v12.16b
+	eor	v1.16b, v9.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v8.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v9.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v1.16b
+	eor	v2.16b, v8.16b, v13.16b
+	eor	v3.16b, v9.16b, v13.16b
+	tbl	v2.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v2.16b
+	tbl	v3.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v3.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	eor	v0.16b, v8.16b, v14.16b
+	eor	v1.16b, v9.16b, v14.16b
+	orr	v4.16b, v4.16b, v2.16b
+	orr	v5.16b, v5.16b, v3.16b
+	tbl	v0.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v0.16b
+	tbl	v1.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v1.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v5.16b, v5.16b, v1.16b
+	ld1	{v8.16b}, [x7]
+	tbl	v4.16b, {v4.16b}, v8.16b
+	tbl	v5.16b, {v5.16b}, v8.16b
+	;   XOR in Key Schedule
+	ld1	{v8.2d}, [x9], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v8.16b
+	; Round Done
+	rev32	v4.16b, v4.16b
+	rev32	v5.16b, v5.16b
+	ld1	{v1.16b, v2.16b, v3.16b}, [x10]
+	eor	v4.16b, v4.16b, v1.16b
+	eor	v5.16b, v5.16b, v2.16b
+	st1	{v4.16b, v5.16b}, [x1], #32
+	sub	x2, x2, #32
+	cmp	x2, #32
+	bge	L_AES_CBC_decrypt_NEON_loop_2
+	cmp	x2, #0
+	beq	L_AES_CBC_decrypt_NEON_data_done
+L_AES_CBC_decrypt_NEON_start_1
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+	ld1	{v7.2d}, [x7]
+	mov	x9, x3
+	ld1	{v4.16b}, [x0], #16
+	mov	v10.16b, v3.16b
+	mov	v11.16b, v4.16b
+	ld1	{v8.16b}, [x9], #16
+	rev32	v4.16b, v4.16b
+	; Round: 0 - XOR in key schedule
+	eor	v4.16b, v4.16b, v8.16b
+	sub	w8, w4, #2
+L_AES_CBC_decrypt_NEON_loop_nr_1
+	eor	v0.16b, v4.16b, v12.16b
+	eor	v1.16b, v4.16b, v13.16b
+	eor	v2.16b, v4.16b, v14.16b
+	tbl	v8.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v1.16b, v1.16b, v2.16b
+	orr	v8.16b, v8.16b, v1.16b
+	tbl	v8.16b, {v8.16b}, v7.16b
+	sshr	v2.16b, v8.16b, #7
+	ushr	v3.16b, v8.16b, #6
+	ushr	v0.16b, v8.16b, #5
+	and	v2.16b, v2.16b, v15.16b
+	pmul	v3.16b, v3.16b, v15.16b
+	pmul	v0.16b, v0.16b, v15.16b
+	shl	v1.16b, v8.16b, #1
+	eor	v2.16b, v2.16b, v1.16b
+	shl	v1.16b, v8.16b, #3
+	eor	v0.16b, v0.16b, v1.16b
+	shl	v1.16b, v8.16b, #2
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v1.16b, v2.16b, v0.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v2.16b, v3.16b, v0.16b
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v1.16b, v1.16b, v8.16b
+	shl	v8.4s, v1.4s, #8
+	rev32	v2.8h, v2.8h
+	sri	v8.4s, v1.4s, #24
+	eor	v8.16b, v8.16b, v3.16b
+	shl	v1.4s, v0.4s, #24
+	eor	v8.16b, v8.16b, v2.16b
+	sri	v1.4s, v0.4s, #8
+	eor	v8.16b, v8.16b, v1.16b
+	ld1	{v4.2d}, [x9], #16
+	;   XOR in Key Schedule
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v0.16b, v8.16b, v12.16b
+	eor	v1.16b, v8.16b, v13.16b
+	eor	v2.16b, v8.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v8.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v1.16b, v1.16b, v2.16b
+	orr	v4.16b, v4.16b, v1.16b
+	tbl	v4.16b, {v4.16b}, v7.16b
+	sshr	v2.16b, v4.16b, #7
+	ushr	v3.16b, v4.16b, #6
+	ushr	v0.16b, v4.16b, #5
+	and	v2.16b, v2.16b, v15.16b
+	pmul	v3.16b, v3.16b, v15.16b
+	pmul	v0.16b, v0.16b, v15.16b
+	shl	v1.16b, v4.16b, #1
+	eor	v2.16b, v2.16b, v1.16b
+	shl	v1.16b, v4.16b, #3
+	eor	v0.16b, v0.16b, v1.16b
+	shl	v1.16b, v4.16b, #2
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v1.16b, v2.16b, v0.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v2.16b, v3.16b, v0.16b
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v1.16b, v1.16b, v4.16b
+	shl	v4.4s, v1.4s, #8
+	rev32	v2.8h, v2.8h
+	sri	v4.4s, v1.4s, #24
+	eor	v4.16b, v4.16b, v3.16b
+	shl	v1.4s, v0.4s, #24
+	eor	v4.16b, v4.16b, v2.16b
+	sri	v1.4s, v0.4s, #8
+	eor	v4.16b, v4.16b, v1.16b
+	ld1	{v8.2d}, [x9], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v8.16b
+	subs	w8, w8, #2
+	bne	L_AES_CBC_decrypt_NEON_loop_nr_1
+	eor	v0.16b, v4.16b, v12.16b
+	eor	v1.16b, v4.16b, v13.16b
+	eor	v2.16b, v4.16b, v14.16b
+	tbl	v8.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v1.16b, v1.16b, v2.16b
+	orr	v8.16b, v8.16b, v1.16b
+	tbl	v8.16b, {v8.16b}, v7.16b
+	sshr	v2.16b, v8.16b, #7
+	ushr	v3.16b, v8.16b, #6
+	ushr	v0.16b, v8.16b, #5
+	and	v2.16b, v2.16b, v15.16b
+	pmul	v3.16b, v3.16b, v15.16b
+	pmul	v0.16b, v0.16b, v15.16b
+	shl	v1.16b, v8.16b, #1
+	eor	v2.16b, v2.16b, v1.16b
+	shl	v1.16b, v8.16b, #3
+	eor	v0.16b, v0.16b, v1.16b
+	shl	v1.16b, v8.16b, #2
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v1.16b, v2.16b, v0.16b
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v2.16b, v3.16b, v0.16b
+	eor	v3.16b, v3.16b, v1.16b
+	eor	v1.16b, v1.16b, v8.16b
+	shl	v8.4s, v1.4s, #8
+	rev32	v2.8h, v2.8h
+	sri	v8.4s, v1.4s, #24
+	eor	v8.16b, v8.16b, v3.16b
+	shl	v1.4s, v0.4s, #24
+	eor	v8.16b, v8.16b, v2.16b
+	sri	v1.4s, v0.4s, #8
+	eor	v8.16b, v8.16b, v1.16b
+	ld1	{v4.2d}, [x9], #16
+	;   XOR in Key Schedule
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v0.16b, v8.16b, v12.16b
+	eor	v1.16b, v8.16b, v13.16b
+	eor	v2.16b, v8.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v8.16b
+	tbl	v0.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v0.16b
+	tbl	v1.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v1.16b
+	tbl	v2.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v2.16b
+	orr	v4.16b, v4.16b, v0.16b
+	orr	v1.16b, v1.16b, v2.16b
+	orr	v4.16b, v4.16b, v1.16b
+	tbl	v4.16b, {v4.16b}, v7.16b
+	ld1	{v8.2d}, [x9], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v8.16b
+	rev32	v4.16b, v4.16b
+	mov	v3.16b, v11.16b
+	eor	v4.16b, v4.16b, v10.16b
+	st1	{v4.16b}, [x1], #16
+L_AES_CBC_decrypt_NEON_data_done
+	st1	{v3.2d}, [x5]
+	ldp	d8, d9, [x29, #96]
+	ldp	d10, d11, [x29, #112]
+	ldp	d12, d13, [x29, #128]
+	ldp	d14, d15, [x29, #144]
+	ldp	x29, x30, [sp], #0xa0
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	ENDIF
+	IF :DEF:HAVE_AESGCM
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	GCM_gmult_len_NEON
+GCM_gmult_len_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	ld1	{v18.2d}, [x0]
+	ld1	{v10.2d}, [x1]
+	movi	v19.16b, #15
+	eor	v20.16b, v20.16b, v20.16b
+	rbit	v18.16b, v18.16b
+	rbit	v10.16b, v10.16b
+	and	v12.16b, v10.16b, v19.16b
+	ushr	v13.16b, v10.16b, #4
+	eor	v14.16b, v12.16b, v13.16b
+L_GCM_gmult_len_NEON_start_block
+	ld1	{v0.16b}, [x2], #16
+	rbit	v0.16b, v0.16b
+	eor	v18.16b, v18.16b, v0.16b
+	; Mul 128x128
+	and	v15.16b, v18.16b, v19.16b
+	ushr	v16.16b, v18.16b, #4
+	eor	v17.16b, v15.16b, v16.16b
+	dup	v0.16b, v12.b[0]
+	dup	v2.16b, v14.b[0]
+	dup	v1.16b, v13.b[0]
+	pmul	v8.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v8.16b
+	eor	v5.16b, v5.16b, v4.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v8.16b, v8.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	dup	v0.16b, v12.b[1]
+	dup	v2.16b, v14.b[1]
+	dup	v1.16b, v13.b[1]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v6.16b, v20.16b, v3.16b, #15
+	ext	v9.16b, v3.16b, v20.16b, #15
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[2]
+	dup	v2.16b, v14.b[2]
+	dup	v1.16b, v13.b[2]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #14
+	ext	v6.16b, v20.16b, v3.16b, #14
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[3]
+	dup	v2.16b, v14.b[3]
+	dup	v1.16b, v13.b[3]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #13
+	ext	v6.16b, v20.16b, v3.16b, #13
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[4]
+	dup	v2.16b, v14.b[4]
+	dup	v1.16b, v13.b[4]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #12
+	ext	v6.16b, v20.16b, v3.16b, #12
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[5]
+	dup	v2.16b, v14.b[5]
+	dup	v1.16b, v13.b[5]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #11
+	ext	v6.16b, v20.16b, v3.16b, #11
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[6]
+	dup	v2.16b, v14.b[6]
+	dup	v1.16b, v13.b[6]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #10
+	ext	v6.16b, v20.16b, v3.16b, #10
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[7]
+	dup	v2.16b, v14.b[7]
+	dup	v1.16b, v13.b[7]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #9
+	ext	v6.16b, v20.16b, v3.16b, #9
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[8]
+	dup	v2.16b, v14.b[8]
+	dup	v1.16b, v13.b[8]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #8
+	ext	v6.16b, v20.16b, v3.16b, #8
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[9]
+	dup	v2.16b, v14.b[9]
+	dup	v1.16b, v13.b[9]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #7
+	ext	v6.16b, v20.16b, v3.16b, #7
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[10]
+	dup	v2.16b, v14.b[10]
+	dup	v1.16b, v13.b[10]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #6
+	ext	v6.16b, v20.16b, v3.16b, #6
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[11]
+	dup	v2.16b, v14.b[11]
+	dup	v1.16b, v13.b[11]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #5
+	ext	v6.16b, v20.16b, v3.16b, #5
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[12]
+	dup	v2.16b, v14.b[12]
+	dup	v1.16b, v13.b[12]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #4
+	ext	v6.16b, v20.16b, v3.16b, #4
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[13]
+	dup	v2.16b, v14.b[13]
+	dup	v1.16b, v13.b[13]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #3
+	ext	v6.16b, v20.16b, v3.16b, #3
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[14]
+	dup	v2.16b, v14.b[14]
+	dup	v1.16b, v13.b[14]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #2
+	ext	v6.16b, v20.16b, v3.16b, #2
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	dup	v0.16b, v12.b[15]
+	dup	v2.16b, v14.b[15]
+	dup	v1.16b, v13.b[15]
+	pmul	v3.16b, v15.16b, v0.16b
+	pmul	v5.16b, v17.16b, v2.16b
+	pmul	v4.16b, v16.16b, v1.16b
+	eor	v5.16b, v5.16b, v3.16b
+	eor	v5.16b, v5.16b, v4.16b
+	eor	v3.16b, v3.16b, v11.16b
+	shl	v6.16b, v5.16b, #4
+	ushr	v7.16b, v5.16b, #4
+	eor	v3.16b, v3.16b, v6.16b
+	eor	v11.16b, v4.16b, v7.16b
+	ext	v7.16b, v3.16b, v20.16b, #1
+	ext	v6.16b, v20.16b, v3.16b, #1
+	eor	v9.16b, v9.16b, v7.16b
+	eor	v8.16b, v8.16b, v6.16b
+	eor	v9.16b, v9.16b, v11.16b
+	; Reduce 254-bit number
+	shl	v0.16b, v9.16b, #1
+	shl	v1.16b, v9.16b, #2
+	shl	v2.16b, v9.16b, #7
+	ushr	v3.16b, v9.16b, #7
+	ushr	v4.16b, v9.16b, #6
+	ushr	v5.16b, v9.16b, #1
+	eor	v0.16b, v0.16b, v9.16b
+	eor	v1.16b, v1.16b, v2.16b
+	eor	v0.16b, v0.16b, v1.16b
+	eor	v8.16b, v8.16b, v0.16b
+	ext	v0.16b, v20.16b, v3.16b, #15
+	ext	v1.16b, v20.16b, v4.16b, #15
+	ext	v2.16b, v20.16b, v5.16b, #15
+	ext	v4.16b, v4.16b, v20.16b, #15
+	ext	v5.16b, v5.16b, v20.16b, #15
+	eor	v0.16b, v0.16b, v1.16b
+	eor	v8.16b, v8.16b, v2.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v3.16b, v4.16b, v5.16b
+	shl	v0.2d, v3.2d, #1
+	shl	v1.2d, v3.2d, #2
+	shl	v2.2d, v3.2d, #7
+	eor	v3.16b, v3.16b, v0.16b
+	eor	v1.16b, v1.16b, v2.16b
+	eor	v8.16b, v8.16b, v3.16b
+	eor	v18.16b, v8.16b, v1.16b
+	subs	x3, x3, #16
+	bne	L_GCM_gmult_len_NEON_start_block
+	rbit	v18.16b, v18.16b
+	st1	{v18.2d}, [x0]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt_NEON
+AES_GCM_encrypt_NEON PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x9, L_AES_ARM64_NEON_te
+	add	x9, x9, L_AES_ARM64_NEON_te
+	adrp	x10, L_AES_ARM64_NEON_shift_rows_shuffle
+	add	x10, x10, L_AES_ARM64_NEON_shift_rows_shuffle
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x9], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x9], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x9], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x9]
+	ld1	{v2.2d}, [x5]
+	rev32	v2.16b, v2.16b
+	mov	w6, v2.s[3]
+	cmp	x2, #0x40
+	blt	L_AES_GCM_encrypt_NEON_start_2
+	mov	x7, v2.d[0]
+	mov	x8, v2.d[1]
+L_AES_GCM_encrypt_NEON_loop_4
+	mov	x12, x3
+	ld1	{v4.2d}, [x12], #16
+	mov	v8.d[0], x7
+	mov	v8.d[1], x8
+	; Round: 0 - XOR in key schedule
+	add	w6, w6, #1
+	mov	v8.s[3], w6
+	eor	v0.16b, v8.16b, v4.16b
+	add	w6, w6, #1
+	mov	v8.s[3], w6
+	eor	v1.16b, v8.16b, v4.16b
+	add	w6, w6, #1
+	mov	v8.s[3], w6
+	eor	v2.16b, v8.16b, v4.16b
+	add	w6, w6, #1
+	mov	v8.s[3], w6
+	eor	v3.16b, v8.16b, v4.16b
+	sub	w11, w4, #2
+L_AES_GCM_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x10]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x12], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x10]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	sshr	v10.16b, v2.16b, #7
+	sshr	v11.16b, v3.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	shl	v14.16b, v2.16b, #1
+	shl	v15.16b, v3.16b, #1
+	movi	v4.16b, #27
+	and	v8.16b, v8.16b, v4.16b
+	and	v9.16b, v9.16b, v4.16b
+	and	v10.16b, v10.16b, v4.16b
+	and	v11.16b, v11.16b, v4.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	eor	v6.16b, v10.16b, v2.16b
+	eor	v7.16b, v11.16b, v3.16b
+	shl	v12.4s, v4.4s, #8
+	shl	v13.4s, v5.4s, #8
+	shl	v14.4s, v6.4s, #8
+	shl	v15.4s, v7.4s, #8
+	sri	v12.4s, v4.4s, #24
+	sri	v13.4s, v5.4s, #24
+	sri	v14.4s, v6.4s, #24
+	sri	v15.4s, v7.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	shl	v6.4s, v2.4s, #24
+	shl	v7.4s, v3.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	sri	v6.4s, v2.4s, #8
+	sri	v7.4s, v3.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	rev32	v2.8h, v2.8h
+	rev32	v3.8h, v3.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x12], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	; Round Done
+	subs	w11, w11, #2
+	bne	L_AES_GCM_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x10]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x12], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x10]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x12], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x0], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	sub	x2, x2, #0x40
+	cmp	x2, #0x40
+	bge	L_AES_GCM_encrypt_NEON_loop_4
+	mov	v2.d[0], x7
+	mov	v2.d[1], x8
+	mov	v2.s[3], w6
+L_AES_GCM_encrypt_NEON_start_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+	cmp	x2, #16
+	beq	L_AES_GCM_encrypt_NEON_start_1
+	blt	L_AES_GCM_encrypt_NEON_data_done
+L_AES_GCM_encrypt_NEON_loop_2
+	mov	x12, x3
+	ld1	{v4.2d}, [x12], #16
+	; Round: 0 - XOR in key schedule
+	add	w6, w6, #1
+	mov	v2.s[3], w6
+	eor	v0.16b, v2.16b, v4.16b
+	add	w6, w6, #1
+	mov	v2.s[3], w6
+	eor	v1.16b, v2.16b, v4.16b
+	sub	w11, w4, #2
+L_AES_GCM_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x10]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x12], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x10]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	shl	v10.16b, v0.16b, #1
+	shl	v11.16b, v1.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	shl	v10.4s, v4.4s, #8
+	shl	v11.4s, v5.4s, #8
+	sri	v10.4s, v4.4s, #24
+	sri	v11.4s, v5.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x12], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	; Round Done
+	subs	w11, w11, #2
+	bne	L_AES_GCM_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x10]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x12], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x10]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x12], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	ld1	{v4.16b, v5.16b}, [x0], #32
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	st1	{v0.16b, v1.16b}, [x1], #32
+	sub	x2, x2, #32
+	cmp	x2, #0
+	beq	L_AES_GCM_encrypt_NEON_data_done
+L_AES_GCM_encrypt_NEON_start_1
+	ld1	{v3.2d}, [x10]
+	mov	x12, x3
+	add	w6, w6, #1
+	ld1	{v4.2d}, [x12], #16
+	mov	v2.s[3], w6
+	; Round: 0 - XOR in key schedule
+	eor	v0.16b, v2.16b, v4.16b
+	sub	w11, w4, #2
+L_AES_GCM_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x12], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x12], #16
+	sshr	v10.16b, v0.16b, #7
+	shl	v9.16b, v0.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v0.8h
+	eor	v11.16b, v10.16b, v0.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v0.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v4.16b
+	sri	v9.4s, v0.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v0.16b, v10.16b, v9.16b
+	eor	v0.16b, v0.16b, v8.16b
+	subs	w11, w11, #2
+	bne	L_AES_GCM_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x12], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x12], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	ld1	{v4.16b}, [x0], #16
+	eor	v0.16b, v0.16b, v4.16b
+	st1	{v0.16b}, [x1], #16
+L_AES_GCM_encrypt_NEON_data_done
+	rev32	v2.16b, v2.16b
+	st1	{v2.2d}, [x5]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:WOLFSSL_AES_XTS
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_encrypt_NEON
+AES_XTS_encrypt_NEON PROC
+	stp	x29, x30, [sp, #-128]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	str	x22, [x29, #56]
+	stp	d8, d9, [x29, #64]
+	stp	d10, d11, [x29, #80]
+	stp	d12, d13, [x29, #96]
+	stp	d14, d15, [x29, #112]
+	adrp	x19, L_AES_ARM64_NEON_te
+	add	x19, x19, L_AES_ARM64_NEON_te
+	adrp	x20, L_AES_ARM64_NEON_shift_rows_shuffle
+	add	x20, x20, L_AES_ARM64_NEON_shift_rows_shuffle
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x19], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x19], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x19], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x19]
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+	ld1	{v3.2d}, [x20]
+	mov	x17, #0x87
+	ld1	{v2.2d}, [x3]
+	ld1	{v4.2d}, [x5]
+	rev32	v2.16b, v2.16b
+	add	x22, x5, #16
+	; Round: 0 - XOR in key schedule
+	eor	v2.16b, v2.16b, v4.16b
+	sub	w21, w7, #2
+L_AES_XTS_encrypt_NEON_loop_nr_tweak
+	eor	v8.16b, v2.16b, v12.16b
+	eor	v9.16b, v2.16b, v13.16b
+	eor	v10.16b, v2.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v2.2d}, [x22], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v2.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v2.16b, v2.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v2.16b, v2.16b, v9.16b
+	tbl	v2.16b, {v2.16b}, v3.16b
+	ld1	{v4.2d}, [x22], #16
+	sshr	v10.16b, v2.16b, #7
+	shl	v9.16b, v2.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v2.8h
+	eor	v11.16b, v10.16b, v2.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v2.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v4.16b
+	sri	v9.4s, v2.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v2.16b, v10.16b, v9.16b
+	eor	v2.16b, v2.16b, v8.16b
+	subs	w21, w21, #2
+	bne	L_AES_XTS_encrypt_NEON_loop_nr_tweak
+	eor	v8.16b, v2.16b, v12.16b
+	eor	v9.16b, v2.16b, v13.16b
+	eor	v10.16b, v2.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v2.2d}, [x22], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v2.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v2.16b, v2.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v2.16b, v2.16b, v9.16b
+	tbl	v2.16b, {v2.16b}, v3.16b
+	ld1	{v4.2d}, [x22], #16
+	;   XOR in Key Schedule
+	eor	v2.16b, v2.16b, v4.16b
+	rev32	v2.16b, v2.16b
+	mov	x8, v2.d[0]
+	mov	x9, v2.d[1]
+	cmp	w2, #0x40
+	blt	L_AES_XTS_encrypt_NEON_start_2
+L_AES_XTS_encrypt_NEON_loop_4
+	mov	x22, x4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b}, [x22], #16
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	and	x16, x17, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x16, x10, lsl 1
+	and	x16, x17, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x16, x12, lsl 1
+	mov	v8.d[0], x8
+	mov	v8.d[1], x9
+	mov	v9.d[0], x10
+	mov	v9.d[1], x11
+	mov	v10.d[0], x12
+	mov	v10.d[1], x13
+	mov	v11.d[0], x14
+	mov	v11.d[1], x15
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	sub	w21, w7, #2
+L_AES_XTS_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x20]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x22], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x20]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	sshr	v10.16b, v2.16b, #7
+	sshr	v11.16b, v3.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	shl	v14.16b, v2.16b, #1
+	shl	v15.16b, v3.16b, #1
+	movi	v4.16b, #27
+	and	v8.16b, v8.16b, v4.16b
+	and	v9.16b, v9.16b, v4.16b
+	and	v10.16b, v10.16b, v4.16b
+	and	v11.16b, v11.16b, v4.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	eor	v6.16b, v10.16b, v2.16b
+	eor	v7.16b, v11.16b, v3.16b
+	shl	v12.4s, v4.4s, #8
+	shl	v13.4s, v5.4s, #8
+	shl	v14.4s, v6.4s, #8
+	shl	v15.4s, v7.4s, #8
+	sri	v12.4s, v4.4s, #24
+	sri	v13.4s, v5.4s, #24
+	sri	v14.4s, v6.4s, #24
+	sri	v15.4s, v7.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	shl	v6.4s, v2.4s, #24
+	shl	v7.4s, v3.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	sri	v6.4s, v2.4s, #8
+	sri	v7.4s, v3.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	rev32	v2.8h, v2.8h
+	rev32	v3.8h, v3.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x22], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	; Round Done
+	subs	w21, w21, #2
+	bne	L_AES_XTS_encrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x20]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	movi	v0.16b, #27
+	and	v8.16b, v8.16b, v0.16b
+	and	v9.16b, v9.16b, v0.16b
+	and	v10.16b, v10.16b, v0.16b
+	and	v11.16b, v11.16b, v0.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	eor	v2.16b, v10.16b, v6.16b
+	eor	v3.16b, v11.16b, v7.16b
+	shl	v12.4s, v0.4s, #8
+	shl	v13.4s, v1.4s, #8
+	shl	v14.4s, v2.4s, #8
+	shl	v15.4s, v3.4s, #8
+	sri	v12.4s, v0.4s, #24
+	sri	v13.4s, v1.4s, #24
+	sri	v14.4s, v2.4s, #24
+	sri	v15.4s, v3.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	shl	v2.4s, v6.4s, #24
+	shl	v3.4s, v7.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	sri	v2.4s, v6.4s, #8
+	sri	v3.4s, v7.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	rev32	v6.8h, v6.8h
+	rev32	v7.8h, v7.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x22], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x20]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x22], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	mov	v8.d[0], x8
+	mov	v8.d[1], x9
+	mov	v9.d[0], x10
+	mov	v9.d[1], x11
+	mov	v10.d[0], x12
+	mov	v10.d[1], x13
+	mov	v11.d[0], x14
+	mov	v11.d[1], x15
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	and	x16, x17, x15, asr 63
+	extr	x9, x15, x14, #63
+	eor	x8, x16, x14, lsl 1
+	sub	w2, w2, #0x40
+	cmp	w2, #0x40
+	bge	L_AES_XTS_encrypt_NEON_loop_4
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+L_AES_XTS_encrypt_NEON_start_2
+	cmp	w2, #32
+	blt	L_AES_XTS_encrypt_NEON_start_1
+	mov	x22, x4
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	ld1	{v4.16b}, [x22], #16
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	and	x16, x17, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x16, x10, lsl 1
+	mov	v2.d[0], x8
+	mov	v2.d[1], x9
+	mov	v3.d[0], x10
+	mov	v3.d[1], x11
+	eor	v0.16b, v0.16b, v2.16b
+	eor	v1.16b, v1.16b, v3.16b
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	sub	w21, w7, #2
+L_AES_XTS_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x20]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x22], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x20]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	shl	v10.16b, v0.16b, #1
+	shl	v11.16b, v1.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v4.16b, v8.16b, v0.16b
+	eor	v5.16b, v9.16b, v1.16b
+	shl	v10.4s, v4.4s, #8
+	shl	v11.4s, v5.4s, #8
+	sri	v10.4s, v4.4s, #24
+	sri	v11.4s, v5.4s, #24
+	shl	v4.4s, v0.4s, #24
+	shl	v5.4s, v1.4s, #24
+	sri	v4.4s, v0.4s, #8
+	sri	v5.4s, v1.4s, #8
+	rev32	v0.8h, v0.8h
+	rev32	v1.8h, v1.8h
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x22], #16
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	; Round Done
+	subs	w21, w21, #2
+	bne	L_AES_XTS_encrypt_NEON_loop_nr_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x20]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v10.16b, v4.16b, #1
+	shl	v11.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v15.16b
+	and	v9.16b, v9.16b, v15.16b
+	eor	v8.16b, v8.16b, v10.16b
+	eor	v9.16b, v9.16b, v11.16b
+	eor	v0.16b, v8.16b, v4.16b
+	eor	v1.16b, v9.16b, v5.16b
+	shl	v10.4s, v0.4s, #8
+	shl	v11.4s, v1.4s, #8
+	sri	v10.4s, v0.4s, #24
+	sri	v11.4s, v1.4s, #24
+	shl	v0.4s, v4.4s, #24
+	shl	v1.4s, v5.4s, #24
+	sri	v0.4s, v4.4s, #8
+	sri	v1.4s, v5.4s, #8
+	rev32	v4.8h, v4.8h
+	rev32	v5.8h, v5.8h
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x22], #16
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	; Round Done
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x20]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x22], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	eor	v0.16b, v0.16b, v2.16b
+	eor	v1.16b, v1.16b, v3.16b
+	st1	{v0.16b, v1.16b}, [x1], #32
+	and	x16, x17, x11, asr 63
+	extr	x9, x11, x10, #63
+	eor	x8, x16, x10, lsl 1
+	sub	w2, w2, #32
+L_AES_XTS_encrypt_NEON_start_1
+	ld1	{v3.2d}, [x20]
+	mov	v2.d[0], x8
+	mov	v2.d[1], x9
+	cmp	w2, #16
+	blt	L_AES_XTS_encrypt_NEON_start_partial
+	mov	x22, x4
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v4.2d}, [x22], #16
+	eor	v0.16b, v0.16b, v2.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v4.16b
+	sub	w21, w7, #2
+L_AES_XTS_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x22], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x22], #16
+	sshr	v10.16b, v0.16b, #7
+	shl	v9.16b, v0.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v0.8h
+	eor	v11.16b, v10.16b, v0.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v0.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v4.16b
+	sri	v9.4s, v0.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v0.16b, v10.16b, v9.16b
+	eor	v0.16b, v0.16b, v8.16b
+	subs	w21, w21, #2
+	bne	L_AES_XTS_encrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x22], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x22], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v2.16b
+	st1	{v0.16b}, [x1], #16
+	subs	w2, w2, #16
+	beq	L_AES_XTS_encrypt_NEON_data_done
+	and	x16, x17, x9, asr 63
+	extr	x9, x9, x8, #63
+	eor	x8, x16, x8, lsl 1
+L_AES_XTS_encrypt_NEON_start_partial
+	cbz	w2, L_AES_XTS_encrypt_NEON_data_done
+	mov	v2.d[0], x8
+	mov	v2.d[1], x9
+	mov	x22, x4
+	sub	x1, x1, #16
+	ld1	{v0.16b}, [x1], #16
+	st1	{v0.2d}, [x6]
+	mov	w16, w2
+L_AES_XTS_encrypt_NEON_start_byte
+	ldrb	w10, [x6]
+	ldrb	w11, [x0], #1
+	strb	w10, [x1], #1
+	strb	w11, [x6], #1
+	subs	w16, w16, #1
+	bgt	L_AES_XTS_encrypt_NEON_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ld1	{v0.2d}, [x6]
+	ld1	{v4.2d}, [x22], #16
+	eor	v0.16b, v0.16b, v2.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v4.16b
+	sub	w21, w7, #2
+L_AES_XTS_encrypt_NEON_loop_nr_partial
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x22], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x22], #16
+	sshr	v10.16b, v0.16b, #7
+	shl	v9.16b, v0.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v0.8h
+	eor	v11.16b, v10.16b, v0.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v0.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v4.16b
+	sri	v9.4s, v0.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v0.16b, v10.16b, v9.16b
+	eor	v0.16b, v0.16b, v8.16b
+	subs	w21, w21, #2
+	bne	L_AES_XTS_encrypt_NEON_loop_nr_partial
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v0.2d}, [x22], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v0.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x22], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v2.16b
+	st1	{v0.16b}, [x1]
+L_AES_XTS_encrypt_NEON_data_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldr	x22, [x29, #56]
+	ldp	d8, d9, [x29, #64]
+	ldp	d10, d11, [x29, #80]
+	ldp	d12, d13, [x29, #96]
+	ldp	d14, d15, [x29, #112]
+	ldp	x29, x30, [sp], #0x80
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_decrypt_NEON
+AES_XTS_decrypt_NEON PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	stp	x22, x23, [x29, #48]
+	stp	x24, x25, [x29, #64]
+	stp	d8, d9, [x29, #80]
+	stp	d10, d11, [x29, #96]
+	stp	d12, d13, [x29, #112]
+	stp	d14, d15, [x29, #128]
+	adrp	x20, L_AES_ARM64_NEON_te
+	add	x20, x20, L_AES_ARM64_NEON_te
+	adrp	x21, L_AES_ARM64_NEON_td
+	add	x21, x21, L_AES_ARM64_NEON_td
+	adrp	x22, L_AES_ARM64_NEON_shift_rows_shuffle
+	add	x22, x22, L_AES_ARM64_NEON_shift_rows_shuffle
+	adrp	x23, L_AES_ARM64_NEON_shift_rows_invshuffle
+	add	x23, x23, L_AES_ARM64_NEON_shift_rows_invshuffle
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x20], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x20], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x20], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x20]
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+	ld1	{v3.2d}, [x22]
+	mov	x17, #0x87
+	ands	w19, w2, #15
+	cset	w16, ne
+	sub	w2, w2, w16, lsl 4
+	ld1	{v2.2d}, [x3]
+	ld1	{v4.2d}, [x5]
+	rev32	v2.16b, v2.16b
+	add	x25, x5, #16
+	; Round: 0 - XOR in key schedule
+	eor	v2.16b, v2.16b, v4.16b
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_tweak
+	eor	v8.16b, v2.16b, v12.16b
+	eor	v9.16b, v2.16b, v13.16b
+	eor	v10.16b, v2.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v2.2d}, [x25], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v2.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v2.16b, v2.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v2.16b, v2.16b, v9.16b
+	tbl	v2.16b, {v2.16b}, v3.16b
+	ld1	{v4.2d}, [x25], #16
+	sshr	v10.16b, v2.16b, #7
+	shl	v9.16b, v2.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v2.8h
+	eor	v11.16b, v10.16b, v2.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v2.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v4.16b
+	sri	v9.4s, v2.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v2.16b, v10.16b, v9.16b
+	eor	v2.16b, v2.16b, v8.16b
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_tweak
+	eor	v8.16b, v2.16b, v12.16b
+	eor	v9.16b, v2.16b, v13.16b
+	eor	v10.16b, v2.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	ld1	{v2.2d}, [x25], #16
+	sshr	v10.16b, v4.16b, #7
+	shl	v9.16b, v4.16b, #1
+	and	v10.16b, v10.16b, v15.16b
+	eor	v10.16b, v10.16b, v9.16b
+	rev32	v8.8h, v4.8h
+	eor	v11.16b, v10.16b, v4.16b
+	eor	v10.16b, v10.16b, v8.16b
+	shl	v9.4s, v4.4s, #24
+	shl	v8.4s, v11.4s, #8
+	;   XOR in Key Schedule
+	eor	v10.16b, v10.16b, v2.16b
+	sri	v9.4s, v4.4s, #8
+	sri	v8.4s, v11.4s, #24
+	eor	v4.16b, v10.16b, v9.16b
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v2.16b, v2.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v2.16b, v2.16b, v9.16b
+	tbl	v2.16b, {v2.16b}, v3.16b
+	ld1	{v4.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v2.16b, v2.16b, v4.16b
+	rev32	v2.16b, v2.16b
+	mov	x8, v2.d[0]
+	mov	x9, v2.d[1]
+	ld1	{v16.16b, v17.16b, v18.16b, v19.16b}, [x21], #0x40
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x21], #0x40
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x21], #0x40
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x21]
+	ld1	{v3.2d}, [x23]
+	cmp	w2, #0x40
+	blt	L_AES_XTS_decrypt_NEON_start_2
+L_AES_XTS_decrypt_NEON_loop_4
+	mov	x25, x4
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld1	{v4.16b}, [x25], #16
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	and	x16, x17, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x16, x10, lsl 1
+	and	x16, x17, x13, asr 63
+	extr	x15, x13, x12, #63
+	eor	x14, x16, x12, lsl 1
+	mov	v8.d[0], x8
+	mov	v8.d[1], x9
+	mov	v9.d[0], x10
+	mov	v9.d[1], x11
+	mov	v10.d[0], x12
+	mov	v10.d[1], x13
+	mov	v11.d[0], x14
+	mov	v11.d[1], x15
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x23]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	movi	v28.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	and	v8.16b, v8.16b, v28.16b
+	and	v9.16b, v9.16b, v28.16b
+	and	v10.16b, v10.16b, v28.16b
+	and	v11.16b, v11.16b, v28.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	ushr	v14.16b, v6.16b, #6
+	ushr	v15.16b, v7.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	shl	v2.16b, v6.16b, #2
+	shl	v3.16b, v7.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	eor	v14.16b, v14.16b, v2.16b
+	eor	v15.16b, v15.16b, v3.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	ushr	v2.16b, v6.16b, #5
+	ushr	v3.16b, v7.16b, #5
+	pmul	v0.16b, v0.16b, v28.16b
+	pmul	v1.16b, v1.16b, v28.16b
+	pmul	v2.16b, v2.16b, v28.16b
+	pmul	v3.16b, v3.16b, v28.16b
+	shl	v28.16b, v4.16b, #3
+	shl	v29.16b, v5.16b, #3
+	shl	v30.16b, v6.16b, #3
+	shl	v31.16b, v7.16b, #3
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v1.16b, v1.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	eor	v3.16b, v3.16b, v31.16b
+	eor	v28.16b, v8.16b, v0.16b
+	eor	v29.16b, v9.16b, v1.16b
+	eor	v30.16b, v10.16b, v2.16b
+	eor	v31.16b, v11.16b, v3.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v10.16b, v14.16b, v2.16b
+	eor	v11.16b, v15.16b, v3.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v4.16b
+	eor	v29.16b, v29.16b, v5.16b
+	eor	v30.16b, v30.16b, v6.16b
+	eor	v31.16b, v31.16b, v7.16b
+	shl	v4.4s, v28.4s, #8
+	shl	v5.4s, v29.4s, #8
+	shl	v6.4s, v30.4s, #8
+	shl	v7.4s, v31.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	rev32	v10.8h, v10.8h
+	rev32	v11.8h, v11.8h
+	sri	v4.4s, v28.4s, #24
+	sri	v5.4s, v29.4s, #24
+	sri	v6.4s, v30.4s, #24
+	sri	v7.4s, v31.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	shl	v28.4s, v0.4s, #24
+	shl	v29.4s, v1.4s, #24
+	shl	v30.4s, v2.4s, #24
+	shl	v31.4s, v3.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	sri	v28.4s, v0.4s, #8
+	sri	v29.4s, v1.4s, #8
+	sri	v30.4s, v2.4s, #8
+	sri	v31.4s, v3.4s, #8
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x21]
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x25], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x23]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	movi	v28.16b, #27
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	sshr	v10.16b, v2.16b, #7
+	sshr	v11.16b, v3.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	shl	v14.16b, v2.16b, #1
+	shl	v15.16b, v3.16b, #1
+	and	v8.16b, v8.16b, v28.16b
+	and	v9.16b, v9.16b, v28.16b
+	and	v10.16b, v10.16b, v28.16b
+	and	v11.16b, v11.16b, v28.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	ushr	v12.16b, v0.16b, #6
+	ushr	v13.16b, v1.16b, #6
+	ushr	v14.16b, v2.16b, #6
+	ushr	v15.16b, v3.16b, #6
+	shl	v4.16b, v0.16b, #2
+	shl	v5.16b, v1.16b, #2
+	shl	v6.16b, v2.16b, #2
+	shl	v7.16b, v3.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	eor	v14.16b, v14.16b, v6.16b
+	eor	v15.16b, v15.16b, v7.16b
+	ushr	v4.16b, v0.16b, #5
+	ushr	v5.16b, v1.16b, #5
+	ushr	v6.16b, v2.16b, #5
+	ushr	v7.16b, v3.16b, #5
+	pmul	v4.16b, v4.16b, v28.16b
+	pmul	v5.16b, v5.16b, v28.16b
+	pmul	v6.16b, v6.16b, v28.16b
+	pmul	v7.16b, v7.16b, v28.16b
+	shl	v28.16b, v0.16b, #3
+	shl	v29.16b, v1.16b, #3
+	shl	v30.16b, v2.16b, #3
+	shl	v31.16b, v3.16b, #3
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	eor	v28.16b, v8.16b, v4.16b
+	eor	v29.16b, v9.16b, v5.16b
+	eor	v30.16b, v10.16b, v6.16b
+	eor	v31.16b, v11.16b, v7.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v6.16b, v6.16b, v2.16b
+	eor	v7.16b, v7.16b, v3.16b
+	eor	v8.16b, v12.16b, v4.16b
+	eor	v9.16b, v13.16b, v5.16b
+	eor	v10.16b, v14.16b, v6.16b
+	eor	v11.16b, v15.16b, v7.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v0.16b
+	eor	v29.16b, v29.16b, v1.16b
+	eor	v30.16b, v30.16b, v2.16b
+	eor	v31.16b, v31.16b, v3.16b
+	shl	v0.4s, v28.4s, #8
+	shl	v1.4s, v29.4s, #8
+	shl	v2.4s, v30.4s, #8
+	shl	v3.4s, v31.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	rev32	v10.8h, v10.8h
+	rev32	v11.8h, v11.8h
+	sri	v0.4s, v28.4s, #24
+	sri	v1.4s, v29.4s, #24
+	sri	v2.4s, v30.4s, #24
+	sri	v3.4s, v31.4s, #24
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	eor	v2.16b, v2.16b, v14.16b
+	eor	v3.16b, v3.16b, v15.16b
+	shl	v28.4s, v4.4s, #24
+	shl	v29.4s, v5.4s, #24
+	shl	v30.4s, v6.4s, #24
+	shl	v31.4s, v7.4s, #24
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	sri	v28.4s, v4.4s, #8
+	sri	v29.4s, v5.4s, #8
+	sri	v30.4s, v6.4s, #8
+	sri	v31.4s, v7.4s, #8
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v1.16b, v1.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	eor	v3.16b, v3.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x21]
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x25], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_4
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v6.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v2.16b
+	tbl	v7.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v3.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	eor	v10.16b, v2.16b, v12.16b
+	eor	v11.16b, v3.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v13.16b
+	eor	v9.16b, v1.16b, v13.16b
+	eor	v10.16b, v2.16b, v13.16b
+	eor	v11.16b, v3.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	eor	v10.16b, v2.16b, v14.16b
+	eor	v11.16b, v3.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	orr	v6.16b, v6.16b, v10.16b
+	orr	v7.16b, v7.16b, v11.16b
+	ld1	{v0.16b}, [x23]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	tbl	v6.16b, {v6.16b}, v0.16b
+	tbl	v7.16b, {v7.16b}, v0.16b
+	movi	v28.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	sshr	v10.16b, v6.16b, #7
+	sshr	v11.16b, v7.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	shl	v14.16b, v6.16b, #1
+	shl	v15.16b, v7.16b, #1
+	and	v8.16b, v8.16b, v28.16b
+	and	v9.16b, v9.16b, v28.16b
+	and	v10.16b, v10.16b, v28.16b
+	and	v11.16b, v11.16b, v28.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	eor	v10.16b, v10.16b, v14.16b
+	eor	v11.16b, v11.16b, v15.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	ushr	v14.16b, v6.16b, #6
+	ushr	v15.16b, v7.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	shl	v2.16b, v6.16b, #2
+	shl	v3.16b, v7.16b, #2
+	pmul	v12.16b, v12.16b, v28.16b
+	pmul	v13.16b, v13.16b, v28.16b
+	pmul	v14.16b, v14.16b, v28.16b
+	pmul	v15.16b, v15.16b, v28.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	eor	v14.16b, v14.16b, v2.16b
+	eor	v15.16b, v15.16b, v3.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	ushr	v2.16b, v6.16b, #5
+	ushr	v3.16b, v7.16b, #5
+	pmul	v0.16b, v0.16b, v28.16b
+	pmul	v1.16b, v1.16b, v28.16b
+	pmul	v2.16b, v2.16b, v28.16b
+	pmul	v3.16b, v3.16b, v28.16b
+	shl	v28.16b, v4.16b, #3
+	shl	v29.16b, v5.16b, #3
+	shl	v30.16b, v6.16b, #3
+	shl	v31.16b, v7.16b, #3
+	eor	v0.16b, v0.16b, v28.16b
+	eor	v1.16b, v1.16b, v29.16b
+	eor	v2.16b, v2.16b, v30.16b
+	eor	v3.16b, v3.16b, v31.16b
+	eor	v28.16b, v8.16b, v0.16b
+	eor	v29.16b, v9.16b, v1.16b
+	eor	v30.16b, v10.16b, v2.16b
+	eor	v31.16b, v11.16b, v3.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v10.16b, v14.16b, v2.16b
+	eor	v11.16b, v15.16b, v3.16b
+	eor	v12.16b, v12.16b, v28.16b
+	eor	v13.16b, v13.16b, v29.16b
+	eor	v14.16b, v14.16b, v30.16b
+	eor	v15.16b, v15.16b, v31.16b
+	eor	v28.16b, v28.16b, v4.16b
+	eor	v29.16b, v29.16b, v5.16b
+	eor	v30.16b, v30.16b, v6.16b
+	eor	v31.16b, v31.16b, v7.16b
+	shl	v4.4s, v28.4s, #8
+	shl	v5.4s, v29.4s, #8
+	shl	v6.4s, v30.4s, #8
+	shl	v7.4s, v31.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	rev32	v10.8h, v10.8h
+	rev32	v11.8h, v11.8h
+	sri	v4.4s, v28.4s, #24
+	sri	v5.4s, v29.4s, #24
+	sri	v6.4s, v30.4s, #24
+	sri	v7.4s, v31.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	eor	v6.16b, v6.16b, v14.16b
+	eor	v7.16b, v7.16b, v15.16b
+	shl	v28.4s, v0.4s, #24
+	shl	v29.4s, v1.4s, #24
+	shl	v30.4s, v2.4s, #24
+	shl	v31.4s, v3.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	eor	v6.16b, v6.16b, v10.16b
+	eor	v7.16b, v7.16b, v11.16b
+	sri	v28.4s, v0.4s, #8
+	sri	v29.4s, v1.4s, #8
+	sri	v30.4s, v2.4s, #8
+	sri	v31.4s, v3.4s, #8
+	eor	v4.16b, v4.16b, v28.16b
+	eor	v5.16b, v5.16b, v29.16b
+	eor	v6.16b, v6.16b, v30.16b
+	eor	v7.16b, v7.16b, v31.16b
+	ld1	{v28.16b, v29.16b, v30.16b, v31.16b}, [x21]
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x25], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	eor	v6.16b, v6.16b, v0.16b
+	eor	v7.16b, v7.16b, v0.16b
+	; Round Done
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v2.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v6.16b
+	tbl	v3.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v7.16b
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	eor	v10.16b, v6.16b, v12.16b
+	eor	v11.16b, v7.16b, v12.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	tbl	v10.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v10.16b
+	tbl	v11.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v13.16b
+	eor	v9.16b, v5.16b, v13.16b
+	eor	v10.16b, v6.16b, v13.16b
+	eor	v11.16b, v7.16b, v13.16b
+	tbl	v8.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	eor	v10.16b, v6.16b, v14.16b
+	eor	v11.16b, v7.16b, v14.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	tbl	v11.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	orr	v2.16b, v2.16b, v10.16b
+	orr	v3.16b, v3.16b, v11.16b
+	ld1	{v4.16b}, [x23]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	tbl	v2.16b, {v2.16b}, v4.16b
+	tbl	v3.16b, {v3.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x25], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	eor	v2.16b, v2.16b, v4.16b
+	eor	v3.16b, v3.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	rev32	v2.16b, v2.16b
+	rev32	v3.16b, v3.16b
+	mov	v8.d[0], x8
+	mov	v8.d[1], x9
+	mov	v9.d[0], x10
+	mov	v9.d[1], x11
+	mov	v10.d[0], x12
+	mov	v10.d[1], x13
+	mov	v11.d[0], x14
+	mov	v11.d[1], x15
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	eor	v2.16b, v2.16b, v10.16b
+	eor	v3.16b, v3.16b, v11.16b
+	st1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	and	x16, x17, x15, asr 63
+	extr	x9, x15, x14, #63
+	eor	x8, x16, x14, lsl 1
+	sub	w2, w2, #0x40
+	cmp	w2, #0x40
+	bge	L_AES_XTS_decrypt_NEON_loop_4
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	movi	v15.16b, #27
+L_AES_XTS_decrypt_NEON_start_2
+	cmp	w2, #32
+	blt	L_AES_XTS_decrypt_NEON_start_1
+	mov	x25, x4
+	ld1	{v0.16b, v1.16b}, [x0], #32
+	ld1	{v4.16b}, [x25], #16
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	and	x16, x17, x11, asr 63
+	extr	x13, x11, x10, #63
+	eor	x12, x16, x10, lsl 1
+	mov	v2.d[0], x8
+	mov	v2.d[1], x9
+	mov	v3.d[0], x10
+	mov	v3.d[1], x11
+	eor	v0.16b, v0.16b, v2.16b
+	eor	v1.16b, v1.16b, v3.16b
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x23]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	movi	v10.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v10.16b
+	and	v9.16b, v9.16b, v10.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	pmul	v12.16b, v12.16b, v10.16b
+	pmul	v13.16b, v13.16b, v10.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	pmul	v0.16b, v0.16b, v10.16b
+	pmul	v1.16b, v1.16b, v10.16b
+	shl	v10.16b, v4.16b, #3
+	shl	v11.16b, v5.16b, #3
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	eor	v10.16b, v8.16b, v0.16b
+	eor	v11.16b, v9.16b, v1.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v11.16b
+	eor	v10.16b, v10.16b, v4.16b
+	eor	v11.16b, v11.16b, v5.16b
+	shl	v4.4s, v10.4s, #8
+	shl	v5.4s, v11.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	sri	v4.4s, v10.4s, #24
+	sri	v5.4s, v11.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	shl	v10.4s, v0.4s, #24
+	shl	v11.4s, v1.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	sri	v10.4s, v0.4s, #8
+	sri	v11.4s, v1.4s, #8
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x25], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	; Round Done
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x23]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	movi	v10.16b, #27
+	sshr	v8.16b, v0.16b, #7
+	sshr	v9.16b, v1.16b, #7
+	shl	v12.16b, v0.16b, #1
+	shl	v13.16b, v1.16b, #1
+	and	v8.16b, v8.16b, v10.16b
+	and	v9.16b, v9.16b, v10.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	ushr	v12.16b, v0.16b, #6
+	ushr	v13.16b, v1.16b, #6
+	shl	v4.16b, v0.16b, #2
+	shl	v5.16b, v1.16b, #2
+	pmul	v12.16b, v12.16b, v10.16b
+	pmul	v13.16b, v13.16b, v10.16b
+	eor	v12.16b, v12.16b, v4.16b
+	eor	v13.16b, v13.16b, v5.16b
+	ushr	v4.16b, v0.16b, #5
+	ushr	v5.16b, v1.16b, #5
+	pmul	v4.16b, v4.16b, v10.16b
+	pmul	v5.16b, v5.16b, v10.16b
+	shl	v10.16b, v0.16b, #3
+	shl	v11.16b, v1.16b, #3
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	eor	v10.16b, v8.16b, v4.16b
+	eor	v11.16b, v9.16b, v5.16b
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v1.16b
+	eor	v8.16b, v12.16b, v4.16b
+	eor	v9.16b, v13.16b, v5.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v11.16b
+	eor	v10.16b, v10.16b, v0.16b
+	eor	v11.16b, v11.16b, v1.16b
+	shl	v0.4s, v10.4s, #8
+	shl	v1.4s, v11.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	sri	v0.4s, v10.4s, #24
+	sri	v1.4s, v11.4s, #24
+	eor	v0.16b, v0.16b, v12.16b
+	eor	v1.16b, v1.16b, v13.16b
+	shl	v10.4s, v4.4s, #24
+	shl	v11.4s, v5.4s, #24
+	eor	v0.16b, v0.16b, v8.16b
+	eor	v1.16b, v1.16b, v9.16b
+	sri	v10.4s, v4.4s, #8
+	sri	v11.4s, v5.4s, #8
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x25], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_2
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v1.16b, v12.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v5.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v1.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v0.16b, v13.16b
+	eor	v11.16b, v1.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	eor	v8.16b, v0.16b, v14.16b
+	eor	v9.16b, v1.16b, v14.16b
+	orr	v4.16b, v4.16b, v10.16b
+	orr	v5.16b, v5.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v5.16b, v5.16b, v9.16b
+	ld1	{v0.16b}, [x23]
+	tbl	v4.16b, {v4.16b}, v0.16b
+	tbl	v5.16b, {v5.16b}, v0.16b
+	movi	v10.16b, #27
+	sshr	v8.16b, v4.16b, #7
+	sshr	v9.16b, v5.16b, #7
+	shl	v12.16b, v4.16b, #1
+	shl	v13.16b, v5.16b, #1
+	and	v8.16b, v8.16b, v10.16b
+	and	v9.16b, v9.16b, v10.16b
+	eor	v8.16b, v8.16b, v12.16b
+	eor	v9.16b, v9.16b, v13.16b
+	ushr	v12.16b, v4.16b, #6
+	ushr	v13.16b, v5.16b, #6
+	shl	v0.16b, v4.16b, #2
+	shl	v1.16b, v5.16b, #2
+	pmul	v12.16b, v12.16b, v10.16b
+	pmul	v13.16b, v13.16b, v10.16b
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	ushr	v0.16b, v4.16b, #5
+	ushr	v1.16b, v5.16b, #5
+	pmul	v0.16b, v0.16b, v10.16b
+	pmul	v1.16b, v1.16b, v10.16b
+	shl	v10.16b, v4.16b, #3
+	shl	v11.16b, v5.16b, #3
+	eor	v0.16b, v0.16b, v10.16b
+	eor	v1.16b, v1.16b, v11.16b
+	eor	v10.16b, v8.16b, v0.16b
+	eor	v11.16b, v9.16b, v1.16b
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v8.16b, v12.16b, v0.16b
+	eor	v9.16b, v13.16b, v1.16b
+	eor	v12.16b, v12.16b, v10.16b
+	eor	v13.16b, v13.16b, v11.16b
+	eor	v10.16b, v10.16b, v4.16b
+	eor	v11.16b, v11.16b, v5.16b
+	shl	v4.4s, v10.4s, #8
+	shl	v5.4s, v11.4s, #8
+	rev32	v8.8h, v8.8h
+	rev32	v9.8h, v9.8h
+	sri	v4.4s, v10.4s, #24
+	sri	v5.4s, v11.4s, #24
+	eor	v4.16b, v4.16b, v12.16b
+	eor	v5.16b, v5.16b, v13.16b
+	shl	v10.4s, v0.4s, #24
+	shl	v11.4s, v1.4s, #24
+	eor	v4.16b, v4.16b, v8.16b
+	eor	v5.16b, v5.16b, v9.16b
+	sri	v10.4s, v0.4s, #8
+	sri	v11.4s, v1.4s, #8
+	eor	v4.16b, v4.16b, v10.16b
+	eor	v5.16b, v5.16b, v11.16b
+	;   XOR in Key Schedule
+	ld1	{v0.2d}, [x25], #16
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v5.16b, v5.16b, v0.16b
+	; Round Done
+	movi	v12.16b, #0x40
+	movi	v13.16b, #0x80
+	movi	v14.16b, #0xc0
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v5.16b, v12.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v1.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v5.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v9.16b
+	eor	v10.16b, v4.16b, v13.16b
+	eor	v11.16b, v5.16b, v13.16b
+	tbl	v10.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v10.16b
+	tbl	v11.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v11.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	eor	v8.16b, v4.16b, v14.16b
+	eor	v9.16b, v5.16b, v14.16b
+	orr	v0.16b, v0.16b, v10.16b
+	orr	v1.16b, v1.16b, v11.16b
+	tbl	v8.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v8.16b
+	tbl	v9.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v9.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v1.16b, v1.16b, v9.16b
+	ld1	{v4.16b}, [x23]
+	tbl	v0.16b, {v0.16b}, v4.16b
+	tbl	v1.16b, {v1.16b}, v4.16b
+	;   XOR in Key Schedule
+	ld1	{v4.2d}, [x25], #16
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v4.16b
+	; Round Done
+	rev32	v0.16b, v0.16b
+	rev32	v1.16b, v1.16b
+	eor	v0.16b, v0.16b, v2.16b
+	eor	v1.16b, v1.16b, v3.16b
+	st1	{v0.16b, v1.16b}, [x1], #32
+	and	x16, x17, x11, asr 63
+	extr	x9, x11, x10, #63
+	eor	x8, x16, x10, lsl 1
+	sub	w2, w2, #32
+L_AES_XTS_decrypt_NEON_start_1
+	ld1	{v3.2d}, [x23]
+	mov	v2.d[0], x8
+	mov	v2.d[1], x9
+	cmp	w2, #16
+	blt	L_AES_XTS_decrypt_NEON_start_partial
+	mov	x25, x4
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v4.2d}, [x25], #16
+	eor	v0.16b, v0.16b, v2.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v4.16b
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	sshr	v10.16b, v0.16b, #7
+	ushr	v11.16b, v0.16b, #6
+	ushr	v8.16b, v0.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v0.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v0.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v0.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v0.16b
+	shl	v0.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v0.4s, v9.4s, #24
+	eor	v0.16b, v0.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v0.16b, v0.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v0.16b, v0.16b, v9.16b
+	ld1	{v4.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v2.16b
+	st1	{v0.16b}, [x1], #16
+	sub	w2, w2, #16
+	cbz	w19, L_AES_XTS_decrypt_NEON_data_done
+	and	x16, x17, x9, asr 63
+	extr	x9, x9, x8, #63
+	eor	x8, x16, x8, lsl 1
+L_AES_XTS_decrypt_NEON_start_partial
+	mov	w2, w19
+	cbz	w2, L_AES_XTS_decrypt_NEON_data_done
+	mov	v2.d[0], x8
+	mov	v2.d[1], x9
+	and	x16, x17, x9, asr 63
+	extr	x11, x9, x8, #63
+	eor	x10, x16, x8, lsl 1
+	mov	v1.d[0], x10
+	mov	v1.d[1], x11
+	mov	x25, x4
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v4.2d}, [x25], #16
+	eor	v0.16b, v0.16b, v1.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v4.16b
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_partial_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	sshr	v10.16b, v0.16b, #7
+	ushr	v11.16b, v0.16b, #6
+	ushr	v8.16b, v0.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v0.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v0.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v0.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v0.16b
+	shl	v0.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v0.4s, v9.4s, #24
+	eor	v0.16b, v0.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v0.16b, v0.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v0.16b, v0.16b, v9.16b
+	ld1	{v4.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_partial_1
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v1.16b
+	st1	{v0.2d}, [x6]
+	add	x1, x1, #16
+	mov	w16, w2
+L_AES_XTS_decrypt_NEON_start_byte
+	ldrb	w10, [x6]
+	ldrb	w11, [x0], #1
+	strb	w10, [x1], #1
+	strb	w11, [x6], #1
+	subs	w16, w16, #1
+	bgt	L_AES_XTS_decrypt_NEON_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	mov	x25, x4
+	ld1	{v0.2d}, [x6]
+	ld1	{v4.2d}, [x25], #16
+	eor	v0.16b, v0.16b, v2.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v4.16b
+	sub	w24, w7, #2
+L_AES_XTS_decrypt_NEON_loop_nr_partial_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	sshr	v10.16b, v0.16b, #7
+	ushr	v11.16b, v0.16b, #6
+	ushr	v8.16b, v0.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v0.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v0.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v0.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v0.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v0.16b
+	shl	v0.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v0.4s, v9.4s, #24
+	eor	v0.16b, v0.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v0.16b, v0.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v0.16b, v0.16b, v9.16b
+	ld1	{v4.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	subs	w24, w24, #2
+	bne	L_AES_XTS_decrypt_NEON_loop_nr_partial_2
+	eor	v8.16b, v0.16b, v12.16b
+	eor	v9.16b, v0.16b, v13.16b
+	eor	v10.16b, v0.16b, v14.16b
+	tbl	v4.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v0.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v4.16b, v4.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v4.16b, v4.16b, v9.16b
+	tbl	v4.16b, {v4.16b}, v3.16b
+	sshr	v10.16b, v4.16b, #7
+	ushr	v11.16b, v4.16b, #6
+	ushr	v8.16b, v4.16b, #5
+	and	v10.16b, v10.16b, v15.16b
+	pmul	v11.16b, v11.16b, v15.16b
+	pmul	v8.16b, v8.16b, v15.16b
+	shl	v9.16b, v4.16b, #1
+	eor	v10.16b, v10.16b, v9.16b
+	shl	v9.16b, v4.16b, #3
+	eor	v8.16b, v8.16b, v9.16b
+	shl	v9.16b, v4.16b, #2
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v10.16b, v8.16b
+	eor	v8.16b, v8.16b, v4.16b
+	eor	v10.16b, v11.16b, v8.16b
+	eor	v11.16b, v11.16b, v9.16b
+	eor	v9.16b, v9.16b, v4.16b
+	shl	v4.4s, v9.4s, #8
+	rev32	v10.8h, v10.8h
+	sri	v4.4s, v9.4s, #24
+	eor	v4.16b, v4.16b, v11.16b
+	shl	v9.4s, v8.4s, #24
+	eor	v4.16b, v4.16b, v10.16b
+	sri	v9.4s, v8.4s, #8
+	eor	v4.16b, v4.16b, v9.16b
+	ld1	{v0.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v4.16b, v4.16b, v0.16b
+	eor	v8.16b, v4.16b, v12.16b
+	eor	v9.16b, v4.16b, v13.16b
+	eor	v10.16b, v4.16b, v14.16b
+	tbl	v0.16b, {v16.16b, v17.16b, v18.16b, v19.16b}, v4.16b
+	tbl	v8.16b, {v20.16b, v21.16b, v22.16b, v23.16b}, v8.16b
+	tbl	v9.16b, {v24.16b, v25.16b, v26.16b, v27.16b}, v9.16b
+	tbl	v10.16b, {v28.16b, v29.16b, v30.16b, v31.16b}, v10.16b
+	orr	v0.16b, v0.16b, v8.16b
+	orr	v9.16b, v9.16b, v10.16b
+	orr	v0.16b, v0.16b, v9.16b
+	tbl	v0.16b, {v0.16b}, v3.16b
+	ld1	{v4.2d}, [x25], #16
+	;   XOR in Key Schedule
+	eor	v0.16b, v0.16b, v4.16b
+	rev32	v0.16b, v0.16b
+	eor	v0.16b, v0.16b, v2.16b
+	st1	{v0.16b}, [x1]
+L_AES_XTS_decrypt_NEON_data_done
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x22, x23, [x29, #48]
+	ldp	x24, x25, [x29, #64]
+	ldp	d8, d9, [x29, #80]
+	ldp	d10, d11, [x29, #96]
+	ldp	d12, d13, [x29, #112]
+	ldp	d14, d15, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	ENDIF
+	IF :LNOT::DEF:WOLFSSL_ARMASM_NEON_NO_TABLE_LOOKUP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_td
+	DCD	0x5051f4a7, 0x537e4165, 0xc31a17a4, 0x963a275e
+	DCD	0xcb3bab6b, 0xf11f9d45, 0xabacfa58, 0x934be303
+	DCD	0x552030fa, 0xf6ad766d, 0x9188cc76, 0x25f5024c
+	DCD	0xfc4fe5d7, 0xd7c52acb, 0x80263544, 0x8fb562a3
+	DCD	0x49deb15a, 0x6725ba1b, 0x9845ea0e, 0xe15dfec0
+	DCD	0x02c32f75, 0x12814cf0, 0xa38d4697, 0xc66bd3f9
+	DCD	0xe7038f5f, 0x9515929c, 0xebbf6d7a, 0xda955259
+	DCD	0x2dd4be83, 0xd3587421, 0x2949e069, 0x448ec9c8
+	DCD	0x6a75c289, 0x78f48e79, 0x6b99583e, 0xdd27b971
+	DCD	0xb6bee14f, 0x17f088ad, 0x66c920ac, 0xb47dce3a
+	DCD	0x1863df4a, 0x82e51a31, 0x60975133, 0x4562537f
+	DCD	0xe0b16477, 0x84bb6bae, 0x1cfe81a0, 0x94f9082b
+	DCD	0x58704868, 0x198f45fd, 0x8794de6c, 0xb7527bf8
+	DCD	0x23ab73d3, 0xe2724b02, 0x57e31f8f, 0x2a6655ab
+	DCD	0x07b2eb28, 0x032fb5c2, 0x9a86c57b, 0xa5d33708
+	DCD	0xf2302887, 0xb223bfa5, 0xba02036a, 0x5ced1682
+	DCD	0x2b8acf1c, 0x92a779b4, 0xf0f307f2, 0xa14e69e2
+	DCD	0xcd65daf4, 0xd50605be, 0x1fd13462, 0x8ac4a6fe
+	DCD	0x9d342e53, 0xa0a2f355, 0x32058ae1, 0x75a4f6eb
+	DCD	0x390b83ec, 0xaa4060ef, 0x065e719f, 0x51bd6e10
+	DCD	0xf93e218a, 0x3d96dd06, 0xaedd3e05, 0x464de6bd
+	DCD	0xb591548d, 0x0571c45d, 0x6f0406d4, 0xff605015
+	DCD	0x241998fb, 0x97d6bde9, 0xcc894043, 0x7767d99e
+	DCD	0xbdb0e842, 0x8807898b, 0x38e7195b, 0xdb79c8ee
+	DCD	0x47a17c0a, 0xe97c420f, 0xc9f8841e, 0x00000000
+	DCD	0x83098086, 0x48322bed, 0xac1e1170, 0x4e6c5a72
+	DCD	0xfbfd0eff, 0x560f8538, 0x1e3daed5, 0x27362d39
+	DCD	0x640a0fd9, 0x21685ca6, 0xd19b5b54, 0x3a24362e
+	DCD	0xb10c0a67, 0x0f9357e7, 0xd2b4ee96, 0x9e1b9b91
+	DCD	0x4f80c0c5, 0xa261dc20, 0x695a774b, 0x161c121a
+	DCD	0x0ae293ba, 0xe5c0a02a, 0x433c22e0, 0x1d121b17
+	DCD	0x0b0e090d, 0xadf28bc7, 0xb92db6a8, 0xc8141ea9
+	DCD	0x8557f119, 0x4caf7507, 0xbbee99dd, 0xfda37f60
+	DCD	0x9ff70126, 0xbc5c72f5, 0xc544663b, 0x345bfb7e
+	DCD	0x768b4329, 0xdccb23c6, 0x68b6edfc, 0x63b8e4f1
+	DCD	0xcad731dc, 0x10426385, 0x40139722, 0x2084c611
+	DCD	0x7d854a24, 0xf8d2bb3d, 0x11aef932, 0x6dc729a1
+	DCD	0x4b1d9e2f, 0xf3dcb230, 0xec0d8652, 0xd077c1e3
+	DCD	0x6c2bb316, 0x99a970b9, 0xfa119448, 0x2247e964
+	DCD	0xc4a8fc8c, 0x1aa0f03f, 0xd8567d2c, 0xef223390
+	DCD	0xc787494e, 0xc1d938d1, 0xfe8ccaa2, 0x3698d40b
+	DCD	0xcfa6f581, 0x28a57ade, 0x26dab78e, 0xa43fadbf
+	DCD	0xe42c3a9d, 0x0d507892, 0x9b6a5fcc, 0x62547e46
+	DCD	0xc2f68d13, 0xe890d8b8, 0x5e2e39f7, 0xf582c3af
+	DCD	0xbe9f5d80, 0x7c69d093, 0xa96fd52d, 0xb3cf2512
+	DCD	0x3bc8ac99, 0xa710187d, 0x6ee89c63, 0x7bdb3bbb
+	DCD	0x09cd2678, 0xf46e5918, 0x01ec9ab7, 0xa8834f9a
+	DCD	0x65e6956e, 0x7eaaffe6, 0x0821bccf, 0xe6ef15e8
+	DCD	0xd9bae79b, 0xce4a6f36, 0xd4ea9f09, 0xd629b07c
+	DCD	0xaf31a4b2, 0x312a3f23, 0x30c6a594, 0xc035a266
+	DCD	0x37744ebc, 0xa6fc82ca, 0xb0e090d0, 0x1533a7d8
+	DCD	0x4af10498, 0xf741ecda, 0x0e7fcd50, 0x2f1791f6
+	DCD	0x8d764dd6, 0x4d43efb0, 0x54ccaa4d, 0xdfe49604
+	DCD	0xe39ed1b5, 0x1b4c6a88, 0xb8c12c1f, 0x7f466551
+	DCD	0x049d5eea, 0x5d018c35, 0x73fa8774, 0x2efb0b41
+	DCD	0x5ab3671d, 0x5292dbd2, 0x33e91056, 0x136dd647
+	DCD	0x8c9ad761, 0x7a37a10c, 0x8e59f814, 0x89eb133c
+	DCD	0xeecea927, 0x35b761c9, 0xede11ce5, 0x3c7a47b1
+	DCD	0x599cd2df, 0x3f55f273, 0x791814ce, 0xbf73c737
+	DCD	0xea53f7cd, 0x5b5ffdaa, 0x14df3d6f, 0x867844db
+	DCD	0x81caaff3, 0x3eb968c4, 0x2c382434, 0x5fc2a340
+	DCD	0x72161dc3, 0x0cbce225, 0x8b283c49, 0x41ff0d95
+	DCD	0x7139a801, 0xde080cb3, 0x9cd8b4e4, 0x906456c1
+	DCD	0x617bcb84, 0x70d532b6, 0x74486c5c, 0x42d0b857
+	ENDIF
+	IF :DEF:HAVE_AES_DECRYPT :LOR: :DEF:HAVE_AES_CBC :LOR: :DEF:HAVE_AESCCM :LOR: :DEF:HAVE_AESGCM :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_te
+	DCD	0xa5c66363, 0x84f87c7c, 0x99ee7777, 0x8df67b7b
+	DCD	0x0dfff2f2, 0xbdd66b6b, 0xb1de6f6f, 0x5491c5c5
+	DCD	0x50603030, 0x03020101, 0xa9ce6767, 0x7d562b2b
+	DCD	0x19e7fefe, 0x62b5d7d7, 0xe64dabab, 0x9aec7676
+	DCD	0x458fcaca, 0x9d1f8282, 0x4089c9c9, 0x87fa7d7d
+	DCD	0x15effafa, 0xebb25959, 0xc98e4747, 0x0bfbf0f0
+	DCD	0xec41adad, 0x67b3d4d4, 0xfd5fa2a2, 0xea45afaf
+	DCD	0xbf239c9c, 0xf753a4a4, 0x96e47272, 0x5b9bc0c0
+	DCD	0xc275b7b7, 0x1ce1fdfd, 0xae3d9393, 0x6a4c2626
+	DCD	0x5a6c3636, 0x417e3f3f, 0x02f5f7f7, 0x4f83cccc
+	DCD	0x5c683434, 0xf451a5a5, 0x34d1e5e5, 0x08f9f1f1
+	DCD	0x93e27171, 0x73abd8d8, 0x53623131, 0x3f2a1515
+	DCD	0x0c080404, 0x5295c7c7, 0x65462323, 0x5e9dc3c3
+	DCD	0x28301818, 0xa1379696, 0x0f0a0505, 0xb52f9a9a
+	DCD	0x090e0707, 0x36241212, 0x9b1b8080, 0x3ddfe2e2
+	DCD	0x26cdebeb, 0x694e2727, 0xcd7fb2b2, 0x9fea7575
+	DCD	0x1b120909, 0x9e1d8383, 0x74582c2c, 0x2e341a1a
+	DCD	0x2d361b1b, 0xb2dc6e6e, 0xeeb45a5a, 0xfb5ba0a0
+	DCD	0xf6a45252, 0x4d763b3b, 0x61b7d6d6, 0xce7db3b3
+	DCD	0x7b522929, 0x3edde3e3, 0x715e2f2f, 0x97138484
+	DCD	0xf5a65353, 0x68b9d1d1, 0x00000000, 0x2cc1eded
+	DCD	0x60402020, 0x1fe3fcfc, 0xc879b1b1, 0xedb65b5b
+	DCD	0xbed46a6a, 0x468dcbcb, 0xd967bebe, 0x4b723939
+	DCD	0xde944a4a, 0xd4984c4c, 0xe8b05858, 0x4a85cfcf
+	DCD	0x6bbbd0d0, 0x2ac5efef, 0xe54faaaa, 0x16edfbfb
+	DCD	0xc5864343, 0xd79a4d4d, 0x55663333, 0x94118585
+	DCD	0xcf8a4545, 0x10e9f9f9, 0x06040202, 0x81fe7f7f
+	DCD	0xf0a05050, 0x44783c3c, 0xba259f9f, 0xe34ba8a8
+	DCD	0xf3a25151, 0xfe5da3a3, 0xc0804040, 0x8a058f8f
+	DCD	0xad3f9292, 0xbc219d9d, 0x48703838, 0x04f1f5f5
+	DCD	0xdf63bcbc, 0xc177b6b6, 0x75afdada, 0x63422121
+	DCD	0x30201010, 0x1ae5ffff, 0x0efdf3f3, 0x6dbfd2d2
+	DCD	0x4c81cdcd, 0x14180c0c, 0x35261313, 0x2fc3ecec
+	DCD	0xe1be5f5f, 0xa2359797, 0xcc884444, 0x392e1717
+	DCD	0x5793c4c4, 0xf255a7a7, 0x82fc7e7e, 0x477a3d3d
+	DCD	0xacc86464, 0xe7ba5d5d, 0x2b321919, 0x95e67373
+	DCD	0xa0c06060, 0x98198181, 0xd19e4f4f, 0x7fa3dcdc
+	DCD	0x66442222, 0x7e542a2a, 0xab3b9090, 0x830b8888
+	DCD	0xca8c4646, 0x29c7eeee, 0xd36bb8b8, 0x3c281414
+	DCD	0x79a7dede, 0xe2bc5e5e, 0x1d160b0b, 0x76addbdb
+	DCD	0x3bdbe0e0, 0x56643232, 0x4e743a3a, 0x1e140a0a
+	DCD	0xdb924949, 0x0a0c0606, 0x6c482424, 0xe4b85c5c
+	DCD	0x5d9fc2c2, 0x6ebdd3d3, 0xef43acac, 0xa6c46262
+	DCD	0xa8399191, 0xa4319595, 0x37d3e4e4, 0x8bf27979
+	DCD	0x32d5e7e7, 0x438bc8c8, 0x596e3737, 0xb7da6d6d
+	DCD	0x8c018d8d, 0x64b1d5d5, 0xd29c4e4e, 0xe049a9a9
+	DCD	0xb4d86c6c, 0xfaac5656, 0x07f3f4f4, 0x25cfeaea
+	DCD	0xafca6565, 0x8ef47a7a, 0xe947aeae, 0x18100808
+	DCD	0xd56fbaba, 0x88f07878, 0x6f4a2525, 0x725c2e2e
+	DCD	0x24381c1c, 0xf157a6a6, 0xc773b4b4, 0x5197c6c6
+	DCD	0x23cbe8e8, 0x7ca1dddd, 0x9ce87474, 0x213e1f1f
+	DCD	0xdd964b4b, 0xdc61bdbd, 0x860d8b8b, 0x850f8a8a
+	DCD	0x90e07070, 0x427c3e3e, 0xc471b5b5, 0xaacc6666
+	DCD	0xd8904848, 0x05060303, 0x01f7f6f6, 0x121c0e0e
+	DCD	0xa3c26161, 0x5f6a3535, 0xf9ae5757, 0xd069b9b9
+	DCD	0x91178686, 0x5899c1c1, 0x273a1d1d, 0xb9279e9e
+	DCD	0x38d9e1e1, 0x13ebf8f8, 0xb32b9898, 0x33221111
+	DCD	0xbbd26969, 0x70a9d9d9, 0x89078e8e, 0xa7339494
+	DCD	0xb62d9b9b, 0x223c1e1e, 0x92158787, 0x20c9e9e9
+	DCD	0x4987cece, 0xffaa5555, 0x78502828, 0x7aa5dfdf
+	DCD	0x8f038c8c, 0xf859a1a1, 0x80098989, 0x171a0d0d
+	DCD	0xda65bfbf, 0x31d7e6e6, 0xc6844242, 0xb8d06868
+	DCD	0xc3824141, 0xb0299999, 0x775a2d2d, 0x111e0f0f
+	DCD	0xcb7bb0b0, 0xfca85454, 0xd66dbbbb, 0x3a2c1616
+	ENDIF
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_invert_key
+AES_invert_key PROC
+	adrp	x2, L_AES_ARM64_te
+	add	x2, x2, L_AES_ARM64_te
+	adrp	x3, L_AES_ARM64_td
+	add	x3, x3, L_AES_ARM64_td
+	add	x12, x0, x1, lsl 4
+	mov	w13, w1
+L_AES_invert_key_loop
+	ldp	w4, w5, [x0]
+	ldnp	w6, w7, [x0, #8]
+	ldp	w8, w9, [x12]
+	ldnp	w10, w11, [x12, #8]
+	stp	w4, w5, [x12]
+	stnp	w6, w7, [x12, #8]
+	stp	w8, w9, [x0], #8
+	stp	w10, w11, [x0], #8
+	subs	w13, w13, #2
+	sub	x12, x12, #16
+	bne	L_AES_invert_key_loop
+	sub	x0, x0, x1, lsl 3
+	add	x0, x0, #16
+	sub	w13, w1, #1
+L_AES_invert_key_mix_loop
+	ldp	w4, w5, [x0]
+	ldnp	w6, w7, [x0, #8]
+	ubfx	w8, w4, #0, #8
+	ubfx	w9, w4, #8, #8
+	ubfx	w10, w4, #16, #8
+	ubfx	w11, w4, #24, #8
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	lsl	w10, w10, #2
+	lsl	w11, w11, #2
+	ldrb	w8, [x2, x8, LSL 0]
+	ldrb	w9, [x2, x9, LSL 0]
+	ldrb	w10, [x2, x10, LSL 0]
+	ldrb	w11, [x2, x11, LSL 0]
+	ldr	w8, [x3, x8, LSL 2]
+	ldr	w9, [x3, x9, LSL 2]
+	ldr	w10, [x3, x10, LSL 2]
+	ldr	w11, [x3, x11, LSL 2]
+	eor	w10, w10, w8, ror 16
+	eor	w10, w10, w9, ror 8
+	eor	w10, w10, w11, ror 24
+	str	w10, [x0], #4
+	ubfx	w8, w5, #0, #8
+	ubfx	w9, w5, #8, #8
+	ubfx	w10, w5, #16, #8
+	ubfx	w11, w5, #24, #8
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	lsl	w10, w10, #2
+	lsl	w11, w11, #2
+	ldrb	w8, [x2, x8, LSL 0]
+	ldrb	w9, [x2, x9, LSL 0]
+	ldrb	w10, [x2, x10, LSL 0]
+	ldrb	w11, [x2, x11, LSL 0]
+	ldr	w8, [x3, x8, LSL 2]
+	ldr	w9, [x3, x9, LSL 2]
+	ldr	w10, [x3, x10, LSL 2]
+	ldr	w11, [x3, x11, LSL 2]
+	eor	w10, w10, w8, ror 16
+	eor	w10, w10, w9, ror 8
+	eor	w10, w10, w11, ror 24
+	str	w10, [x0], #4
+	ubfx	w8, w6, #0, #8
+	ubfx	w9, w6, #8, #8
+	ubfx	w10, w6, #16, #8
+	ubfx	w11, w6, #24, #8
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	lsl	w10, w10, #2
+	lsl	w11, w11, #2
+	ldrb	w8, [x2, x8, LSL 0]
+	ldrb	w9, [x2, x9, LSL 0]
+	ldrb	w10, [x2, x10, LSL 0]
+	ldrb	w11, [x2, x11, LSL 0]
+	ldr	w8, [x3, x8, LSL 2]
+	ldr	w9, [x3, x9, LSL 2]
+	ldr	w10, [x3, x10, LSL 2]
+	ldr	w11, [x3, x11, LSL 2]
+	eor	w10, w10, w8, ror 16
+	eor	w10, w10, w9, ror 8
+	eor	w10, w10, w11, ror 24
+	str	w10, [x0], #4
+	ubfx	w8, w7, #0, #8
+	ubfx	w9, w7, #8, #8
+	ubfx	w10, w7, #16, #8
+	ubfx	w11, w7, #24, #8
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	lsl	w10, w10, #2
+	lsl	w11, w11, #2
+	ldrb	w8, [x2, x8, LSL 0]
+	ldrb	w9, [x2, x9, LSL 0]
+	ldrb	w10, [x2, x10, LSL 0]
+	ldrb	w11, [x2, x11, LSL 0]
+	ldr	w8, [x3, x8, LSL 2]
+	ldr	w9, [x3, x9, LSL 2]
+	ldr	w10, [x3, x10, LSL 2]
+	ldr	w11, [x3, x11, LSL 2]
+	eor	w10, w10, w8, ror 16
+	eor	w10, w10, w9, ror 8
+	eor	w10, w10, w11, ror 24
+	str	w10, [x0], #4
+	subs	w13, w13, #1
+	bne	L_AES_invert_key_mix_loop
+	ret
+	ENDP
+	ENDIF
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_rcon
+	DCD	0x01000000, 0x02000000, 0x04000000, 0x08000000
+	DCD	0x10000000, 0x20000000, 0x40000000, 0x80000000
+	DCD	0x1b000000, 0x36000000
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_set_encrypt_key
+AES_set_encrypt_key PROC
+	adrp	x5, L_AES_ARM64_rcon
+	add	x5, x5, L_AES_ARM64_rcon
+	adrp	x12, L_AES_ARM64_te
+	add	x12, x12, L_AES_ARM64_te
+	cmp	x1, #0x80
+	beq	L_AES_set_encrypt_key_start_128
+	cmp	x1, #0xc0
+	beq	L_AES_set_encrypt_key_start_192
+	ldr	w6, [x0]
+	ldr	w7, [x0, #4]
+	ldr	w8, [x0, #8]
+	ldr	w9, [x0, #12]
+	rev	w6, w6
+	rev	w7, w7
+	rev	w8, w8
+	rev	w9, w9
+	stp	w6, w7, [x2], #8
+	stp	w8, w9, [x2], #8
+	ldr	w6, [x0, #16]
+	ldr	w7, [x0, #20]
+	ldr	w8, [x0, #24]
+	ldr	w9, [x0, #28]
+	rev	w6, w6
+	rev	w7, w7
+	rev	w8, w8
+	rev	w9, w9
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	sub	x2, x2, #16
+	mov	x4, #6
+L_AES_set_encrypt_key_loop_256
+	ubfx	w6, w9, #0, #8
+	ubfx	w7, w9, #8, #8
+	ubfx	w8, w9, #16, #8
+	ubfx	w9, w9, #24, #8
+	lsl	w6, w6, #2
+	lsl	w7, w7, #2
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	ldrb	w6, [x12, x6, LSL 0]
+	ldrb	w7, [x12, x7, LSL 0]
+	ldrb	w8, [x12, x8, LSL 0]
+	ldrb	w9, [x12, x9, LSL 0]
+	eor	w3, w9, w6, lsl 8
+	eor	w3, w3, w7, lsl 16
+	eor	w3, w3, w8, lsl 24
+	ldp	w6, w7, [x2], #8
+	ldp	w8, w9, [x2], #8
+	eor	w6, w6, w3
+	ldr	w3, [x5], #4
+	eor	w6, w6, w3
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	add	x2, x2, #16
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	sub	x2, x2, #16
+	ubfx	w6, w9, #8, #8
+	ubfx	w7, w9, #16, #8
+	ubfx	w8, w9, #24, #8
+	ubfx	w3, w9, #0, #8
+	lsl	w6, w6, #2
+	lsl	w7, w7, #2
+	lsl	w8, w8, #2
+	lsl	w3, w3, #2
+	ldrb	w6, [x12, x6, LSL 0]
+	ldrb	w8, [x12, x8, LSL 0]
+	ldrb	w7, [x12, x7, LSL 0]
+	ldrb	w3, [x12, x3, LSL 0]
+	eor	w3, w3, w6, lsl 8
+	eor	w3, w3, w7, lsl 16
+	eor	w3, w3, w8, lsl 24
+	ldp	w6, w7, [x2], #8
+	ldp	w8, w9, [x2], #8
+	eor	w6, w6, w3
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	add	x2, x2, #16
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	sub	x2, x2, #16
+	subs	x4, x4, #1
+	bne	L_AES_set_encrypt_key_loop_256
+	ubfx	w6, w9, #0, #8
+	ubfx	w7, w9, #8, #8
+	ubfx	w8, w9, #16, #8
+	ubfx	w9, w9, #24, #8
+	lsl	w6, w6, #2
+	lsl	w7, w7, #2
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	ldrb	w6, [x12, x6, LSL 0]
+	ldrb	w7, [x12, x7, LSL 0]
+	ldrb	w8, [x12, x8, LSL 0]
+	ldrb	w9, [x12, x9, LSL 0]
+	eor	w3, w9, w6, lsl 8
+	eor	w3, w3, w7, lsl 16
+	eor	w3, w3, w8, lsl 24
+	ldp	w6, w7, [x2], #8
+	ldp	w8, w9, [x2], #8
+	eor	w6, w6, w3
+	ldr	w3, [x5], #4
+	eor	w6, w6, w3
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	add	x2, x2, #16
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	sub	x2, x2, #16
+	b	L_AES_set_encrypt_key_end
+L_AES_set_encrypt_key_start_192
+	ldr	w6, [x0]
+	ldr	w7, [x0, #4]
+	ldr	w8, [x0, #8]
+	ldr	w9, [x0, #12]
+	ldr	w10, [x0, #16]
+	ldr	w11, [x0, #20]
+	rev	w6, w6
+	rev	w7, w7
+	rev	w8, w8
+	rev	w9, w9
+	rev	w10, w10
+	rev	w11, w11
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	stnp	w10, w11, [x2, #16]
+	mov	x4, #7
+L_AES_set_encrypt_key_loop_192
+	ubfx	w6, w11, #0, #8
+	ubfx	w7, w11, #8, #8
+	ubfx	w8, w11, #16, #8
+	ubfx	w11, w11, #24, #8
+	lsl	w6, w6, #2
+	lsl	w7, w7, #2
+	lsl	w8, w8, #2
+	lsl	w11, w11, #2
+	ldrb	w6, [x12, x6, LSL 0]
+	ldrb	w7, [x12, x7, LSL 0]
+	ldrb	w8, [x12, x8, LSL 0]
+	ldrb	w11, [x12, x11, LSL 0]
+	eor	w3, w11, w6, lsl 8
+	eor	w3, w3, w7, lsl 16
+	eor	w3, w3, w8, lsl 24
+	ldp	w6, w7, [x2], #8
+	ldp	w8, w9, [x2], #8
+	ldp	w10, w11, [x2], #8
+	eor	w6, w6, w3
+	ldr	w3, [x5], #4
+	eor	w6, w6, w3
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	eor	w10, w10, w9
+	eor	w11, w11, w10
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	stnp	w10, w11, [x2, #16]
+	subs	x4, x4, #1
+	bne	L_AES_set_encrypt_key_loop_192
+	ubfx	w6, w11, #0, #8
+	ubfx	w7, w11, #8, #8
+	ubfx	w8, w11, #16, #8
+	ubfx	w11, w11, #24, #8
+	lsl	w6, w6, #2
+	lsl	w7, w7, #2
+	lsl	w8, w8, #2
+	lsl	w11, w11, #2
+	ldrb	w6, [x12, x6, LSL 0]
+	ldrb	w7, [x12, x7, LSL 0]
+	ldrb	w8, [x12, x8, LSL 0]
+	ldrb	w11, [x12, x11, LSL 0]
+	eor	w3, w11, w6, lsl 8
+	eor	w3, w3, w7, lsl 16
+	eor	w3, w3, w8, lsl 24
+	ldp	w6, w7, [x2], #8
+	ldp	w8, w9, [x2], #8
+	ldp	w10, w11, [x2], #8
+	eor	w6, w6, w3
+	ldr	w3, [x5], #4
+	eor	w6, w6, w3
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	b	L_AES_set_encrypt_key_end
+L_AES_set_encrypt_key_start_128
+	ldr	w6, [x0]
+	ldr	w7, [x0, #4]
+	ldr	w8, [x0, #8]
+	ldr	w9, [x0, #12]
+	rev	w6, w6
+	rev	w7, w7
+	rev	w8, w8
+	rev	w9, w9
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	mov	x4, #10
+L_AES_set_encrypt_key_loop_128
+	ubfx	w6, w9, #0, #8
+	ubfx	w7, w9, #8, #8
+	ubfx	w8, w9, #16, #8
+	ubfx	w9, w9, #24, #8
+	lsl	w6, w6, #2
+	lsl	w7, w7, #2
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	ldrb	w6, [x12, x6, LSL 0]
+	ldrb	w7, [x12, x7, LSL 0]
+	ldrb	w8, [x12, x8, LSL 0]
+	ldrb	w9, [x12, x9, LSL 0]
+	eor	w3, w9, w6, lsl 8
+	eor	w3, w3, w7, lsl 16
+	eor	w3, w3, w8, lsl 24
+	ldp	w6, w7, [x2], #8
+	ldp	w8, w9, [x2], #8
+	eor	w6, w6, w3
+	ldr	w3, [x5], #4
+	eor	w6, w6, w3
+	eor	w7, w7, w6
+	eor	w8, w8, w7
+	eor	w9, w9, w8
+	stp	w6, w7, [x2]
+	stnp	w8, w9, [x2, #8]
+	subs	x4, x4, #1
+	bne	L_AES_set_encrypt_key_loop_128
+L_AES_set_encrypt_key_end
+	ret
+	ENDP
+	IF :DEF:HAVE_AESCCM :LOR: :DEF:HAVE_AESGCM :LOR: :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER :LOR: :DEF:HAVE_AES_ECB
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_ECB_encrypt
+AES_ECB_encrypt PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	adrp	x5, L_AES_ARM64_te
+	add	x5, x5, L_AES_ARM64_te
+L_AES_ECB_encrypt_loop_block_128
+	mov	x17, x3
+	ldr	x6, [x0]
+	ldr	x7, [x0, #8]
+	rev32	x6, x6
+	rev32	x7, x7
+	ldp	x10, x11, [x17], #16
+	; Round: 0 - XOR in key schedule
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	sub	w16, w4, #2
+L_AES_ECB_encrypt_loop_nr
+	ubfx	x10, x6, #48, #8
+	ubfx	x13, x6, #24, #8
+	ubfx	x14, x7, #8, #8
+	ubfx	x15, x7, #32, #8
+	ldr	x8, [x5]
+	ldr	x8, [x5, #64]
+	ldr	x8, [x5, #128]
+	ldr	x8, [x5, #192]
+	ldr	x8, [x5, #256]
+	ldr	x8, [x5, #320]
+	ldr	x8, [x5, #384]
+	ldr	x8, [x5, #448]
+	ldr	x8, [x5, #512]
+	ldr	x8, [x5, #576]
+	ldr	x8, [x5, #640]
+	ldr	x8, [x5, #704]
+	ldr	x8, [x5, #768]
+	ldr	x8, [x5, #832]
+	ldr	x8, [x5, #896]
+	ldr	x8, [x5, #960]
+	ldr	w10, [x5, x10, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x11, x7, #16, #8
+	eor	w10, w10, w13, ror 24
+	ubfx	x13, x6, #56, #8
+	eor	w10, w10, w14, ror 8
+	ubfx	x14, x7, #40, #8
+	eor	w10, w10, w15, ror 16
+	ubfx	x15, x6, #0, #8
+	ldr	w11, [x5, x11, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x12, x7, #48, #8
+	eor	w11, w11, w13, ror 24
+	ubfx	x13, x7, #24, #8
+	eor	w11, w11, w14, ror 8
+	ubfx	x14, x6, #8, #8
+	eor	w11, w11, w15, ror 16
+	ubfx	x15, x6, #32, #8
+	bfi	x10, x11, #32, #32
+	ldr	w12, [x5, x12, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x8, x7, #0, #8
+	eor	w12, w12, w13, ror 24
+	ubfx	x13, x6, #16, #8
+	eor	w12, w12, w14, ror 8
+	ubfx	x14, x7, #56, #8
+	eor	w11, w12, w15, ror 16
+	ubfx	x15, x6, #40, #8
+	ldr	w8, [x5, x8, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	eor	w14, w14, w8, ror 24
+	ldp	x6, x7, [x17], #16
+	eor	w13, w13, w14, ror 24
+	eor	w13, w13, w15, ror 8
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x6
+	eor	x11, x11, x7
+	ubfx	x6, x10, #48, #8
+	ubfx	x9, x10, #24, #8
+	ubfx	x14, x11, #8, #8
+	ubfx	x15, x11, #32, #8
+	ldr	x12, [x5]
+	ldr	x12, [x5, #64]
+	ldr	x12, [x5, #128]
+	ldr	x12, [x5, #192]
+	ldr	x12, [x5, #256]
+	ldr	x12, [x5, #320]
+	ldr	x12, [x5, #384]
+	ldr	x12, [x5, #448]
+	ldr	x12, [x5, #512]
+	ldr	x12, [x5, #576]
+	ldr	x12, [x5, #640]
+	ldr	x12, [x5, #704]
+	ldr	x12, [x5, #768]
+	ldr	x12, [x5, #832]
+	ldr	x12, [x5, #896]
+	ldr	x12, [x5, #960]
+	ldr	w6, [x5, x6, LSL 2]
+	ldr	w9, [x5, x9, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x7, x11, #16, #8
+	eor	w6, w6, w9, ror 24
+	ubfx	x9, x10, #56, #8
+	eor	w6, w6, w14, ror 8
+	ubfx	x14, x11, #40, #8
+	eor	w6, w6, w15, ror 16
+	ubfx	x15, x10, #0, #8
+	ldr	w7, [x5, x7, LSL 2]
+	ldr	w9, [x5, x9, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x8, x11, #48, #8
+	eor	w7, w7, w9, ror 24
+	ubfx	x9, x11, #24, #8
+	eor	w7, w7, w14, ror 8
+	ubfx	x14, x10, #8, #8
+	eor	w7, w7, w15, ror 16
+	ubfx	x15, x10, #32, #8
+	bfi	x6, x7, #32, #32
+	ldr	w8, [x5, x8, LSL 2]
+	ldr	w9, [x5, x9, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x12, x11, #0, #8
+	eor	w8, w8, w9, ror 24
+	ubfx	x9, x10, #16, #8
+	eor	w8, w8, w14, ror 8
+	ubfx	x14, x11, #56, #8
+	eor	w7, w8, w15, ror 16
+	ubfx	x15, x10, #40, #8
+	ldr	w12, [x5, x12, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w9, [x5, x9, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	eor	w14, w14, w12, ror 24
+	ldp	x10, x11, [x17], #16
+	eor	w9, w9, w14, ror 24
+	eor	w9, w9, w15, ror 8
+	bfi	x7, x9, #32, #32
+	;   XOR in Key Schedule
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	subs	w16, w16, #2
+	bne	L_AES_ECB_encrypt_loop_nr
+	ubfx	x10, x6, #48, #8
+	ubfx	x13, x6, #24, #8
+	ubfx	x14, x7, #8, #8
+	ubfx	x15, x7, #32, #8
+	ldr	x8, [x5]
+	ldr	x8, [x5, #64]
+	ldr	x8, [x5, #128]
+	ldr	x8, [x5, #192]
+	ldr	x8, [x5, #256]
+	ldr	x8, [x5, #320]
+	ldr	x8, [x5, #384]
+	ldr	x8, [x5, #448]
+	ldr	x8, [x5, #512]
+	ldr	x8, [x5, #576]
+	ldr	x8, [x5, #640]
+	ldr	x8, [x5, #704]
+	ldr	x8, [x5, #768]
+	ldr	x8, [x5, #832]
+	ldr	x8, [x5, #896]
+	ldr	x8, [x5, #960]
+	ldr	w10, [x5, x10, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x11, x7, #16, #8
+	eor	w10, w10, w13, ror 24
+	ubfx	x13, x6, #56, #8
+	eor	w10, w10, w14, ror 8
+	ubfx	x14, x7, #40, #8
+	eor	w10, w10, w15, ror 16
+	ubfx	x15, x6, #0, #8
+	ldr	w11, [x5, x11, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x12, x7, #48, #8
+	eor	w11, w11, w13, ror 24
+	ubfx	x13, x7, #24, #8
+	eor	w11, w11, w14, ror 8
+	ubfx	x14, x6, #8, #8
+	eor	w11, w11, w15, ror 16
+	ubfx	x15, x6, #32, #8
+	bfi	x10, x11, #32, #32
+	ldr	w12, [x5, x12, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ubfx	x8, x7, #0, #8
+	eor	w12, w12, w13, ror 24
+	ubfx	x13, x6, #16, #8
+	eor	w12, w12, w14, ror 8
+	ubfx	x14, x7, #56, #8
+	eor	w11, w12, w15, ror 16
+	ubfx	x15, x6, #40, #8
+	ldr	w8, [x5, x8, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	eor	w14, w14, w8, ror 24
+	ldp	x6, x7, [x17], #16
+	eor	w13, w13, w14, ror 24
+	eor	w13, w13, w15, ror 8
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x6
+	eor	x11, x11, x7
+	ubfx	x6, x11, #32, #8
+	ubfx	x9, x11, #8, #8
+	ubfx	x14, x10, #48, #8
+	ubfx	x15, x10, #24, #8
+	lsl	w6, w6, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldr	x13, [x5]
+	ldr	x13, [x5, #64]
+	ldr	x13, [x5, #128]
+	ldr	x13, [x5, #192]
+	ldr	x13, [x5, #256]
+	ldr	x13, [x5, #320]
+	ldr	x13, [x5, #384]
+	ldr	x13, [x5, #448]
+	ldr	x13, [x5, #512]
+	ldr	x13, [x5, #576]
+	ldr	x13, [x5, #640]
+	ldr	x13, [x5, #704]
+	ldr	x13, [x5, #768]
+	ldr	x13, [x5, #832]
+	ldr	x13, [x5, #896]
+	ldr	x13, [x5, #960]
+	ldrb	w6, [x5, x6, LSL 0]
+	ldrb	w9, [x5, x9, LSL 0]
+	ldrb	w14, [x5, x14, LSL 0]
+	ldrb	w15, [x5, x15, LSL 0]
+	ubfx	x7, x10, #0, #8
+	eor	w6, w6, w9, lsl 8
+	ubfx	x9, x11, #40, #8
+	eor	w6, w6, w14, lsl 16
+	ubfx	x14, x11, #16, #8
+	eor	w6, w6, w15, lsl 24
+	ubfx	x15, x10, #56, #8
+	lsl	w7, w7, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldrb	w7, [x5, x7, LSL 0]
+	ldrb	w9, [x5, x9, LSL 0]
+	ldrb	w14, [x5, x14, LSL 0]
+	ldrb	w15, [x5, x15, LSL 0]
+	ubfx	x8, x10, #32, #8
+	eor	w7, w7, w9, lsl 8
+	ubfx	x9, x10, #8, #8
+	eor	w7, w7, w14, lsl 16
+	ubfx	x14, x11, #48, #8
+	eor	w7, w7, w15, lsl 24
+	ubfx	x15, x11, #24, #8
+	bfi	x6, x7, #32, #32
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldrb	w8, [x5, x8, LSL 0]
+	ldrb	w9, [x5, x9, LSL 0]
+	ldrb	w14, [x5, x14, LSL 0]
+	ldrb	w15, [x5, x15, LSL 0]
+	ubfx	x13, x11, #56, #8
+	eor	w8, w8, w9, lsl 8
+	ubfx	x9, x11, #0, #8
+	eor	w8, w8, w14, lsl 16
+	ubfx	x14, x10, #40, #8
+	eor	w7, w8, w15, lsl 24
+	ubfx	x15, x10, #16, #8
+	lsl	w13, w13, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldrb	w13, [x5, x13, LSL 0]
+	ldrb	w9, [x5, x9, LSL 0]
+	ldrb	w14, [x5, x14, LSL 0]
+	ldrb	w15, [x5, x15, LSL 0]
+	eor	w14, w14, w13, lsl 16
+	ldp	x10, x11, [x17]
+	eor	w9, w9, w14, lsl 8
+	eor	w9, w9, w15, lsl 16
+	bfi	x7, x9, #32, #32
+	;   XOR in Key Schedule
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	rev32	x6, x6
+	rev32	x7, x7
+	str	x6, [x1]
+	str	x7, [x1, #8]
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_ECB_encrypt_loop_block_128
+	ldr	x17, [x29, #24]
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:HAVE_AES_CBC
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CBC_encrypt
+AES_CBC_encrypt PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	adrp	x6, L_AES_ARM64_te
+	add	x6, x6, L_AES_ARM64_te
+	ldp	x7, x8, [x5]
+L_AES_CBC_encrypt_loop_block
+	mov	x19, x3
+	ldr	x11, [x0]
+	ldr	x12, [x0, #8]
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	rev32	x7, x7
+	rev32	x8, x8
+	ldp	x11, x12, [x19], #16
+	; Round: 0 - XOR in key schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	sub	w17, w4, #2
+L_AES_CBC_encrypt_loop_nr
+	ubfx	x11, x7, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x15, x8, #8, #8
+	ubfx	x16, x8, #32, #8
+	ldr	x9, [x6]
+	ldr	x9, [x6, #64]
+	ldr	x9, [x6, #128]
+	ldr	x9, [x6, #192]
+	ldr	x9, [x6, #256]
+	ldr	x9, [x6, #320]
+	ldr	x9, [x6, #384]
+	ldr	x9, [x6, #448]
+	ldr	x9, [x6, #512]
+	ldr	x9, [x6, #576]
+	ldr	x9, [x6, #640]
+	ldr	x9, [x6, #704]
+	ldr	x9, [x6, #768]
+	ldr	x9, [x6, #832]
+	ldr	x9, [x6, #896]
+	ldr	x9, [x6, #960]
+	ldr	w11, [x6, x11, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x12, x8, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w15, ror 8
+	ubfx	x15, x8, #40, #8
+	eor	w11, w11, w16, ror 16
+	ubfx	x16, x7, #0, #8
+	ldr	w12, [x6, x12, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x13, x8, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w15, ror 8
+	ubfx	x15, x7, #8, #8
+	eor	w12, w12, w16, ror 16
+	ubfx	x16, x7, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x9, x8, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x7, #16, #8
+	eor	w13, w13, w15, ror 8
+	ubfx	x15, x8, #56, #8
+	eor	w12, w13, w16, ror 16
+	ubfx	x16, x7, #40, #8
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	eor	w15, w15, w9, ror 24
+	ldp	x7, x8, [x19], #16
+	eor	w14, w14, w15, ror 24
+	eor	w14, w14, w16, ror 8
+	bfi	x12, x14, #32, #32
+	;   XOR in Key Schedule
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x11, #48, #8
+	ubfx	x10, x11, #24, #8
+	ubfx	x15, x12, #8, #8
+	ubfx	x16, x12, #32, #8
+	ldr	x13, [x6]
+	ldr	x13, [x6, #64]
+	ldr	x13, [x6, #128]
+	ldr	x13, [x6, #192]
+	ldr	x13, [x6, #256]
+	ldr	x13, [x6, #320]
+	ldr	x13, [x6, #384]
+	ldr	x13, [x6, #448]
+	ldr	x13, [x6, #512]
+	ldr	x13, [x6, #576]
+	ldr	x13, [x6, #640]
+	ldr	x13, [x6, #704]
+	ldr	x13, [x6, #768]
+	ldr	x13, [x6, #832]
+	ldr	x13, [x6, #896]
+	ldr	x13, [x6, #960]
+	ldr	w7, [x6, x7, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x8, x12, #16, #8
+	eor	w7, w7, w10, ror 24
+	ubfx	x10, x11, #56, #8
+	eor	w7, w7, w15, ror 8
+	ubfx	x15, x12, #40, #8
+	eor	w7, w7, w16, ror 16
+	ubfx	x16, x11, #0, #8
+	ldr	w8, [x6, x8, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x9, x12, #48, #8
+	eor	w8, w8, w10, ror 24
+	ubfx	x10, x12, #24, #8
+	eor	w8, w8, w15, ror 8
+	ubfx	x15, x11, #8, #8
+	eor	w8, w8, w16, ror 16
+	ubfx	x16, x11, #32, #8
+	bfi	x7, x8, #32, #32
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x13, x12, #0, #8
+	eor	w9, w9, w10, ror 24
+	ubfx	x10, x11, #16, #8
+	eor	w9, w9, w15, ror 8
+	ubfx	x15, x12, #56, #8
+	eor	w8, w9, w16, ror 16
+	ubfx	x16, x11, #40, #8
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	eor	w15, w15, w13, ror 24
+	ldp	x11, x12, [x19], #16
+	eor	w10, w10, w15, ror 24
+	eor	w10, w10, w16, ror 8
+	bfi	x8, x10, #32, #32
+	;   XOR in Key Schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	subs	w17, w17, #2
+	bne	L_AES_CBC_encrypt_loop_nr
+	ubfx	x11, x7, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x15, x8, #8, #8
+	ubfx	x16, x8, #32, #8
+	ldr	x9, [x6]
+	ldr	x9, [x6, #64]
+	ldr	x9, [x6, #128]
+	ldr	x9, [x6, #192]
+	ldr	x9, [x6, #256]
+	ldr	x9, [x6, #320]
+	ldr	x9, [x6, #384]
+	ldr	x9, [x6, #448]
+	ldr	x9, [x6, #512]
+	ldr	x9, [x6, #576]
+	ldr	x9, [x6, #640]
+	ldr	x9, [x6, #704]
+	ldr	x9, [x6, #768]
+	ldr	x9, [x6, #832]
+	ldr	x9, [x6, #896]
+	ldr	x9, [x6, #960]
+	ldr	w11, [x6, x11, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x12, x8, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w15, ror 8
+	ubfx	x15, x8, #40, #8
+	eor	w11, w11, w16, ror 16
+	ubfx	x16, x7, #0, #8
+	ldr	w12, [x6, x12, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x13, x8, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w15, ror 8
+	ubfx	x15, x7, #8, #8
+	eor	w12, w12, w16, ror 16
+	ubfx	x16, x7, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	ubfx	x9, x8, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x7, #16, #8
+	eor	w13, w13, w15, ror 8
+	ubfx	x15, x8, #56, #8
+	eor	w12, w13, w16, ror 16
+	ubfx	x16, x7, #40, #8
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w15, [x6, x15, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w16, [x6, x16, LSL 2]
+	eor	w15, w15, w9, ror 24
+	ldp	x7, x8, [x19], #16
+	eor	w14, w14, w15, ror 24
+	eor	w14, w14, w16, ror 8
+	bfi	x12, x14, #32, #32
+	;   XOR in Key Schedule
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x12, #32, #8
+	ubfx	x10, x12, #8, #8
+	ubfx	x15, x11, #48, #8
+	ubfx	x16, x11, #24, #8
+	lsl	w7, w7, #2
+	lsl	w10, w10, #2
+	lsl	w15, w15, #2
+	lsl	w16, w16, #2
+	ldr	x14, [x6]
+	ldr	x14, [x6, #64]
+	ldr	x14, [x6, #128]
+	ldr	x14, [x6, #192]
+	ldr	x14, [x6, #256]
+	ldr	x14, [x6, #320]
+	ldr	x14, [x6, #384]
+	ldr	x14, [x6, #448]
+	ldr	x14, [x6, #512]
+	ldr	x14, [x6, #576]
+	ldr	x14, [x6, #640]
+	ldr	x14, [x6, #704]
+	ldr	x14, [x6, #768]
+	ldr	x14, [x6, #832]
+	ldr	x14, [x6, #896]
+	ldr	x14, [x6, #960]
+	ldrb	w7, [x6, x7, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x8, x11, #0, #8
+	eor	w7, w7, w10, lsl 8
+	ubfx	x10, x12, #40, #8
+	eor	w7, w7, w15, lsl 16
+	ubfx	x15, x12, #16, #8
+	eor	w7, w7, w16, lsl 24
+	ubfx	x16, x11, #56, #8
+	lsl	w8, w8, #2
+	lsl	w10, w10, #2
+	lsl	w15, w15, #2
+	lsl	w16, w16, #2
+	ldrb	w8, [x6, x8, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x9, x11, #32, #8
+	eor	w8, w8, w10, lsl 8
+	ubfx	x10, x11, #8, #8
+	eor	w8, w8, w15, lsl 16
+	ubfx	x15, x12, #48, #8
+	eor	w8, w8, w16, lsl 24
+	ubfx	x16, x12, #24, #8
+	bfi	x7, x8, #32, #32
+	lsl	w9, w9, #2
+	lsl	w10, w10, #2
+	lsl	w15, w15, #2
+	lsl	w16, w16, #2
+	ldrb	w9, [x6, x9, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x14, x12, #56, #8
+	eor	w9, w9, w10, lsl 8
+	ubfx	x10, x12, #0, #8
+	eor	w9, w9, w15, lsl 16
+	ubfx	x15, x11, #40, #8
+	eor	w8, w9, w16, lsl 24
+	ubfx	x16, x11, #16, #8
+	lsl	w14, w14, #2
+	lsl	w10, w10, #2
+	lsl	w15, w15, #2
+	lsl	w16, w16, #2
+	ldrb	w14, [x6, x14, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	eor	w15, w15, w14, lsl 16
+	ldp	x11, x12, [x19]
+	eor	w10, w10, w15, lsl 8
+	eor	w10, w10, w16, lsl 16
+	bfi	x8, x10, #32, #32
+	;   XOR in Key Schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	rev32	x7, x7
+	rev32	x8, x8
+	str	x7, [x1]
+	str	x8, [x1, #8]
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_CBC_encrypt_loop_block
+	stp	x7, x8, [x5]
+	ldp	x17, x19, [x29, #16]
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:WOLFSSL_AES_COUNTER
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CTR_encrypt
+AES_CTR_encrypt PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	adrp	x6, L_AES_ARM64_te
+	add	x6, x6, L_AES_ARM64_te
+	ldp	x15, x16, [x5]
+	rev32	x15, x15
+	rev32	x16, x16
+L_AES_CTR_encrypt_loop_block_128
+	mov	x21, x3
+	ldp	x11, x12, [x21], #16
+	; Round: 0 - XOR in key schedule
+	eor	x7, x15, x11
+	eor	x8, x16, x12
+	sub	w20, w4, #2
+L_AES_CTR_encrypt_loop_nr
+	ubfx	x11, x7, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x17, x8, #8, #8
+	ubfx	x19, x8, #32, #8
+	ldr	x9, [x6]
+	ldr	x9, [x6, #64]
+	ldr	x9, [x6, #128]
+	ldr	x9, [x6, #192]
+	ldr	x9, [x6, #256]
+	ldr	x9, [x6, #320]
+	ldr	x9, [x6, #384]
+	ldr	x9, [x6, #448]
+	ldr	x9, [x6, #512]
+	ldr	x9, [x6, #576]
+	ldr	x9, [x6, #640]
+	ldr	x9, [x6, #704]
+	ldr	x9, [x6, #768]
+	ldr	x9, [x6, #832]
+	ldr	x9, [x6, #896]
+	ldr	x9, [x6, #960]
+	ldr	w11, [x6, x11, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x12, x8, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w17, ror 8
+	ubfx	x17, x8, #40, #8
+	eor	w11, w11, w19, ror 16
+	ubfx	x19, x7, #0, #8
+	ldr	w12, [x6, x12, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x13, x8, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w17, ror 8
+	ubfx	x17, x7, #8, #8
+	eor	w12, w12, w19, ror 16
+	ubfx	x19, x7, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x9, x8, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x7, #16, #8
+	eor	w13, w13, w17, ror 8
+	ubfx	x17, x8, #56, #8
+	eor	w12, w13, w19, ror 16
+	ubfx	x19, x7, #40, #8
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	eor	w17, w17, w9, ror 24
+	ldp	x7, x8, [x21], #16
+	eor	w14, w14, w17, ror 24
+	eor	w14, w14, w19, ror 8
+	bfi	x12, x14, #32, #32
+	;   XOR in Key Schedule
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x11, #48, #8
+	ubfx	x10, x11, #24, #8
+	ubfx	x17, x12, #8, #8
+	ubfx	x19, x12, #32, #8
+	ldr	x13, [x6]
+	ldr	x13, [x6, #64]
+	ldr	x13, [x6, #128]
+	ldr	x13, [x6, #192]
+	ldr	x13, [x6, #256]
+	ldr	x13, [x6, #320]
+	ldr	x13, [x6, #384]
+	ldr	x13, [x6, #448]
+	ldr	x13, [x6, #512]
+	ldr	x13, [x6, #576]
+	ldr	x13, [x6, #640]
+	ldr	x13, [x6, #704]
+	ldr	x13, [x6, #768]
+	ldr	x13, [x6, #832]
+	ldr	x13, [x6, #896]
+	ldr	x13, [x6, #960]
+	ldr	w7, [x6, x7, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x8, x12, #16, #8
+	eor	w7, w7, w10, ror 24
+	ubfx	x10, x11, #56, #8
+	eor	w7, w7, w17, ror 8
+	ubfx	x17, x12, #40, #8
+	eor	w7, w7, w19, ror 16
+	ubfx	x19, x11, #0, #8
+	ldr	w8, [x6, x8, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x9, x12, #48, #8
+	eor	w8, w8, w10, ror 24
+	ubfx	x10, x12, #24, #8
+	eor	w8, w8, w17, ror 8
+	ubfx	x17, x11, #8, #8
+	eor	w8, w8, w19, ror 16
+	ubfx	x19, x11, #32, #8
+	bfi	x7, x8, #32, #32
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x13, x12, #0, #8
+	eor	w9, w9, w10, ror 24
+	ubfx	x10, x11, #16, #8
+	eor	w9, w9, w17, ror 8
+	ubfx	x17, x12, #56, #8
+	eor	w8, w9, w19, ror 16
+	ubfx	x19, x11, #40, #8
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w10, [x6, x10, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	eor	w17, w17, w13, ror 24
+	ldp	x11, x12, [x21], #16
+	eor	w10, w10, w17, ror 24
+	eor	w10, w10, w19, ror 8
+	bfi	x8, x10, #32, #32
+	;   XOR in Key Schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	subs	w20, w20, #2
+	bne	L_AES_CTR_encrypt_loop_nr
+	ubfx	x11, x7, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x17, x8, #8, #8
+	ubfx	x19, x8, #32, #8
+	ldr	x9, [x6]
+	ldr	x9, [x6, #64]
+	ldr	x9, [x6, #128]
+	ldr	x9, [x6, #192]
+	ldr	x9, [x6, #256]
+	ldr	x9, [x6, #320]
+	ldr	x9, [x6, #384]
+	ldr	x9, [x6, #448]
+	ldr	x9, [x6, #512]
+	ldr	x9, [x6, #576]
+	ldr	x9, [x6, #640]
+	ldr	x9, [x6, #704]
+	ldr	x9, [x6, #768]
+	ldr	x9, [x6, #832]
+	ldr	x9, [x6, #896]
+	ldr	x9, [x6, #960]
+	ldr	w11, [x6, x11, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x12, x8, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w17, ror 8
+	ubfx	x17, x8, #40, #8
+	eor	w11, w11, w19, ror 16
+	ubfx	x19, x7, #0, #8
+	ldr	w12, [x6, x12, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x13, x8, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w17, ror 8
+	ubfx	x17, x7, #8, #8
+	eor	w12, w12, w19, ror 16
+	ubfx	x19, x7, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x6, x13, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	ubfx	x9, x8, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x7, #16, #8
+	eor	w13, w13, w17, ror 8
+	ubfx	x17, x8, #56, #8
+	eor	w12, w13, w19, ror 16
+	ubfx	x19, x7, #40, #8
+	ldr	w9, [x6, x9, LSL 2]
+	ldr	w17, [x6, x17, LSL 2]
+	ldr	w14, [x6, x14, LSL 2]
+	ldr	w19, [x6, x19, LSL 2]
+	eor	w17, w17, w9, ror 24
+	ldp	x7, x8, [x21], #16
+	eor	w14, w14, w17, ror 24
+	eor	w14, w14, w19, ror 8
+	bfi	x12, x14, #32, #32
+	;   XOR in Key Schedule
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x12, #32, #8
+	ubfx	x10, x12, #8, #8
+	ubfx	x17, x11, #48, #8
+	ubfx	x19, x11, #24, #8
+	lsl	w7, w7, #2
+	lsl	w10, w10, #2
+	lsl	w17, w17, #2
+	lsl	w19, w19, #2
+	ldr	x14, [x6]
+	ldr	x14, [x6, #64]
+	ldr	x14, [x6, #128]
+	ldr	x14, [x6, #192]
+	ldr	x14, [x6, #256]
+	ldr	x14, [x6, #320]
+	ldr	x14, [x6, #384]
+	ldr	x14, [x6, #448]
+	ldr	x14, [x6, #512]
+	ldr	x14, [x6, #576]
+	ldr	x14, [x6, #640]
+	ldr	x14, [x6, #704]
+	ldr	x14, [x6, #768]
+	ldr	x14, [x6, #832]
+	ldr	x14, [x6, #896]
+	ldr	x14, [x6, #960]
+	ldrb	w7, [x6, x7, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	ubfx	x8, x11, #0, #8
+	eor	w7, w7, w10, lsl 8
+	ubfx	x10, x12, #40, #8
+	eor	w7, w7, w17, lsl 16
+	ubfx	x17, x12, #16, #8
+	eor	w7, w7, w19, lsl 24
+	ubfx	x19, x11, #56, #8
+	lsl	w8, w8, #2
+	lsl	w10, w10, #2
+	lsl	w17, w17, #2
+	lsl	w19, w19, #2
+	ldrb	w8, [x6, x8, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	ubfx	x9, x11, #32, #8
+	eor	w8, w8, w10, lsl 8
+	ubfx	x10, x11, #8, #8
+	eor	w8, w8, w17, lsl 16
+	ubfx	x17, x12, #48, #8
+	eor	w8, w8, w19, lsl 24
+	ubfx	x19, x12, #24, #8
+	bfi	x7, x8, #32, #32
+	lsl	w9, w9, #2
+	lsl	w10, w10, #2
+	lsl	w17, w17, #2
+	lsl	w19, w19, #2
+	ldrb	w9, [x6, x9, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	ubfx	x14, x12, #56, #8
+	eor	w9, w9, w10, lsl 8
+	ubfx	x10, x12, #0, #8
+	eor	w9, w9, w17, lsl 16
+	ubfx	x17, x11, #40, #8
+	eor	w8, w9, w19, lsl 24
+	ubfx	x19, x11, #16, #8
+	lsl	w14, w14, #2
+	lsl	w10, w10, #2
+	lsl	w17, w17, #2
+	lsl	w19, w19, #2
+	ldrb	w14, [x6, x14, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w19, [x6, x19, LSL 0]
+	eor	w17, w17, w14, lsl 16
+	ldp	x11, x12, [x21]
+	eor	w10, w10, w17, lsl 8
+	eor	w10, w10, w19, lsl 16
+	bfi	x8, x10, #32, #32
+	;   XOR in Key Schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	rev32	x7, x7
+	rev32	x8, x8
+	ldr	x11, [x0]
+	ldr	x12, [x0, #8]
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	str	x7, [x1]
+	str	x8, [x1, #8]
+	ror	x16, x16, #32
+	ror	x15, x15, #32
+	adds	x16, x16, #1
+	adc	x15, x15, xzr
+	ror	x16, x16, #32
+	ror	x15, x15, #32
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_CTR_encrypt_loop_block_128
+	rev32	x15, x15
+	rev32	x16, x16
+	stp	x15, x16, [x5]
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:HAVE_AES_DECRYPT
+	IF :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER :LOR: :DEF:HAVE_AES_CBC :LOR: :DEF:HAVE_AES_ECB
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_AES_ARM64_td4
+	DCB	0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38
+	DCB	0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb
+	DCB	0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87
+	DCB	0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb
+	DCB	0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d
+	DCB	0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e
+	DCB	0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2
+	DCB	0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25
+	DCB	0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16
+	DCB	0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92
+	DCB	0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda
+	DCB	0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84
+	DCB	0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a
+	DCB	0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06
+	DCB	0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02
+	DCB	0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b
+	DCB	0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea
+	DCB	0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73
+	DCB	0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85
+	DCB	0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e
+	DCB	0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89
+	DCB	0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b
+	DCB	0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20
+	DCB	0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4
+	DCB	0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31
+	DCB	0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f
+	DCB	0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d
+	DCB	0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef
+	DCB	0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0
+	DCB	0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61
+	DCB	0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26
+	DCB	0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d
+	IF :DEF:WOLFSSL_AES_DIRECT :LOR: :DEF:WOLFSSL_AES_COUNTER :LOR: :DEF:HAVE_AES_ECB
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_ECB_decrypt
+AES_ECB_decrypt PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	adrp	x5, L_AES_ARM64_td
+	add	x5, x5, L_AES_ARM64_td
+	adrp	x6, L_AES_ARM64_td4
+	add	x6, x6, L_AES_ARM64_td4
+L_AES_ECB_decrypt_loop_block
+	mov	x19, x3
+	ldr	x7, [x0]
+	ldr	x8, [x0, #8]
+	rev32	x7, x7
+	rev32	x8, x8
+	ldp	x11, x12, [x19], #16
+	; Round: 0 - XOR in key schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	sub	w17, w4, #2
+L_AES_ECB_decrypt_loop_nr
+	ubfx	x11, x8, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x15, x8, #8, #8
+	ubfx	x16, x7, #32, #8
+	ldr	x9, [x5]
+	ldr	x9, [x5, #64]
+	ldr	x9, [x5, #128]
+	ldr	x9, [x5, #192]
+	ldr	x9, [x5, #256]
+	ldr	x9, [x5, #320]
+	ldr	x9, [x5, #384]
+	ldr	x9, [x5, #448]
+	ldr	x9, [x5, #512]
+	ldr	x9, [x5, #576]
+	ldr	x9, [x5, #640]
+	ldr	x9, [x5, #704]
+	ldr	x9, [x5, #768]
+	ldr	x9, [x5, #832]
+	ldr	x9, [x5, #896]
+	ldr	x9, [x5, #960]
+	ldr	w11, [x5, x11, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x12, x7, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w15, ror 8
+	ubfx	x15, x8, #40, #8
+	eor	w11, w11, w16, ror 16
+	ubfx	x16, x8, #0, #8
+	ldr	w12, [x5, x12, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x13, x7, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w15, ror 8
+	ubfx	x15, x7, #8, #8
+	eor	w12, w12, w16, ror 16
+	ubfx	x16, x8, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x9, x7, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x8, #16, #8
+	eor	w13, w13, w15, ror 8
+	ubfx	x15, x8, #56, #8
+	eor	w12, w13, w16, ror 16
+	ubfx	x16, x7, #40, #8
+	ldr	w9, [x5, x9, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	eor	w15, w15, w9, ror 24
+	ldp	x7, x8, [x19], #16
+	eor	w14, w14, w16, ror 8
+	eor	w14, w14, w15, ror 24
+	bfi	x12, x14, #32, #32
+	;   XOR in Key Schedule
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x12, #48, #8
+	ubfx	x10, x11, #24, #8
+	ubfx	x15, x12, #8, #8
+	ubfx	x16, x11, #32, #8
+	ldr	x13, [x5]
+	ldr	x13, [x5, #64]
+	ldr	x13, [x5, #128]
+	ldr	x13, [x5, #192]
+	ldr	x13, [x5, #256]
+	ldr	x13, [x5, #320]
+	ldr	x13, [x5, #384]
+	ldr	x13, [x5, #448]
+	ldr	x13, [x5, #512]
+	ldr	x13, [x5, #576]
+	ldr	x13, [x5, #640]
+	ldr	x13, [x5, #704]
+	ldr	x13, [x5, #768]
+	ldr	x13, [x5, #832]
+	ldr	x13, [x5, #896]
+	ldr	x13, [x5, #960]
+	ldr	w7, [x5, x7, LSL 2]
+	ldr	w10, [x5, x10, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x8, x11, #16, #8
+	eor	w7, w7, w10, ror 24
+	ubfx	x10, x11, #56, #8
+	eor	w7, w7, w15, ror 8
+	ubfx	x15, x12, #40, #8
+	eor	w7, w7, w16, ror 16
+	ubfx	x16, x12, #0, #8
+	ldr	w8, [x5, x8, LSL 2]
+	ldr	w10, [x5, x10, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x9, x11, #48, #8
+	eor	w8, w8, w10, ror 24
+	ubfx	x10, x12, #24, #8
+	eor	w8, w8, w15, ror 8
+	ubfx	x15, x11, #8, #8
+	eor	w8, w8, w16, ror 16
+	ubfx	x16, x12, #32, #8
+	bfi	x7, x8, #32, #32
+	ldr	w9, [x5, x9, LSL 2]
+	ldr	w10, [x5, x10, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x13, x11, #0, #8
+	eor	w9, w9, w10, ror 24
+	ubfx	x10, x12, #16, #8
+	eor	w9, w9, w15, ror 8
+	ubfx	x15, x12, #56, #8
+	eor	w8, w9, w16, ror 16
+	ubfx	x16, x11, #40, #8
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w10, [x5, x10, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	eor	w15, w15, w13, ror 24
+	ldp	x11, x12, [x19], #16
+	eor	w10, w10, w16, ror 8
+	eor	w10, w10, w15, ror 24
+	bfi	x8, x10, #32, #32
+	;   XOR in Key Schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	subs	w17, w17, #2
+	bne	L_AES_ECB_decrypt_loop_nr
+	ubfx	x11, x8, #48, #8
+	ubfx	x14, x7, #24, #8
+	ubfx	x15, x8, #8, #8
+	ubfx	x16, x7, #32, #8
+	ldr	x9, [x5]
+	ldr	x9, [x5, #64]
+	ldr	x9, [x5, #128]
+	ldr	x9, [x5, #192]
+	ldr	x9, [x5, #256]
+	ldr	x9, [x5, #320]
+	ldr	x9, [x5, #384]
+	ldr	x9, [x5, #448]
+	ldr	x9, [x5, #512]
+	ldr	x9, [x5, #576]
+	ldr	x9, [x5, #640]
+	ldr	x9, [x5, #704]
+	ldr	x9, [x5, #768]
+	ldr	x9, [x5, #832]
+	ldr	x9, [x5, #896]
+	ldr	x9, [x5, #960]
+	ldr	w11, [x5, x11, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x12, x7, #16, #8
+	eor	w11, w11, w14, ror 24
+	ubfx	x14, x7, #56, #8
+	eor	w11, w11, w15, ror 8
+	ubfx	x15, x8, #40, #8
+	eor	w11, w11, w16, ror 16
+	ubfx	x16, x8, #0, #8
+	ldr	w12, [x5, x12, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x13, x7, #48, #8
+	eor	w12, w12, w14, ror 24
+	ubfx	x14, x8, #24, #8
+	eor	w12, w12, w15, ror 8
+	ubfx	x15, x7, #8, #8
+	eor	w12, w12, w16, ror 16
+	ubfx	x16, x8, #32, #8
+	bfi	x11, x12, #32, #32
+	ldr	w13, [x5, x13, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	ubfx	x9, x7, #0, #8
+	eor	w13, w13, w14, ror 24
+	ubfx	x14, x8, #16, #8
+	eor	w13, w13, w15, ror 8
+	ubfx	x15, x8, #56, #8
+	eor	w12, w13, w16, ror 16
+	ubfx	x16, x7, #40, #8
+	ldr	w9, [x5, x9, LSL 2]
+	ldr	w15, [x5, x15, LSL 2]
+	ldr	w14, [x5, x14, LSL 2]
+	ldr	w16, [x5, x16, LSL 2]
+	eor	w15, w15, w9, ror 24
+	ldp	x7, x8, [x19], #16
+	eor	w14, w14, w16, ror 8
+	eor	w14, w14, w15, ror 24
+	bfi	x12, x14, #32, #32
+	;   XOR in Key Schedule
+	eor	x11, x11, x7
+	eor	x12, x12, x8
+	ubfx	x7, x11, #32, #8
+	ubfx	x10, x12, #8, #8
+	ubfx	x15, x12, #48, #8
+	ubfx	x16, x11, #24, #8
+	ldr	x14, [x6]
+	ldr	x14, [x6, #64]
+	ldr	x14, [x6, #128]
+	ldr	x14, [x6, #192]
+	ldrb	w7, [x6, x7, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x8, x12, #0, #8
+	eor	w7, w7, w10, lsl 8
+	ubfx	x10, x12, #40, #8
+	eor	w7, w7, w15, lsl 16
+	ubfx	x15, x11, #16, #8
+	eor	w7, w7, w16, lsl 24
+	ubfx	x16, x11, #56, #8
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ldrb	w8, [x6, x8, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ubfx	x9, x12, #32, #8
+	eor	w8, w8, w10, lsl 8
+	ubfx	x10, x11, #8, #8
+	eor	w8, w8, w15, lsl 16
+	ubfx	x15, x11, #48, #8
+	eor	w8, w8, w16, lsl 24
+	ubfx	x16, x12, #24, #8
+	bfi	x7, x8, #32, #32
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ldrb	w9, [x6, x9, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ubfx	x14, x12, #56, #8
+	eor	w9, w9, w10, lsl 8
+	ubfx	x10, x11, #0, #8
+	eor	w9, w9, w15, lsl 16
+	ubfx	x15, x11, #40, #8
+	eor	w8, w9, w16, lsl 24
+	ubfx	x16, x12, #16, #8
+	ldrb	w14, [x6, x14, LSL 0]
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	eor	w15, w15, w14, lsl 16
+	ldp	x11, x12, [x19]
+	eor	w10, w10, w15, lsl 8
+	eor	w10, w10, w16, lsl 16
+	bfi	x8, x10, #32, #32
+	;   XOR in Key Schedule
+	eor	x7, x7, x11
+	eor	x8, x8, x12
+	rev32	x7, x7
+	rev32	x8, x8
+	str	x7, [x1]
+	str	x8, [x1, #8]
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_ECB_decrypt_loop_block
+	ldp	x17, x19, [x29, #16]
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:HAVE_AES_CBC
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_CBC_decrypt
+AES_CBC_decrypt PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	str	x20, [x29, #40]
+	adrp	x6, L_AES_ARM64_td4
+	add	x6, x6, L_AES_ARM64_td4
+	adrp	x7, L_AES_ARM64_td
+	add	x7, x7, L_AES_ARM64_td
+L_AES_CBC_decrypt_loop_block
+	mov	x20, x3
+	ldr	x8, [x0]
+	ldr	x9, [x0, #8]
+	stnp	x8, x9, [x5, #16]
+	rev32	x8, x8
+	rev32	x9, x9
+	ldp	x12, x13, [x20], #16
+	; Round: 0 - XOR in key schedule
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	sub	w19, w4, #2
+L_AES_CBC_decrypt_loop_nr_even
+	ubfx	x12, x9, #48, #8
+	ubfx	x15, x8, #24, #8
+	ubfx	x16, x9, #8, #8
+	ubfx	x17, x8, #32, #8
+	ldr	x10, [x7]
+	ldr	x10, [x7, #64]
+	ldr	x10, [x7, #128]
+	ldr	x10, [x7, #192]
+	ldr	x10, [x7, #256]
+	ldr	x10, [x7, #320]
+	ldr	x10, [x7, #384]
+	ldr	x10, [x7, #448]
+	ldr	x10, [x7, #512]
+	ldr	x10, [x7, #576]
+	ldr	x10, [x7, #640]
+	ldr	x10, [x7, #704]
+	ldr	x10, [x7, #768]
+	ldr	x10, [x7, #832]
+	ldr	x10, [x7, #896]
+	ldr	x10, [x7, #960]
+	ldr	w12, [x7, x12, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x13, x8, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x8, #56, #8
+	eor	w12, w12, w16, ror 8
+	ubfx	x16, x9, #40, #8
+	eor	w12, w12, w17, ror 16
+	ubfx	x17, x9, #0, #8
+	ldr	w13, [x7, x13, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x14, x8, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x9, #24, #8
+	eor	w13, w13, w16, ror 8
+	ubfx	x16, x8, #8, #8
+	eor	w13, w13, w17, ror 16
+	ubfx	x17, x9, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x7, x14, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x10, x8, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x9, #16, #8
+	eor	w14, w14, w16, ror 8
+	ubfx	x16, x9, #56, #8
+	eor	w13, w14, w17, ror 16
+	ubfx	x17, x8, #40, #8
+	ldr	w10, [x7, x10, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	eor	w16, w16, w10, ror 24
+	ldp	x8, x9, [x20], #16
+	eor	w15, w15, w17, ror 8
+	eor	w15, w15, w16, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x8
+	eor	x13, x13, x9
+	ubfx	x8, x13, #48, #8
+	ubfx	x11, x12, #24, #8
+	ubfx	x16, x13, #8, #8
+	ubfx	x17, x12, #32, #8
+	ldr	x14, [x7]
+	ldr	x14, [x7, #64]
+	ldr	x14, [x7, #128]
+	ldr	x14, [x7, #192]
+	ldr	x14, [x7, #256]
+	ldr	x14, [x7, #320]
+	ldr	x14, [x7, #384]
+	ldr	x14, [x7, #448]
+	ldr	x14, [x7, #512]
+	ldr	x14, [x7, #576]
+	ldr	x14, [x7, #640]
+	ldr	x14, [x7, #704]
+	ldr	x14, [x7, #768]
+	ldr	x14, [x7, #832]
+	ldr	x14, [x7, #896]
+	ldr	x14, [x7, #960]
+	ldr	w8, [x7, x8, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x9, x12, #16, #8
+	eor	w8, w8, w11, ror 24
+	ubfx	x11, x12, #56, #8
+	eor	w8, w8, w16, ror 8
+	ubfx	x16, x13, #40, #8
+	eor	w8, w8, w17, ror 16
+	ubfx	x17, x13, #0, #8
+	ldr	w9, [x7, x9, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x10, x12, #48, #8
+	eor	w9, w9, w11, ror 24
+	ubfx	x11, x13, #24, #8
+	eor	w9, w9, w16, ror 8
+	ubfx	x16, x12, #8, #8
+	eor	w9, w9, w17, ror 16
+	ubfx	x17, x13, #32, #8
+	bfi	x8, x9, #32, #32
+	ldr	w10, [x7, x10, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w10, w10, w11, ror 24
+	ubfx	x11, x13, #16, #8
+	eor	w10, w10, w16, ror 8
+	ubfx	x16, x13, #56, #8
+	eor	w9, w10, w17, ror 16
+	ubfx	x17, x12, #40, #8
+	ldr	w14, [x7, x14, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	eor	w16, w16, w14, ror 24
+	ldp	x12, x13, [x20], #16
+	eor	w11, w11, w17, ror 8
+	eor	w11, w11, w16, ror 24
+	bfi	x9, x11, #32, #32
+	;   XOR in Key Schedule
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	subs	w19, w19, #2
+	bne	L_AES_CBC_decrypt_loop_nr_even
+	ubfx	x12, x9, #48, #8
+	ubfx	x15, x8, #24, #8
+	ubfx	x16, x9, #8, #8
+	ubfx	x17, x8, #32, #8
+	ldr	x10, [x7]
+	ldr	x10, [x7, #64]
+	ldr	x10, [x7, #128]
+	ldr	x10, [x7, #192]
+	ldr	x10, [x7, #256]
+	ldr	x10, [x7, #320]
+	ldr	x10, [x7, #384]
+	ldr	x10, [x7, #448]
+	ldr	x10, [x7, #512]
+	ldr	x10, [x7, #576]
+	ldr	x10, [x7, #640]
+	ldr	x10, [x7, #704]
+	ldr	x10, [x7, #768]
+	ldr	x10, [x7, #832]
+	ldr	x10, [x7, #896]
+	ldr	x10, [x7, #960]
+	ldr	w12, [x7, x12, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x13, x8, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x8, #56, #8
+	eor	w12, w12, w16, ror 8
+	ubfx	x16, x9, #40, #8
+	eor	w12, w12, w17, ror 16
+	ubfx	x17, x9, #0, #8
+	ldr	w13, [x7, x13, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x14, x8, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x9, #24, #8
+	eor	w13, w13, w16, ror 8
+	ubfx	x16, x8, #8, #8
+	eor	w13, w13, w17, ror 16
+	ubfx	x17, x9, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x7, x14, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x10, x8, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x9, #16, #8
+	eor	w14, w14, w16, ror 8
+	ubfx	x16, x9, #56, #8
+	eor	w13, w14, w17, ror 16
+	ubfx	x17, x8, #40, #8
+	ldr	w10, [x7, x10, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	eor	w16, w16, w10, ror 24
+	ldp	x8, x9, [x20], #16
+	eor	w15, w15, w17, ror 8
+	eor	w15, w15, w16, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x8
+	eor	x13, x13, x9
+	ubfx	x8, x12, #32, #8
+	ubfx	x11, x13, #8, #8
+	ubfx	x16, x13, #48, #8
+	ubfx	x17, x12, #24, #8
+	ldr	x15, [x6]
+	ldr	x15, [x6, #64]
+	ldr	x15, [x6, #128]
+	ldr	x15, [x6, #192]
+	ldrb	w8, [x6, x8, LSL 0]
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ubfx	x9, x13, #0, #8
+	eor	w8, w8, w11, lsl 8
+	ubfx	x11, x13, #40, #8
+	eor	w8, w8, w16, lsl 16
+	ubfx	x16, x12, #16, #8
+	eor	w8, w8, w17, lsl 24
+	ubfx	x17, x12, #56, #8
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w9, [x6, x9, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x10, x13, #32, #8
+	eor	w9, w9, w11, lsl 8
+	ubfx	x11, x12, #8, #8
+	eor	w9, w9, w16, lsl 16
+	ubfx	x16, x12, #48, #8
+	eor	w9, w9, w17, lsl 24
+	ubfx	x17, x13, #24, #8
+	bfi	x8, x9, #32, #32
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x15, x13, #56, #8
+	eor	w10, w10, w11, lsl 8
+	ubfx	x11, x12, #0, #8
+	eor	w10, w10, w16, lsl 16
+	ubfx	x16, x12, #40, #8
+	eor	w9, w10, w17, lsl 24
+	ubfx	x17, x13, #16, #8
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	eor	w16, w16, w15, lsl 16
+	ldp	x12, x13, [x20]
+	eor	w11, w11, w16, lsl 8
+	eor	w11, w11, w17, lsl 16
+	bfi	x9, x11, #32, #32
+	;   XOR in Key Schedule
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	rev32	x8, x8
+	rev32	x9, x9
+	ldp	x12, x13, [x5]
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	str	x8, [x1]
+	str	x9, [x1, #8]
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	beq	L_AES_CBC_decrypt_end_dec_odd
+	mov	x20, x3
+	ldr	x8, [x0]
+	ldr	x9, [x0, #8]
+	stp	x8, x9, [x5]
+	rev32	x8, x8
+	rev32	x9, x9
+	ldp	x12, x13, [x20], #16
+	; Round: 0 - XOR in key schedule
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	sub	w19, w4, #2
+L_AES_CBC_decrypt_loop_nr_odd
+	ubfx	x12, x9, #48, #8
+	ubfx	x15, x8, #24, #8
+	ubfx	x16, x9, #8, #8
+	ubfx	x17, x8, #32, #8
+	ldr	x10, [x7]
+	ldr	x10, [x7, #64]
+	ldr	x10, [x7, #128]
+	ldr	x10, [x7, #192]
+	ldr	x10, [x7, #256]
+	ldr	x10, [x7, #320]
+	ldr	x10, [x7, #384]
+	ldr	x10, [x7, #448]
+	ldr	x10, [x7, #512]
+	ldr	x10, [x7, #576]
+	ldr	x10, [x7, #640]
+	ldr	x10, [x7, #704]
+	ldr	x10, [x7, #768]
+	ldr	x10, [x7, #832]
+	ldr	x10, [x7, #896]
+	ldr	x10, [x7, #960]
+	ldr	w12, [x7, x12, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x13, x8, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x8, #56, #8
+	eor	w12, w12, w16, ror 8
+	ubfx	x16, x9, #40, #8
+	eor	w12, w12, w17, ror 16
+	ubfx	x17, x9, #0, #8
+	ldr	w13, [x7, x13, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x14, x8, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x9, #24, #8
+	eor	w13, w13, w16, ror 8
+	ubfx	x16, x8, #8, #8
+	eor	w13, w13, w17, ror 16
+	ubfx	x17, x9, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x7, x14, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x10, x8, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x9, #16, #8
+	eor	w14, w14, w16, ror 8
+	ubfx	x16, x9, #56, #8
+	eor	w13, w14, w17, ror 16
+	ubfx	x17, x8, #40, #8
+	ldr	w10, [x7, x10, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	eor	w16, w16, w10, ror 24
+	ldp	x8, x9, [x20], #16
+	eor	w15, w15, w17, ror 8
+	eor	w15, w15, w16, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x8
+	eor	x13, x13, x9
+	ubfx	x8, x13, #48, #8
+	ubfx	x11, x12, #24, #8
+	ubfx	x16, x13, #8, #8
+	ubfx	x17, x12, #32, #8
+	ldr	x14, [x7]
+	ldr	x14, [x7, #64]
+	ldr	x14, [x7, #128]
+	ldr	x14, [x7, #192]
+	ldr	x14, [x7, #256]
+	ldr	x14, [x7, #320]
+	ldr	x14, [x7, #384]
+	ldr	x14, [x7, #448]
+	ldr	x14, [x7, #512]
+	ldr	x14, [x7, #576]
+	ldr	x14, [x7, #640]
+	ldr	x14, [x7, #704]
+	ldr	x14, [x7, #768]
+	ldr	x14, [x7, #832]
+	ldr	x14, [x7, #896]
+	ldr	x14, [x7, #960]
+	ldr	w8, [x7, x8, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x9, x12, #16, #8
+	eor	w8, w8, w11, ror 24
+	ubfx	x11, x12, #56, #8
+	eor	w8, w8, w16, ror 8
+	ubfx	x16, x13, #40, #8
+	eor	w8, w8, w17, ror 16
+	ubfx	x17, x13, #0, #8
+	ldr	w9, [x7, x9, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x10, x12, #48, #8
+	eor	w9, w9, w11, ror 24
+	ubfx	x11, x13, #24, #8
+	eor	w9, w9, w16, ror 8
+	ubfx	x16, x12, #8, #8
+	eor	w9, w9, w17, ror 16
+	ubfx	x17, x13, #32, #8
+	bfi	x8, x9, #32, #32
+	ldr	w10, [x7, x10, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w10, w10, w11, ror 24
+	ubfx	x11, x13, #16, #8
+	eor	w10, w10, w16, ror 8
+	ubfx	x16, x13, #56, #8
+	eor	w9, w10, w17, ror 16
+	ubfx	x17, x12, #40, #8
+	ldr	w14, [x7, x14, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w11, [x7, x11, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	eor	w16, w16, w14, ror 24
+	ldp	x12, x13, [x20], #16
+	eor	w11, w11, w17, ror 8
+	eor	w11, w11, w16, ror 24
+	bfi	x9, x11, #32, #32
+	;   XOR in Key Schedule
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	subs	w19, w19, #2
+	bne	L_AES_CBC_decrypt_loop_nr_odd
+	ubfx	x12, x9, #48, #8
+	ubfx	x15, x8, #24, #8
+	ubfx	x16, x9, #8, #8
+	ubfx	x17, x8, #32, #8
+	ldr	x10, [x7]
+	ldr	x10, [x7, #64]
+	ldr	x10, [x7, #128]
+	ldr	x10, [x7, #192]
+	ldr	x10, [x7, #256]
+	ldr	x10, [x7, #320]
+	ldr	x10, [x7, #384]
+	ldr	x10, [x7, #448]
+	ldr	x10, [x7, #512]
+	ldr	x10, [x7, #576]
+	ldr	x10, [x7, #640]
+	ldr	x10, [x7, #704]
+	ldr	x10, [x7, #768]
+	ldr	x10, [x7, #832]
+	ldr	x10, [x7, #896]
+	ldr	x10, [x7, #960]
+	ldr	w12, [x7, x12, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x13, x8, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x8, #56, #8
+	eor	w12, w12, w16, ror 8
+	ubfx	x16, x9, #40, #8
+	eor	w12, w12, w17, ror 16
+	ubfx	x17, x9, #0, #8
+	ldr	w13, [x7, x13, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x14, x8, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x9, #24, #8
+	eor	w13, w13, w16, ror 8
+	ubfx	x16, x8, #8, #8
+	eor	w13, w13, w17, ror 16
+	ubfx	x17, x9, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x7, x14, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	ubfx	x10, x8, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x9, #16, #8
+	eor	w14, w14, w16, ror 8
+	ubfx	x16, x9, #56, #8
+	eor	w13, w14, w17, ror 16
+	ubfx	x17, x8, #40, #8
+	ldr	w10, [x7, x10, LSL 2]
+	ldr	w16, [x7, x16, LSL 2]
+	ldr	w15, [x7, x15, LSL 2]
+	ldr	w17, [x7, x17, LSL 2]
+	eor	w16, w16, w10, ror 24
+	ldp	x8, x9, [x20], #16
+	eor	w15, w15, w17, ror 8
+	eor	w15, w15, w16, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x8
+	eor	x13, x13, x9
+	ubfx	x8, x12, #32, #8
+	ubfx	x11, x13, #8, #8
+	ubfx	x16, x13, #48, #8
+	ubfx	x17, x12, #24, #8
+	ldr	x15, [x6]
+	ldr	x15, [x6, #64]
+	ldr	x15, [x6, #128]
+	ldr	x15, [x6, #192]
+	ldrb	w8, [x6, x8, LSL 0]
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ubfx	x9, x13, #0, #8
+	eor	w8, w8, w11, lsl 8
+	ubfx	x11, x13, #40, #8
+	eor	w8, w8, w16, lsl 16
+	ubfx	x16, x12, #16, #8
+	eor	w8, w8, w17, lsl 24
+	ubfx	x17, x12, #56, #8
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w9, [x6, x9, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x10, x13, #32, #8
+	eor	w9, w9, w11, lsl 8
+	ubfx	x11, x12, #8, #8
+	eor	w9, w9, w16, lsl 16
+	ubfx	x16, x12, #48, #8
+	eor	w9, w9, w17, lsl 24
+	ubfx	x17, x13, #24, #8
+	bfi	x8, x9, #32, #32
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	ldrb	w10, [x6, x10, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ubfx	x15, x13, #56, #8
+	eor	w10, w10, w11, lsl 8
+	ubfx	x11, x12, #0, #8
+	eor	w10, w10, w16, lsl 16
+	ubfx	x16, x12, #40, #8
+	eor	w9, w10, w17, lsl 24
+	ubfx	x17, x13, #16, #8
+	ldrb	w15, [x6, x15, LSL 0]
+	ldrb	w16, [x6, x16, LSL 0]
+	ldrb	w11, [x6, x11, LSL 0]
+	ldrb	w17, [x6, x17, LSL 0]
+	eor	w16, w16, w15, lsl 16
+	ldp	x12, x13, [x20]
+	eor	w11, w11, w16, lsl 8
+	eor	w11, w11, w17, lsl 16
+	bfi	x9, x11, #32, #32
+	;   XOR in Key Schedule
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	rev32	x8, x8
+	rev32	x9, x9
+	ldnp	x12, x13, [x5, #16]
+	eor	x8, x8, x12
+	eor	x9, x9, x13
+	str	x8, [x1]
+	str	x9, [x1, #8]
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_CBC_decrypt_loop_block
+	b	L_AES_CBC_decrypt_end_dec
+L_AES_CBC_decrypt_end_dec_odd
+	ldnp	x12, x13, [x5, #16]
+	stp	x12, x13, [x5]
+L_AES_CBC_decrypt_end_dec
+	ldp	x17, x19, [x29, #24]
+	ldr	x20, [x29, #40]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	ENDIF
+	IF :DEF:HAVE_AESGCM
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_GCM_gmult_len_r
+	DCD	0x00000000, 0x1c200000, 0x38400000, 0x24600000
+	DCD	0x70800000, 0x6ca00000, 0x48c00000, 0x54e00000
+	DCD	0xe1000000, 0xfd200000, 0xd9400000, 0xc5600000
+	DCD	0x91800000, 0x8da00000, 0xa9c00000, 0xb5e00000
+	DCD	0x00000000, 0x01c20000, 0x03840000, 0x02460000
+	DCD	0x07080000, 0x06ca0000, 0x048c0000, 0x054e0000
+	DCD	0x0e100000, 0x0fd20000, 0x0d940000, 0x0c560000
+	DCD	0x09180000, 0x08da0000, 0x0a9c0000, 0x0b5e0000
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	GCM_gmult_len
+GCM_gmult_len PROC
+	adrp	x10, L_GCM_gmult_len_r
+	add	x10, x10, L_GCM_gmult_len_r
+L_GCM_gmult_len_start_block
+	ldp	x4, x5, [x0]
+	ldp	x6, x7, [x2]
+	eor	x4, x4, x6
+	eor	x5, x5, x7
+	ubfx	x12, x5, #56, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x8, x9, [x12]
+	ubfx	x12, x5, #60, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x5, #48, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x5, #52, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x5, #40, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x5, #44, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x5, #32, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x5, #36, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x5, #24, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x5, #28, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x5, #16, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x5, #20, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x5, #8, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x5, #12, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x5, #0, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x5, #4, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x4, #56, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x4, #60, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x4, #48, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x4, #52, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x4, #40, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x4, #44, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x4, #32, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x4, #36, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x4, #24, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x4, #28, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x4, #16, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x4, #20, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfx	x12, x4, #8, #4
+	add	x12, x1, x12, lsl 4
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x12, x4, #12, #4
+	mov	x11, x9
+	add	x12, x12, #16
+	lsr	x9, x9, #8
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 56
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #8
+	eor	x8, x8, x6
+	sub	x12, x12, #0x100
+	eor	x9, x9, x7
+	ldr	x7, [x12, #8]
+	ubfx	w6, w11, #0, #4
+	eor	x11, x11, x7, lsl 4
+	add	w6, w6, #16
+	ubfx	w11, w11, #4, #4
+	ldr	w6, [x10, x6, LSL 2]
+	ldr	w7, [x10, x11, LSL 2]
+	eor	x8, x8, x6, lsl 32
+	eor	x8, x8, x7, lsl 32
+	ubfiz	x12, x4, #4, #4
+	add	x12, x12, x1
+	ldp	x6, x7, [x12]
+	eor	x8, x8, x6
+	eor	x9, x9, x7
+	ubfx	x11, x9, #0, #4
+	ubfx	x12, x4, #4, #4
+	lsr	x9, x9, #4
+	add	x12, x1, x12, lsl 4
+	orr	x9, x9, x8, lsl 60
+	ldp	x6, x7, [x12]
+	lsr	x8, x8, #4
+	eor	x8, x8, x6
+	ldr	w6, [x10, x11, LSL 2]
+	eor	x9, x9, x7
+	eor	x8, x8, x6, lsl 32
+	rev	x8, x8
+	rev	x9, x9
+	stp	x8, x9, [x0]
+	subs	x3, x3, #16
+	add	x2, x2, #16
+	bne	L_GCM_gmult_len_start_block
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_GCM_encrypt
+AES_GCM_encrypt PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	adrp	x19, L_AES_ARM64_te
+	add	x19, x19, L_AES_ARM64_te
+	ldp	x16, x17, [x5]
+	rev32	x16, x16
+	rev32	x17, x17
+L_AES_GCM_encrypt_loop_block
+	mov	x21, x3
+	lsr	x9, x17, #32
+	ldp	x10, x11, [x21], #16
+	add	w9, w9, #1
+	bfi	x17, x9, #32, #32
+	; Round: 0 - XOR in key schedule
+	eor	x6, x16, x10
+	eor	x7, x17, x11
+	sub	w20, w4, #2
+L_AES_GCM_encrypt_loop_nr
+	ubfx	x10, x6, #48, #8
+	ubfx	x13, x6, #24, #8
+	ubfx	x14, x7, #8, #8
+	ubfx	x15, x7, #32, #8
+	ldr	x8, [x19]
+	ldr	x8, [x19, #64]
+	ldr	x8, [x19, #128]
+	ldr	x8, [x19, #192]
+	ldr	x8, [x19, #256]
+	ldr	x8, [x19, #320]
+	ldr	x8, [x19, #384]
+	ldr	x8, [x19, #448]
+	ldr	x8, [x19, #512]
+	ldr	x8, [x19, #576]
+	ldr	x8, [x19, #640]
+	ldr	x8, [x19, #704]
+	ldr	x8, [x19, #768]
+	ldr	x8, [x19, #832]
+	ldr	x8, [x19, #896]
+	ldr	x8, [x19, #960]
+	ldr	w10, [x19, x10, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x11, x7, #16, #8
+	eor	w10, w10, w13, ror 24
+	ubfx	x13, x6, #56, #8
+	eor	w10, w10, w14, ror 8
+	ubfx	x14, x7, #40, #8
+	eor	w10, w10, w15, ror 16
+	ubfx	x15, x6, #0, #8
+	ldr	w11, [x19, x11, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x12, x7, #48, #8
+	eor	w11, w11, w13, ror 24
+	ubfx	x13, x7, #24, #8
+	eor	w11, w11, w14, ror 8
+	ubfx	x14, x6, #8, #8
+	eor	w11, w11, w15, ror 16
+	ubfx	x15, x6, #32, #8
+	bfi	x10, x11, #32, #32
+	ldr	w12, [x19, x12, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x8, x7, #0, #8
+	eor	w12, w12, w13, ror 24
+	ubfx	x13, x6, #16, #8
+	eor	w12, w12, w14, ror 8
+	ubfx	x14, x7, #56, #8
+	eor	w11, w12, w15, ror 16
+	ubfx	x15, x6, #40, #8
+	ldr	w8, [x19, x8, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	eor	w14, w14, w8, ror 24
+	ldp	x6, x7, [x21], #16
+	eor	w13, w13, w14, ror 24
+	eor	w13, w13, w15, ror 8
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x6
+	eor	x11, x11, x7
+	ubfx	x6, x10, #48, #8
+	ubfx	x9, x10, #24, #8
+	ubfx	x14, x11, #8, #8
+	ubfx	x15, x11, #32, #8
+	ldr	x12, [x19]
+	ldr	x12, [x19, #64]
+	ldr	x12, [x19, #128]
+	ldr	x12, [x19, #192]
+	ldr	x12, [x19, #256]
+	ldr	x12, [x19, #320]
+	ldr	x12, [x19, #384]
+	ldr	x12, [x19, #448]
+	ldr	x12, [x19, #512]
+	ldr	x12, [x19, #576]
+	ldr	x12, [x19, #640]
+	ldr	x12, [x19, #704]
+	ldr	x12, [x19, #768]
+	ldr	x12, [x19, #832]
+	ldr	x12, [x19, #896]
+	ldr	x12, [x19, #960]
+	ldr	w6, [x19, x6, LSL 2]
+	ldr	w9, [x19, x9, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x7, x11, #16, #8
+	eor	w6, w6, w9, ror 24
+	ubfx	x9, x10, #56, #8
+	eor	w6, w6, w14, ror 8
+	ubfx	x14, x11, #40, #8
+	eor	w6, w6, w15, ror 16
+	ubfx	x15, x10, #0, #8
+	ldr	w7, [x19, x7, LSL 2]
+	ldr	w9, [x19, x9, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x8, x11, #48, #8
+	eor	w7, w7, w9, ror 24
+	ubfx	x9, x11, #24, #8
+	eor	w7, w7, w14, ror 8
+	ubfx	x14, x10, #8, #8
+	eor	w7, w7, w15, ror 16
+	ubfx	x15, x10, #32, #8
+	bfi	x6, x7, #32, #32
+	ldr	w8, [x19, x8, LSL 2]
+	ldr	w9, [x19, x9, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x12, x11, #0, #8
+	eor	w8, w8, w9, ror 24
+	ubfx	x9, x10, #16, #8
+	eor	w8, w8, w14, ror 8
+	ubfx	x14, x11, #56, #8
+	eor	w7, w8, w15, ror 16
+	ubfx	x15, x10, #40, #8
+	ldr	w12, [x19, x12, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w9, [x19, x9, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	eor	w14, w14, w12, ror 24
+	ldp	x10, x11, [x21], #16
+	eor	w9, w9, w14, ror 24
+	eor	w9, w9, w15, ror 8
+	bfi	x7, x9, #32, #32
+	;   XOR in Key Schedule
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	subs	w20, w20, #2
+	bne	L_AES_GCM_encrypt_loop_nr
+	ubfx	x10, x6, #48, #8
+	ubfx	x13, x6, #24, #8
+	ubfx	x14, x7, #8, #8
+	ubfx	x15, x7, #32, #8
+	ldr	x8, [x19]
+	ldr	x8, [x19, #64]
+	ldr	x8, [x19, #128]
+	ldr	x8, [x19, #192]
+	ldr	x8, [x19, #256]
+	ldr	x8, [x19, #320]
+	ldr	x8, [x19, #384]
+	ldr	x8, [x19, #448]
+	ldr	x8, [x19, #512]
+	ldr	x8, [x19, #576]
+	ldr	x8, [x19, #640]
+	ldr	x8, [x19, #704]
+	ldr	x8, [x19, #768]
+	ldr	x8, [x19, #832]
+	ldr	x8, [x19, #896]
+	ldr	x8, [x19, #960]
+	ldr	w10, [x19, x10, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x11, x7, #16, #8
+	eor	w10, w10, w13, ror 24
+	ubfx	x13, x6, #56, #8
+	eor	w10, w10, w14, ror 8
+	ubfx	x14, x7, #40, #8
+	eor	w10, w10, w15, ror 16
+	ubfx	x15, x6, #0, #8
+	ldr	w11, [x19, x11, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x12, x7, #48, #8
+	eor	w11, w11, w13, ror 24
+	ubfx	x13, x7, #24, #8
+	eor	w11, w11, w14, ror 8
+	ubfx	x14, x6, #8, #8
+	eor	w11, w11, w15, ror 16
+	ubfx	x15, x6, #32, #8
+	bfi	x10, x11, #32, #32
+	ldr	w12, [x19, x12, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	ubfx	x8, x7, #0, #8
+	eor	w12, w12, w13, ror 24
+	ubfx	x13, x6, #16, #8
+	eor	w12, w12, w14, ror 8
+	ubfx	x14, x7, #56, #8
+	eor	w11, w12, w15, ror 16
+	ubfx	x15, x6, #40, #8
+	ldr	w8, [x19, x8, LSL 2]
+	ldr	w14, [x19, x14, LSL 2]
+	ldr	w13, [x19, x13, LSL 2]
+	ldr	w15, [x19, x15, LSL 2]
+	eor	w14, w14, w8, ror 24
+	ldp	x6, x7, [x21], #16
+	eor	w13, w13, w14, ror 24
+	eor	w13, w13, w15, ror 8
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x6
+	eor	x11, x11, x7
+	ubfx	x6, x11, #32, #8
+	ubfx	x9, x11, #8, #8
+	ubfx	x14, x10, #48, #8
+	ubfx	x15, x10, #24, #8
+	lsl	w6, w6, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldr	x13, [x19]
+	ldr	x13, [x19, #64]
+	ldr	x13, [x19, #128]
+	ldr	x13, [x19, #192]
+	ldr	x13, [x19, #256]
+	ldr	x13, [x19, #320]
+	ldr	x13, [x19, #384]
+	ldr	x13, [x19, #448]
+	ldr	x13, [x19, #512]
+	ldr	x13, [x19, #576]
+	ldr	x13, [x19, #640]
+	ldr	x13, [x19, #704]
+	ldr	x13, [x19, #768]
+	ldr	x13, [x19, #832]
+	ldr	x13, [x19, #896]
+	ldr	x13, [x19, #960]
+	ldrb	w6, [x19, x6, LSL 0]
+	ldrb	w9, [x19, x9, LSL 0]
+	ldrb	w14, [x19, x14, LSL 0]
+	ldrb	w15, [x19, x15, LSL 0]
+	ubfx	x7, x10, #0, #8
+	eor	w6, w6, w9, lsl 8
+	ubfx	x9, x11, #40, #8
+	eor	w6, w6, w14, lsl 16
+	ubfx	x14, x11, #16, #8
+	eor	w6, w6, w15, lsl 24
+	ubfx	x15, x10, #56, #8
+	lsl	w7, w7, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldrb	w7, [x19, x7, LSL 0]
+	ldrb	w9, [x19, x9, LSL 0]
+	ldrb	w14, [x19, x14, LSL 0]
+	ldrb	w15, [x19, x15, LSL 0]
+	ubfx	x8, x10, #32, #8
+	eor	w7, w7, w9, lsl 8
+	ubfx	x9, x10, #8, #8
+	eor	w7, w7, w14, lsl 16
+	ubfx	x14, x11, #48, #8
+	eor	w7, w7, w15, lsl 24
+	ubfx	x15, x11, #24, #8
+	bfi	x6, x7, #32, #32
+	lsl	w8, w8, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldrb	w8, [x19, x8, LSL 0]
+	ldrb	w9, [x19, x9, LSL 0]
+	ldrb	w14, [x19, x14, LSL 0]
+	ldrb	w15, [x19, x15, LSL 0]
+	ubfx	x13, x11, #56, #8
+	eor	w8, w8, w9, lsl 8
+	ubfx	x9, x11, #0, #8
+	eor	w8, w8, w14, lsl 16
+	ubfx	x14, x10, #40, #8
+	eor	w7, w8, w15, lsl 24
+	ubfx	x15, x10, #16, #8
+	lsl	w13, w13, #2
+	lsl	w9, w9, #2
+	lsl	w14, w14, #2
+	lsl	w15, w15, #2
+	ldrb	w13, [x19, x13, LSL 0]
+	ldrb	w9, [x19, x9, LSL 0]
+	ldrb	w14, [x19, x14, LSL 0]
+	ldrb	w15, [x19, x15, LSL 0]
+	eor	w14, w14, w13, lsl 16
+	ldp	x10, x11, [x21]
+	eor	w9, w9, w14, lsl 8
+	eor	w9, w9, w15, lsl 16
+	bfi	x7, x9, #32, #32
+	;   XOR in Key Schedule
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	rev32	x6, x6
+	rev32	x7, x7
+	ldr	x10, [x0]
+	ldr	x11, [x0, #8]
+	eor	x6, x6, x10
+	eor	x7, x7, x11
+	str	x6, [x1]
+	str	x7, [x1, #8]
+	subs	x2, x2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	bne	L_AES_GCM_encrypt_loop_block
+	rev32	x16, x16
+	rev32	x17, x17
+	stp	x16, x17, [x5]
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	ENDIF
+	IF :DEF:WOLFSSL_AES_XTS
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_encrypt
+AES_XTS_encrypt PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	str	x26, [x29, #88]
+	adrp	x8, L_AES_ARM64_te
+	add	x8, x8, L_AES_ARM64_te
+	mov	x9, #0x87
+	mov	x26, x5
+	ldp	x21, x22, [x3]
+	ldp	x14, x15, [x26], #16
+	rev32	x21, x21
+	rev32	x22, x22
+	; Round: 0 - XOR in key schedule
+	eor	x21, x21, x14
+	eor	x22, x22, x15
+	sub	w25, w7, #2
+L_AES_XTS_encrypt_loop_nr_tweak
+	ubfx	x14, x21, #48, #8
+	ubfx	x17, x21, #24, #8
+	ubfx	x19, x22, #8, #8
+	ubfx	x20, x22, #32, #8
+	ldr	x23, [x8]
+	ldr	x23, [x8, #64]
+	ldr	x23, [x8, #128]
+	ldr	x23, [x8, #192]
+	ldr	x23, [x8, #256]
+	ldr	x23, [x8, #320]
+	ldr	x23, [x8, #384]
+	ldr	x23, [x8, #448]
+	ldr	x23, [x8, #512]
+	ldr	x23, [x8, #576]
+	ldr	x23, [x8, #640]
+	ldr	x23, [x8, #704]
+	ldr	x23, [x8, #768]
+	ldr	x23, [x8, #832]
+	ldr	x23, [x8, #896]
+	ldr	x23, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x22, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x21, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x22, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x21, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x22, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x22, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x21, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x21, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x23, x22, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x21, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x22, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x21, #40, #8
+	ldr	w23, [x8, x23, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w23, ror 24
+	ldp	x21, x22, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x21
+	eor	x15, x15, x22
+	ubfx	x21, x14, #48, #8
+	ubfx	x24, x14, #24, #8
+	ubfx	x19, x15, #8, #8
+	ubfx	x20, x15, #32, #8
+	ldr	x16, [x8]
+	ldr	x16, [x8, #64]
+	ldr	x16, [x8, #128]
+	ldr	x16, [x8, #192]
+	ldr	x16, [x8, #256]
+	ldr	x16, [x8, #320]
+	ldr	x16, [x8, #384]
+	ldr	x16, [x8, #448]
+	ldr	x16, [x8, #512]
+	ldr	x16, [x8, #576]
+	ldr	x16, [x8, #640]
+	ldr	x16, [x8, #704]
+	ldr	x16, [x8, #768]
+	ldr	x16, [x8, #832]
+	ldr	x16, [x8, #896]
+	ldr	x16, [x8, #960]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x22, x15, #16, #8
+	eor	w21, w21, w24, ror 24
+	ubfx	x24, x14, #56, #8
+	eor	w21, w21, w19, ror 8
+	ubfx	x19, x15, #40, #8
+	eor	w21, w21, w20, ror 16
+	ubfx	x20, x14, #0, #8
+	ldr	w22, [x8, x22, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x23, x15, #48, #8
+	eor	w22, w22, w24, ror 24
+	ubfx	x24, x15, #24, #8
+	eor	w22, w22, w19, ror 8
+	ubfx	x19, x14, #8, #8
+	eor	w22, w22, w20, ror 16
+	ubfx	x20, x14, #32, #8
+	bfi	x21, x22, #32, #32
+	ldr	w23, [x8, x23, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x15, #0, #8
+	eor	w23, w23, w24, ror 24
+	ubfx	x24, x14, #16, #8
+	eor	w23, w23, w19, ror 8
+	ubfx	x19, x15, #56, #8
+	eor	w22, w23, w20, ror 16
+	ubfx	x20, x14, #40, #8
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w24, [x8, x24, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w16, ror 24
+	ldp	x14, x15, [x26], #16
+	eor	w24, w24, w19, ror 24
+	eor	w24, w24, w20, ror 8
+	bfi	x22, x24, #32, #32
+	;   XOR in Key Schedule
+	eor	x21, x21, x14
+	eor	x22, x22, x15
+	subs	w25, w25, #2
+	bne	L_AES_XTS_encrypt_loop_nr_tweak
+	ubfx	x14, x21, #48, #8
+	ubfx	x17, x21, #24, #8
+	ubfx	x19, x22, #8, #8
+	ubfx	x20, x22, #32, #8
+	ldr	x23, [x8]
+	ldr	x23, [x8, #64]
+	ldr	x23, [x8, #128]
+	ldr	x23, [x8, #192]
+	ldr	x23, [x8, #256]
+	ldr	x23, [x8, #320]
+	ldr	x23, [x8, #384]
+	ldr	x23, [x8, #448]
+	ldr	x23, [x8, #512]
+	ldr	x23, [x8, #576]
+	ldr	x23, [x8, #640]
+	ldr	x23, [x8, #704]
+	ldr	x23, [x8, #768]
+	ldr	x23, [x8, #832]
+	ldr	x23, [x8, #896]
+	ldr	x23, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x22, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x21, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x22, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x21, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x22, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x22, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x21, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x21, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x23, x22, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x21, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x22, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x21, #40, #8
+	ldr	w23, [x8, x23, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w23, ror 24
+	ldp	x21, x22, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x21
+	eor	x15, x15, x22
+	ubfx	x21, x15, #32, #8
+	ubfx	x24, x15, #8, #8
+	ubfx	x19, x14, #48, #8
+	ubfx	x20, x14, #24, #8
+	lsl	w21, w21, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldr	x17, [x8]
+	ldr	x17, [x8, #64]
+	ldr	x17, [x8, #128]
+	ldr	x17, [x8, #192]
+	ldr	x17, [x8, #256]
+	ldr	x17, [x8, #320]
+	ldr	x17, [x8, #384]
+	ldr	x17, [x8, #448]
+	ldr	x17, [x8, #512]
+	ldr	x17, [x8, #576]
+	ldr	x17, [x8, #640]
+	ldr	x17, [x8, #704]
+	ldr	x17, [x8, #768]
+	ldr	x17, [x8, #832]
+	ldr	x17, [x8, #896]
+	ldr	x17, [x8, #960]
+	ldrb	w21, [x8, x21, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x22, x14, #0, #8
+	eor	w21, w21, w24, lsl 8
+	ubfx	x24, x15, #40, #8
+	eor	w21, w21, w19, lsl 16
+	ubfx	x19, x15, #16, #8
+	eor	w21, w21, w20, lsl 24
+	ubfx	x20, x14, #56, #8
+	lsl	w22, w22, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w22, [x8, x22, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x23, x14, #32, #8
+	eor	w22, w22, w24, lsl 8
+	ubfx	x24, x14, #8, #8
+	eor	w22, w22, w19, lsl 16
+	ubfx	x19, x15, #48, #8
+	eor	w22, w22, w20, lsl 24
+	ubfx	x20, x15, #24, #8
+	bfi	x21, x22, #32, #32
+	lsl	w23, w23, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w23, [x8, x23, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x17, x15, #56, #8
+	eor	w23, w23, w24, lsl 8
+	ubfx	x24, x15, #0, #8
+	eor	w23, w23, w19, lsl 16
+	ubfx	x19, x14, #40, #8
+	eor	w22, w23, w20, lsl 24
+	ubfx	x20, x14, #16, #8
+	lsl	w17, w17, #2
+	lsl	w24, w24, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w17, [x8, x17, LSL 0]
+	ldrb	w24, [x8, x24, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	eor	w19, w19, w17, lsl 16
+	ldp	x14, x15, [x26]
+	eor	w24, w24, w19, lsl 8
+	eor	w24, w24, w20, lsl 16
+	bfi	x22, x24, #32, #32
+	;   XOR in Key Schedule
+	eor	x21, x21, x14
+	eor	x22, x22, x15
+	rev32	x21, x21
+	rev32	x22, x22
+L_AES_XTS_encrypt_loop_block
+	mov	x26, x4
+	ldp	x10, x11, [x0]
+	ldp	x14, x15, [x26], #16
+	eor	x10, x10, x21
+	eor	x11, x11, x22
+	rev32	x10, x10
+	rev32	x11, x11
+	; Round: 0 - XOR in key schedule
+	eor	x10, x10, x14
+	eor	x11, x11, x15
+	sub	w25, w7, #2
+L_AES_XTS_encrypt_loop_nr
+	ubfx	x14, x10, #48, #8
+	ubfx	x17, x10, #24, #8
+	ubfx	x19, x11, #8, #8
+	ubfx	x20, x11, #32, #8
+	ldr	x12, [x8]
+	ldr	x12, [x8, #64]
+	ldr	x12, [x8, #128]
+	ldr	x12, [x8, #192]
+	ldr	x12, [x8, #256]
+	ldr	x12, [x8, #320]
+	ldr	x12, [x8, #384]
+	ldr	x12, [x8, #448]
+	ldr	x12, [x8, #512]
+	ldr	x12, [x8, #576]
+	ldr	x12, [x8, #640]
+	ldr	x12, [x8, #704]
+	ldr	x12, [x8, #768]
+	ldr	x12, [x8, #832]
+	ldr	x12, [x8, #896]
+	ldr	x12, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x11, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x10, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x11, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x10, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x11, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x11, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x10, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x10, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x12, x11, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x10, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x11, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x10, #40, #8
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w12, ror 24
+	ldp	x10, x11, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x10
+	eor	x15, x15, x11
+	ubfx	x10, x14, #48, #8
+	ubfx	x13, x14, #24, #8
+	ubfx	x19, x15, #8, #8
+	ubfx	x20, x15, #32, #8
+	ldr	x16, [x8]
+	ldr	x16, [x8, #64]
+	ldr	x16, [x8, #128]
+	ldr	x16, [x8, #192]
+	ldr	x16, [x8, #256]
+	ldr	x16, [x8, #320]
+	ldr	x16, [x8, #384]
+	ldr	x16, [x8, #448]
+	ldr	x16, [x8, #512]
+	ldr	x16, [x8, #576]
+	ldr	x16, [x8, #640]
+	ldr	x16, [x8, #704]
+	ldr	x16, [x8, #768]
+	ldr	x16, [x8, #832]
+	ldr	x16, [x8, #896]
+	ldr	x16, [x8, #960]
+	ldr	w10, [x8, x10, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x11, x15, #16, #8
+	eor	w10, w10, w13, ror 24
+	ubfx	x13, x14, #56, #8
+	eor	w10, w10, w19, ror 8
+	ubfx	x19, x15, #40, #8
+	eor	w10, w10, w20, ror 16
+	ubfx	x20, x14, #0, #8
+	ldr	w11, [x8, x11, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x12, x15, #48, #8
+	eor	w11, w11, w13, ror 24
+	ubfx	x13, x15, #24, #8
+	eor	w11, w11, w19, ror 8
+	ubfx	x19, x14, #8, #8
+	eor	w11, w11, w20, ror 16
+	ubfx	x20, x14, #32, #8
+	bfi	x10, x11, #32, #32
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x15, #0, #8
+	eor	w12, w12, w13, ror 24
+	ubfx	x13, x14, #16, #8
+	eor	w12, w12, w19, ror 8
+	ubfx	x19, x15, #56, #8
+	eor	w11, w12, w20, ror 16
+	ubfx	x20, x14, #40, #8
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w16, ror 24
+	ldp	x14, x15, [x26], #16
+	eor	w13, w13, w19, ror 24
+	eor	w13, w13, w20, ror 8
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x14
+	eor	x11, x11, x15
+	subs	w25, w25, #2
+	bne	L_AES_XTS_encrypt_loop_nr
+	ubfx	x14, x10, #48, #8
+	ubfx	x17, x10, #24, #8
+	ubfx	x19, x11, #8, #8
+	ubfx	x20, x11, #32, #8
+	ldr	x12, [x8]
+	ldr	x12, [x8, #64]
+	ldr	x12, [x8, #128]
+	ldr	x12, [x8, #192]
+	ldr	x12, [x8, #256]
+	ldr	x12, [x8, #320]
+	ldr	x12, [x8, #384]
+	ldr	x12, [x8, #448]
+	ldr	x12, [x8, #512]
+	ldr	x12, [x8, #576]
+	ldr	x12, [x8, #640]
+	ldr	x12, [x8, #704]
+	ldr	x12, [x8, #768]
+	ldr	x12, [x8, #832]
+	ldr	x12, [x8, #896]
+	ldr	x12, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x11, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x10, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x11, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x10, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x11, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x11, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x10, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x10, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x12, x11, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x10, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x11, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x10, #40, #8
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w12, ror 24
+	ldp	x10, x11, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x10
+	eor	x15, x15, x11
+	ubfx	x10, x15, #32, #8
+	ubfx	x13, x15, #8, #8
+	ubfx	x19, x14, #48, #8
+	ubfx	x20, x14, #24, #8
+	lsl	w10, w10, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldr	x17, [x8]
+	ldr	x17, [x8, #64]
+	ldr	x17, [x8, #128]
+	ldr	x17, [x8, #192]
+	ldr	x17, [x8, #256]
+	ldr	x17, [x8, #320]
+	ldr	x17, [x8, #384]
+	ldr	x17, [x8, #448]
+	ldr	x17, [x8, #512]
+	ldr	x17, [x8, #576]
+	ldr	x17, [x8, #640]
+	ldr	x17, [x8, #704]
+	ldr	x17, [x8, #768]
+	ldr	x17, [x8, #832]
+	ldr	x17, [x8, #896]
+	ldr	x17, [x8, #960]
+	ldrb	w10, [x8, x10, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x11, x14, #0, #8
+	eor	w10, w10, w13, lsl 8
+	ubfx	x13, x15, #40, #8
+	eor	w10, w10, w19, lsl 16
+	ubfx	x19, x15, #16, #8
+	eor	w10, w10, w20, lsl 24
+	ubfx	x20, x14, #56, #8
+	lsl	w11, w11, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w11, [x8, x11, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x12, x14, #32, #8
+	eor	w11, w11, w13, lsl 8
+	ubfx	x13, x14, #8, #8
+	eor	w11, w11, w19, lsl 16
+	ubfx	x19, x15, #48, #8
+	eor	w11, w11, w20, lsl 24
+	ubfx	x20, x15, #24, #8
+	bfi	x10, x11, #32, #32
+	lsl	w12, w12, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w12, [x8, x12, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x17, x15, #56, #8
+	eor	w12, w12, w13, lsl 8
+	ubfx	x13, x15, #0, #8
+	eor	w12, w12, w19, lsl 16
+	ubfx	x19, x14, #40, #8
+	eor	w11, w12, w20, lsl 24
+	ubfx	x20, x14, #16, #8
+	lsl	w17, w17, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w17, [x8, x17, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	eor	w19, w19, w17, lsl 16
+	ldp	x14, x15, [x26]
+	eor	w13, w13, w19, lsl 8
+	eor	w13, w13, w20, lsl 16
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x14
+	eor	x11, x11, x15
+	rev32	x10, x10
+	rev32	x11, x11
+	eor	x10, x10, x21
+	eor	x11, x11, x22
+	stp	x10, x11, [x1]
+	and	x19, x9, x22, asr 63
+	extr	x22, x22, x21, #63
+	eor	x21, x19, x21, lsl 1
+	sub	w2, w2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	cmp	w2, #16
+	bge	L_AES_XTS_encrypt_loop_block
+	cbz	w2, L_AES_XTS_encrypt_done_data
+	mov	x26, x4
+	sub	x1, x1, #16
+	ldp	x10, x11, [x1], #16
+	stp	x10, x11, [x6]
+	mov	w14, w2
+L_AES_XTS_encrypt_start_byte
+	ldrb	w19, [x6]
+	ldrb	w20, [x0], #1
+	strb	w19, [x1], #1
+	strb	w20, [x6], #1
+	subs	w14, w14, #1
+	bgt	L_AES_XTS_encrypt_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	ldp	x10, x11, [x6]
+	ldp	x14, x15, [x26], #16
+	eor	x10, x10, x21
+	eor	x11, x11, x22
+	rev32	x10, x10
+	rev32	x11, x11
+	; Round: 0 - XOR in key schedule
+	eor	x10, x10, x14
+	eor	x11, x11, x15
+	sub	w25, w7, #2
+L_AES_XTS_encrypt_loop_nr_partial
+	ubfx	x14, x10, #48, #8
+	ubfx	x17, x10, #24, #8
+	ubfx	x19, x11, #8, #8
+	ubfx	x20, x11, #32, #8
+	ldr	x12, [x8]
+	ldr	x12, [x8, #64]
+	ldr	x12, [x8, #128]
+	ldr	x12, [x8, #192]
+	ldr	x12, [x8, #256]
+	ldr	x12, [x8, #320]
+	ldr	x12, [x8, #384]
+	ldr	x12, [x8, #448]
+	ldr	x12, [x8, #512]
+	ldr	x12, [x8, #576]
+	ldr	x12, [x8, #640]
+	ldr	x12, [x8, #704]
+	ldr	x12, [x8, #768]
+	ldr	x12, [x8, #832]
+	ldr	x12, [x8, #896]
+	ldr	x12, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x11, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x10, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x11, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x10, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x11, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x11, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x10, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x10, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x12, x11, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x10, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x11, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x10, #40, #8
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w12, ror 24
+	ldp	x10, x11, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x10
+	eor	x15, x15, x11
+	ubfx	x10, x14, #48, #8
+	ubfx	x13, x14, #24, #8
+	ubfx	x19, x15, #8, #8
+	ubfx	x20, x15, #32, #8
+	ldr	x16, [x8]
+	ldr	x16, [x8, #64]
+	ldr	x16, [x8, #128]
+	ldr	x16, [x8, #192]
+	ldr	x16, [x8, #256]
+	ldr	x16, [x8, #320]
+	ldr	x16, [x8, #384]
+	ldr	x16, [x8, #448]
+	ldr	x16, [x8, #512]
+	ldr	x16, [x8, #576]
+	ldr	x16, [x8, #640]
+	ldr	x16, [x8, #704]
+	ldr	x16, [x8, #768]
+	ldr	x16, [x8, #832]
+	ldr	x16, [x8, #896]
+	ldr	x16, [x8, #960]
+	ldr	w10, [x8, x10, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x11, x15, #16, #8
+	eor	w10, w10, w13, ror 24
+	ubfx	x13, x14, #56, #8
+	eor	w10, w10, w19, ror 8
+	ubfx	x19, x15, #40, #8
+	eor	w10, w10, w20, ror 16
+	ubfx	x20, x14, #0, #8
+	ldr	w11, [x8, x11, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x12, x15, #48, #8
+	eor	w11, w11, w13, ror 24
+	ubfx	x13, x15, #24, #8
+	eor	w11, w11, w19, ror 8
+	ubfx	x19, x14, #8, #8
+	eor	w11, w11, w20, ror 16
+	ubfx	x20, x14, #32, #8
+	bfi	x10, x11, #32, #32
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x15, #0, #8
+	eor	w12, w12, w13, ror 24
+	ubfx	x13, x14, #16, #8
+	eor	w12, w12, w19, ror 8
+	ubfx	x19, x15, #56, #8
+	eor	w11, w12, w20, ror 16
+	ubfx	x20, x14, #40, #8
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w16, ror 24
+	ldp	x14, x15, [x26], #16
+	eor	w13, w13, w19, ror 24
+	eor	w13, w13, w20, ror 8
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x14
+	eor	x11, x11, x15
+	subs	w25, w25, #2
+	bne	L_AES_XTS_encrypt_loop_nr_partial
+	ubfx	x14, x10, #48, #8
+	ubfx	x17, x10, #24, #8
+	ubfx	x19, x11, #8, #8
+	ubfx	x20, x11, #32, #8
+	ldr	x12, [x8]
+	ldr	x12, [x8, #64]
+	ldr	x12, [x8, #128]
+	ldr	x12, [x8, #192]
+	ldr	x12, [x8, #256]
+	ldr	x12, [x8, #320]
+	ldr	x12, [x8, #384]
+	ldr	x12, [x8, #448]
+	ldr	x12, [x8, #512]
+	ldr	x12, [x8, #576]
+	ldr	x12, [x8, #640]
+	ldr	x12, [x8, #704]
+	ldr	x12, [x8, #768]
+	ldr	x12, [x8, #832]
+	ldr	x12, [x8, #896]
+	ldr	x12, [x8, #960]
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x15, x11, #16, #8
+	eor	w14, w14, w17, ror 24
+	ubfx	x17, x10, #56, #8
+	eor	w14, w14, w19, ror 8
+	ubfx	x19, x11, #40, #8
+	eor	w14, w14, w20, ror 16
+	ubfx	x20, x10, #0, #8
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x16, x11, #48, #8
+	eor	w15, w15, w17, ror 24
+	ubfx	x17, x11, #24, #8
+	eor	w15, w15, w19, ror 8
+	ubfx	x19, x10, #8, #8
+	eor	w15, w15, w20, ror 16
+	ubfx	x20, x10, #32, #8
+	bfi	x14, x15, #32, #32
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ubfx	x12, x11, #0, #8
+	eor	w16, w16, w17, ror 24
+	ubfx	x17, x10, #16, #8
+	eor	w16, w16, w19, ror 8
+	ubfx	x19, x11, #56, #8
+	eor	w15, w16, w20, ror 16
+	ubfx	x20, x10, #40, #8
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	eor	w19, w19, w12, ror 24
+	ldp	x10, x11, [x26], #16
+	eor	w17, w17, w19, ror 24
+	eor	w17, w17, w20, ror 8
+	bfi	x15, x17, #32, #32
+	;   XOR in Key Schedule
+	eor	x14, x14, x10
+	eor	x15, x15, x11
+	ubfx	x10, x15, #32, #8
+	ubfx	x13, x15, #8, #8
+	ubfx	x19, x14, #48, #8
+	ubfx	x20, x14, #24, #8
+	lsl	w10, w10, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldr	x17, [x8]
+	ldr	x17, [x8, #64]
+	ldr	x17, [x8, #128]
+	ldr	x17, [x8, #192]
+	ldr	x17, [x8, #256]
+	ldr	x17, [x8, #320]
+	ldr	x17, [x8, #384]
+	ldr	x17, [x8, #448]
+	ldr	x17, [x8, #512]
+	ldr	x17, [x8, #576]
+	ldr	x17, [x8, #640]
+	ldr	x17, [x8, #704]
+	ldr	x17, [x8, #768]
+	ldr	x17, [x8, #832]
+	ldr	x17, [x8, #896]
+	ldr	x17, [x8, #960]
+	ldrb	w10, [x8, x10, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x11, x14, #0, #8
+	eor	w10, w10, w13, lsl 8
+	ubfx	x13, x15, #40, #8
+	eor	w10, w10, w19, lsl 16
+	ubfx	x19, x15, #16, #8
+	eor	w10, w10, w20, lsl 24
+	ubfx	x20, x14, #56, #8
+	lsl	w11, w11, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w11, [x8, x11, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x12, x14, #32, #8
+	eor	w11, w11, w13, lsl 8
+	ubfx	x13, x14, #8, #8
+	eor	w11, w11, w19, lsl 16
+	ubfx	x19, x15, #48, #8
+	eor	w11, w11, w20, lsl 24
+	ubfx	x20, x15, #24, #8
+	bfi	x10, x11, #32, #32
+	lsl	w12, w12, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w12, [x8, x12, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	ubfx	x17, x15, #56, #8
+	eor	w12, w12, w13, lsl 8
+	ubfx	x13, x15, #0, #8
+	eor	w12, w12, w19, lsl 16
+	ubfx	x19, x14, #40, #8
+	eor	w11, w12, w20, lsl 24
+	ubfx	x20, x14, #16, #8
+	lsl	w17, w17, #2
+	lsl	w13, w13, #2
+	lsl	w19, w19, #2
+	lsl	w20, w20, #2
+	ldrb	w17, [x8, x17, LSL 0]
+	ldrb	w13, [x8, x13, LSL 0]
+	ldrb	w19, [x8, x19, LSL 0]
+	ldrb	w20, [x8, x20, LSL 0]
+	eor	w19, w19, w17, lsl 16
+	ldp	x14, x15, [x26]
+	eor	w13, w13, w19, lsl 8
+	eor	w13, w13, w20, lsl 16
+	bfi	x11, x13, #32, #32
+	;   XOR in Key Schedule
+	eor	x10, x10, x14
+	eor	x11, x11, x15
+	rev32	x10, x10
+	rev32	x11, x11
+	eor	x10, x10, x21
+	eor	x11, x11, x22
+	stp	x10, x11, [x1]
+L_AES_XTS_encrypt_done_data
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldr	x26, [x29, #88]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	IF :DEF:HAVE_AES_DECRYPT
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	AES_XTS_decrypt
+AES_XTS_decrypt PROC
+	stp	x29, x30, [sp, #-112]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	stp	x26, x27, [x29, #88]
+	str	x28, [x29, #104]
+	adrp	x8, L_AES_ARM64_td
+	add	x8, x8, L_AES_ARM64_td
+	adrp	x9, L_AES_ARM64_td4
+	add	x9, x9, L_AES_ARM64_td4
+	adrp	x10, L_AES_ARM64_te
+	add	x10, x10, L_AES_ARM64_te
+	ands	w11, w2, #15
+	cset	w11, ne
+	sub	w2, w2, w11, lsl 4
+	mov	x11, #0x87
+	mov	x28, x5
+	ldp	x23, x24, [x3]
+	ldp	x16, x17, [x28], #16
+	rev32	x23, x23
+	rev32	x24, x24
+	; Round: 0 - XOR in key schedule
+	eor	x23, x23, x16
+	eor	x24, x24, x17
+	sub	w27, w7, #2
+L_AES_XTS_decrypt_loop_nr_tweak
+	ubfx	x16, x23, #48, #8
+	ubfx	x20, x23, #24, #8
+	ubfx	x21, x24, #8, #8
+	ubfx	x22, x24, #32, #8
+	ldr	x25, [x10]
+	ldr	x25, [x10, #64]
+	ldr	x25, [x10, #128]
+	ldr	x25, [x10, #192]
+	ldr	x25, [x10, #256]
+	ldr	x25, [x10, #320]
+	ldr	x25, [x10, #384]
+	ldr	x25, [x10, #448]
+	ldr	x25, [x10, #512]
+	ldr	x25, [x10, #576]
+	ldr	x25, [x10, #640]
+	ldr	x25, [x10, #704]
+	ldr	x25, [x10, #768]
+	ldr	x25, [x10, #832]
+	ldr	x25, [x10, #896]
+	ldr	x25, [x10, #960]
+	ldr	w16, [x10, x16, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x17, x24, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x23, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x24, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x23, #0, #8
+	ldr	w17, [x10, x17, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x19, x24, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x24, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x23, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x23, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x10, x19, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x25, x24, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x23, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x24, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x23, #40, #8
+	ldr	w25, [x10, x25, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	eor	w21, w21, w25, ror 24
+	ldp	x23, x24, [x28], #16
+	eor	w20, w20, w21, ror 24
+	eor	w20, w20, w22, ror 8
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x23
+	eor	x17, x17, x24
+	ubfx	x23, x16, #48, #8
+	ubfx	x26, x16, #24, #8
+	ubfx	x21, x17, #8, #8
+	ubfx	x22, x17, #32, #8
+	ldr	x19, [x10]
+	ldr	x19, [x10, #64]
+	ldr	x19, [x10, #128]
+	ldr	x19, [x10, #192]
+	ldr	x19, [x10, #256]
+	ldr	x19, [x10, #320]
+	ldr	x19, [x10, #384]
+	ldr	x19, [x10, #448]
+	ldr	x19, [x10, #512]
+	ldr	x19, [x10, #576]
+	ldr	x19, [x10, #640]
+	ldr	x19, [x10, #704]
+	ldr	x19, [x10, #768]
+	ldr	x19, [x10, #832]
+	ldr	x19, [x10, #896]
+	ldr	x19, [x10, #960]
+	ldr	w23, [x10, x23, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x24, x17, #16, #8
+	eor	w23, w23, w26, ror 24
+	ubfx	x26, x16, #56, #8
+	eor	w23, w23, w21, ror 8
+	ubfx	x21, x17, #40, #8
+	eor	w23, w23, w22, ror 16
+	ubfx	x22, x16, #0, #8
+	ldr	w24, [x10, x24, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x25, x17, #48, #8
+	eor	w24, w24, w26, ror 24
+	ubfx	x26, x17, #24, #8
+	eor	w24, w24, w21, ror 8
+	ubfx	x21, x16, #8, #8
+	eor	w24, w24, w22, ror 16
+	ubfx	x22, x16, #32, #8
+	bfi	x23, x24, #32, #32
+	ldr	w25, [x10, x25, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x19, x17, #0, #8
+	eor	w25, w25, w26, ror 24
+	ubfx	x26, x16, #16, #8
+	eor	w25, w25, w21, ror 8
+	ubfx	x21, x17, #56, #8
+	eor	w24, w25, w22, ror 16
+	ubfx	x22, x16, #40, #8
+	ldr	w19, [x10, x19, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w26, [x10, x26, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	eor	w21, w21, w19, ror 24
+	ldp	x16, x17, [x28], #16
+	eor	w26, w26, w21, ror 24
+	eor	w26, w26, w22, ror 8
+	bfi	x24, x26, #32, #32
+	;   XOR in Key Schedule
+	eor	x23, x23, x16
+	eor	x24, x24, x17
+	subs	w27, w27, #2
+	bne	L_AES_XTS_decrypt_loop_nr_tweak
+	ubfx	x16, x23, #48, #8
+	ubfx	x20, x23, #24, #8
+	ubfx	x21, x24, #8, #8
+	ubfx	x22, x24, #32, #8
+	ldr	x25, [x10]
+	ldr	x25, [x10, #64]
+	ldr	x25, [x10, #128]
+	ldr	x25, [x10, #192]
+	ldr	x25, [x10, #256]
+	ldr	x25, [x10, #320]
+	ldr	x25, [x10, #384]
+	ldr	x25, [x10, #448]
+	ldr	x25, [x10, #512]
+	ldr	x25, [x10, #576]
+	ldr	x25, [x10, #640]
+	ldr	x25, [x10, #704]
+	ldr	x25, [x10, #768]
+	ldr	x25, [x10, #832]
+	ldr	x25, [x10, #896]
+	ldr	x25, [x10, #960]
+	ldr	w16, [x10, x16, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x17, x24, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x23, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x24, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x23, #0, #8
+	ldr	w17, [x10, x17, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x19, x24, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x24, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x23, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x23, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x10, x19, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	ubfx	x25, x24, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x23, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x24, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x23, #40, #8
+	ldr	w25, [x10, x25, LSL 2]
+	ldr	w21, [x10, x21, LSL 2]
+	ldr	w20, [x10, x20, LSL 2]
+	ldr	w22, [x10, x22, LSL 2]
+	eor	w21, w21, w25, ror 24
+	ldp	x23, x24, [x28], #16
+	eor	w20, w20, w21, ror 24
+	eor	w20, w20, w22, ror 8
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x23
+	eor	x17, x17, x24
+	ubfx	x23, x17, #32, #8
+	ubfx	x26, x17, #8, #8
+	ubfx	x21, x16, #48, #8
+	ubfx	x22, x16, #24, #8
+	lsl	w23, w23, #2
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldr	x20, [x10]
+	ldr	x20, [x10, #64]
+	ldr	x20, [x10, #128]
+	ldr	x20, [x10, #192]
+	ldr	x20, [x10, #256]
+	ldr	x20, [x10, #320]
+	ldr	x20, [x10, #384]
+	ldr	x20, [x10, #448]
+	ldr	x20, [x10, #512]
+	ldr	x20, [x10, #576]
+	ldr	x20, [x10, #640]
+	ldr	x20, [x10, #704]
+	ldr	x20, [x10, #768]
+	ldr	x20, [x10, #832]
+	ldr	x20, [x10, #896]
+	ldr	x20, [x10, #960]
+	ldrb	w23, [x10, x23, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	ubfx	x24, x16, #0, #8
+	eor	w23, w23, w26, lsl 8
+	ubfx	x26, x17, #40, #8
+	eor	w23, w23, w21, lsl 16
+	ubfx	x21, x17, #16, #8
+	eor	w23, w23, w22, lsl 24
+	ubfx	x22, x16, #56, #8
+	lsl	w24, w24, #2
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldrb	w24, [x10, x24, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	ubfx	x25, x16, #32, #8
+	eor	w24, w24, w26, lsl 8
+	ubfx	x26, x16, #8, #8
+	eor	w24, w24, w21, lsl 16
+	ubfx	x21, x17, #48, #8
+	eor	w24, w24, w22, lsl 24
+	ubfx	x22, x17, #24, #8
+	bfi	x23, x24, #32, #32
+	lsl	w25, w25, #2
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldrb	w25, [x10, x25, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	ubfx	x20, x17, #56, #8
+	eor	w25, w25, w26, lsl 8
+	ubfx	x26, x17, #0, #8
+	eor	w25, w25, w21, lsl 16
+	ubfx	x21, x16, #40, #8
+	eor	w24, w25, w22, lsl 24
+	ubfx	x22, x16, #16, #8
+	lsl	w20, w20, #2
+	lsl	w26, w26, #2
+	lsl	w21, w21, #2
+	lsl	w22, w22, #2
+	ldrb	w20, [x10, x20, LSL 0]
+	ldrb	w26, [x10, x26, LSL 0]
+	ldrb	w21, [x10, x21, LSL 0]
+	ldrb	w22, [x10, x22, LSL 0]
+	eor	w21, w21, w20, lsl 16
+	ldp	x16, x17, [x28]
+	eor	w26, w26, w21, lsl 8
+	eor	w26, w26, w22, lsl 16
+	bfi	x24, x26, #32, #32
+	;   XOR in Key Schedule
+	eor	x23, x23, x16
+	eor	x24, x24, x17
+	rev32	x23, x23
+	rev32	x24, x24
+	cmp	w2, #16
+	blt	L_AES_XTS_decrypt_start_partail
+L_AES_XTS_decrypt_loop_block
+	mov	x28, x4
+	ldp	x12, x13, [x0]
+	ldp	x16, x17, [x28], #16
+	eor	x12, x12, x23
+	eor	x13, x13, x24
+	rev32	x12, x12
+	rev32	x13, x13
+	; Round: 0 - XOR in key schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	sub	w27, w7, #2
+L_AES_XTS_decrypt_loop_nr
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x12, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x13, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x13, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x12, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x13, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x13, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x13, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
+	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x17, #48, #8
+	ubfx	x15, x16, #24, #8
+	ubfx	x21, x17, #8, #8
+	ubfx	x22, x16, #32, #8
+	ldr	x19, [x8]
+	ldr	x19, [x8, #64]
+	ldr	x19, [x8, #128]
+	ldr	x19, [x8, #192]
+	ldr	x19, [x8, #256]
+	ldr	x19, [x8, #320]
+	ldr	x19, [x8, #384]
+	ldr	x19, [x8, #448]
+	ldr	x19, [x8, #512]
+	ldr	x19, [x8, #576]
+	ldr	x19, [x8, #640]
+	ldr	x19, [x8, #704]
+	ldr	x19, [x8, #768]
+	ldr	x19, [x8, #832]
+	ldr	x19, [x8, #896]
+	ldr	x19, [x8, #960]
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x13, x16, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x16, #56, #8
+	eor	w12, w12, w21, ror 8
+	ubfx	x21, x17, #40, #8
+	eor	w12, w12, w22, ror 16
+	ubfx	x22, x17, #0, #8
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x16, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x17, #24, #8
+	eor	w13, w13, w21, ror 8
+	ubfx	x21, x16, #8, #8
+	eor	w13, w13, w22, ror 16
+	ubfx	x22, x17, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x16, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x17, #16, #8
+	eor	w14, w14, w21, ror 8
+	ubfx	x21, x17, #56, #8
+	eor	w13, w14, w22, ror 16
+	ubfx	x22, x16, #40, #8
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w19, ror 24
+	ldp	x16, x17, [x28], #16
+	eor	w15, w15, w22, ror 8
+	eor	w15, w15, w21, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	subs	w27, w27, #2
+	bne	L_AES_XTS_decrypt_loop_nr
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x12, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x13, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x13, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x12, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x13, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x13, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x13, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
+	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x16, #32, #8
+	ubfx	x15, x17, #8, #8
+	ubfx	x21, x17, #48, #8
+	ubfx	x22, x16, #24, #8
+	ldr	x20, [x9]
+	ldr	x20, [x9, #64]
+	ldr	x20, [x9, #128]
+	ldr	x20, [x9, #192]
+	ldrb	w12, [x9, x12, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ubfx	x13, x17, #0, #8
+	eor	w12, w12, w15, lsl 8
+	ubfx	x15, x17, #40, #8
+	eor	w12, w12, w21, lsl 16
+	ubfx	x21, x16, #16, #8
+	eor	w12, w12, w22, lsl 24
+	ubfx	x22, x16, #56, #8
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w13, [x9, x13, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ubfx	x14, x17, #32, #8
+	eor	w13, w13, w15, lsl 8
+	ubfx	x15, x16, #8, #8
+	eor	w13, w13, w21, lsl 16
+	ubfx	x21, x16, #48, #8
+	eor	w13, w13, w22, lsl 24
+	ubfx	x22, x17, #24, #8
+	bfi	x12, x13, #32, #32
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w14, [x9, x14, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ubfx	x20, x17, #56, #8
+	eor	w14, w14, w15, lsl 8
+	ubfx	x15, x16, #0, #8
+	eor	w14, w14, w21, lsl 16
+	ubfx	x21, x16, #40, #8
+	eor	w13, w14, w22, lsl 24
+	ubfx	x22, x17, #16, #8
+	ldrb	w20, [x9, x20, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	eor	w21, w21, w20, lsl 16
+	ldp	x16, x17, [x28]
+	eor	w15, w15, w21, lsl 8
+	eor	w15, w15, w22, lsl 16
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	rev32	x12, x12
+	rev32	x13, x13
+	eor	x12, x12, x23
+	eor	x13, x13, x24
+	stp	x12, x13, [x1]
+	and	x21, x11, x24, asr 63
+	extr	x24, x24, x23, #63
+	eor	x23, x21, x23, lsl 1
+	sub	w2, w2, #16
+	add	x0, x0, #16
+	add	x1, x1, #16
+	cmp	w2, #16
+	bge	L_AES_XTS_decrypt_loop_block
+	cbz	w2, L_AES_XTS_decrypt_done_data
+L_AES_XTS_decrypt_start_partail
+	and	x21, x11, x24, asr 63
+	extr	x26, x24, x23, #63
+	eor	x25, x21, x23, lsl 1
+	mov	x28, x4
+	ldp	x12, x13, [x0], #16
+	ldp	x16, x17, [x28], #16
+	eor	x12, x12, x25
+	eor	x13, x13, x26
+	rev32	x12, x12
+	rev32	x13, x13
+	; Round: 0 - XOR in key schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	sub	w27, w7, #2
+L_AES_XTS_decrypt_loop_nr_partial_1
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x12, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x13, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x13, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x12, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x13, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x13, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x13, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
+	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x17, #48, #8
+	ubfx	x15, x16, #24, #8
+	ubfx	x21, x17, #8, #8
+	ubfx	x22, x16, #32, #8
+	ldr	x19, [x8]
+	ldr	x19, [x8, #64]
+	ldr	x19, [x8, #128]
+	ldr	x19, [x8, #192]
+	ldr	x19, [x8, #256]
+	ldr	x19, [x8, #320]
+	ldr	x19, [x8, #384]
+	ldr	x19, [x8, #448]
+	ldr	x19, [x8, #512]
+	ldr	x19, [x8, #576]
+	ldr	x19, [x8, #640]
+	ldr	x19, [x8, #704]
+	ldr	x19, [x8, #768]
+	ldr	x19, [x8, #832]
+	ldr	x19, [x8, #896]
+	ldr	x19, [x8, #960]
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x13, x16, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x16, #56, #8
+	eor	w12, w12, w21, ror 8
+	ubfx	x21, x17, #40, #8
+	eor	w12, w12, w22, ror 16
+	ubfx	x22, x17, #0, #8
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x16, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x17, #24, #8
+	eor	w13, w13, w21, ror 8
+	ubfx	x21, x16, #8, #8
+	eor	w13, w13, w22, ror 16
+	ubfx	x22, x17, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x16, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x17, #16, #8
+	eor	w14, w14, w21, ror 8
+	ubfx	x21, x17, #56, #8
+	eor	w13, w14, w22, ror 16
+	ubfx	x22, x16, #40, #8
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w19, ror 24
+	ldp	x16, x17, [x28], #16
+	eor	w15, w15, w22, ror 8
+	eor	w15, w15, w21, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	subs	w27, w27, #2
+	bne	L_AES_XTS_decrypt_loop_nr_partial_1
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x12, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x13, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x13, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x12, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x13, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x13, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x13, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
+	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x16, #32, #8
+	ubfx	x15, x17, #8, #8
+	ubfx	x21, x17, #48, #8
+	ubfx	x22, x16, #24, #8
+	ldr	x20, [x9]
+	ldr	x20, [x9, #64]
+	ldr	x20, [x9, #128]
+	ldr	x20, [x9, #192]
+	ldrb	w12, [x9, x12, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ubfx	x13, x17, #0, #8
+	eor	w12, w12, w15, lsl 8
+	ubfx	x15, x17, #40, #8
+	eor	w12, w12, w21, lsl 16
+	ubfx	x21, x16, #16, #8
+	eor	w12, w12, w22, lsl 24
+	ubfx	x22, x16, #56, #8
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w13, [x9, x13, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ubfx	x14, x17, #32, #8
+	eor	w13, w13, w15, lsl 8
+	ubfx	x15, x16, #8, #8
+	eor	w13, w13, w21, lsl 16
+	ubfx	x21, x16, #48, #8
+	eor	w13, w13, w22, lsl 24
+	ubfx	x22, x17, #24, #8
+	bfi	x12, x13, #32, #32
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w14, [x9, x14, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ubfx	x20, x17, #56, #8
+	eor	w14, w14, w15, lsl 8
+	ubfx	x15, x16, #0, #8
+	eor	w14, w14, w21, lsl 16
+	ubfx	x21, x16, #40, #8
+	eor	w13, w14, w22, lsl 24
+	ubfx	x22, x17, #16, #8
+	ldrb	w20, [x9, x20, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	eor	w21, w21, w20, lsl 16
+	ldp	x16, x17, [x28]
+	eor	w15, w15, w21, lsl 8
+	eor	w15, w15, w22, lsl 16
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	rev32	x12, x12
+	rev32	x13, x13
+	eor	x12, x12, x25
+	eor	x13, x13, x26
+	stp	x12, x13, [x6]
+	add	x1, x1, #16
+	mov	w16, w2
+L_AES_XTS_decrypt_start_byte
+	ldrb	w21, [x6]
+	ldrb	w22, [x0], #1
+	strb	w21, [x1], #1
+	strb	w22, [x6], #1
+	subs	w16, w16, #1
+	bgt	L_AES_XTS_decrypt_start_byte
+	sub	x1, x1, x2
+	sub	x6, x6, x2
+	sub	x1, x1, #16
+	mov	x28, x4
+	ldp	x12, x13, [x6]
+	ldp	x16, x17, [x28], #16
+	eor	x12, x12, x23
+	eor	x13, x13, x24
+	rev32	x12, x12
+	rev32	x13, x13
+	; Round: 0 - XOR in key schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	sub	w27, w7, #2
+L_AES_XTS_decrypt_loop_nr_partial_2
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x12, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x13, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x13, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x12, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x13, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x13, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x13, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
+	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x17, #48, #8
+	ubfx	x15, x16, #24, #8
+	ubfx	x21, x17, #8, #8
+	ubfx	x22, x16, #32, #8
+	ldr	x19, [x8]
+	ldr	x19, [x8, #64]
+	ldr	x19, [x8, #128]
+	ldr	x19, [x8, #192]
+	ldr	x19, [x8, #256]
+	ldr	x19, [x8, #320]
+	ldr	x19, [x8, #384]
+	ldr	x19, [x8, #448]
+	ldr	x19, [x8, #512]
+	ldr	x19, [x8, #576]
+	ldr	x19, [x8, #640]
+	ldr	x19, [x8, #704]
+	ldr	x19, [x8, #768]
+	ldr	x19, [x8, #832]
+	ldr	x19, [x8, #896]
+	ldr	x19, [x8, #960]
+	ldr	w12, [x8, x12, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x13, x16, #16, #8
+	eor	w12, w12, w15, ror 24
+	ubfx	x15, x16, #56, #8
+	eor	w12, w12, w21, ror 8
+	ubfx	x21, x17, #40, #8
+	eor	w12, w12, w22, ror 16
+	ubfx	x22, x17, #0, #8
+	ldr	w13, [x8, x13, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x16, #48, #8
+	eor	w13, w13, w15, ror 24
+	ubfx	x15, x17, #24, #8
+	eor	w13, w13, w21, ror 8
+	ubfx	x21, x16, #8, #8
+	eor	w13, w13, w22, ror 16
+	ubfx	x22, x17, #32, #8
+	bfi	x12, x13, #32, #32
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x16, #0, #8
+	eor	w14, w14, w15, ror 24
+	ubfx	x15, x17, #16, #8
+	eor	w14, w14, w21, ror 8
+	ubfx	x21, x17, #56, #8
+	eor	w13, w14, w22, ror 16
+	ubfx	x22, x16, #40, #8
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w15, [x8, x15, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w19, ror 24
+	ldp	x16, x17, [x28], #16
+	eor	w15, w15, w22, ror 8
+	eor	w15, w15, w21, ror 24
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	subs	w27, w27, #2
+	bne	L_AES_XTS_decrypt_loop_nr_partial_2
+	ubfx	x16, x13, #48, #8
+	ubfx	x20, x12, #24, #8
+	ubfx	x21, x13, #8, #8
+	ubfx	x22, x12, #32, #8
+	ldr	x14, [x8]
+	ldr	x14, [x8, #64]
+	ldr	x14, [x8, #128]
+	ldr	x14, [x8, #192]
+	ldr	x14, [x8, #256]
+	ldr	x14, [x8, #320]
+	ldr	x14, [x8, #384]
+	ldr	x14, [x8, #448]
+	ldr	x14, [x8, #512]
+	ldr	x14, [x8, #576]
+	ldr	x14, [x8, #640]
+	ldr	x14, [x8, #704]
+	ldr	x14, [x8, #768]
+	ldr	x14, [x8, #832]
+	ldr	x14, [x8, #896]
+	ldr	x14, [x8, #960]
+	ldr	w16, [x8, x16, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x17, x12, #16, #8
+	eor	w16, w16, w20, ror 24
+	ubfx	x20, x12, #56, #8
+	eor	w16, w16, w21, ror 8
+	ubfx	x21, x13, #40, #8
+	eor	w16, w16, w22, ror 16
+	ubfx	x22, x13, #0, #8
+	ldr	w17, [x8, x17, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x19, x12, #48, #8
+	eor	w17, w17, w20, ror 24
+	ubfx	x20, x13, #24, #8
+	eor	w17, w17, w21, ror 8
+	ubfx	x21, x12, #8, #8
+	eor	w17, w17, w22, ror 16
+	ubfx	x22, x13, #32, #8
+	bfi	x16, x17, #32, #32
+	ldr	w19, [x8, x19, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	ubfx	x14, x12, #0, #8
+	eor	w19, w19, w20, ror 24
+	ubfx	x20, x13, #16, #8
+	eor	w19, w19, w21, ror 8
+	ubfx	x21, x13, #56, #8
+	eor	w17, w19, w22, ror 16
+	ubfx	x22, x12, #40, #8
+	ldr	w14, [x8, x14, LSL 2]
+	ldr	w21, [x8, x21, LSL 2]
+	ldr	w20, [x8, x20, LSL 2]
+	ldr	w22, [x8, x22, LSL 2]
+	eor	w21, w21, w14, ror 24
+	ldp	x12, x13, [x28], #16
+	eor	w20, w20, w22, ror 8
+	eor	w20, w20, w21, ror 24
+	bfi	x17, x20, #32, #32
+	;   XOR in Key Schedule
+	eor	x16, x16, x12
+	eor	x17, x17, x13
+	ubfx	x12, x16, #32, #8
+	ubfx	x15, x17, #8, #8
+	ubfx	x21, x17, #48, #8
+	ubfx	x22, x16, #24, #8
+	ldr	x20, [x9]
+	ldr	x20, [x9, #64]
+	ldr	x20, [x9, #128]
+	ldr	x20, [x9, #192]
+	ldrb	w12, [x9, x12, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ubfx	x13, x17, #0, #8
+	eor	w12, w12, w15, lsl 8
+	ubfx	x15, x17, #40, #8
+	eor	w12, w12, w21, lsl 16
+	ubfx	x21, x16, #16, #8
+	eor	w12, w12, w22, lsl 24
+	ubfx	x22, x16, #56, #8
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w13, [x9, x13, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ubfx	x14, x17, #32, #8
+	eor	w13, w13, w15, lsl 8
+	ubfx	x15, x16, #8, #8
+	eor	w13, w13, w21, lsl 16
+	ubfx	x21, x16, #48, #8
+	eor	w13, w13, w22, lsl 24
+	ubfx	x22, x17, #24, #8
+	bfi	x12, x13, #32, #32
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	ldrb	w14, [x9, x14, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ubfx	x20, x17, #56, #8
+	eor	w14, w14, w15, lsl 8
+	ubfx	x15, x16, #0, #8
+	eor	w14, w14, w21, lsl 16
+	ubfx	x21, x16, #40, #8
+	eor	w13, w14, w22, lsl 24
+	ubfx	x22, x17, #16, #8
+	ldrb	w20, [x9, x20, LSL 0]
+	ldrb	w21, [x9, x21, LSL 0]
+	ldrb	w15, [x9, x15, LSL 0]
+	ldrb	w22, [x9, x22, LSL 0]
+	eor	w21, w21, w20, lsl 16
+	ldp	x16, x17, [x28]
+	eor	w15, w15, w21, lsl 8
+	eor	w15, w15, w22, lsl 16
+	bfi	x13, x15, #32, #32
+	;   XOR in Key Schedule
+	eor	x12, x12, x16
+	eor	x13, x13, x17
+	rev32	x12, x12
+	rev32	x13, x13
+	eor	x12, x12, x23
+	eor	x13, x13, x24
+	stp	x12, x13, [x1]
+L_AES_XTS_decrypt_done_data
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldp	x26, x27, [x29, #88]
+	ldr	x28, [x29, #104]
+	ldp	x29, x30, [sp], #0x70
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	ENDIF
+	ENDIF
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-chacha-asm.asm b/wolfcrypt/src/port/arm/armv8-chacha-asm.asm
new file mode 100644
index 0000000000..6a8a7e6565
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-chacha-asm.asm
@@ -0,0 +1,1016 @@
+; /* armv8-chacha-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./chacha/chacha.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-chacha-asm.asm
+	IF :DEF:HAVE_CHACHA
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_chacha20_arm64_ctr
+	DCD	0x00000000, 0x00000001, 0x00000002, 0x00000003
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_chacha20_arm64_rol8
+	DCD	0x02010003, 0x06050407, 0x0a09080b, 0x0e0d0c0f
+	IF :LNOT::DEF:WOLFSSL_ARMASM_NO_NEON
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	wc_chacha_crypt_bytes
+wc_chacha_crypt_bytes PROC
+	stp	x29, x30, [sp, #-160]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	str	x26, [x29, #88]
+	stp	d8, d9, [x29, #96]
+	stp	d10, d11, [x29, #112]
+	stp	d12, d13, [x29, #128]
+	stp	d14, d15, [x29, #144]
+	adrp	x5, L_chacha20_arm64_rol8
+	add	x5, x5, L_chacha20_arm64_rol8
+	adrp	x6, L_chacha20_arm64_ctr
+	add	x6, x6, L_chacha20_arm64_ctr
+	eor	v29.16b, v29.16b, v29.16b
+	mov	x26, #5
+	eor	v31.16b, v31.16b, v31.16b
+	mov	w7, #1
+	ld1	{v30.16b}, [x5]
+	ld1	{v28.4s}, [x6]
+	add	x4, x0, #0x44
+	mov	v29.s[0], w26
+	mov	v31.s[0], w7
+	; Load state to encrypt
+	ld1	{v16.4s, v17.4s, v18.4s, v19.4s}, [x0]
+	cmp	x3, #0x140
+	blt	L_chacha_crypt_bytes_arm64_lt_320
+	mov	w25, #4
+L_chacha_crypt_bytes_arm64_loop_320
+	; Move state into regular register
+	mov	x8, v16.d[0]
+	mov	x10, v16.d[1]
+	mov	x12, v17.d[0]
+	mov	x14, v17.d[1]
+	mov	x16, v18.d[0]
+	mov	x19, v18.d[1]
+	mov	x21, v19.d[0]
+	mov	x23, v19.d[1]
+	sub	x3, x3, #0x140
+	; Move state into vector registers
+	dup	v0.4s, v16.s[0]
+	dup	v1.4s, v16.s[1]
+	lsr	x9, x8, #32
+	dup	v2.4s, v16.s[2]
+	dup	v3.4s, v16.s[3]
+	lsr	x11, x10, #32
+	dup	v4.4s, v17.s[0]
+	dup	v5.4s, v17.s[1]
+	lsr	x13, x12, #32
+	dup	v6.4s, v17.s[2]
+	dup	v7.4s, v17.s[3]
+	lsr	x15, x14, #32
+	dup	v8.4s, v18.s[0]
+	dup	v9.4s, v18.s[1]
+	lsr	x17, x16, #32
+	dup	v10.4s, v18.s[2]
+	dup	v11.4s, v18.s[3]
+	lsr	x20, x19, #32
+	dup	v12.4s, v19.s[0]
+	dup	v13.4s, v19.s[1]
+	lsr	x22, x21, #32
+	dup	v14.4s, v19.s[2]
+	dup	v15.4s, v19.s[3]
+	lsr	x24, x23, #32
+	; Add to counter word
+	add	v12.4s, v12.4s, v28.4s
+	add	w21, w21, w25
+	; Set number of odd+even rounds to perform
+	mov	x26, #10
+L_chacha_crypt_bytes_arm64_round_start_320
+	subs	x26, x26, #1
+	; Round odd
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v4.4s
+	add	w8, w8, w12
+	add	v1.4s, v1.4s, v5.4s
+	add	w9, w9, w13
+	add	v2.4s, v2.4s, v6.4s
+	add	w10, w10, w14
+	add	v3.4s, v3.4s, v7.4s
+	add	w11, w11, w15
+	eor	v12.16b, v12.16b, v0.16b
+	eor	w21, w21, w8
+	eor	v13.16b, v13.16b, v1.16b
+	eor	w22, w22, w9
+	eor	v14.16b, v14.16b, v2.16b
+	eor	w23, w23, w10
+	eor	v15.16b, v15.16b, v3.16b
+	eor	w24, w24, w11
+	rev32	v12.8h, v12.8h
+	ror	w21, w21, #16
+	rev32	v13.8h, v13.8h
+	ror	w22, w22, #16
+	rev32	v14.8h, v14.8h
+	ror	w23, w23, #16
+	rev32	v15.8h, v15.8h
+	ror	w24, w24, #16
+	; c += d; b ^= c; b <<<= 12;
+	add	v8.4s, v8.4s, v12.4s
+	add	w16, w16, w21
+	add	v9.4s, v9.4s, v13.4s
+	add	w17, w17, w22
+	add	v10.4s, v10.4s, v14.4s
+	add	w19, w19, w23
+	add	v11.4s, v11.4s, v15.4s
+	add	w20, w20, w24
+	eor	v20.16b, v4.16b, v8.16b
+	eor	w12, w12, w16
+	eor	v21.16b, v5.16b, v9.16b
+	eor	w13, w13, w17
+	eor	v22.16b, v6.16b, v10.16b
+	eor	w14, w14, w19
+	eor	v23.16b, v7.16b, v11.16b
+	eor	w15, w15, w20
+	shl	v4.4s, v20.4s, #12
+	ror	w12, w12, #20
+	shl	v5.4s, v21.4s, #12
+	ror	w13, w13, #20
+	shl	v6.4s, v22.4s, #12
+	ror	w14, w14, #20
+	shl	v7.4s, v23.4s, #12
+	ror	w15, w15, #20
+	sri	v4.4s, v20.4s, #20
+	sri	v5.4s, v21.4s, #20
+	sri	v6.4s, v22.4s, #20
+	sri	v7.4s, v23.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v4.4s
+	add	w8, w8, w12
+	add	v1.4s, v1.4s, v5.4s
+	add	w9, w9, w13
+	add	v2.4s, v2.4s, v6.4s
+	add	w10, w10, w14
+	add	v3.4s, v3.4s, v7.4s
+	add	w11, w11, w15
+	eor	v12.16b, v12.16b, v0.16b
+	eor	w21, w21, w8
+	eor	v13.16b, v13.16b, v1.16b
+	eor	w22, w22, w9
+	eor	v14.16b, v14.16b, v2.16b
+	eor	w23, w23, w10
+	eor	v15.16b, v15.16b, v3.16b
+	eor	w24, w24, w11
+	tbl	v12.16b, {v12.16b}, v30.16b
+	ror	w21, w21, #24
+	tbl	v13.16b, {v13.16b}, v30.16b
+	ror	w22, w22, #24
+	tbl	v14.16b, {v14.16b}, v30.16b
+	ror	w23, w23, #24
+	tbl	v15.16b, {v15.16b}, v30.16b
+	ror	w24, w24, #24
+	; c += d; b ^= c; b <<<= 7;
+	add	v8.4s, v8.4s, v12.4s
+	add	w16, w16, w21
+	add	v9.4s, v9.4s, v13.4s
+	add	w17, w17, w22
+	add	v10.4s, v10.4s, v14.4s
+	add	w19, w19, w23
+	add	v11.4s, v11.4s, v15.4s
+	add	w20, w20, w24
+	eor	v20.16b, v4.16b, v8.16b
+	eor	w12, w12, w16
+	eor	v21.16b, v5.16b, v9.16b
+	eor	w13, w13, w17
+	eor	v22.16b, v6.16b, v10.16b
+	eor	w14, w14, w19
+	eor	v23.16b, v7.16b, v11.16b
+	eor	w15, w15, w20
+	shl	v4.4s, v20.4s, #7
+	ror	w12, w12, #25
+	shl	v5.4s, v21.4s, #7
+	ror	w13, w13, #25
+	shl	v6.4s, v22.4s, #7
+	ror	w14, w14, #25
+	shl	v7.4s, v23.4s, #7
+	ror	w15, w15, #25
+	sri	v4.4s, v20.4s, #25
+	sri	v5.4s, v21.4s, #25
+	sri	v6.4s, v22.4s, #25
+	sri	v7.4s, v23.4s, #25
+	; Round even
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v5.4s
+	add	w8, w8, w13
+	add	v1.4s, v1.4s, v6.4s
+	add	w9, w9, w14
+	add	v2.4s, v2.4s, v7.4s
+	add	w10, w10, w15
+	add	v3.4s, v3.4s, v4.4s
+	add	w11, w11, w12
+	eor	v15.16b, v15.16b, v0.16b
+	eor	w24, w24, w8
+	eor	v12.16b, v12.16b, v1.16b
+	eor	w21, w21, w9
+	eor	v13.16b, v13.16b, v2.16b
+	eor	w22, w22, w10
+	eor	v14.16b, v14.16b, v3.16b
+	eor	w23, w23, w11
+	rev32	v15.8h, v15.8h
+	ror	w24, w24, #16
+	rev32	v12.8h, v12.8h
+	ror	w21, w21, #16
+	rev32	v13.8h, v13.8h
+	ror	w22, w22, #16
+	rev32	v14.8h, v14.8h
+	ror	w23, w23, #16
+	; c += d; b ^= c; b <<<= 12;
+	add	v10.4s, v10.4s, v15.4s
+	add	w19, w19, w24
+	add	v11.4s, v11.4s, v12.4s
+	add	w20, w20, w21
+	add	v8.4s, v8.4s, v13.4s
+	add	w16, w16, w22
+	add	v9.4s, v9.4s, v14.4s
+	add	w17, w17, w23
+	eor	v20.16b, v5.16b, v10.16b
+	eor	w13, w13, w19
+	eor	v21.16b, v6.16b, v11.16b
+	eor	w14, w14, w20
+	eor	v22.16b, v7.16b, v8.16b
+	eor	w15, w15, w16
+	eor	v23.16b, v4.16b, v9.16b
+	eor	w12, w12, w17
+	shl	v5.4s, v20.4s, #12
+	ror	w13, w13, #20
+	shl	v6.4s, v21.4s, #12
+	ror	w14, w14, #20
+	shl	v7.4s, v22.4s, #12
+	ror	w15, w15, #20
+	shl	v4.4s, v23.4s, #12
+	ror	w12, w12, #20
+	sri	v5.4s, v20.4s, #20
+	sri	v6.4s, v21.4s, #20
+	sri	v7.4s, v22.4s, #20
+	sri	v4.4s, v23.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v5.4s
+	add	w8, w8, w13
+	add	v1.4s, v1.4s, v6.4s
+	add	w9, w9, w14
+	add	v2.4s, v2.4s, v7.4s
+	add	w10, w10, w15
+	add	v3.4s, v3.4s, v4.4s
+	add	w11, w11, w12
+	eor	v15.16b, v15.16b, v0.16b
+	eor	w24, w24, w8
+	eor	v12.16b, v12.16b, v1.16b
+	eor	w21, w21, w9
+	eor	v13.16b, v13.16b, v2.16b
+	eor	w22, w22, w10
+	eor	v14.16b, v14.16b, v3.16b
+	eor	w23, w23, w11
+	tbl	v15.16b, {v15.16b}, v30.16b
+	ror	w24, w24, #24
+	tbl	v12.16b, {v12.16b}, v30.16b
+	ror	w21, w21, #24
+	tbl	v13.16b, {v13.16b}, v30.16b
+	ror	w22, w22, #24
+	tbl	v14.16b, {v14.16b}, v30.16b
+	ror	w23, w23, #24
+	; c += d; b ^= c; b <<<= 7;
+	add	v10.4s, v10.4s, v15.4s
+	add	w19, w19, w24
+	add	v11.4s, v11.4s, v12.4s
+	add	w20, w20, w21
+	add	v8.4s, v8.4s, v13.4s
+	add	w16, w16, w22
+	add	v9.4s, v9.4s, v14.4s
+	add	w17, w17, w23
+	eor	v20.16b, v5.16b, v10.16b
+	eor	w13, w13, w19
+	eor	v21.16b, v6.16b, v11.16b
+	eor	w14, w14, w20
+	eor	v22.16b, v7.16b, v8.16b
+	eor	w15, w15, w16
+	eor	v23.16b, v4.16b, v9.16b
+	eor	w12, w12, w17
+	shl	v5.4s, v20.4s, #7
+	ror	w13, w13, #25
+	shl	v6.4s, v21.4s, #7
+	ror	w14, w14, #25
+	shl	v7.4s, v22.4s, #7
+	ror	w15, w15, #25
+	shl	v4.4s, v23.4s, #7
+	ror	w12, w12, #25
+	sri	v5.4s, v20.4s, #25
+	sri	v6.4s, v21.4s, #25
+	sri	v7.4s, v22.4s, #25
+	sri	v4.4s, v23.4s, #25
+	bne	L_chacha_crypt_bytes_arm64_round_start_320
+	; Add counter now rather than after transposed
+	add	v12.4s, v12.4s, v28.4s
+	add	w21, w21, w25
+	; Load message
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	; Transpose vectors
+	trn1	v20.4s, v0.4s, v1.4s
+	trn1	v22.4s, v2.4s, v3.4s
+	orr	x8, x8, x9, lsl 32
+	trn2	v21.4s, v0.4s, v1.4s
+	trn2	v23.4s, v2.4s, v3.4s
+	trn1	v0.2d, v20.2d, v22.2d
+	trn1	v1.2d, v21.2d, v23.2d
+	orr	x10, x10, x11, lsl 32
+	trn2	v2.2d, v20.2d, v22.2d
+	trn2	v3.2d, v21.2d, v23.2d
+	trn1	v20.4s, v4.4s, v5.4s
+	trn1	v22.4s, v6.4s, v7.4s
+	orr	x12, x12, x13, lsl 32
+	trn2	v21.4s, v4.4s, v5.4s
+	trn2	v23.4s, v6.4s, v7.4s
+	trn1	v4.2d, v20.2d, v22.2d
+	trn1	v5.2d, v21.2d, v23.2d
+	orr	x14, x14, x15, lsl 32
+	trn2	v6.2d, v20.2d, v22.2d
+	trn2	v7.2d, v21.2d, v23.2d
+	trn1	v20.4s, v8.4s, v9.4s
+	trn1	v22.4s, v10.4s, v11.4s
+	orr	x16, x16, x17, lsl 32
+	trn2	v21.4s, v8.4s, v9.4s
+	trn2	v23.4s, v10.4s, v11.4s
+	trn1	v8.2d, v20.2d, v22.2d
+	trn1	v9.2d, v21.2d, v23.2d
+	orr	x19, x19, x20, lsl 32
+	trn2	v10.2d, v20.2d, v22.2d
+	trn2	v11.2d, v21.2d, v23.2d
+	trn1	v20.4s, v12.4s, v13.4s
+	trn1	v22.4s, v14.4s, v15.4s
+	orr	x21, x21, x22, lsl 32
+	trn2	v21.4s, v12.4s, v13.4s
+	trn2	v23.4s, v14.4s, v15.4s
+	trn1	v12.2d, v20.2d, v22.2d
+	trn1	v13.2d, v21.2d, v23.2d
+	orr	x23, x23, x24, lsl 32
+	trn2	v14.2d, v20.2d, v22.2d
+	trn2	v15.2d, v21.2d, v23.2d
+	; Add back state, XOR in message and store (load next block)
+	add	v20.4s, v0.4s, v16.4s
+	add	v21.4s, v4.4s, v17.4s
+	add	v22.4s, v8.4s, v18.4s
+	add	v23.4s, v12.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	add	v20.4s, v1.4s, v16.4s
+	add	v21.4s, v5.4s, v17.4s
+	add	v22.4s, v9.4s, v18.4s
+	add	v23.4s, v13.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	add	v20.4s, v2.4s, v16.4s
+	add	v21.4s, v6.4s, v17.4s
+	add	v22.4s, v10.4s, v18.4s
+	add	v23.4s, v14.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	add	v20.4s, v3.4s, v16.4s
+	add	v21.4s, v7.4s, v17.4s
+	add	v22.4s, v11.4s, v18.4s
+	add	v23.4s, v15.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	; Move regular registers into vector registers for adding and xor
+	mov	v0.d[0], x8
+	mov	v0.d[1], x10
+	mov	v1.d[0], x12
+	mov	v1.d[1], x14
+	mov	v2.d[0], x16
+	mov	v2.d[1], x19
+	mov	v3.d[0], x21
+	mov	v3.d[1], x23
+	; Add back state, XOR in message and store
+	add	v0.4s, v0.4s, v16.4s
+	add	v1.4s, v1.4s, v17.4s
+	add	v2.4s, v2.4s, v18.4s
+	add	v3.4s, v3.4s, v19.4s
+	eor	v0.16b, v0.16b, v24.16b
+	eor	v1.16b, v1.16b, v25.16b
+	eor	v2.16b, v2.16b, v26.16b
+	eor	v3.16b, v3.16b, v27.16b
+	st1	{v0.4s, v1.4s, v2.4s, v3.4s}, [x1], #0x40
+	cmp	x3, #0x140
+	add	v19.4s, v19.4s, v29.4s
+	bge	L_chacha_crypt_bytes_arm64_loop_320
+	; Done doing 320 bytes at a time
+L_chacha_crypt_bytes_arm64_lt_320
+	cmp	x3, #0x100
+	blt	L_chacha_crypt_bytes_arm64_lt_256
+	; Move state into vector registers
+	dup	v0.4s, v16.s[0]
+	dup	v1.4s, v16.s[1]
+	dup	v2.4s, v16.s[2]
+	dup	v3.4s, v16.s[3]
+	dup	v4.4s, v17.s[0]
+	dup	v5.4s, v17.s[1]
+	dup	v6.4s, v17.s[2]
+	dup	v7.4s, v17.s[3]
+	dup	v8.4s, v18.s[0]
+	dup	v9.4s, v18.s[1]
+	dup	v10.4s, v18.s[2]
+	dup	v11.4s, v18.s[3]
+	dup	v12.4s, v19.s[0]
+	dup	v13.4s, v19.s[1]
+	dup	v14.4s, v19.s[2]
+	dup	v15.4s, v19.s[3]
+	; Add to counter word
+	add	v12.4s, v12.4s, v28.4s
+	; Set number of odd+even rounds to perform
+	mov	x26, #10
+L_chacha_crypt_bytes_arm64_round_start_256
+	subs	x26, x26, #1
+	; Round odd
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v4.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	eor	v14.16b, v14.16b, v2.16b
+	eor	v15.16b, v15.16b, v3.16b
+	rev32	v12.8h, v12.8h
+	rev32	v13.8h, v13.8h
+	rev32	v14.8h, v14.8h
+	rev32	v15.8h, v15.8h
+	; c += d; b ^= c; b <<<= 12;
+	add	v8.4s, v8.4s, v12.4s
+	add	v9.4s, v9.4s, v13.4s
+	add	v10.4s, v10.4s, v14.4s
+	add	v11.4s, v11.4s, v15.4s
+	eor	v20.16b, v4.16b, v8.16b
+	eor	v21.16b, v5.16b, v9.16b
+	eor	v22.16b, v6.16b, v10.16b
+	eor	v23.16b, v7.16b, v11.16b
+	shl	v4.4s, v20.4s, #12
+	shl	v5.4s, v21.4s, #12
+	shl	v6.4s, v22.4s, #12
+	shl	v7.4s, v23.4s, #12
+	sri	v4.4s, v20.4s, #20
+	sri	v5.4s, v21.4s, #20
+	sri	v6.4s, v22.4s, #20
+	sri	v7.4s, v23.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v4.4s
+	add	v1.4s, v1.4s, v5.4s
+	add	v2.4s, v2.4s, v6.4s
+	add	v3.4s, v3.4s, v7.4s
+	eor	v12.16b, v12.16b, v0.16b
+	eor	v13.16b, v13.16b, v1.16b
+	eor	v14.16b, v14.16b, v2.16b
+	eor	v15.16b, v15.16b, v3.16b
+	tbl	v12.16b, {v12.16b}, v30.16b
+	tbl	v13.16b, {v13.16b}, v30.16b
+	tbl	v14.16b, {v14.16b}, v30.16b
+	tbl	v15.16b, {v15.16b}, v30.16b
+	; c += d; b ^= c; b <<<= 7;
+	add	v8.4s, v8.4s, v12.4s
+	add	v9.4s, v9.4s, v13.4s
+	add	v10.4s, v10.4s, v14.4s
+	add	v11.4s, v11.4s, v15.4s
+	eor	v20.16b, v4.16b, v8.16b
+	eor	v21.16b, v5.16b, v9.16b
+	eor	v22.16b, v6.16b, v10.16b
+	eor	v23.16b, v7.16b, v11.16b
+	shl	v4.4s, v20.4s, #7
+	shl	v5.4s, v21.4s, #7
+	shl	v6.4s, v22.4s, #7
+	shl	v7.4s, v23.4s, #7
+	sri	v4.4s, v20.4s, #25
+	sri	v5.4s, v21.4s, #25
+	sri	v6.4s, v22.4s, #25
+	sri	v7.4s, v23.4s, #25
+	; Round even
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v4.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v12.16b, v12.16b, v1.16b
+	eor	v13.16b, v13.16b, v2.16b
+	eor	v14.16b, v14.16b, v3.16b
+	rev32	v15.8h, v15.8h
+	rev32	v12.8h, v12.8h
+	rev32	v13.8h, v13.8h
+	rev32	v14.8h, v14.8h
+	; c += d; b ^= c; b <<<= 12;
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v12.4s
+	add	v8.4s, v8.4s, v13.4s
+	add	v9.4s, v9.4s, v14.4s
+	eor	v20.16b, v5.16b, v10.16b
+	eor	v21.16b, v6.16b, v11.16b
+	eor	v22.16b, v7.16b, v8.16b
+	eor	v23.16b, v4.16b, v9.16b
+	shl	v5.4s, v20.4s, #12
+	shl	v6.4s, v21.4s, #12
+	shl	v7.4s, v22.4s, #12
+	shl	v4.4s, v23.4s, #12
+	sri	v5.4s, v20.4s, #20
+	sri	v6.4s, v21.4s, #20
+	sri	v7.4s, v22.4s, #20
+	sri	v4.4s, v23.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v5.4s
+	add	v1.4s, v1.4s, v6.4s
+	add	v2.4s, v2.4s, v7.4s
+	add	v3.4s, v3.4s, v4.4s
+	eor	v15.16b, v15.16b, v0.16b
+	eor	v12.16b, v12.16b, v1.16b
+	eor	v13.16b, v13.16b, v2.16b
+	eor	v14.16b, v14.16b, v3.16b
+	tbl	v15.16b, {v15.16b}, v30.16b
+	tbl	v12.16b, {v12.16b}, v30.16b
+	tbl	v13.16b, {v13.16b}, v30.16b
+	tbl	v14.16b, {v14.16b}, v30.16b
+	; c += d; b ^= c; b <<<= 7;
+	add	v10.4s, v10.4s, v15.4s
+	add	v11.4s, v11.4s, v12.4s
+	add	v8.4s, v8.4s, v13.4s
+	add	v9.4s, v9.4s, v14.4s
+	eor	v20.16b, v5.16b, v10.16b
+	eor	v21.16b, v6.16b, v11.16b
+	eor	v22.16b, v7.16b, v8.16b
+	eor	v23.16b, v4.16b, v9.16b
+	shl	v5.4s, v20.4s, #7
+	shl	v6.4s, v21.4s, #7
+	shl	v7.4s, v22.4s, #7
+	shl	v4.4s, v23.4s, #7
+	sri	v5.4s, v20.4s, #25
+	sri	v6.4s, v21.4s, #25
+	sri	v7.4s, v22.4s, #25
+	sri	v4.4s, v23.4s, #25
+	bne	L_chacha_crypt_bytes_arm64_round_start_256
+	mov	x26, #4
+	; Add counter now rather than after transposed
+	add	v12.4s, v12.4s, v28.4s
+	; Load message
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	; Transpose vectors
+	trn1	v20.4s, v0.4s, v1.4s
+	trn1	v22.4s, v2.4s, v3.4s
+	trn2	v21.4s, v0.4s, v1.4s
+	trn2	v23.4s, v2.4s, v3.4s
+	trn1	v0.2d, v20.2d, v22.2d
+	trn1	v1.2d, v21.2d, v23.2d
+	trn2	v2.2d, v20.2d, v22.2d
+	trn2	v3.2d, v21.2d, v23.2d
+	trn1	v20.4s, v4.4s, v5.4s
+	trn1	v22.4s, v6.4s, v7.4s
+	trn2	v21.4s, v4.4s, v5.4s
+	trn2	v23.4s, v6.4s, v7.4s
+	trn1	v4.2d, v20.2d, v22.2d
+	trn1	v5.2d, v21.2d, v23.2d
+	trn2	v6.2d, v20.2d, v22.2d
+	trn2	v7.2d, v21.2d, v23.2d
+	trn1	v20.4s, v8.4s, v9.4s
+	trn1	v22.4s, v10.4s, v11.4s
+	trn2	v21.4s, v8.4s, v9.4s
+	trn2	v23.4s, v10.4s, v11.4s
+	trn1	v8.2d, v20.2d, v22.2d
+	trn1	v9.2d, v21.2d, v23.2d
+	trn2	v10.2d, v20.2d, v22.2d
+	trn2	v11.2d, v21.2d, v23.2d
+	trn1	v20.4s, v12.4s, v13.4s
+	trn1	v22.4s, v14.4s, v15.4s
+	trn2	v21.4s, v12.4s, v13.4s
+	trn2	v23.4s, v14.4s, v15.4s
+	trn1	v12.2d, v20.2d, v22.2d
+	trn1	v13.2d, v21.2d, v23.2d
+	trn2	v14.2d, v20.2d, v22.2d
+	trn2	v15.2d, v21.2d, v23.2d
+	; Add back state, XOR in message and store (load next block)
+	add	v20.4s, v0.4s, v16.4s
+	add	v21.4s, v4.4s, v17.4s
+	add	v22.4s, v8.4s, v18.4s
+	add	v23.4s, v12.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	add	v20.4s, v1.4s, v16.4s
+	add	v21.4s, v5.4s, v17.4s
+	add	v22.4s, v9.4s, v18.4s
+	add	v23.4s, v13.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	add	v20.4s, v2.4s, v16.4s
+	add	v21.4s, v6.4s, v17.4s
+	add	v22.4s, v10.4s, v18.4s
+	add	v23.4s, v14.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	add	v20.4s, v3.4s, v16.4s
+	add	v21.4s, v7.4s, v17.4s
+	add	v22.4s, v11.4s, v18.4s
+	add	v23.4s, v15.4s, v19.4s
+	eor	v20.16b, v20.16b, v24.16b
+	eor	v21.16b, v21.16b, v25.16b
+	eor	v22.16b, v22.16b, v26.16b
+	eor	v23.16b, v23.16b, v27.16b
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	mov	v29.s[0], w26
+	sub	x3, x3, #0x100
+	add	v19.4s, v19.4s, v29.4s
+	; Done 256-byte block
+L_chacha_crypt_bytes_arm64_lt_256
+	cmp	x3, #0x80
+	blt	L_chacha_crypt_bytes_arm64_lt_128
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	; Move state into vector registers
+	mov	v4.16b, v16.16b
+	mov	v5.16b, v17.16b
+	mov	v6.16b, v18.16b
+	mov	v7.16b, v19.16b
+	mov	v0.16b, v16.16b
+	mov	v1.16b, v17.16b
+	mov	v2.16b, v18.16b
+	mov	v3.16b, v19.16b
+	; Add counter word
+	add	v7.4s, v7.4s, v31.4s
+	; Set number of odd+even rounds to perform
+	mov	x26, #10
+L_chacha_crypt_bytes_arm64_round_start_128
+	subs	x26, x26, #1
+	; Round odd
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v1.4s
+	add	v4.4s, v4.4s, v5.4s
+	eor	v3.16b, v3.16b, v0.16b
+	eor	v7.16b, v7.16b, v4.16b
+	rev32	v3.8h, v3.8h
+	rev32	v7.8h, v7.8h
+	; c += d; b ^= c; b <<<= 12;
+	add	v2.4s, v2.4s, v3.4s
+	add	v6.4s, v6.4s, v7.4s
+	eor	v20.16b, v1.16b, v2.16b
+	eor	v21.16b, v5.16b, v6.16b
+	shl	v1.4s, v20.4s, #12
+	shl	v5.4s, v21.4s, #12
+	sri	v1.4s, v20.4s, #20
+	sri	v5.4s, v21.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v1.4s
+	add	v4.4s, v4.4s, v5.4s
+	eor	v3.16b, v3.16b, v0.16b
+	eor	v7.16b, v7.16b, v4.16b
+	tbl	v3.16b, {v3.16b}, v30.16b
+	tbl	v7.16b, {v7.16b}, v30.16b
+	; c += d; b ^= c; b <<<= 7;
+	add	v2.4s, v2.4s, v3.4s
+	add	v6.4s, v6.4s, v7.4s
+	eor	v20.16b, v1.16b, v2.16b
+	eor	v21.16b, v5.16b, v6.16b
+	shl	v1.4s, v20.4s, #7
+	shl	v5.4s, v21.4s, #7
+	sri	v1.4s, v20.4s, #25
+	sri	v5.4s, v21.4s, #25
+	ext	v3.16b, v3.16b, v3.16b, #12
+	ext	v7.16b, v7.16b, v7.16b, #12
+	ext	v1.16b, v1.16b, v1.16b, #4
+	ext	v5.16b, v5.16b, v5.16b, #4
+	ext	v2.16b, v2.16b, v2.16b, #8
+	ext	v6.16b, v6.16b, v6.16b, #8
+	; Round even
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v1.4s
+	add	v4.4s, v4.4s, v5.4s
+	eor	v3.16b, v3.16b, v0.16b
+	eor	v7.16b, v7.16b, v4.16b
+	rev32	v3.8h, v3.8h
+	rev32	v7.8h, v7.8h
+	; c += d; b ^= c; b <<<= 12;
+	add	v2.4s, v2.4s, v3.4s
+	add	v6.4s, v6.4s, v7.4s
+	eor	v20.16b, v1.16b, v2.16b
+	eor	v21.16b, v5.16b, v6.16b
+	shl	v1.4s, v20.4s, #12
+	shl	v5.4s, v21.4s, #12
+	sri	v1.4s, v20.4s, #20
+	sri	v5.4s, v21.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v1.4s
+	add	v4.4s, v4.4s, v5.4s
+	eor	v3.16b, v3.16b, v0.16b
+	eor	v7.16b, v7.16b, v4.16b
+	tbl	v3.16b, {v3.16b}, v30.16b
+	tbl	v7.16b, {v7.16b}, v30.16b
+	; c += d; b ^= c; b <<<= 7;
+	add	v2.4s, v2.4s, v3.4s
+	add	v6.4s, v6.4s, v7.4s
+	eor	v20.16b, v1.16b, v2.16b
+	eor	v21.16b, v5.16b, v6.16b
+	shl	v1.4s, v20.4s, #7
+	shl	v5.4s, v21.4s, #7
+	sri	v1.4s, v20.4s, #25
+	sri	v5.4s, v21.4s, #25
+	ext	v3.16b, v3.16b, v3.16b, #4
+	ext	v7.16b, v7.16b, v7.16b, #4
+	ext	v1.16b, v1.16b, v1.16b, #12
+	ext	v5.16b, v5.16b, v5.16b, #12
+	ext	v2.16b, v2.16b, v2.16b, #8
+	ext	v6.16b, v6.16b, v6.16b, #8
+	bne	L_chacha_crypt_bytes_arm64_round_start_128
+	; Add back state, XOR in message and store (load next block)
+	add	v0.4s, v0.4s, v16.4s
+	add	v1.4s, v1.4s, v17.4s
+	add	v2.4s, v2.4s, v18.4s
+	add	v3.4s, v3.4s, v19.4s
+	eor	v24.16b, v24.16b, v0.16b
+	eor	v25.16b, v25.16b, v1.16b
+	eor	v26.16b, v26.16b, v2.16b
+	eor	v27.16b, v27.16b, v3.16b
+	ld1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x2], #0x40
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	add	v19.4s, v19.4s, v31.4s
+	add	v4.4s, v4.4s, v16.4s
+	add	v5.4s, v5.4s, v17.4s
+	add	v6.4s, v6.4s, v18.4s
+	add	v7.4s, v7.4s, v19.4s
+	eor	v20.16b, v20.16b, v4.16b
+	eor	v21.16b, v21.16b, v5.16b
+	eor	v22.16b, v22.16b, v6.16b
+	eor	v23.16b, v23.16b, v7.16b
+	st1	{v20.16b, v21.16b, v22.16b, v23.16b}, [x1], #0x40
+	add	v19.4s, v19.4s, v31.4s
+	sub	x3, x3, #0x80
+	; Done 128-byte block
+L_chacha_crypt_bytes_arm64_lt_128
+	cmp	x3, #0
+	beq	L_chacha_crypt_bytes_arm64_done_all
+	mov	w5, #0x40
+L_chacha_crypt_bytes_arm64_loop_64
+	; Move state into vector registers
+	mov	v0.16b, v16.16b
+	mov	v1.16b, v17.16b
+	mov	v2.16b, v18.16b
+	mov	v3.16b, v19.16b
+	; Set number of odd+even rounds to perform
+	mov	x26, #10
+L_chacha_crypt_bytes_arm64_round_64
+	subs	x26, x26, #1
+	; Round odd
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v1.4s
+	eor	v3.16b, v3.16b, v0.16b
+	rev32	v3.8h, v3.8h
+	; c += d; b ^= c; b <<<= 12;
+	add	v2.4s, v2.4s, v3.4s
+	eor	v20.16b, v1.16b, v2.16b
+	shl	v1.4s, v20.4s, #12
+	sri	v1.4s, v20.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v1.4s
+	eor	v3.16b, v3.16b, v0.16b
+	tbl	v3.16b, {v3.16b}, v30.16b
+	; c += d; b ^= c; b <<<= 7;
+	add	v2.4s, v2.4s, v3.4s
+	eor	v20.16b, v1.16b, v2.16b
+	shl	v1.4s, v20.4s, #7
+	sri	v1.4s, v20.4s, #25
+	ext	v3.16b, v3.16b, v3.16b, #12
+	ext	v1.16b, v1.16b, v1.16b, #4
+	ext	v2.16b, v2.16b, v2.16b, #8
+	; Round even
+	; a += b; d ^= a; d <<<= 16;
+	add	v0.4s, v0.4s, v1.4s
+	eor	v3.16b, v3.16b, v0.16b
+	rev32	v3.8h, v3.8h
+	; c += d; b ^= c; b <<<= 12;
+	add	v2.4s, v2.4s, v3.4s
+	eor	v20.16b, v1.16b, v2.16b
+	shl	v1.4s, v20.4s, #12
+	sri	v1.4s, v20.4s, #20
+	; a += b; d ^= a; d <<<= 8;
+	add	v0.4s, v0.4s, v1.4s
+	eor	v3.16b, v3.16b, v0.16b
+	tbl	v3.16b, {v3.16b}, v30.16b
+	; c += d; b ^= c; b <<<= 7;
+	add	v2.4s, v2.4s, v3.4s
+	eor	v20.16b, v1.16b, v2.16b
+	shl	v1.4s, v20.4s, #7
+	sri	v1.4s, v20.4s, #25
+	ext	v3.16b, v3.16b, v3.16b, #4
+	ext	v1.16b, v1.16b, v1.16b, #12
+	ext	v2.16b, v2.16b, v2.16b, #8
+	bne	L_chacha_crypt_bytes_arm64_round_64
+	; Add back state
+	add	v0.4s, v0.4s, v16.4s
+	add	v1.4s, v1.4s, v17.4s
+	add	v2.4s, v2.4s, v18.4s
+	add	v3.4s, v3.4s, v19.4s
+	; Check if data is less than 64 bytes - store in over
+	cmp	x3, #0x40
+	add	v19.4s, v19.4s, v31.4s
+	blt	L_chacha_crypt_bytes_arm64_lt_64
+	; Encipher 64 bytes
+	ld1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x2], #0x40
+	eor	v24.16b, v24.16b, v0.16b
+	eor	v25.16b, v25.16b, v1.16b
+	eor	v26.16b, v26.16b, v2.16b
+	eor	v27.16b, v27.16b, v3.16b
+	st1	{v24.16b, v25.16b, v26.16b, v27.16b}, [x1], #0x40
+	; Check for more bytes to be enciphered
+	subs	x3, x3, #0x40
+	bne	L_chacha_crypt_bytes_arm64_loop_64
+	b	L_chacha_crypt_bytes_arm64_done
+L_chacha_crypt_bytes_arm64_lt_64
+	; Calculate bytes left in block not used
+	sub	w5, w5, w3
+	; Store encipher block in over for further operations and left
+	st1	{v0.4s, v1.4s, v2.4s, v3.4s}, [x4]
+	str	w5, [x0, #64]
+	; Encipher 32 bytes
+	cmp	x3, #32
+	blt	L_chacha_crypt_bytes_arm64_lt_32
+	ld1	{v24.16b, v25.16b}, [x2], #32
+	eor	v24.16b, v24.16b, v0.16b
+	eor	v25.16b, v25.16b, v1.16b
+	st1	{v24.16b, v25.16b}, [x1], #32
+	subs	x3, x3, #32
+	mov	v0.16b, v2.16b
+	mov	v1.16b, v3.16b
+	beq	L_chacha_crypt_bytes_arm64_done
+L_chacha_crypt_bytes_arm64_lt_32
+	cmp	x3, #16
+	blt	L_chacha_crypt_bytes_arm64_lt_16
+	; Encipher 16 bytes
+	ld1	{v24.16b}, [x2], #16
+	eor	v24.16b, v24.16b, v0.16b
+	st1	{v24.16b}, [x1], #16
+	subs	x3, x3, #16
+	mov	v0.16b, v1.16b
+	beq	L_chacha_crypt_bytes_arm64_done
+L_chacha_crypt_bytes_arm64_lt_16
+	cmp	x3, #8
+	blt	L_chacha_crypt_bytes_arm64_lt_8
+	; Encipher 8 bytes
+	ld1	{v24.8b}, [x2], #8
+	eor	v24.8b, v24.8b, v0.8b
+	st1	{v24.8b}, [x1], #8
+	subs	x3, x3, #8
+	mov	v0.d[0], v0.d[1]
+	beq	L_chacha_crypt_bytes_arm64_done
+L_chacha_crypt_bytes_arm64_lt_8
+	mov	x5, v0.d[0]
+L_chacha_crypt_bytes_arm64_loop_lt_8
+	; Encipher 1 byte at a time
+	ldrb	w6, [x2], #1
+	eor	w6, w6, w5
+	strb	w6, [x1], #1
+	subs	x3, x3, #1
+	lsr	x5, x5, #8
+	bgt	L_chacha_crypt_bytes_arm64_loop_lt_8
+L_chacha_crypt_bytes_arm64_done
+L_chacha_crypt_bytes_arm64_done_all
+	st1	{v16.4s, v17.4s, v18.4s, v19.4s}, [x0]
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldr	x26, [x29, #88]
+	ldp	d8, d9, [x29, #96]
+	ldp	d10, d11, [x29, #112]
+	ldp	d12, d13, [x29, #128]
+	ldp	d14, d15, [x29, #144]
+	ldp	x29, x30, [sp], #0xa0
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	wc_chacha_setiv
+wc_chacha_setiv PROC
+	ldr	x3, [x1]
+	ldr	w4, [x1, #8]
+	str	x2, [x0, #48]
+	str	x3, [x0, #52]
+	str	w4, [x0, #60]
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_chacha_setkey_arm64_constant
+	DCD	0x61707865, 0x3120646e, 0x79622d36, 0x6b206574
+	DCD	0x61707865, 0x3320646e, 0x79622d32, 0x6b206574
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	wc_chacha_setkey
+wc_chacha_setkey PROC
+	adrp	x3, L_chacha_setkey_arm64_constant
+	add	x3, x3, L_chacha_setkey_arm64_constant
+	subs	x2, x2, #16
+	add	x3, x3, x2
+	; Start with constants
+	ld1	{v0.4s}, [x3]
+	ld1	{v1.16b}, [x1], #16
+	IF :DEF:BIG_ENDIAN_ORDER
+	rev32	v1.8h, v1.8h
+	ENDIF
+	st1	{v0.4s}, [x0], #16
+	st1	{v1.4s}, [x0], #16
+	beq	L_chacha_setkey_arm64_done
+	ld1	{v1.16b}, [x1]
+	IF :DEF:BIG_ENDIAN_ORDER
+	rev32	v1.8h, v1.8h
+	ENDIF
+L_chacha_setkey_arm64_done
+	st1	{v1.4s}, [x0]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	wc_chacha_use_over
+wc_chacha_use_over PROC
+L_chacha_use_over_arm64_16byte_loop
+	cmp	x3, #16
+	blt	L_chacha_use_over_arm64_word_loop
+	; 16 bytes of state XORed into message.
+	ld1	{v0.16b}, [x0], #16
+	ld1	{v1.16b}, [x2], #16
+	eor	v1.16b, v1.16b, v0.16b
+	subs	x3, x3, #16
+	st1	{v1.16b}, [x1], #16
+	beq	L_chacha_use_over_arm64_done
+	b	L_chacha_use_over_arm64_16byte_loop
+L_chacha_use_over_arm64_word_loop
+	cmp	x3, #4
+	blt	L_chacha_use_over_arm64_byte_loop
+	; 4 bytes of state XORed into message.
+	ldr	w4, [x0], #4
+	ldr	w5, [x2], #4
+	eor	w5, w5, w4
+	subs	x3, x3, #4
+	str	w5, [x1], #4
+	beq	L_chacha_use_over_arm64_done
+	b	L_chacha_use_over_arm64_word_loop
+L_chacha_use_over_arm64_byte_loop
+	; 1 bytes of state XORed into message.
+	ldrb	w4, [x0], #1
+	ldrb	w5, [x2], #1
+	eor	w5, w5, w4
+	subs	x3, x3, #1
+	strb	w5, [x1], #1
+	bne	L_chacha_use_over_arm64_byte_loop
+L_chacha_use_over_arm64_done
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-curve25519.asm b/wolfcrypt/src/port/arm/armv8-curve25519.asm
new file mode 100644
index 0000000000..6c06c06bb6
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-curve25519.asm
@@ -0,0 +1,11482 @@
+; /* armv8-curve25519
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./x25519/x25519.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-curve25519.asm
+	IF :DEF:HAVE_CURVE25519 :LOR: :DEF:HAVE_ED25519
+	IF :LNOT::DEF:CURVE25519_SMALL :LOR: :LNOT::DEF:ED25519_SMALL
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_init
+fe_init PROC
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_frombytes
+fe_frombytes PROC
+	ldp	x2, x3, [x1]
+	ldp	x4, x5, [x1, #16]
+	and	x5, x5, #0x7fffffffffffffff
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_tobytes
+fe_tobytes PROC
+	mov	x7, #19
+	ldp	x2, x3, [x1]
+	ldp	x4, x5, [x1, #16]
+	adds	x6, x2, x7
+	adcs	x6, x3, xzr
+	adcs	x6, x4, xzr
+	adc	x6, x5, xzr
+	and	x6, x7, x6, asr 63
+	adds	x2, x2, x6
+	adcs	x3, x3, xzr
+	adcs	x4, x4, xzr
+	adc	x5, x5, xzr
+	and	x5, x5, #0x7fffffffffffffff
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_1
+fe_1 PROC
+	; Set one
+	mov	x1, #1
+	stp	x1, xzr, [x0]
+	stp	xzr, xzr, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_0
+fe_0 PROC
+	; Set zero
+	stp	xzr, xzr, [x0]
+	stp	xzr, xzr, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_copy
+fe_copy PROC
+	; Copy
+	ldp	x2, x3, [x1]
+	ldp	x4, x5, [x1, #16]
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_sub
+fe_sub PROC
+	; Sub
+	ldp	x3, x4, [x1]
+	ldp	x5, x6, [x1, #16]
+	ldp	x7, x8, [x2]
+	ldp	x9, x10, [x2, #16]
+	subs	x3, x3, x7
+	sbcs	x4, x4, x8
+	sbcs	x5, x5, x9
+	sbcs	x6, x6, x10
+	csetm	x11, cc
+	mov	x12, #-19
+	;   Mask the modulus
+	extr	x11, x11, x6, #63
+	mul	x12, x11, x12
+	;   Add modulus (if underflow)
+	subs	x3, x3, x12
+	sbcs	x4, x4, xzr
+	and	x6, x6, #0x7fffffffffffffff
+	sbcs	x5, x5, xzr
+	sbc	x6, x6, xzr
+	stp	x3, x4, [x0]
+	stp	x5, x6, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_add
+fe_add PROC
+	; Add
+	ldp	x3, x4, [x1]
+	ldp	x5, x6, [x1, #16]
+	ldp	x7, x8, [x2]
+	ldp	x9, x10, [x2, #16]
+	adds	x3, x3, x7
+	adcs	x4, x4, x8
+	adcs	x5, x5, x9
+	adcs	x6, x6, x10
+	cset	x11, cs
+	mov	x12, #19
+	;   Mask the modulus
+	extr	x11, x11, x6, #63
+	mul	x12, x11, x12
+	;   Sub modulus (if overflow)
+	adds	x3, x3, x12
+	adcs	x4, x4, xzr
+	and	x6, x6, #0x7fffffffffffffff
+	adcs	x5, x5, xzr
+	adc	x6, x6, xzr
+	stp	x3, x4, [x0]
+	stp	x5, x6, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_neg
+fe_neg PROC
+	ldp	x2, x3, [x1]
+	ldp	x4, x5, [x1, #16]
+	mov	x6, #-19
+	mov	x7, #-1
+	mov	x8, #-1
+	mov	x9, #0x7fffffffffffffff
+	subs	x6, x6, x2
+	sbcs	x7, x7, x3
+	sbcs	x8, x8, x4
+	sbc	x9, x9, x5
+	stp	x6, x7, [x0]
+	stp	x8, x9, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_isnonzero
+fe_isnonzero PROC
+	mov	x6, #19
+	ldp	x1, x2, [x0]
+	ldp	x3, x4, [x0, #16]
+	adds	x5, x1, x6
+	adcs	x5, x2, xzr
+	adcs	x5, x3, xzr
+	adc	x5, x4, xzr
+	and	x5, x6, x5, asr 63
+	adds	x1, x1, x5
+	adcs	x2, x2, xzr
+	adcs	x3, x3, xzr
+	adc	x4, x4, xzr
+	and	x4, x4, #0x7fffffffffffffff
+	orr	x0, x1, x2
+	orr	x3, x3, x4
+	orr	x0, x0, x3
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_isnegative
+fe_isnegative PROC
+	mov	x6, #19
+	ldp	x1, x2, [x0]
+	ldp	x3, x4, [x0, #16]
+	adds	x5, x1, x6
+	adcs	x5, x2, xzr
+	adcs	x5, x3, xzr
+	adc	x5, x4, xzr
+	and	x0, x1, #1
+	eor	x0, x0, x5, lsr 63
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_cmov_table
+fe_cmov_table PROC
+	stp	x29, x30, [sp, #-128]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #40]
+	stp	x20, x21, [x29, #56]
+	stp	x22, x23, [x29, #72]
+	stp	x24, x25, [x29, #88]
+	stp	x26, x27, [x29, #104]
+	str	x28, [x29, #120]
+	str	x0, [x29, #16]
+	sxtb	x2, w2
+	sbfx	x3, x2, #7, #1
+	eor	x0, x2, x3
+	sub	x0, x0, x3
+	mov	x4, #1
+	mov	x5, xzr
+	mov	x6, xzr
+	mov	x7, xzr
+	mov	x8, #1
+	mov	x9, xzr
+	mov	x10, xzr
+	mov	x11, xzr
+	mov	x12, xzr
+	mov	x13, xzr
+	mov	x14, xzr
+	mov	x15, xzr
+	cmp	x0, #1
+	ldp	x16, x17, [x1]
+	ldp	x19, x20, [x1, #16]
+	ldp	x21, x22, [x1, #32]
+	ldp	x23, x24, [x1, #48]
+	ldp	x25, x26, [x1, #64]
+	ldp	x27, x28, [x1, #80]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	cmp	x0, #2
+	ldp	x16, x17, [x1, #96]
+	ldp	x19, x20, [x1, #112]
+	ldp	x21, x22, [x1, #128]
+	ldp	x23, x24, [x1, #144]
+	ldp	x25, x26, [x1, #160]
+	ldp	x27, x28, [x1, #176]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	cmp	x0, #3
+	ldp	x16, x17, [x1, #192]
+	ldp	x19, x20, [x1, #208]
+	ldp	x21, x22, [x1, #224]
+	ldp	x23, x24, [x1, #240]
+	ldp	x25, x26, [x1, #256]
+	ldp	x27, x28, [x1, #272]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	cmp	x0, #4
+	ldp	x16, x17, [x1, #288]
+	ldp	x19, x20, [x1, #304]
+	ldp	x21, x22, [x1, #320]
+	ldp	x23, x24, [x1, #336]
+	ldp	x25, x26, [x1, #352]
+	ldp	x27, x28, [x1, #368]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	add	x1, x1, #0x180
+	cmp	x0, #5
+	ldp	x16, x17, [x1]
+	ldp	x19, x20, [x1, #16]
+	ldp	x21, x22, [x1, #32]
+	ldp	x23, x24, [x1, #48]
+	ldp	x25, x26, [x1, #64]
+	ldp	x27, x28, [x1, #80]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	cmp	x0, #6
+	ldp	x16, x17, [x1, #96]
+	ldp	x19, x20, [x1, #112]
+	ldp	x21, x22, [x1, #128]
+	ldp	x23, x24, [x1, #144]
+	ldp	x25, x26, [x1, #160]
+	ldp	x27, x28, [x1, #176]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	cmp	x0, #7
+	ldp	x16, x17, [x1, #192]
+	ldp	x19, x20, [x1, #208]
+	ldp	x21, x22, [x1, #224]
+	ldp	x23, x24, [x1, #240]
+	ldp	x25, x26, [x1, #256]
+	ldp	x27, x28, [x1, #272]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	cmp	x0, #8
+	ldp	x16, x17, [x1, #288]
+	ldp	x19, x20, [x1, #304]
+	ldp	x21, x22, [x1, #320]
+	ldp	x23, x24, [x1, #336]
+	ldp	x25, x26, [x1, #352]
+	ldp	x27, x28, [x1, #368]
+	csel	x4, x16, x4, eq
+	csel	x5, x17, x5, eq
+	csel	x6, x19, x6, eq
+	csel	x7, x20, x7, eq
+	csel	x8, x21, x8, eq
+	csel	x9, x22, x9, eq
+	csel	x10, x23, x10, eq
+	csel	x11, x24, x11, eq
+	csel	x12, x25, x12, eq
+	csel	x13, x26, x13, eq
+	csel	x14, x27, x14, eq
+	csel	x15, x28, x15, eq
+	mov	x16, #-19
+	mov	x17, #-1
+	mov	x19, #-1
+	mov	x20, #0x7fffffffffffffff
+	subs	x16, x16, x12
+	sbcs	x17, x17, x13
+	sbcs	x19, x19, x14
+	sbc	x20, x20, x15
+	cmp	x2, #0
+	mov	x3, x4
+	csel	x4, x8, x4, lt
+	csel	x8, x3, x8, lt
+	mov	x3, x5
+	csel	x5, x9, x5, lt
+	csel	x9, x3, x9, lt
+	mov	x3, x6
+	csel	x6, x10, x6, lt
+	csel	x10, x3, x10, lt
+	mov	x3, x7
+	csel	x7, x11, x7, lt
+	csel	x11, x3, x11, lt
+	csel	x12, x16, x12, lt
+	csel	x13, x17, x13, lt
+	csel	x14, x19, x14, lt
+	csel	x15, x20, x15, lt
+	ldr	x0, [x29, #16]
+	stp	x4, x5, [x0]
+	stp	x6, x7, [x0, #16]
+	stp	x8, x9, [x0, #32]
+	stp	x10, x11, [x0, #48]
+	stp	x12, x13, [x0, #64]
+	stp	x14, x15, [x0, #80]
+	ldp	x17, x19, [x29, #40]
+	ldp	x20, x21, [x29, #56]
+	ldp	x22, x23, [x29, #72]
+	ldp	x24, x25, [x29, #88]
+	ldp	x26, x27, [x29, #104]
+	ldr	x28, [x29, #120]
+	ldp	x29, x30, [sp], #0x80
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_invert_nct
+fe_invert_nct PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	str	x24, [x29, #72]
+	mov	x19, #-19
+	mov	x20, #-1
+	mov	x21, #0x7fffffffffffffff
+	ldr	x6, [x1]
+	ldr	x7, [x1, #8]
+	ldr	x8, [x1, #16]
+	ldr	x9, [x1, #24]
+	mov	x2, x19
+	mov	x3, x20
+	mov	x4, x20
+	mov	x5, x21
+	mov	x10, xzr
+	mov	x11, xzr
+	mov	x12, xzr
+	mov	x13, xzr
+	mov	x14, #1
+	mov	x15, xzr
+	mov	x16, xzr
+	mov	x17, xzr
+	mov	x22, #0xff
+	cmp	x9, #0
+	beq	L_fe_invert_nct_num_bits_init_v_0
+	mov	x24, #0x100
+	clz	x23, x9
+	sub	x23, x24, x23
+	b	L_fe_invert_nct_num_bits_init_v_3
+L_fe_invert_nct_num_bits_init_v_0
+	cmp	x8, #0
+	beq	L_fe_invert_nct_num_bits_init_v_1
+	mov	x24, #0xc0
+	clz	x23, x8
+	sub	x23, x24, x23
+	b	L_fe_invert_nct_num_bits_init_v_3
+L_fe_invert_nct_num_bits_init_v_1
+	cmp	x7, #0
+	beq	L_fe_invert_nct_num_bits_init_v_2
+	mov	x24, #0x80
+	clz	x23, x7
+	sub	x23, x24, x23
+	b	L_fe_invert_nct_num_bits_init_v_3
+L_fe_invert_nct_num_bits_init_v_2
+	mov	x24, #0x40
+	clz	x23, x6
+	sub	x23, x24, x23
+L_fe_invert_nct_num_bits_init_v_3
+	tst	x6, #1
+	bne	L_fe_invert_nct_loop
+L_fe_invert_nct_even_init_v_0
+	extr	x6, x7, x6, #1
+	extr	x7, x8, x7, #1
+	extr	x8, x9, x8, #1
+	lsr	x9, x9, #1
+	sub	x23, x23, #1
+	ands	x24, x14, #1
+	beq	L_fe_invert_nct_even_init_v_1
+	adds	x14, x14, x19
+	adcs	x15, x15, x20
+	adcs	x16, x16, x20
+	adcs	x17, x17, x21
+	cset	x24, cs
+L_fe_invert_nct_even_init_v_1
+	extr	x14, x15, x14, #1
+	extr	x15, x16, x15, #1
+	extr	x16, x17, x16, #1
+	extr	x17, x24, x17, #1
+	tst	x6, #1
+	beq	L_fe_invert_nct_even_init_v_0
+L_fe_invert_nct_loop
+	cmp	x22, #1
+	beq	L_fe_invert_nct_u_done
+	cmp	x23, #1
+	beq	L_fe_invert_nct_v_done
+	cmp	x22, x23
+	bhi	L_fe_invert_nct_u_larger
+	bcc	L_fe_invert_nct_v_larger
+	cmp	x5, x9
+	bhi	L_fe_invert_nct_u_larger
+	bcc	L_fe_invert_nct_v_larger
+	cmp	x4, x8
+	bhi	L_fe_invert_nct_u_larger
+	bcc	L_fe_invert_nct_v_larger
+	cmp	x3, x7
+	bhi	L_fe_invert_nct_u_larger
+	bcc	L_fe_invert_nct_v_larger
+	cmp	x2, x6
+	bcc	L_fe_invert_nct_v_larger
+L_fe_invert_nct_u_larger
+	subs	x2, x2, x6
+	sbcs	x3, x3, x7
+	sbcs	x4, x4, x8
+	sbc	x5, x5, x9
+	subs	x10, x10, x14
+	sbcs	x11, x11, x15
+	sbcs	x12, x12, x16
+	sbcs	x13, x13, x17
+	bcs	L_fe_invert_nct_sub_uv
+	adds	x10, x10, x19
+	adcs	x11, x11, x20
+	adcs	x12, x12, x20
+	adc	x13, x13, x21
+L_fe_invert_nct_sub_uv
+	cmp	x5, #0
+	beq	L_fe_invert_nct_nct_num_bits_u_0
+	mov	x24, #0x100
+	clz	x22, x5
+	sub	x22, x24, x22
+	b	L_fe_invert_nct_nct_num_bits_u_3
+L_fe_invert_nct_nct_num_bits_u_0
+	cmp	x4, #0
+	beq	L_fe_invert_nct_nct_num_bits_u_1
+	mov	x24, #0xc0
+	clz	x22, x4
+	sub	x22, x24, x22
+	b	L_fe_invert_nct_nct_num_bits_u_3
+L_fe_invert_nct_nct_num_bits_u_1
+	cmp	x3, #0
+	beq	L_fe_invert_nct_nct_num_bits_u_2
+	mov	x24, #0x80
+	clz	x22, x3
+	sub	x22, x24, x22
+	b	L_fe_invert_nct_nct_num_bits_u_3
+L_fe_invert_nct_nct_num_bits_u_2
+	mov	x24, #0x40
+	clz	x22, x2
+	sub	x22, x24, x22
+L_fe_invert_nct_nct_num_bits_u_3
+L_fe_invert_nct_even_u_0
+	extr	x2, x3, x2, #1
+	extr	x3, x4, x3, #1
+	extr	x4, x5, x4, #1
+	lsr	x5, x5, #1
+	sub	x22, x22, #1
+	ands	x24, x10, #1
+	beq	L_fe_invert_nct_even_u_1
+	adds	x10, x10, x19
+	adcs	x11, x11, x20
+	adcs	x12, x12, x20
+	adcs	x13, x13, x21
+	cset	x24, cs
+L_fe_invert_nct_even_u_1
+	extr	x10, x11, x10, #1
+	extr	x11, x12, x11, #1
+	extr	x12, x13, x12, #1
+	extr	x13, x24, x13, #1
+	tst	x2, #1
+	beq	L_fe_invert_nct_even_u_0
+	b	L_fe_invert_nct_loop
+L_fe_invert_nct_v_larger
+	subs	x6, x6, x2
+	sbcs	x7, x7, x3
+	sbcs	x8, x8, x4
+	sbc	x9, x9, x5
+	subs	x14, x14, x10
+	sbcs	x15, x15, x11
+	sbcs	x16, x16, x12
+	sbcs	x17, x17, x13
+	bcs	L_fe_invert_nct_sub_vu
+	adds	x14, x14, x19
+	adcs	x15, x15, x20
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+L_fe_invert_nct_sub_vu
+	cmp	x9, #0
+	beq	L_fe_invert_nct_nct_num_bits_v_0
+	mov	x24, #0x100
+	clz	x23, x9
+	sub	x23, x24, x23
+	b	L_fe_invert_nct_nct_num_bits_v_3
+L_fe_invert_nct_nct_num_bits_v_0
+	cmp	x8, #0
+	beq	L_fe_invert_nct_nct_num_bits_v_1
+	mov	x24, #0xc0
+	clz	x23, x8
+	sub	x23, x24, x23
+	b	L_fe_invert_nct_nct_num_bits_v_3
+L_fe_invert_nct_nct_num_bits_v_1
+	cmp	x7, #0
+	beq	L_fe_invert_nct_nct_num_bits_v_2
+	mov	x24, #0x80
+	clz	x23, x7
+	sub	x23, x24, x23
+	b	L_fe_invert_nct_nct_num_bits_v_3
+L_fe_invert_nct_nct_num_bits_v_2
+	mov	x24, #0x40
+	clz	x23, x6
+	sub	x23, x24, x23
+L_fe_invert_nct_nct_num_bits_v_3
+L_fe_invert_nct_even_v_0
+	extr	x6, x7, x6, #1
+	extr	x7, x8, x7, #1
+	extr	x8, x9, x8, #1
+	lsr	x9, x9, #1
+	sub	x23, x23, #1
+	ands	x24, x14, #1
+	beq	L_fe_invert_nct_even_v_1
+	adds	x14, x14, x19
+	adcs	x15, x15, x20
+	adcs	x16, x16, x20
+	adcs	x17, x17, x21
+	cset	x24, cs
+L_fe_invert_nct_even_v_1
+	extr	x14, x15, x14, #1
+	extr	x15, x16, x15, #1
+	extr	x16, x17, x16, #1
+	extr	x17, x24, x17, #1
+	tst	x6, #1
+	beq	L_fe_invert_nct_even_v_0
+	b	L_fe_invert_nct_loop
+L_fe_invert_nct_u_done
+	str	x10, [x0]
+	str	x11, [x0, #8]
+	str	x12, [x0, #16]
+	str	x13, [x0, #24]
+	b	L_fe_invert_nct_done
+L_fe_invert_nct_v_done
+	str	x14, [x0]
+	str	x15, [x0, #8]
+	str	x16, [x0, #16]
+	str	x17, [x0, #24]
+L_fe_invert_nct_done
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldr	x24, [x29, #72]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_mul
+fe_mul PROC
+	stp	x29, x30, [sp, #-64]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	str	x22, [x29, #56]
+	; Multiply
+	ldp	x14, x15, [x1]
+	ldp	x16, x17, [x1, #16]
+	ldp	x19, x20, [x2]
+	ldp	x21, x22, [x2, #16]
+	; A[0] * B[0]
+	umulh	x7, x14, x19
+	mul	x6, x14, x19
+	; A[2] * B[0]
+	umulh	x9, x16, x19
+	mul	x8, x16, x19
+	; A[1] * B[0]
+	mul	x3, x15, x19
+	adds	x7, x7, x3
+	umulh	x4, x15, x19
+	adcs	x8, x8, x4
+	; A[1] * B[3]
+	umulh	x11, x15, x22
+	adc	x9, x9, xzr
+	mul	x10, x15, x22
+	; A[0] * B[1]
+	mul	x3, x14, x20
+	adds	x7, x7, x3
+	umulh	x4, x14, x20
+	adcs	x8, x8, x4
+	; A[2] * B[1]
+	mul	x3, x16, x20
+	adcs	x9, x9, x3
+	umulh	x4, x16, x20
+	adcs	x10, x10, x4
+	adc	x11, x11, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x21
+	adds	x9, x9, x3
+	umulh	x4, x15, x21
+	adcs	x10, x10, x4
+	adcs	x11, x11, xzr
+	adc	x12, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x21
+	adds	x8, x8, x3
+	umulh	x4, x14, x21
+	adcs	x9, x9, x4
+	adcs	x10, x10, xzr
+	adcs	x11, x11, xzr
+	adc	x12, x12, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x20
+	adds	x8, x8, x3
+	umulh	x4, x15, x20
+	adcs	x9, x9, x4
+	; A[3] * B[1]
+	mul	x3, x17, x20
+	adcs	x10, x10, x3
+	umulh	x4, x17, x20
+	adcs	x11, x11, x4
+	adc	x12, x12, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x21
+	adds	x10, x10, x3
+	umulh	x4, x16, x21
+	adcs	x11, x11, x4
+	; A[3] * B[3]
+	mul	x3, x17, x22
+	adcs	x12, x12, x3
+	umulh	x13, x17, x22
+	adc	x13, x13, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x22
+	adds	x9, x9, x3
+	umulh	x4, x14, x22
+	adcs	x10, x10, x4
+	; A[2] * B[3]
+	mul	x3, x16, x22
+	adcs	x11, x11, x3
+	umulh	x4, x16, x22
+	adcs	x12, x12, x4
+	adc	x13, x13, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x19
+	adds	x9, x9, x3
+	umulh	x4, x17, x19
+	adcs	x10, x10, x4
+	; A[3] * B[2]
+	mul	x3, x17, x21
+	adcs	x11, x11, x3
+	umulh	x4, x17, x21
+	adcs	x12, x12, x4
+	adc	x13, x13, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x13
+	adds	x9, x9, x4
+	umulh	x5, x3, x13
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x5, x5, x3
+	and	x9, x9, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x10
+	adds	x6, x6, x4
+	umulh	x10, x3, x10
+	mul	x4, x3, x11
+	adcs	x7, x7, x4
+	umulh	x11, x3, x11
+	mul	x4, x3, x12
+	adcs	x8, x8, x4
+	umulh	x12, x3, x12
+	adc	x9, x9, xzr
+	;  Add high product results in
+	adds	x6, x6, x5
+	adcs	x7, x7, x10
+	adcs	x8, x8, x11
+	adc	x9, x9, x12
+	; Reduce if top bit set
+	mov	x3, #19
+	and	x4, x3, x9, asr 63
+	adds	x6, x6, x4
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Store
+	stp	x6, x7, [x0]
+	stp	x8, x9, [x0, #16]
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldr	x22, [x29, #56]
+	ldp	x29, x30, [sp], #0x40
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_sq
+fe_sq PROC
+	; Square
+	ldp	x13, x14, [x1]
+	ldp	x15, x16, [x1, #16]
+	;  A[0] * A[1]
+	umulh	x7, x13, x14
+	mul	x6, x13, x14
+	;  A[0] * A[3]
+	umulh	x9, x13, x16
+	mul	x8, x13, x16
+	;  A[0] * A[2]
+	mul	x2, x13, x15
+	adds	x7, x7, x2
+	umulh	x3, x13, x15
+	adcs	x8, x8, x3
+	;  A[1] * A[3]
+	mul	x2, x14, x16
+	adcs	x9, x9, x2
+	umulh	x10, x14, x16
+	adc	x10, x10, xzr
+	;  A[1] * A[2]
+	mul	x2, x14, x15
+	adds	x8, x8, x2
+	umulh	x3, x14, x15
+	adcs	x9, x9, x3
+	;  A[2] * A[3]
+	mul	x2, x15, x16
+	adcs	x10, x10, x2
+	umulh	x11, x15, x16
+	adc	x11, x11, xzr
+	; Double
+	adds	x6, x6, x6
+	adcs	x7, x7, x7
+	adcs	x8, x8, x8
+	adcs	x9, x9, x9
+	adcs	x10, x10, x10
+	adcs	x11, x11, x11
+	adc	x12, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x3, x13, x13
+	mul	x5, x13, x13
+	;  A[1] * A[1]
+	mul	x2, x14, x14
+	adds	x6, x6, x3
+	umulh	x3, x14, x14
+	adcs	x7, x7, x2
+	;  A[2] * A[2]
+	mul	x2, x15, x15
+	adcs	x8, x8, x3
+	umulh	x3, x15, x15
+	adcs	x9, x9, x2
+	;  A[3] * A[3]
+	mul	x2, x16, x16
+	adcs	x10, x10, x3
+	umulh	x3, x16, x16
+	adcs	x11, x11, x2
+	adc	x12, x12, x3
+	; Reduce
+	mov	x2, #38
+	mul	x3, x2, x12
+	adds	x8, x8, x3
+	umulh	x4, x2, x12
+	adc	x4, x4, xzr
+	mov	x2, #19
+	extr	x4, x4, x8, #63
+	mul	x4, x4, x2
+	and	x8, x8, #0x7fffffffffffffff
+	mov	x2, #38
+	mul	x3, x2, x9
+	adds	x5, x5, x3
+	umulh	x9, x2, x9
+	mul	x3, x2, x10
+	adcs	x6, x6, x3
+	umulh	x10, x2, x10
+	mul	x3, x2, x11
+	adcs	x7, x7, x3
+	umulh	x11, x2, x11
+	adc	x8, x8, xzr
+	;  Add high product results in
+	adds	x5, x5, x4
+	adcs	x6, x6, x9
+	adcs	x7, x7, x10
+	adc	x8, x8, x11
+	; Reduce if top bit set
+	mov	x2, #19
+	and	x3, x2, x8, asr 63
+	adds	x5, x5, x3
+	adcs	x6, x6, xzr
+	and	x8, x8, #0x7fffffffffffffff
+	adcs	x7, x7, xzr
+	adc	x8, x8, xzr
+	; Store
+	stp	x5, x6, [x0]
+	stp	x7, x8, [x0, #16]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_invert
+fe_invert PROC
+	stp	x29, x30, [sp, #-176]!
+	add	x29, sp, #0
+	stp	x17, x20, [x29, #160]
+	; Invert
+	str	x0, [x29, #144]
+	str	x1, [x29, #152]
+	add	x0, x29, #16
+	ldr	x1, [x29, #152]
+	bl	fe_sq
+	add	x0, x29, #48
+	add	x1, x29, #16
+	bl	fe_sq
+	add	x0, x29, #48
+	add	x1, x29, #48
+	bl	fe_sq
+	add	x0, x29, #48
+	ldr	x1, [x29, #152]
+	add	x2, x29, #48
+	bl	fe_mul
+	add	x0, x29, #16
+	add	x1, x29, #16
+	add	x2, x29, #48
+	bl	fe_mul
+	add	x0, x29, #0x50
+	add	x1, x29, #16
+	bl	fe_sq
+	add	x0, x29, #48
+	add	x1, x29, #48
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 5 times
+	mov	x20, #5
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_invert1
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert1
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #48
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x20, #10
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_invert2
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert2
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	; Loop: 20 times
+	mov	x20, #20
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_fe_invert3
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert3
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x20, #10
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_fe_invert4
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert4
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #48
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x20, #50
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_invert5
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert5
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	; Loop: 100 times
+	mov	x20, #0x64
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_fe_invert6
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert6
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x20, #50
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_fe_invert7
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert7
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #48
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	; Loop: 5 times
+	mov	x20, #5
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_invert8
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x20, x20, #1
+	bne	L_fe_invert8
+	; Store
+	stp	x6, x7, [x29, #48]
+	stp	x8, x9, [x29, #64]
+	ldr	x0, [x29, #144]
+	add	x1, x29, #48
+	add	x2, x29, #16
+	bl	fe_mul
+	ldp	x17, x20, [x29, #160]
+	ldp	x29, x30, [sp], #0xb0
+	ret
+	ENDP
+	IF :LNOT::DEF:HAVE_ED25519 :LAND: :LNOT::DEF:WOLFSSL_CURVE25519_USE_ED25519
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	16
+L_curve25519_base_x2
+	DCQ	0x5cae469cdd684efb, 0x8f3f5ced1e350b5c
+	DCQ	0xd9750c687d157114, 0x20d342d51873f1b7
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	curve25519_base
+curve25519_base PROC
+	stp	x29, x30, [sp, #-272]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #184]
+	stp	x20, x21, [x29, #200]
+	stp	x22, x23, [x29, #216]
+	stp	x24, x25, [x29, #232]
+	stp	x26, x27, [x29, #248]
+	str	x28, [x29, #264]
+	adrp	x2, L_curve25519_base_x2
+	add	x2, x2, L_curve25519_base_x2
+	ldp	x6, x7, [x2]
+	ldp	x8, x9, [x2, #16]
+	mov	x10, #1
+	mov	x11, xzr
+	mov	x12, xzr
+	mov	x13, xzr
+	; Set base point x-ordinate
+	mov	x24, #9
+	stp	x24, xzr, [x0]
+	stp	xzr, xzr, [x0, #16]
+	; Set one
+	mov	x24, #1
+	stp	x24, xzr, [x29, #16]
+	stp	xzr, xzr, [x29, #32]
+	mov	x2, xzr
+	mov	x23, x0
+	mov	x24, #0xfd
+L_curve25519_base_bits
+	lsr	x3, x24, #6
+	and	x4, x24, #63
+	ldr	x5, [x1, x3, LSL 3]
+	lsr	x5, x5, x4
+	eor	x2, x2, x5
+	; Conditional Swap
+	subs	xzr, xzr, x2, lsl 63
+	ldp	x25, x26, [x29, #16]
+	ldp	x27, x28, [x29, #32]
+	csel	x19, x25, x10, ne
+	csel	x25, x10, x25, ne
+	csel	x20, x26, x11, ne
+	csel	x26, x11, x26, ne
+	csel	x21, x27, x12, ne
+	csel	x27, x12, x27, ne
+	csel	x22, x28, x13, ne
+	csel	x28, x13, x28, ne
+	; Conditional Swap
+	subs	xzr, xzr, x2, lsl 63
+	ldp	x10, x11, [x0]
+	ldp	x12, x13, [x0, #16]
+	csel	x14, x10, x6, ne
+	csel	x10, x6, x10, ne
+	csel	x15, x11, x7, ne
+	csel	x11, x7, x11, ne
+	csel	x16, x12, x8, ne
+	csel	x12, x8, x12, ne
+	csel	x17, x13, x9, ne
+	csel	x13, x9, x13, ne
+	mov	x2, x5
+	; Add
+	adds	x6, x10, x25
+	adcs	x7, x11, x26
+	adcs	x8, x12, x27
+	adcs	x9, x13, x28
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x6, x6, x3
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Sub
+	subs	x25, x10, x25
+	sbcs	x26, x11, x26
+	sbcs	x27, x12, x27
+	sbcs	x28, x13, x28
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x28, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x25, x25, x3
+	sbcs	x26, x26, xzr
+	and	x28, x28, #0x7fffffffffffffff
+	sbcs	x27, x27, xzr
+	sbc	x28, x28, xzr
+	stp	x25, x26, [x29, #80]
+	stp	x27, x28, [x29, #96]
+	; Add
+	adds	x10, x14, x19
+	adcs	x11, x15, x20
+	adcs	x12, x16, x21
+	adcs	x13, x17, x22
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x10, x10, x3
+	adcs	x11, x11, xzr
+	and	x13, x13, #0x7fffffffffffffff
+	adcs	x12, x12, xzr
+	adc	x13, x13, xzr
+	; Sub
+	subs	x14, x14, x19
+	sbcs	x15, x15, x20
+	sbcs	x16, x16, x21
+	sbcs	x17, x17, x22
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x17, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x14, x14, x3
+	sbcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	sbcs	x16, x16, xzr
+	sbc	x17, x17, xzr
+	; Multiply
+	; A[0] * B[0]
+	umulh	x20, x14, x6
+	mul	x19, x14, x6
+	; A[2] * B[0]
+	umulh	x22, x16, x6
+	mul	x21, x16, x6
+	; A[1] * B[0]
+	mul	x3, x15, x6
+	adds	x20, x20, x3
+	umulh	x4, x15, x6
+	adcs	x21, x21, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x9
+	adc	x22, x22, xzr
+	mul	x25, x15, x9
+	; A[0] * B[1]
+	mul	x3, x14, x7
+	adds	x20, x20, x3
+	umulh	x4, x14, x7
+	adcs	x21, x21, x4
+	; A[2] * B[1]
+	mul	x3, x16, x7
+	adcs	x22, x22, x3
+	umulh	x4, x16, x7
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x8
+	adds	x22, x22, x3
+	umulh	x4, x15, x8
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x8
+	adds	x21, x21, x3
+	umulh	x4, x14, x8
+	adcs	x22, x22, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x7
+	adds	x21, x21, x3
+	umulh	x4, x15, x7
+	adcs	x22, x22, x4
+	; A[3] * B[1]
+	mul	x3, x17, x7
+	adcs	x25, x25, x3
+	umulh	x4, x17, x7
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x8
+	adds	x25, x25, x3
+	umulh	x4, x16, x8
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x9
+	adcs	x27, x27, x3
+	umulh	x28, x17, x9
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x9
+	adds	x22, x22, x3
+	umulh	x4, x14, x9
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x9
+	adcs	x26, x26, x3
+	umulh	x4, x16, x9
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x6
+	adds	x22, x22, x3
+	umulh	x4, x17, x6
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x8
+	adcs	x26, x26, x3
+	umulh	x4, x17, x8
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x22, x22, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x22, #63
+	mul	x5, x5, x3
+	and	x22, x22, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x19, x19, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x20, x20, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x21, x21, x4
+	umulh	x27, x3, x27
+	adc	x22, x22, xzr
+	;  Add high product results in
+	adds	x19, x19, x5
+	adcs	x20, x20, x25
+	adcs	x21, x21, x26
+	adc	x22, x22, x27
+	; Store
+	stp	x19, x20, [x29, #48]
+	stp	x21, x22, [x29, #64]
+	; Multiply
+	ldp	x25, x26, [x29, #80]
+	ldp	x27, x28, [x29, #96]
+	; A[0] * B[0]
+	umulh	x20, x10, x25
+	mul	x19, x10, x25
+	; A[2] * B[0]
+	umulh	x22, x12, x25
+	mul	x21, x12, x25
+	; A[1] * B[0]
+	mul	x3, x11, x25
+	adds	x20, x20, x3
+	umulh	x4, x11, x25
+	adcs	x21, x21, x4
+	; A[1] * B[3]
+	umulh	x15, x11, x28
+	adc	x22, x22, xzr
+	mul	x14, x11, x28
+	; A[0] * B[1]
+	mul	x3, x10, x26
+	adds	x20, x20, x3
+	umulh	x4, x10, x26
+	adcs	x21, x21, x4
+	; A[2] * B[1]
+	mul	x3, x12, x26
+	adcs	x22, x22, x3
+	umulh	x4, x12, x26
+	adcs	x14, x14, x4
+	adc	x15, x15, xzr
+	; A[1] * B[2]
+	mul	x3, x11, x27
+	adds	x22, x22, x3
+	umulh	x4, x11, x27
+	adcs	x14, x14, x4
+	adcs	x15, x15, xzr
+	adc	x16, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x10, x27
+	adds	x21, x21, x3
+	umulh	x4, x10, x27
+	adcs	x22, x22, x4
+	adcs	x14, x14, xzr
+	adcs	x15, x15, xzr
+	adc	x16, x16, xzr
+	; A[1] * B[1]
+	mul	x3, x11, x26
+	adds	x21, x21, x3
+	umulh	x4, x11, x26
+	adcs	x22, x22, x4
+	; A[3] * B[1]
+	mul	x3, x13, x26
+	adcs	x14, x14, x3
+	umulh	x4, x13, x26
+	adcs	x15, x15, x4
+	adc	x16, x16, xzr
+	; A[2] * B[2]
+	mul	x3, x12, x27
+	adds	x14, x14, x3
+	umulh	x4, x12, x27
+	adcs	x15, x15, x4
+	; A[3] * B[3]
+	mul	x3, x13, x28
+	adcs	x16, x16, x3
+	umulh	x17, x13, x28
+	adc	x17, x17, xzr
+	; A[0] * B[3]
+	mul	x3, x10, x28
+	adds	x22, x22, x3
+	umulh	x4, x10, x28
+	adcs	x14, x14, x4
+	; A[2] * B[3]
+	mul	x3, x12, x28
+	adcs	x15, x15, x3
+	umulh	x4, x12, x28
+	adcs	x16, x16, x4
+	adc	x17, x17, xzr
+	; A[3] * B[0]
+	mul	x3, x13, x25
+	adds	x22, x22, x3
+	umulh	x4, x13, x25
+	adcs	x14, x14, x4
+	; A[3] * B[2]
+	mul	x3, x13, x27
+	adcs	x15, x15, x3
+	umulh	x4, x13, x27
+	adcs	x16, x16, x4
+	adc	x17, x17, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x22, x22, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x22, #63
+	mul	x5, x5, x3
+	and	x22, x22, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x19, x19, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x20, x20, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x21, x21, x4
+	umulh	x16, x3, x16
+	adc	x22, x22, xzr
+	;  Add high product results in
+	adds	x19, x19, x5
+	adcs	x20, x20, x14
+	adcs	x21, x21, x15
+	adc	x22, x22, x16
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x25, x26
+	mul	x11, x25, x26
+	;  A[0] * A[3]
+	umulh	x14, x25, x28
+	mul	x13, x25, x28
+	;  A[0] * A[2]
+	mul	x3, x25, x27
+	adds	x12, x12, x3
+	umulh	x4, x25, x27
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x26, x28
+	adcs	x14, x14, x3
+	umulh	x15, x26, x28
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x26, x27
+	adds	x13, x13, x3
+	umulh	x4, x26, x27
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x27, x28
+	adcs	x15, x15, x3
+	umulh	x16, x27, x28
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x25, x25
+	mul	x10, x25, x25
+	;  A[1] * A[1]
+	mul	x3, x26, x26
+	adds	x11, x11, x4
+	umulh	x4, x26, x26
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x27, x27
+	adcs	x13, x13, x4
+	umulh	x4, x27, x27
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x28, x28
+	adcs	x15, x15, x4
+	umulh	x4, x28, x28
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x10, x10, x5
+	adcs	x11, x11, x14
+	adcs	x12, x12, x15
+	adc	x13, x13, x16
+	; Square
+	;  A[0] * A[1]
+	umulh	x16, x6, x7
+	mul	x15, x6, x7
+	;  A[0] * A[3]
+	umulh	x25, x6, x9
+	mul	x17, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x16, x16, x3
+	umulh	x4, x6, x8
+	adcs	x17, x17, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x25, x25, x3
+	umulh	x26, x7, x9
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x17, x17, x3
+	umulh	x4, x7, x8
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x26, x26, x3
+	umulh	x27, x8, x9
+	adc	x27, x27, xzr
+	; Double
+	adds	x15, x15, x15
+	adcs	x16, x16, x16
+	adcs	x17, x17, x17
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x14, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x15, x15, x4
+	umulh	x4, x7, x7
+	adcs	x16, x16, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x17, x17, x4
+	umulh	x4, x8, x8
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x26, x26, x4
+	umulh	x4, x9, x9
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x17, x17, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x14, x14, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x15, x15, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x16, x16, x4
+	umulh	x27, x3, x27
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x25
+	adcs	x16, x16, x26
+	adc	x17, x17, x27
+	; Multiply
+	; A[0] * B[0]
+	umulh	x7, x14, x10
+	mul	x6, x14, x10
+	; A[2] * B[0]
+	umulh	x9, x16, x10
+	mul	x8, x16, x10
+	; A[1] * B[0]
+	mul	x3, x15, x10
+	adds	x7, x7, x3
+	umulh	x4, x15, x10
+	adcs	x8, x8, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x13
+	adc	x9, x9, xzr
+	mul	x25, x15, x13
+	; A[0] * B[1]
+	mul	x3, x14, x11
+	adds	x7, x7, x3
+	umulh	x4, x14, x11
+	adcs	x8, x8, x4
+	; A[2] * B[1]
+	mul	x3, x16, x11
+	adcs	x9, x9, x3
+	umulh	x4, x16, x11
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x12
+	adds	x9, x9, x3
+	umulh	x4, x15, x12
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x12
+	adds	x8, x8, x3
+	umulh	x4, x14, x12
+	adcs	x9, x9, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x11
+	adds	x8, x8, x3
+	umulh	x4, x15, x11
+	adcs	x9, x9, x4
+	; A[3] * B[1]
+	mul	x3, x17, x11
+	adcs	x25, x25, x3
+	umulh	x4, x17, x11
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x12
+	adds	x25, x25, x3
+	umulh	x4, x16, x12
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x13
+	adcs	x27, x27, x3
+	umulh	x28, x17, x13
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x13
+	adds	x9, x9, x3
+	umulh	x4, x14, x13
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x13
+	adcs	x26, x26, x3
+	umulh	x4, x16, x13
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x10
+	adds	x9, x9, x3
+	umulh	x4, x17, x10
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x12
+	adcs	x26, x26, x3
+	umulh	x4, x17, x12
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x9, x9, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x5, x5, x3
+	and	x9, x9, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x6, x6, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x7, x7, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x8, x8, x4
+	umulh	x27, x3, x27
+	adc	x9, x9, xzr
+	;  Add high product results in
+	adds	x6, x6, x5
+	adcs	x7, x7, x25
+	adcs	x8, x8, x26
+	adc	x9, x9, x27
+	; Store
+	stp	x6, x7, [x0]
+	stp	x8, x9, [x0, #16]
+	; Sub
+	subs	x14, x14, x10
+	sbcs	x15, x15, x11
+	sbcs	x16, x16, x12
+	sbcs	x17, x17, x13
+	csetm	x5, cc
+	mov	x3, #-19
+	;   Mask the modulus
+	extr	x5, x5, x17, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x14, x14, x3
+	sbcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	sbcs	x16, x16, xzr
+	sbc	x17, x17, xzr
+	; Multiply by 121666
+	mov	x5, #0xdb42
+	movk	x5, #1, lsl 16
+	mul	x6, x14, x5
+	umulh	x7, x14, x5
+	mul	x3, x15, x5
+	umulh	x8, x15, x5
+	adds	x7, x7, x3
+	adc	x8, x8, xzr
+	mul	x3, x16, x5
+	umulh	x9, x16, x5
+	adds	x8, x8, x3
+	adc	x9, x9, xzr
+	mul	x3, x17, x5
+	umulh	x4, x17, x5
+	adds	x9, x9, x3
+	adc	x4, x4, xzr
+	mov	x5, #19
+	extr	x4, x4, x9, #63
+	mul	x4, x4, x5
+	adds	x6, x6, x4
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Add
+	adds	x10, x10, x6
+	adcs	x11, x11, x7
+	adcs	x12, x12, x8
+	adcs	x13, x13, x9
+	cset	x5, cs
+	mov	x3, #19
+	;   Mask the modulus
+	extr	x5, x5, x13, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x10, x10, x3
+	adcs	x11, x11, xzr
+	and	x13, x13, #0x7fffffffffffffff
+	adcs	x12, x12, xzr
+	adc	x13, x13, xzr
+	; Multiply
+	; A[0] * B[0]
+	umulh	x7, x14, x10
+	mul	x6, x14, x10
+	; A[2] * B[0]
+	umulh	x9, x16, x10
+	mul	x8, x16, x10
+	; A[1] * B[0]
+	mul	x3, x15, x10
+	adds	x7, x7, x3
+	umulh	x4, x15, x10
+	adcs	x8, x8, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x13
+	adc	x9, x9, xzr
+	mul	x25, x15, x13
+	; A[0] * B[1]
+	mul	x3, x14, x11
+	adds	x7, x7, x3
+	umulh	x4, x14, x11
+	adcs	x8, x8, x4
+	; A[2] * B[1]
+	mul	x3, x16, x11
+	adcs	x9, x9, x3
+	umulh	x4, x16, x11
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x12
+	adds	x9, x9, x3
+	umulh	x4, x15, x12
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x12
+	adds	x8, x8, x3
+	umulh	x4, x14, x12
+	adcs	x9, x9, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x11
+	adds	x8, x8, x3
+	umulh	x4, x15, x11
+	adcs	x9, x9, x4
+	; A[3] * B[1]
+	mul	x3, x17, x11
+	adcs	x25, x25, x3
+	umulh	x4, x17, x11
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x12
+	adds	x25, x25, x3
+	umulh	x4, x16, x12
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x13
+	adcs	x27, x27, x3
+	umulh	x28, x17, x13
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x13
+	adds	x9, x9, x3
+	umulh	x4, x14, x13
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x13
+	adcs	x26, x26, x3
+	umulh	x4, x16, x13
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x10
+	adds	x9, x9, x3
+	umulh	x4, x17, x10
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x12
+	adcs	x26, x26, x3
+	umulh	x4, x17, x12
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x9, x9, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x5, x5, x3
+	and	x9, x9, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x6, x6, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x7, x7, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x8, x8, x4
+	umulh	x27, x3, x27
+	adc	x9, x9, xzr
+	;  Add high product results in
+	adds	x6, x6, x5
+	adcs	x7, x7, x25
+	adcs	x8, x8, x26
+	adc	x9, x9, x27
+	; Store
+	stp	x6, x7, [x29, #16]
+	stp	x8, x9, [x29, #32]
+	; Add
+	ldp	x25, x26, [x29, #48]
+	ldp	x27, x28, [x29, #64]
+	adds	x10, x25, x19
+	adcs	x11, x26, x20
+	adcs	x12, x27, x21
+	adcs	x13, x28, x22
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x10, x10, x3
+	adcs	x11, x11, xzr
+	and	x13, x13, #0x7fffffffffffffff
+	adcs	x12, x12, xzr
+	adc	x13, x13, xzr
+	; Sub
+	subs	x19, x25, x19
+	sbcs	x20, x26, x20
+	sbcs	x21, x27, x21
+	sbcs	x22, x28, x22
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x22, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x19, x19, x3
+	sbcs	x20, x20, xzr
+	and	x22, x22, #0x7fffffffffffffff
+	sbcs	x21, x21, xzr
+	sbc	x22, x22, xzr
+	; Square
+	;  A[0] * A[1]
+	umulh	x8, x10, x11
+	mul	x7, x10, x11
+	;  A[0] * A[3]
+	umulh	x25, x10, x13
+	mul	x9, x10, x13
+	;  A[0] * A[2]
+	mul	x3, x10, x12
+	adds	x8, x8, x3
+	umulh	x4, x10, x12
+	adcs	x9, x9, x4
+	;  A[1] * A[3]
+	mul	x3, x11, x13
+	adcs	x25, x25, x3
+	umulh	x26, x11, x13
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x11, x12
+	adds	x9, x9, x3
+	umulh	x4, x11, x12
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x12, x13
+	adcs	x26, x26, x3
+	umulh	x27, x12, x13
+	adc	x27, x27, xzr
+	; Double
+	adds	x7, x7, x7
+	adcs	x8, x8, x8
+	adcs	x9, x9, x9
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x10, x10
+	mul	x6, x10, x10
+	;  A[1] * A[1]
+	mul	x3, x11, x11
+	adds	x7, x7, x4
+	umulh	x4, x11, x11
+	adcs	x8, x8, x3
+	;  A[2] * A[2]
+	mul	x3, x12, x12
+	adcs	x9, x9, x4
+	umulh	x4, x12, x12
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x13, x13
+	adcs	x26, x26, x4
+	umulh	x4, x13, x13
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x9, x9, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x5, x5, x3
+	and	x9, x9, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x6, x6, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x7, x7, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x8, x8, x4
+	umulh	x27, x3, x27
+	adc	x9, x9, xzr
+	;  Add high product results in
+	adds	x6, x6, x5
+	adcs	x7, x7, x25
+	adcs	x8, x8, x26
+	adc	x9, x9, x27
+	; Square
+	;  A[0] * A[1]
+	umulh	x16, x19, x20
+	mul	x15, x19, x20
+	;  A[0] * A[3]
+	umulh	x25, x19, x22
+	mul	x17, x19, x22
+	;  A[0] * A[2]
+	mul	x3, x19, x21
+	adds	x16, x16, x3
+	umulh	x4, x19, x21
+	adcs	x17, x17, x4
+	;  A[1] * A[3]
+	mul	x3, x20, x22
+	adcs	x25, x25, x3
+	umulh	x26, x20, x22
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x20, x21
+	adds	x17, x17, x3
+	umulh	x4, x20, x21
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x21, x22
+	adcs	x26, x26, x3
+	umulh	x27, x21, x22
+	adc	x27, x27, xzr
+	; Double
+	adds	x15, x15, x15
+	adcs	x16, x16, x16
+	adcs	x17, x17, x17
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x19, x19
+	mul	x14, x19, x19
+	;  A[1] * A[1]
+	mul	x3, x20, x20
+	adds	x15, x15, x4
+	umulh	x4, x20, x20
+	adcs	x16, x16, x3
+	;  A[2] * A[2]
+	mul	x3, x21, x21
+	adcs	x17, x17, x4
+	umulh	x4, x21, x21
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x22, x22
+	adcs	x26, x26, x4
+	umulh	x4, x22, x22
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x17, x17, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x14, x14, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x15, x15, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x16, x16, x4
+	umulh	x27, x3, x27
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x25
+	adcs	x16, x16, x26
+	adc	x17, x17, x27
+	; Multiply by 9
+	mov	x5, #9
+	mul	x10, x14, x5
+	umulh	x11, x14, x5
+	mul	x3, x15, x5
+	umulh	x12, x15, x5
+	adds	x11, x11, x3
+	adc	x12, x12, xzr
+	mul	x3, x16, x5
+	umulh	x13, x16, x5
+	adds	x12, x12, x3
+	adc	x13, x13, xzr
+	mul	x3, x17, x5
+	umulh	x4, x17, x5
+	adds	x13, x13, x3
+	adc	x4, x4, xzr
+	mov	x5, #19
+	extr	x4, x4, x13, #63
+	mul	x4, x4, x5
+	adds	x10, x10, x4
+	adcs	x11, x11, xzr
+	and	x13, x13, #0x7fffffffffffffff
+	adcs	x12, x12, xzr
+	adc	x13, x13, xzr
+	subs	x24, x24, #1
+	cmp	x24, #3
+	bge	L_curve25519_base_bits
+	; Conditional Swap
+	subs	xzr, xzr, x2, lsl 63
+	ldp	x25, x26, [x29, #16]
+	ldp	x27, x28, [x29, #32]
+	csel	x19, x25, x10, ne
+	csel	x25, x10, x25, ne
+	csel	x20, x26, x11, ne
+	csel	x26, x11, x26, ne
+	csel	x21, x27, x12, ne
+	csel	x27, x12, x27, ne
+	csel	x22, x28, x13, ne
+	csel	x28, x13, x28, ne
+	; Conditional Swap
+	subs	xzr, xzr, x2, lsl 63
+	ldp	x10, x11, [x0]
+	ldp	x12, x13, [x0, #16]
+	csel	x14, x10, x6, ne
+	csel	x10, x6, x10, ne
+	csel	x15, x11, x7, ne
+	csel	x11, x7, x11, ne
+	csel	x16, x12, x8, ne
+	csel	x12, x8, x12, ne
+	csel	x17, x13, x9, ne
+	csel	x13, x9, x13, ne
+L_curve25519_base_3
+	; Add
+	adds	x6, x10, x25
+	adcs	x7, x11, x26
+	adcs	x8, x12, x27
+	adcs	x9, x13, x28
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x6, x6, x3
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Sub
+	subs	x25, x10, x25
+	sbcs	x26, x11, x26
+	sbcs	x27, x12, x27
+	sbcs	x28, x13, x28
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x28, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x25, x25, x3
+	sbcs	x26, x26, xzr
+	and	x28, x28, #0x7fffffffffffffff
+	sbcs	x27, x27, xzr
+	sbc	x28, x28, xzr
+	; Square
+	;  A[0] * A[1]
+	umulh	x21, x25, x26
+	mul	x20, x25, x26
+	;  A[0] * A[3]
+	umulh	x14, x25, x28
+	mul	x22, x25, x28
+	;  A[0] * A[2]
+	mul	x3, x25, x27
+	adds	x21, x21, x3
+	umulh	x4, x25, x27
+	adcs	x22, x22, x4
+	;  A[1] * A[3]
+	mul	x3, x26, x28
+	adcs	x14, x14, x3
+	umulh	x15, x26, x28
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x26, x27
+	adds	x22, x22, x3
+	umulh	x4, x26, x27
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x27, x28
+	adcs	x15, x15, x3
+	umulh	x16, x27, x28
+	adc	x16, x16, xzr
+	; Double
+	adds	x20, x20, x20
+	adcs	x21, x21, x21
+	adcs	x22, x22, x22
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x25, x25
+	mul	x19, x25, x25
+	;  A[1] * A[1]
+	mul	x3, x26, x26
+	adds	x20, x20, x4
+	umulh	x4, x26, x26
+	adcs	x21, x21, x3
+	;  A[2] * A[2]
+	mul	x3, x27, x27
+	adcs	x22, x22, x4
+	umulh	x4, x27, x27
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x28, x28
+	adcs	x15, x15, x4
+	umulh	x4, x28, x28
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x22, x22, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x22, #63
+	mul	x5, x5, x3
+	and	x22, x22, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x19, x19, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x20, x20, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x21, x21, x4
+	umulh	x16, x3, x16
+	adc	x22, x22, xzr
+	;  Add high product results in
+	adds	x19, x19, x5
+	adcs	x20, x20, x14
+	adcs	x21, x21, x15
+	adc	x22, x22, x16
+	; Square
+	;  A[0] * A[1]
+	umulh	x16, x6, x7
+	mul	x15, x6, x7
+	;  A[0] * A[3]
+	umulh	x25, x6, x9
+	mul	x17, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x16, x16, x3
+	umulh	x4, x6, x8
+	adcs	x17, x17, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x25, x25, x3
+	umulh	x26, x7, x9
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x17, x17, x3
+	umulh	x4, x7, x8
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x26, x26, x3
+	umulh	x27, x8, x9
+	adc	x27, x27, xzr
+	; Double
+	adds	x15, x15, x15
+	adcs	x16, x16, x16
+	adcs	x17, x17, x17
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x14, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x15, x15, x4
+	umulh	x4, x7, x7
+	adcs	x16, x16, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x17, x17, x4
+	umulh	x4, x8, x8
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x26, x26, x4
+	umulh	x4, x9, x9
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x17, x17, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x14, x14, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x15, x15, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x16, x16, x4
+	umulh	x27, x3, x27
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x25
+	adcs	x16, x16, x26
+	adc	x17, x17, x27
+	; Multiply
+	; A[0] * B[0]
+	umulh	x11, x14, x19
+	mul	x10, x14, x19
+	; A[2] * B[0]
+	umulh	x13, x16, x19
+	mul	x12, x16, x19
+	; A[1] * B[0]
+	mul	x3, x15, x19
+	adds	x11, x11, x3
+	umulh	x4, x15, x19
+	adcs	x12, x12, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x22
+	adc	x13, x13, xzr
+	mul	x25, x15, x22
+	; A[0] * B[1]
+	mul	x3, x14, x20
+	adds	x11, x11, x3
+	umulh	x4, x14, x20
+	adcs	x12, x12, x4
+	; A[2] * B[1]
+	mul	x3, x16, x20
+	adcs	x13, x13, x3
+	umulh	x4, x16, x20
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x21
+	adds	x13, x13, x3
+	umulh	x4, x15, x21
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x21
+	adds	x12, x12, x3
+	umulh	x4, x14, x21
+	adcs	x13, x13, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x20
+	adds	x12, x12, x3
+	umulh	x4, x15, x20
+	adcs	x13, x13, x4
+	; A[3] * B[1]
+	mul	x3, x17, x20
+	adcs	x25, x25, x3
+	umulh	x4, x17, x20
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x21
+	adds	x25, x25, x3
+	umulh	x4, x16, x21
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x22
+	adcs	x27, x27, x3
+	umulh	x28, x17, x22
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x22
+	adds	x13, x13, x3
+	umulh	x4, x14, x22
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x22
+	adcs	x26, x26, x3
+	umulh	x4, x16, x22
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x19
+	adds	x13, x13, x3
+	umulh	x4, x17, x19
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x21
+	adcs	x26, x26, x3
+	umulh	x4, x17, x21
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x13, x13, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x10, x10, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x11, x11, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x12, x12, x4
+	umulh	x27, x3, x27
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x10, x10, x5
+	adcs	x11, x11, x25
+	adcs	x12, x12, x26
+	adc	x13, x13, x27
+	; Store
+	stp	x10, x11, [x0]
+	stp	x12, x13, [x0, #16]
+	; Sub
+	subs	x14, x14, x19
+	sbcs	x15, x15, x20
+	sbcs	x16, x16, x21
+	sbcs	x17, x17, x22
+	csetm	x5, cc
+	mov	x3, #-19
+	;   Mask the modulus
+	extr	x5, x5, x17, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x14, x14, x3
+	sbcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	sbcs	x16, x16, xzr
+	sbc	x17, x17, xzr
+	; Multiply by 121666
+	mov	x5, #0xdb42
+	movk	x5, #1, lsl 16
+	mul	x6, x14, x5
+	umulh	x7, x14, x5
+	mul	x3, x15, x5
+	umulh	x8, x15, x5
+	adds	x7, x7, x3
+	adc	x8, x8, xzr
+	mul	x3, x16, x5
+	umulh	x9, x16, x5
+	adds	x8, x8, x3
+	adc	x9, x9, xzr
+	mul	x3, x17, x5
+	umulh	x4, x17, x5
+	adds	x9, x9, x3
+	adc	x4, x4, xzr
+	mov	x5, #19
+	extr	x4, x4, x9, #63
+	mul	x4, x4, x5
+	adds	x6, x6, x4
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Add
+	adds	x19, x19, x6
+	adcs	x20, x20, x7
+	adcs	x21, x21, x8
+	adcs	x22, x22, x9
+	cset	x5, cs
+	mov	x3, #19
+	;   Mask the modulus
+	extr	x5, x5, x22, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x19, x19, x3
+	adcs	x20, x20, xzr
+	and	x22, x22, #0x7fffffffffffffff
+	adcs	x21, x21, xzr
+	adc	x22, x22, xzr
+	; Multiply
+	; A[0] * B[0]
+	umulh	x26, x14, x19
+	mul	x25, x14, x19
+	; A[2] * B[0]
+	umulh	x28, x16, x19
+	mul	x27, x16, x19
+	; A[1] * B[0]
+	mul	x3, x15, x19
+	adds	x26, x26, x3
+	umulh	x4, x15, x19
+	adcs	x27, x27, x4
+	; A[1] * B[3]
+	umulh	x7, x15, x22
+	adc	x28, x28, xzr
+	mul	x6, x15, x22
+	; A[0] * B[1]
+	mul	x3, x14, x20
+	adds	x26, x26, x3
+	umulh	x4, x14, x20
+	adcs	x27, x27, x4
+	; A[2] * B[1]
+	mul	x3, x16, x20
+	adcs	x28, x28, x3
+	umulh	x4, x16, x20
+	adcs	x6, x6, x4
+	adc	x7, x7, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x21
+	adds	x28, x28, x3
+	umulh	x4, x15, x21
+	adcs	x6, x6, x4
+	adcs	x7, x7, xzr
+	adc	x8, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x21
+	adds	x27, x27, x3
+	umulh	x4, x14, x21
+	adcs	x28, x28, x4
+	adcs	x6, x6, xzr
+	adcs	x7, x7, xzr
+	adc	x8, x8, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x20
+	adds	x27, x27, x3
+	umulh	x4, x15, x20
+	adcs	x28, x28, x4
+	; A[3] * B[1]
+	mul	x3, x17, x20
+	adcs	x6, x6, x3
+	umulh	x4, x17, x20
+	adcs	x7, x7, x4
+	adc	x8, x8, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x21
+	adds	x6, x6, x3
+	umulh	x4, x16, x21
+	adcs	x7, x7, x4
+	; A[3] * B[3]
+	mul	x3, x17, x22
+	adcs	x8, x8, x3
+	umulh	x9, x17, x22
+	adc	x9, x9, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x22
+	adds	x28, x28, x3
+	umulh	x4, x14, x22
+	adcs	x6, x6, x4
+	; A[2] * B[3]
+	mul	x3, x16, x22
+	adcs	x7, x7, x3
+	umulh	x4, x16, x22
+	adcs	x8, x8, x4
+	adc	x9, x9, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x19
+	adds	x28, x28, x3
+	umulh	x4, x17, x19
+	adcs	x6, x6, x4
+	; A[3] * B[2]
+	mul	x3, x17, x21
+	adcs	x7, x7, x3
+	umulh	x4, x17, x21
+	adcs	x8, x8, x4
+	adc	x9, x9, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x9
+	adds	x28, x28, x4
+	umulh	x5, x3, x9
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x28, #63
+	mul	x5, x5, x3
+	and	x28, x28, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x6
+	adds	x25, x25, x4
+	umulh	x6, x3, x6
+	mul	x4, x3, x7
+	adcs	x26, x26, x4
+	umulh	x7, x3, x7
+	mul	x4, x3, x8
+	adcs	x27, x27, x4
+	umulh	x8, x3, x8
+	adc	x28, x28, xzr
+	;  Add high product results in
+	adds	x25, x25, x5
+	adcs	x26, x26, x6
+	adcs	x27, x27, x7
+	adc	x28, x28, x8
+	; Store
+	stp	x25, x26, [x29, #16]
+	stp	x27, x28, [x29, #32]
+	subs	x24, x24, #1
+	bge	L_curve25519_base_3
+	; Invert
+	add	x0, x29, #48
+	add	x1, x29, #16
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #48
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #0x50
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #16
+	add	x2, x29, #0x50
+	bl	fe_mul
+	add	x0, x29, #48
+	add	x1, x29, #48
+	add	x2, x29, #0x50
+	bl	fe_mul
+	add	x0, x29, #0x70
+	add	x1, x29, #48
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #0x50
+	add	x2, x29, #0x70
+	bl	fe_mul
+	; Loop: 5 times
+	mov	x24, #5
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_base_inv_1
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_1
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x24, #10
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_base_inv_2
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_2
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 20 times
+	mov	x24, #20
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_base_inv_3
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_3
+	; Store
+	stp	x6, x7, [x29, #144]
+	stp	x8, x9, [x29, #160]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x90
+	add	x2, x29, #0x70
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x24, #10
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_base_inv_4
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_4
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x24, #50
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_base_inv_5
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_5
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 100 times
+	mov	x24, #0x64
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_base_inv_6
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_6
+	; Store
+	stp	x6, x7, [x29, #144]
+	stp	x8, x9, [x29, #160]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x90
+	add	x2, x29, #0x70
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x24, #50
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_base_inv_7
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_7
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 5 times
+	mov	x24, #5
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_base_inv_8
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_base_inv_8
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #16
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	mov	x0, x23
+	; Multiply
+	ldp	x6, x7, [x0]
+	ldp	x8, x9, [x0, #16]
+	ldp	x10, x11, [x29, #16]
+	ldp	x12, x13, [x29, #32]
+	; A[0] * B[0]
+	umulh	x15, x6, x10
+	mul	x14, x6, x10
+	; A[2] * B[0]
+	umulh	x17, x8, x10
+	mul	x16, x8, x10
+	; A[1] * B[0]
+	mul	x3, x7, x10
+	adds	x15, x15, x3
+	umulh	x4, x7, x10
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x7, x13
+	adc	x17, x17, xzr
+	mul	x19, x7, x13
+	; A[0] * B[1]
+	mul	x3, x6, x11
+	adds	x15, x15, x3
+	umulh	x4, x6, x11
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x8, x11
+	adcs	x17, x17, x3
+	umulh	x4, x8, x11
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x7, x12
+	adds	x17, x17, x3
+	umulh	x4, x7, x12
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x6, x12
+	adds	x16, x16, x3
+	umulh	x4, x6, x12
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x7, x11
+	adds	x16, x16, x3
+	umulh	x4, x7, x11
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x9, x11
+	adcs	x19, x19, x3
+	umulh	x4, x9, x11
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x8, x12
+	adds	x19, x19, x3
+	umulh	x4, x8, x12
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x9, x13
+	adcs	x21, x21, x3
+	umulh	x22, x9, x13
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x6, x13
+	adds	x17, x17, x3
+	umulh	x4, x6, x13
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x8, x13
+	adcs	x20, x20, x3
+	umulh	x4, x8, x13
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x9, x10
+	adds	x17, x17, x3
+	umulh	x4, x9, x10
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x9, x12
+	adcs	x20, x20, x3
+	umulh	x4, x9, x12
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Reduce if top bit set
+	mov	x3, #19
+	and	x4, x3, x17, asr 63
+	adds	x14, x14, x4
+	adcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	adcs	x16, x16, xzr
+	adc	x17, x17, xzr
+	adds	x4, x14, x3
+	adcs	x4, x15, xzr
+	adcs	x4, x16, xzr
+	adc	x4, x17, xzr
+	and	x4, x3, x4, asr 63
+	adds	x14, x14, x4
+	adcs	x15, x15, xzr
+	mov	x4, #0x7fffffffffffffff
+	adcs	x16, x16, xzr
+	adc	x17, x17, xzr
+	and	x17, x17, x4
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	mov	x0, xzr
+	ldp	x17, x19, [x29, #184]
+	ldp	x20, x21, [x29, #200]
+	ldp	x22, x23, [x29, #216]
+	ldp	x24, x25, [x29, #232]
+	ldp	x26, x27, [x29, #248]
+	ldr	x28, [x29, #264]
+	ldp	x29, x30, [sp], #0x110
+	ret
+	ENDP
+	ENDIF
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	curve25519
+curve25519 PROC
+	stp	x29, x30, [sp, #-288]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #200]
+	stp	x20, x21, [x29, #216]
+	stp	x22, x23, [x29, #232]
+	stp	x24, x25, [x29, #248]
+	stp	x26, x27, [x29, #264]
+	str	x28, [x29, #280]
+	mov	x23, xzr
+	str	x0, [x29, #176]
+	ldp	x6, x7, [x2]
+	ldp	x8, x9, [x2, #16]
+	mov	x10, #1
+	mov	x11, xzr
+	mov	x12, xzr
+	mov	x13, xzr
+	stp	x10, x11, [x0]
+	stp	x12, x13, [x0, #16]
+	; Set zero
+	stp	xzr, xzr, [x29, #16]
+	stp	xzr, xzr, [x29, #32]
+	mov	x24, #0xfe
+L_curve25519_bits
+	lsr	x3, x24, #6
+	and	x4, x24, #63
+	ldr	x5, [x1, x3, LSL 3]
+	lsr	x5, x5, x4
+	eor	x23, x23, x5
+	; Conditional Swap
+	subs	xzr, xzr, x23, lsl 63
+	ldp	x25, x26, [x29, #16]
+	ldp	x27, x28, [x29, #32]
+	csel	x19, x25, x10, ne
+	csel	x25, x10, x25, ne
+	csel	x20, x26, x11, ne
+	csel	x26, x11, x26, ne
+	csel	x21, x27, x12, ne
+	csel	x27, x12, x27, ne
+	csel	x22, x28, x13, ne
+	csel	x28, x13, x28, ne
+	; Conditional Swap
+	subs	xzr, xzr, x23, lsl 63
+	ldp	x10, x11, [x0]
+	ldp	x12, x13, [x0, #16]
+	csel	x14, x10, x6, ne
+	csel	x10, x6, x10, ne
+	csel	x15, x11, x7, ne
+	csel	x11, x7, x11, ne
+	csel	x16, x12, x8, ne
+	csel	x12, x8, x12, ne
+	csel	x17, x13, x9, ne
+	csel	x13, x9, x13, ne
+	mov	x23, x5
+	; Add
+	adds	x6, x10, x25
+	adcs	x7, x11, x26
+	adcs	x8, x12, x27
+	adcs	x9, x13, x28
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x6, x6, x3
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Sub
+	subs	x25, x10, x25
+	sbcs	x26, x11, x26
+	sbcs	x27, x12, x27
+	sbcs	x28, x13, x28
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x28, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x25, x25, x3
+	sbcs	x26, x26, xzr
+	and	x28, x28, #0x7fffffffffffffff
+	sbcs	x27, x27, xzr
+	sbc	x28, x28, xzr
+	stp	x25, x26, [x29, #80]
+	stp	x27, x28, [x29, #96]
+	; Add
+	adds	x10, x14, x19
+	adcs	x11, x15, x20
+	adcs	x12, x16, x21
+	adcs	x13, x17, x22
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x10, x10, x3
+	adcs	x11, x11, xzr
+	and	x13, x13, #0x7fffffffffffffff
+	adcs	x12, x12, xzr
+	adc	x13, x13, xzr
+	; Sub
+	subs	x14, x14, x19
+	sbcs	x15, x15, x20
+	sbcs	x16, x16, x21
+	sbcs	x17, x17, x22
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x17, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x14, x14, x3
+	sbcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	sbcs	x16, x16, xzr
+	sbc	x17, x17, xzr
+	; Multiply
+	; A[0] * B[0]
+	umulh	x20, x14, x6
+	mul	x19, x14, x6
+	; A[2] * B[0]
+	umulh	x22, x16, x6
+	mul	x21, x16, x6
+	; A[1] * B[0]
+	mul	x3, x15, x6
+	adds	x20, x20, x3
+	umulh	x4, x15, x6
+	adcs	x21, x21, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x9
+	adc	x22, x22, xzr
+	mul	x25, x15, x9
+	; A[0] * B[1]
+	mul	x3, x14, x7
+	adds	x20, x20, x3
+	umulh	x4, x14, x7
+	adcs	x21, x21, x4
+	; A[2] * B[1]
+	mul	x3, x16, x7
+	adcs	x22, x22, x3
+	umulh	x4, x16, x7
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x8
+	adds	x22, x22, x3
+	umulh	x4, x15, x8
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x8
+	adds	x21, x21, x3
+	umulh	x4, x14, x8
+	adcs	x22, x22, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x7
+	adds	x21, x21, x3
+	umulh	x4, x15, x7
+	adcs	x22, x22, x4
+	; A[3] * B[1]
+	mul	x3, x17, x7
+	adcs	x25, x25, x3
+	umulh	x4, x17, x7
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x8
+	adds	x25, x25, x3
+	umulh	x4, x16, x8
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x9
+	adcs	x27, x27, x3
+	umulh	x28, x17, x9
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x9
+	adds	x22, x22, x3
+	umulh	x4, x14, x9
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x9
+	adcs	x26, x26, x3
+	umulh	x4, x16, x9
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x6
+	adds	x22, x22, x3
+	umulh	x4, x17, x6
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x8
+	adcs	x26, x26, x3
+	umulh	x4, x17, x8
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x22, x22, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x22, #63
+	mul	x5, x5, x3
+	and	x22, x22, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x19, x19, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x20, x20, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x21, x21, x4
+	umulh	x27, x3, x27
+	adc	x22, x22, xzr
+	;  Add high product results in
+	adds	x19, x19, x5
+	adcs	x20, x20, x25
+	adcs	x21, x21, x26
+	adc	x22, x22, x27
+	; Store
+	stp	x19, x20, [x29, #48]
+	stp	x21, x22, [x29, #64]
+	; Multiply
+	ldp	x25, x26, [x29, #80]
+	ldp	x27, x28, [x29, #96]
+	; A[0] * B[0]
+	umulh	x20, x10, x25
+	mul	x19, x10, x25
+	; A[2] * B[0]
+	umulh	x22, x12, x25
+	mul	x21, x12, x25
+	; A[1] * B[0]
+	mul	x3, x11, x25
+	adds	x20, x20, x3
+	umulh	x4, x11, x25
+	adcs	x21, x21, x4
+	; A[1] * B[3]
+	umulh	x15, x11, x28
+	adc	x22, x22, xzr
+	mul	x14, x11, x28
+	; A[0] * B[1]
+	mul	x3, x10, x26
+	adds	x20, x20, x3
+	umulh	x4, x10, x26
+	adcs	x21, x21, x4
+	; A[2] * B[1]
+	mul	x3, x12, x26
+	adcs	x22, x22, x3
+	umulh	x4, x12, x26
+	adcs	x14, x14, x4
+	adc	x15, x15, xzr
+	; A[1] * B[2]
+	mul	x3, x11, x27
+	adds	x22, x22, x3
+	umulh	x4, x11, x27
+	adcs	x14, x14, x4
+	adcs	x15, x15, xzr
+	adc	x16, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x10, x27
+	adds	x21, x21, x3
+	umulh	x4, x10, x27
+	adcs	x22, x22, x4
+	adcs	x14, x14, xzr
+	adcs	x15, x15, xzr
+	adc	x16, x16, xzr
+	; A[1] * B[1]
+	mul	x3, x11, x26
+	adds	x21, x21, x3
+	umulh	x4, x11, x26
+	adcs	x22, x22, x4
+	; A[3] * B[1]
+	mul	x3, x13, x26
+	adcs	x14, x14, x3
+	umulh	x4, x13, x26
+	adcs	x15, x15, x4
+	adc	x16, x16, xzr
+	; A[2] * B[2]
+	mul	x3, x12, x27
+	adds	x14, x14, x3
+	umulh	x4, x12, x27
+	adcs	x15, x15, x4
+	; A[3] * B[3]
+	mul	x3, x13, x28
+	adcs	x16, x16, x3
+	umulh	x17, x13, x28
+	adc	x17, x17, xzr
+	; A[0] * B[3]
+	mul	x3, x10, x28
+	adds	x22, x22, x3
+	umulh	x4, x10, x28
+	adcs	x14, x14, x4
+	; A[2] * B[3]
+	mul	x3, x12, x28
+	adcs	x15, x15, x3
+	umulh	x4, x12, x28
+	adcs	x16, x16, x4
+	adc	x17, x17, xzr
+	; A[3] * B[0]
+	mul	x3, x13, x25
+	adds	x22, x22, x3
+	umulh	x4, x13, x25
+	adcs	x14, x14, x4
+	; A[3] * B[2]
+	mul	x3, x13, x27
+	adcs	x15, x15, x3
+	umulh	x4, x13, x27
+	adcs	x16, x16, x4
+	adc	x17, x17, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x22, x22, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x22, #63
+	mul	x5, x5, x3
+	and	x22, x22, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x19, x19, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x20, x20, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x21, x21, x4
+	umulh	x16, x3, x16
+	adc	x22, x22, xzr
+	;  Add high product results in
+	adds	x19, x19, x5
+	adcs	x20, x20, x14
+	adcs	x21, x21, x15
+	adc	x22, x22, x16
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x25, x26
+	mul	x11, x25, x26
+	;  A[0] * A[3]
+	umulh	x14, x25, x28
+	mul	x13, x25, x28
+	;  A[0] * A[2]
+	mul	x3, x25, x27
+	adds	x12, x12, x3
+	umulh	x4, x25, x27
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x26, x28
+	adcs	x14, x14, x3
+	umulh	x15, x26, x28
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x26, x27
+	adds	x13, x13, x3
+	umulh	x4, x26, x27
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x27, x28
+	adcs	x15, x15, x3
+	umulh	x16, x27, x28
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x25, x25
+	mul	x10, x25, x25
+	;  A[1] * A[1]
+	mul	x3, x26, x26
+	adds	x11, x11, x4
+	umulh	x4, x26, x26
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x27, x27
+	adcs	x13, x13, x4
+	umulh	x4, x27, x27
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x28, x28
+	adcs	x15, x15, x4
+	umulh	x4, x28, x28
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x10, x10, x5
+	adcs	x11, x11, x14
+	adcs	x12, x12, x15
+	adc	x13, x13, x16
+	; Square
+	;  A[0] * A[1]
+	umulh	x16, x6, x7
+	mul	x15, x6, x7
+	;  A[0] * A[3]
+	umulh	x25, x6, x9
+	mul	x17, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x16, x16, x3
+	umulh	x4, x6, x8
+	adcs	x17, x17, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x25, x25, x3
+	umulh	x26, x7, x9
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x17, x17, x3
+	umulh	x4, x7, x8
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x26, x26, x3
+	umulh	x27, x8, x9
+	adc	x27, x27, xzr
+	; Double
+	adds	x15, x15, x15
+	adcs	x16, x16, x16
+	adcs	x17, x17, x17
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x14, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x15, x15, x4
+	umulh	x4, x7, x7
+	adcs	x16, x16, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x17, x17, x4
+	umulh	x4, x8, x8
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x26, x26, x4
+	umulh	x4, x9, x9
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x17, x17, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x14, x14, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x15, x15, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x16, x16, x4
+	umulh	x27, x3, x27
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x25
+	adcs	x16, x16, x26
+	adc	x17, x17, x27
+	; Multiply
+	; A[0] * B[0]
+	umulh	x7, x14, x10
+	mul	x6, x14, x10
+	; A[2] * B[0]
+	umulh	x9, x16, x10
+	mul	x8, x16, x10
+	; A[1] * B[0]
+	mul	x3, x15, x10
+	adds	x7, x7, x3
+	umulh	x4, x15, x10
+	adcs	x8, x8, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x13
+	adc	x9, x9, xzr
+	mul	x25, x15, x13
+	; A[0] * B[1]
+	mul	x3, x14, x11
+	adds	x7, x7, x3
+	umulh	x4, x14, x11
+	adcs	x8, x8, x4
+	; A[2] * B[1]
+	mul	x3, x16, x11
+	adcs	x9, x9, x3
+	umulh	x4, x16, x11
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x12
+	adds	x9, x9, x3
+	umulh	x4, x15, x12
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x12
+	adds	x8, x8, x3
+	umulh	x4, x14, x12
+	adcs	x9, x9, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x11
+	adds	x8, x8, x3
+	umulh	x4, x15, x11
+	adcs	x9, x9, x4
+	; A[3] * B[1]
+	mul	x3, x17, x11
+	adcs	x25, x25, x3
+	umulh	x4, x17, x11
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x12
+	adds	x25, x25, x3
+	umulh	x4, x16, x12
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x13
+	adcs	x27, x27, x3
+	umulh	x28, x17, x13
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x13
+	adds	x9, x9, x3
+	umulh	x4, x14, x13
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x13
+	adcs	x26, x26, x3
+	umulh	x4, x16, x13
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x10
+	adds	x9, x9, x3
+	umulh	x4, x17, x10
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x12
+	adcs	x26, x26, x3
+	umulh	x4, x17, x12
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x9, x9, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x5, x5, x3
+	and	x9, x9, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x6, x6, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x7, x7, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x8, x8, x4
+	umulh	x27, x3, x27
+	adc	x9, x9, xzr
+	;  Add high product results in
+	adds	x6, x6, x5
+	adcs	x7, x7, x25
+	adcs	x8, x8, x26
+	adc	x9, x9, x27
+	; Store
+	stp	x6, x7, [x0]
+	stp	x8, x9, [x0, #16]
+	; Sub
+	subs	x14, x14, x10
+	sbcs	x15, x15, x11
+	sbcs	x16, x16, x12
+	sbcs	x17, x17, x13
+	csetm	x5, cc
+	mov	x3, #-19
+	;   Mask the modulus
+	extr	x5, x5, x17, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x14, x14, x3
+	sbcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	sbcs	x16, x16, xzr
+	sbc	x17, x17, xzr
+	; Multiply by 121666
+	mov	x5, #0xdb42
+	movk	x5, #1, lsl 16
+	mul	x6, x14, x5
+	umulh	x7, x14, x5
+	mul	x3, x15, x5
+	umulh	x8, x15, x5
+	adds	x7, x7, x3
+	adc	x8, x8, xzr
+	mul	x3, x16, x5
+	umulh	x9, x16, x5
+	adds	x8, x8, x3
+	adc	x9, x9, xzr
+	mul	x3, x17, x5
+	umulh	x4, x17, x5
+	adds	x9, x9, x3
+	adc	x4, x4, xzr
+	mov	x5, #19
+	extr	x4, x4, x9, #63
+	mul	x4, x4, x5
+	adds	x6, x6, x4
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Add
+	adds	x10, x10, x6
+	adcs	x11, x11, x7
+	adcs	x12, x12, x8
+	adcs	x13, x13, x9
+	cset	x5, cs
+	mov	x3, #19
+	;   Mask the modulus
+	extr	x5, x5, x13, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x10, x10, x3
+	adcs	x11, x11, xzr
+	and	x13, x13, #0x7fffffffffffffff
+	adcs	x12, x12, xzr
+	adc	x13, x13, xzr
+	; Multiply
+	; A[0] * B[0]
+	umulh	x7, x14, x10
+	mul	x6, x14, x10
+	; A[2] * B[0]
+	umulh	x9, x16, x10
+	mul	x8, x16, x10
+	; A[1] * B[0]
+	mul	x3, x15, x10
+	adds	x7, x7, x3
+	umulh	x4, x15, x10
+	adcs	x8, x8, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x13
+	adc	x9, x9, xzr
+	mul	x25, x15, x13
+	; A[0] * B[1]
+	mul	x3, x14, x11
+	adds	x7, x7, x3
+	umulh	x4, x14, x11
+	adcs	x8, x8, x4
+	; A[2] * B[1]
+	mul	x3, x16, x11
+	adcs	x9, x9, x3
+	umulh	x4, x16, x11
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x12
+	adds	x9, x9, x3
+	umulh	x4, x15, x12
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x12
+	adds	x8, x8, x3
+	umulh	x4, x14, x12
+	adcs	x9, x9, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x11
+	adds	x8, x8, x3
+	umulh	x4, x15, x11
+	adcs	x9, x9, x4
+	; A[3] * B[1]
+	mul	x3, x17, x11
+	adcs	x25, x25, x3
+	umulh	x4, x17, x11
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x12
+	adds	x25, x25, x3
+	umulh	x4, x16, x12
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x13
+	adcs	x27, x27, x3
+	umulh	x28, x17, x13
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x13
+	adds	x9, x9, x3
+	umulh	x4, x14, x13
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x13
+	adcs	x26, x26, x3
+	umulh	x4, x16, x13
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x10
+	adds	x9, x9, x3
+	umulh	x4, x17, x10
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x12
+	adcs	x26, x26, x3
+	umulh	x4, x17, x12
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x9, x9, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x5, x5, x3
+	and	x9, x9, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x6, x6, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x7, x7, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x8, x8, x4
+	umulh	x27, x3, x27
+	adc	x9, x9, xzr
+	;  Add high product results in
+	adds	x6, x6, x5
+	adcs	x7, x7, x25
+	adcs	x8, x8, x26
+	adc	x9, x9, x27
+	; Store
+	stp	x6, x7, [x29, #16]
+	stp	x8, x9, [x29, #32]
+	; Add
+	ldp	x25, x26, [x29, #48]
+	ldp	x27, x28, [x29, #64]
+	adds	x10, x25, x19
+	adcs	x11, x26, x20
+	adcs	x12, x27, x21
+	adcs	x13, x28, x22
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x10, x10, x3
+	adcs	x11, x11, xzr
+	and	x13, x13, #0x7fffffffffffffff
+	adcs	x12, x12, xzr
+	adc	x13, x13, xzr
+	; Sub
+	subs	x19, x25, x19
+	sbcs	x20, x26, x20
+	sbcs	x21, x27, x21
+	sbcs	x22, x28, x22
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x22, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x19, x19, x3
+	sbcs	x20, x20, xzr
+	and	x22, x22, #0x7fffffffffffffff
+	sbcs	x21, x21, xzr
+	sbc	x22, x22, xzr
+	; Square
+	;  A[0] * A[1]
+	umulh	x8, x10, x11
+	mul	x7, x10, x11
+	;  A[0] * A[3]
+	umulh	x25, x10, x13
+	mul	x9, x10, x13
+	;  A[0] * A[2]
+	mul	x3, x10, x12
+	adds	x8, x8, x3
+	umulh	x4, x10, x12
+	adcs	x9, x9, x4
+	;  A[1] * A[3]
+	mul	x3, x11, x13
+	adcs	x25, x25, x3
+	umulh	x26, x11, x13
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x11, x12
+	adds	x9, x9, x3
+	umulh	x4, x11, x12
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x12, x13
+	adcs	x26, x26, x3
+	umulh	x27, x12, x13
+	adc	x27, x27, xzr
+	; Double
+	adds	x7, x7, x7
+	adcs	x8, x8, x8
+	adcs	x9, x9, x9
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x10, x10
+	mul	x6, x10, x10
+	;  A[1] * A[1]
+	mul	x3, x11, x11
+	adds	x7, x7, x4
+	umulh	x4, x11, x11
+	adcs	x8, x8, x3
+	;  A[2] * A[2]
+	mul	x3, x12, x12
+	adcs	x9, x9, x4
+	umulh	x4, x12, x12
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x13, x13
+	adcs	x26, x26, x4
+	umulh	x4, x13, x13
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x9, x9, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x5, x5, x3
+	and	x9, x9, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x6, x6, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x7, x7, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x8, x8, x4
+	umulh	x27, x3, x27
+	adc	x9, x9, xzr
+	;  Add high product results in
+	adds	x6, x6, x5
+	adcs	x7, x7, x25
+	adcs	x8, x8, x26
+	adc	x9, x9, x27
+	; Square
+	;  A[0] * A[1]
+	umulh	x16, x19, x20
+	mul	x15, x19, x20
+	;  A[0] * A[3]
+	umulh	x25, x19, x22
+	mul	x17, x19, x22
+	;  A[0] * A[2]
+	mul	x3, x19, x21
+	adds	x16, x16, x3
+	umulh	x4, x19, x21
+	adcs	x17, x17, x4
+	;  A[1] * A[3]
+	mul	x3, x20, x22
+	adcs	x25, x25, x3
+	umulh	x26, x20, x22
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x20, x21
+	adds	x17, x17, x3
+	umulh	x4, x20, x21
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x21, x22
+	adcs	x26, x26, x3
+	umulh	x27, x21, x22
+	adc	x27, x27, xzr
+	; Double
+	adds	x15, x15, x15
+	adcs	x16, x16, x16
+	adcs	x17, x17, x17
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x19, x19
+	mul	x14, x19, x19
+	;  A[1] * A[1]
+	mul	x3, x20, x20
+	adds	x15, x15, x4
+	umulh	x4, x20, x20
+	adcs	x16, x16, x3
+	;  A[2] * A[2]
+	mul	x3, x21, x21
+	adcs	x17, x17, x4
+	umulh	x4, x21, x21
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x22, x22
+	adcs	x26, x26, x4
+	umulh	x4, x22, x22
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x17, x17, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x14, x14, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x15, x15, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x16, x16, x4
+	umulh	x27, x3, x27
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x25
+	adcs	x16, x16, x26
+	adc	x17, x17, x27
+	; Multiply
+	ldp	x19, x20, [x2]
+	ldp	x21, x22, [x2, #16]
+	; A[0] * B[0]
+	umulh	x11, x19, x14
+	mul	x10, x19, x14
+	; A[2] * B[0]
+	umulh	x13, x21, x14
+	mul	x12, x21, x14
+	; A[1] * B[0]
+	mul	x3, x20, x14
+	adds	x11, x11, x3
+	umulh	x4, x20, x14
+	adcs	x12, x12, x4
+	; A[1] * B[3]
+	umulh	x26, x20, x17
+	adc	x13, x13, xzr
+	mul	x25, x20, x17
+	; A[0] * B[1]
+	mul	x3, x19, x15
+	adds	x11, x11, x3
+	umulh	x4, x19, x15
+	adcs	x12, x12, x4
+	; A[2] * B[1]
+	mul	x3, x21, x15
+	adcs	x13, x13, x3
+	umulh	x4, x21, x15
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x20, x16
+	adds	x13, x13, x3
+	umulh	x4, x20, x16
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x19, x16
+	adds	x12, x12, x3
+	umulh	x4, x19, x16
+	adcs	x13, x13, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x20, x15
+	adds	x12, x12, x3
+	umulh	x4, x20, x15
+	adcs	x13, x13, x4
+	; A[3] * B[1]
+	mul	x3, x22, x15
+	adcs	x25, x25, x3
+	umulh	x4, x22, x15
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x21, x16
+	adds	x25, x25, x3
+	umulh	x4, x21, x16
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x22, x17
+	adcs	x27, x27, x3
+	umulh	x28, x22, x17
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x19, x17
+	adds	x13, x13, x3
+	umulh	x4, x19, x17
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x21, x17
+	adcs	x26, x26, x3
+	umulh	x4, x21, x17
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x22, x14
+	adds	x13, x13, x3
+	umulh	x4, x22, x14
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x22, x16
+	adcs	x26, x26, x3
+	umulh	x4, x22, x16
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x13, x13, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x10, x10, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x11, x11, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x12, x12, x4
+	umulh	x27, x3, x27
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x10, x10, x5
+	adcs	x11, x11, x25
+	adcs	x12, x12, x26
+	adc	x13, x13, x27
+	subs	x24, x24, #1
+	cmp	x24, #3
+	bge	L_curve25519_bits
+	; Conditional Swap
+	subs	xzr, xzr, x23, lsl 63
+	ldp	x25, x26, [x29, #16]
+	ldp	x27, x28, [x29, #32]
+	csel	x19, x25, x10, ne
+	csel	x25, x10, x25, ne
+	csel	x20, x26, x11, ne
+	csel	x26, x11, x26, ne
+	csel	x21, x27, x12, ne
+	csel	x27, x12, x27, ne
+	csel	x22, x28, x13, ne
+	csel	x28, x13, x28, ne
+	; Conditional Swap
+	subs	xzr, xzr, x23, lsl 63
+	ldp	x10, x11, [x0]
+	ldp	x12, x13, [x0, #16]
+	csel	x14, x10, x6, ne
+	csel	x10, x6, x10, ne
+	csel	x15, x11, x7, ne
+	csel	x11, x7, x11, ne
+	csel	x16, x12, x8, ne
+	csel	x12, x8, x12, ne
+	csel	x17, x13, x9, ne
+	csel	x13, x9, x13, ne
+L_curve25519_3
+	; Add
+	adds	x6, x10, x25
+	adcs	x7, x11, x26
+	adcs	x8, x12, x27
+	adcs	x9, x13, x28
+	cset	x5, cs
+	mov	x3, #19
+	extr	x5, x5, x9, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x6, x6, x3
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Sub
+	subs	x25, x10, x25
+	sbcs	x26, x11, x26
+	sbcs	x27, x12, x27
+	sbcs	x28, x13, x28
+	csetm	x5, cc
+	mov	x3, #-19
+	extr	x5, x5, x28, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x25, x25, x3
+	sbcs	x26, x26, xzr
+	and	x28, x28, #0x7fffffffffffffff
+	sbcs	x27, x27, xzr
+	sbc	x28, x28, xzr
+	; Square
+	;  A[0] * A[1]
+	umulh	x21, x25, x26
+	mul	x20, x25, x26
+	;  A[0] * A[3]
+	umulh	x14, x25, x28
+	mul	x22, x25, x28
+	;  A[0] * A[2]
+	mul	x3, x25, x27
+	adds	x21, x21, x3
+	umulh	x4, x25, x27
+	adcs	x22, x22, x4
+	;  A[1] * A[3]
+	mul	x3, x26, x28
+	adcs	x14, x14, x3
+	umulh	x15, x26, x28
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x26, x27
+	adds	x22, x22, x3
+	umulh	x4, x26, x27
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x27, x28
+	adcs	x15, x15, x3
+	umulh	x16, x27, x28
+	adc	x16, x16, xzr
+	; Double
+	adds	x20, x20, x20
+	adcs	x21, x21, x21
+	adcs	x22, x22, x22
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x25, x25
+	mul	x19, x25, x25
+	;  A[1] * A[1]
+	mul	x3, x26, x26
+	adds	x20, x20, x4
+	umulh	x4, x26, x26
+	adcs	x21, x21, x3
+	;  A[2] * A[2]
+	mul	x3, x27, x27
+	adcs	x22, x22, x4
+	umulh	x4, x27, x27
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x28, x28
+	adcs	x15, x15, x4
+	umulh	x4, x28, x28
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x22, x22, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x22, #63
+	mul	x5, x5, x3
+	and	x22, x22, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x19, x19, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x20, x20, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x21, x21, x4
+	umulh	x16, x3, x16
+	adc	x22, x22, xzr
+	;  Add high product results in
+	adds	x19, x19, x5
+	adcs	x20, x20, x14
+	adcs	x21, x21, x15
+	adc	x22, x22, x16
+	; Square
+	;  A[0] * A[1]
+	umulh	x16, x6, x7
+	mul	x15, x6, x7
+	;  A[0] * A[3]
+	umulh	x25, x6, x9
+	mul	x17, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x16, x16, x3
+	umulh	x4, x6, x8
+	adcs	x17, x17, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x25, x25, x3
+	umulh	x26, x7, x9
+	adc	x26, x26, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x17, x17, x3
+	umulh	x4, x7, x8
+	adcs	x25, x25, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x26, x26, x3
+	umulh	x27, x8, x9
+	adc	x27, x27, xzr
+	; Double
+	adds	x15, x15, x15
+	adcs	x16, x16, x16
+	adcs	x17, x17, x17
+	adcs	x25, x25, x25
+	adcs	x26, x26, x26
+	adcs	x27, x27, x27
+	adc	x28, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x14, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x15, x15, x4
+	umulh	x4, x7, x7
+	adcs	x16, x16, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x17, x17, x4
+	umulh	x4, x8, x8
+	adcs	x25, x25, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x26, x26, x4
+	umulh	x4, x9, x9
+	adcs	x27, x27, x3
+	adc	x28, x28, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x17, x17, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x14, x14, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x15, x15, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x16, x16, x4
+	umulh	x27, x3, x27
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x25
+	adcs	x16, x16, x26
+	adc	x17, x17, x27
+	; Multiply
+	; A[0] * B[0]
+	umulh	x11, x14, x19
+	mul	x10, x14, x19
+	; A[2] * B[0]
+	umulh	x13, x16, x19
+	mul	x12, x16, x19
+	; A[1] * B[0]
+	mul	x3, x15, x19
+	adds	x11, x11, x3
+	umulh	x4, x15, x19
+	adcs	x12, x12, x4
+	; A[1] * B[3]
+	umulh	x26, x15, x22
+	adc	x13, x13, xzr
+	mul	x25, x15, x22
+	; A[0] * B[1]
+	mul	x3, x14, x20
+	adds	x11, x11, x3
+	umulh	x4, x14, x20
+	adcs	x12, x12, x4
+	; A[2] * B[1]
+	mul	x3, x16, x20
+	adcs	x13, x13, x3
+	umulh	x4, x16, x20
+	adcs	x25, x25, x4
+	adc	x26, x26, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x21
+	adds	x13, x13, x3
+	umulh	x4, x15, x21
+	adcs	x25, x25, x4
+	adcs	x26, x26, xzr
+	adc	x27, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x21
+	adds	x12, x12, x3
+	umulh	x4, x14, x21
+	adcs	x13, x13, x4
+	adcs	x25, x25, xzr
+	adcs	x26, x26, xzr
+	adc	x27, x27, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x20
+	adds	x12, x12, x3
+	umulh	x4, x15, x20
+	adcs	x13, x13, x4
+	; A[3] * B[1]
+	mul	x3, x17, x20
+	adcs	x25, x25, x3
+	umulh	x4, x17, x20
+	adcs	x26, x26, x4
+	adc	x27, x27, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x21
+	adds	x25, x25, x3
+	umulh	x4, x16, x21
+	adcs	x26, x26, x4
+	; A[3] * B[3]
+	mul	x3, x17, x22
+	adcs	x27, x27, x3
+	umulh	x28, x17, x22
+	adc	x28, x28, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x22
+	adds	x13, x13, x3
+	umulh	x4, x14, x22
+	adcs	x25, x25, x4
+	; A[2] * B[3]
+	mul	x3, x16, x22
+	adcs	x26, x26, x3
+	umulh	x4, x16, x22
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x19
+	adds	x13, x13, x3
+	umulh	x4, x17, x19
+	adcs	x25, x25, x4
+	; A[3] * B[2]
+	mul	x3, x17, x21
+	adcs	x26, x26, x3
+	umulh	x4, x17, x21
+	adcs	x27, x27, x4
+	adc	x28, x28, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x28
+	adds	x13, x13, x4
+	umulh	x5, x3, x28
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x25
+	adds	x10, x10, x4
+	umulh	x25, x3, x25
+	mul	x4, x3, x26
+	adcs	x11, x11, x4
+	umulh	x26, x3, x26
+	mul	x4, x3, x27
+	adcs	x12, x12, x4
+	umulh	x27, x3, x27
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x10, x10, x5
+	adcs	x11, x11, x25
+	adcs	x12, x12, x26
+	adc	x13, x13, x27
+	; Store
+	stp	x10, x11, [x0]
+	stp	x12, x13, [x0, #16]
+	; Sub
+	subs	x14, x14, x19
+	sbcs	x15, x15, x20
+	sbcs	x16, x16, x21
+	sbcs	x17, x17, x22
+	csetm	x5, cc
+	mov	x3, #-19
+	;   Mask the modulus
+	extr	x5, x5, x17, #63
+	mul	x3, x5, x3
+	;   Add modulus (if underflow)
+	subs	x14, x14, x3
+	sbcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	sbcs	x16, x16, xzr
+	sbc	x17, x17, xzr
+	; Multiply by 121666
+	mov	x5, #0xdb42
+	movk	x5, #1, lsl 16
+	mul	x6, x14, x5
+	umulh	x7, x14, x5
+	mul	x3, x15, x5
+	umulh	x8, x15, x5
+	adds	x7, x7, x3
+	adc	x8, x8, xzr
+	mul	x3, x16, x5
+	umulh	x9, x16, x5
+	adds	x8, x8, x3
+	adc	x9, x9, xzr
+	mul	x3, x17, x5
+	umulh	x4, x17, x5
+	adds	x9, x9, x3
+	adc	x4, x4, xzr
+	mov	x5, #19
+	extr	x4, x4, x9, #63
+	mul	x4, x4, x5
+	adds	x6, x6, x4
+	adcs	x7, x7, xzr
+	and	x9, x9, #0x7fffffffffffffff
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	; Add
+	adds	x19, x19, x6
+	adcs	x20, x20, x7
+	adcs	x21, x21, x8
+	adcs	x22, x22, x9
+	cset	x5, cs
+	mov	x3, #19
+	;   Mask the modulus
+	extr	x5, x5, x22, #63
+	mul	x3, x5, x3
+	;   Sub modulus (if overflow)
+	adds	x19, x19, x3
+	adcs	x20, x20, xzr
+	and	x22, x22, #0x7fffffffffffffff
+	adcs	x21, x21, xzr
+	adc	x22, x22, xzr
+	; Multiply
+	; A[0] * B[0]
+	umulh	x26, x14, x19
+	mul	x25, x14, x19
+	; A[2] * B[0]
+	umulh	x28, x16, x19
+	mul	x27, x16, x19
+	; A[1] * B[0]
+	mul	x3, x15, x19
+	adds	x26, x26, x3
+	umulh	x4, x15, x19
+	adcs	x27, x27, x4
+	; A[1] * B[3]
+	umulh	x7, x15, x22
+	adc	x28, x28, xzr
+	mul	x6, x15, x22
+	; A[0] * B[1]
+	mul	x3, x14, x20
+	adds	x26, x26, x3
+	umulh	x4, x14, x20
+	adcs	x27, x27, x4
+	; A[2] * B[1]
+	mul	x3, x16, x20
+	adcs	x28, x28, x3
+	umulh	x4, x16, x20
+	adcs	x6, x6, x4
+	adc	x7, x7, xzr
+	; A[1] * B[2]
+	mul	x3, x15, x21
+	adds	x28, x28, x3
+	umulh	x4, x15, x21
+	adcs	x6, x6, x4
+	adcs	x7, x7, xzr
+	adc	x8, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x14, x21
+	adds	x27, x27, x3
+	umulh	x4, x14, x21
+	adcs	x28, x28, x4
+	adcs	x6, x6, xzr
+	adcs	x7, x7, xzr
+	adc	x8, x8, xzr
+	; A[1] * B[1]
+	mul	x3, x15, x20
+	adds	x27, x27, x3
+	umulh	x4, x15, x20
+	adcs	x28, x28, x4
+	; A[3] * B[1]
+	mul	x3, x17, x20
+	adcs	x6, x6, x3
+	umulh	x4, x17, x20
+	adcs	x7, x7, x4
+	adc	x8, x8, xzr
+	; A[2] * B[2]
+	mul	x3, x16, x21
+	adds	x6, x6, x3
+	umulh	x4, x16, x21
+	adcs	x7, x7, x4
+	; A[3] * B[3]
+	mul	x3, x17, x22
+	adcs	x8, x8, x3
+	umulh	x9, x17, x22
+	adc	x9, x9, xzr
+	; A[0] * B[3]
+	mul	x3, x14, x22
+	adds	x28, x28, x3
+	umulh	x4, x14, x22
+	adcs	x6, x6, x4
+	; A[2] * B[3]
+	mul	x3, x16, x22
+	adcs	x7, x7, x3
+	umulh	x4, x16, x22
+	adcs	x8, x8, x4
+	adc	x9, x9, xzr
+	; A[3] * B[0]
+	mul	x3, x17, x19
+	adds	x28, x28, x3
+	umulh	x4, x17, x19
+	adcs	x6, x6, x4
+	; A[3] * B[2]
+	mul	x3, x17, x21
+	adcs	x7, x7, x3
+	umulh	x4, x17, x21
+	adcs	x8, x8, x4
+	adc	x9, x9, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x9
+	adds	x28, x28, x4
+	umulh	x5, x3, x9
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x28, #63
+	mul	x5, x5, x3
+	and	x28, x28, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x6
+	adds	x25, x25, x4
+	umulh	x6, x3, x6
+	mul	x4, x3, x7
+	adcs	x26, x26, x4
+	umulh	x7, x3, x7
+	mul	x4, x3, x8
+	adcs	x27, x27, x4
+	umulh	x8, x3, x8
+	adc	x28, x28, xzr
+	;  Add high product results in
+	adds	x25, x25, x5
+	adcs	x26, x26, x6
+	adcs	x27, x27, x7
+	adc	x28, x28, x8
+	; Store
+	stp	x25, x26, [x29, #16]
+	stp	x27, x28, [x29, #32]
+	subs	x24, x24, #1
+	bge	L_curve25519_3
+	; Invert
+	add	x0, x29, #48
+	add	x1, x29, #16
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #48
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #0x50
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #16
+	add	x2, x29, #0x50
+	bl	fe_mul
+	add	x0, x29, #48
+	add	x1, x29, #48
+	add	x2, x29, #0x50
+	bl	fe_mul
+	add	x0, x29, #0x70
+	add	x1, x29, #48
+	bl	fe_sq
+	add	x0, x29, #0x50
+	add	x1, x29, #0x50
+	add	x2, x29, #0x70
+	bl	fe_mul
+	; Loop: 5 times
+	mov	x24, #5
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_inv_1
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_1
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x24, #10
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_inv_2
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_2
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 20 times
+	mov	x24, #20
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_inv_3
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_3
+	; Store
+	stp	x6, x7, [x29, #144]
+	stp	x8, x9, [x29, #160]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x90
+	add	x2, x29, #0x70
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x24, #10
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_inv_4
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_4
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x24, #50
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_inv_5
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_5
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 100 times
+	mov	x24, #0x64
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_inv_6
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_6
+	; Store
+	stp	x6, x7, [x29, #144]
+	stp	x8, x9, [x29, #160]
+	add	x0, x29, #0x70
+	add	x1, x29, #0x90
+	add	x2, x29, #0x70
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x24, #50
+	ldp	x6, x7, [x29, #112]
+	ldp	x8, x9, [x29, #128]
+L_curve25519_inv_7
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_7
+	; Store
+	stp	x6, x7, [x29, #112]
+	stp	x8, x9, [x29, #128]
+	add	x0, x29, #0x50
+	add	x1, x29, #0x70
+	add	x2, x29, #0x50
+	bl	fe_mul
+	; Loop: 5 times
+	mov	x24, #5
+	ldp	x6, x7, [x29, #80]
+	ldp	x8, x9, [x29, #96]
+L_curve25519_inv_8
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x24, x24, #1
+	bne	L_curve25519_inv_8
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #16
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	ldr	x0, [x29, #176]
+	; Multiply
+	ldp	x6, x7, [x0]
+	ldp	x8, x9, [x0, #16]
+	ldp	x10, x11, [x29, #16]
+	ldp	x12, x13, [x29, #32]
+	; A[0] * B[0]
+	umulh	x15, x6, x10
+	mul	x14, x6, x10
+	; A[2] * B[0]
+	umulh	x17, x8, x10
+	mul	x16, x8, x10
+	; A[1] * B[0]
+	mul	x3, x7, x10
+	adds	x15, x15, x3
+	umulh	x4, x7, x10
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x7, x13
+	adc	x17, x17, xzr
+	mul	x19, x7, x13
+	; A[0] * B[1]
+	mul	x3, x6, x11
+	adds	x15, x15, x3
+	umulh	x4, x6, x11
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x8, x11
+	adcs	x17, x17, x3
+	umulh	x4, x8, x11
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x7, x12
+	adds	x17, x17, x3
+	umulh	x4, x7, x12
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x6, x12
+	adds	x16, x16, x3
+	umulh	x4, x6, x12
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x7, x11
+	adds	x16, x16, x3
+	umulh	x4, x7, x11
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x9, x11
+	adcs	x19, x19, x3
+	umulh	x4, x9, x11
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x8, x12
+	adds	x19, x19, x3
+	umulh	x4, x8, x12
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x9, x13
+	adcs	x21, x21, x3
+	umulh	x22, x9, x13
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x6, x13
+	adds	x17, x17, x3
+	umulh	x4, x6, x13
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x8, x13
+	adcs	x20, x20, x3
+	umulh	x4, x8, x13
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x9, x10
+	adds	x17, x17, x3
+	umulh	x4, x9, x10
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x9, x12
+	adcs	x20, x20, x3
+	umulh	x4, x9, x12
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Reduce if top bit set
+	mov	x3, #19
+	and	x4, x3, x17, asr 63
+	adds	x14, x14, x4
+	adcs	x15, x15, xzr
+	and	x17, x17, #0x7fffffffffffffff
+	adcs	x16, x16, xzr
+	adc	x17, x17, xzr
+	adds	x4, x14, x3
+	adcs	x4, x15, xzr
+	adcs	x4, x16, xzr
+	adc	x4, x17, xzr
+	and	x4, x3, x4, asr 63
+	adds	x14, x14, x4
+	adcs	x15, x15, xzr
+	mov	x4, #0x7fffffffffffffff
+	adcs	x16, x16, xzr
+	adc	x17, x17, xzr
+	and	x17, x17, x4
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	mov	x0, xzr
+	ldp	x17, x19, [x29, #200]
+	ldp	x20, x21, [x29, #216]
+	ldp	x22, x23, [x29, #232]
+	ldp	x24, x25, [x29, #248]
+	ldp	x26, x27, [x29, #264]
+	ldr	x28, [x29, #280]
+	ldp	x29, x30, [sp], #0x120
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	fe_pow22523
+fe_pow22523 PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x23, [x29, #128]
+	; pow22523
+	str	x0, [x29, #112]
+	str	x1, [x29, #120]
+	add	x0, x29, #16
+	ldr	x1, [x29, #120]
+	bl	fe_sq
+	add	x0, x29, #48
+	add	x1, x29, #16
+	bl	fe_sq
+	add	x0, x29, #48
+	add	x1, x29, #48
+	bl	fe_sq
+	add	x0, x29, #48
+	ldr	x1, [x29, #120]
+	add	x2, x29, #48
+	bl	fe_mul
+	add	x0, x29, #16
+	add	x1, x29, #16
+	add	x2, x29, #48
+	bl	fe_mul
+	add	x0, x29, #16
+	add	x1, x29, #16
+	bl	fe_sq
+	add	x0, x29, #16
+	add	x1, x29, #48
+	add	x2, x29, #16
+	bl	fe_mul
+	; Loop: 5 times
+	mov	x23, #5
+	ldp	x6, x7, [x29, #16]
+	ldp	x8, x9, [x29, #32]
+L_fe_pow22523_1
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x23, x23, #1
+	bne	L_fe_pow22523_1
+	; Store
+	stp	x6, x7, [x29, #48]
+	stp	x8, x9, [x29, #64]
+	add	x0, x29, #16
+	add	x1, x29, #48
+	add	x2, x29, #16
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x23, #10
+	ldp	x6, x7, [x29, #16]
+	ldp	x8, x9, [x29, #32]
+L_fe_pow22523_2
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x23, x23, #1
+	bne	L_fe_pow22523_2
+	; Store
+	stp	x6, x7, [x29, #48]
+	stp	x8, x9, [x29, #64]
+	add	x0, x29, #48
+	add	x1, x29, #48
+	add	x2, x29, #16
+	bl	fe_mul
+	; Loop: 20 times
+	mov	x23, #20
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_pow22523_3
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x23, x23, #1
+	bne	L_fe_pow22523_3
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #48
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	; Loop: 10 times
+	mov	x23, #10
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_pow22523_4
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x23, x23, #1
+	bne	L_fe_pow22523_4
+	; Store
+	stp	x6, x7, [x29, #48]
+	stp	x8, x9, [x29, #64]
+	add	x0, x29, #16
+	add	x1, x29, #48
+	add	x2, x29, #16
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x23, #50
+	ldp	x6, x7, [x29, #16]
+	ldp	x8, x9, [x29, #32]
+L_fe_pow22523_5
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x23, x23, #1
+	bne	L_fe_pow22523_5
+	; Store
+	stp	x6, x7, [x29, #48]
+	stp	x8, x9, [x29, #64]
+	add	x0, x29, #48
+	add	x1, x29, #48
+	add	x2, x29, #16
+	bl	fe_mul
+	; Loop: 100 times
+	mov	x23, #0x64
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_pow22523_6
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x23, x23, #1
+	bne	L_fe_pow22523_6
+	; Store
+	stp	x6, x7, [x29, #80]
+	stp	x8, x9, [x29, #96]
+	add	x0, x29, #48
+	add	x1, x29, #0x50
+	add	x2, x29, #48
+	bl	fe_mul
+	; Loop: 50 times
+	mov	x23, #50
+	ldp	x6, x7, [x29, #48]
+	ldp	x8, x9, [x29, #64]
+L_fe_pow22523_7
+	; Square
+	;  A[0] * A[1]
+	umulh	x12, x6, x7
+	mul	x11, x6, x7
+	;  A[0] * A[3]
+	umulh	x14, x6, x9
+	mul	x13, x6, x9
+	;  A[0] * A[2]
+	mul	x3, x6, x8
+	adds	x12, x12, x3
+	umulh	x4, x6, x8
+	adcs	x13, x13, x4
+	;  A[1] * A[3]
+	mul	x3, x7, x9
+	adcs	x14, x14, x3
+	umulh	x15, x7, x9
+	adc	x15, x15, xzr
+	;  A[1] * A[2]
+	mul	x3, x7, x8
+	adds	x13, x13, x3
+	umulh	x4, x7, x8
+	adcs	x14, x14, x4
+	;  A[2] * A[3]
+	mul	x3, x8, x9
+	adcs	x15, x15, x3
+	umulh	x16, x8, x9
+	adc	x16, x16, xzr
+	; Double
+	adds	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adcs	x15, x15, x15
+	adcs	x16, x16, x16
+	adc	x17, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x4, x6, x6
+	mul	x10, x6, x6
+	;  A[1] * A[1]
+	mul	x3, x7, x7
+	adds	x11, x11, x4
+	umulh	x4, x7, x7
+	adcs	x12, x12, x3
+	;  A[2] * A[2]
+	mul	x3, x8, x8
+	adcs	x13, x13, x4
+	umulh	x4, x8, x8
+	adcs	x14, x14, x3
+	;  A[3] * A[3]
+	mul	x3, x9, x9
+	adcs	x15, x15, x4
+	umulh	x4, x9, x9
+	adcs	x16, x16, x3
+	adc	x17, x17, x4
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x17
+	adds	x13, x13, x4
+	umulh	x5, x3, x17
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x13, #63
+	mul	x5, x5, x3
+	and	x13, x13, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x14
+	adds	x10, x10, x4
+	umulh	x14, x3, x14
+	mul	x4, x3, x15
+	adcs	x11, x11, x4
+	umulh	x15, x3, x15
+	mul	x4, x3, x16
+	adcs	x12, x12, x4
+	umulh	x16, x3, x16
+	adc	x13, x13, xzr
+	;  Add high product results in
+	adds	x6, x10, x5
+	adcs	x7, x11, x14
+	adcs	x8, x12, x15
+	adc	x9, x13, x16
+	subs	x23, x23, #1
+	bne	L_fe_pow22523_7
+	; Store
+	stp	x6, x7, [x29, #48]
+	stp	x8, x9, [x29, #64]
+	add	x0, x29, #16
+	add	x1, x29, #48
+	add	x2, x29, #16
+	bl	fe_mul
+	add	x0, x29, #16
+	add	x1, x29, #16
+	bl	fe_sq
+	bl	fe_sq
+	ldr	x0, [x29, #112]
+	add	x1, x29, #16
+	ldr	x2, [x29, #120]
+	bl	fe_mul
+	ldp	x17, x23, [x29, #128]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	ge_p1p1_to_p2
+ge_p1p1_to_p2 PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #40]
+	stp	x20, x21, [x29, #56]
+	str	x22, [x29, #72]
+	str	x0, [x29, #16]
+	str	x1, [x29, #24]
+	mov	x2, x1
+	add	x1, x1, #0x60
+	; Multiply
+	ldp	x10, x11, [x1]
+	ldp	x12, x13, [x1, #16]
+	ldp	x6, x7, [x2]
+	ldp	x8, x9, [x2, #16]
+	; A[0] * B[0]
+	umulh	x15, x10, x6
+	mul	x14, x10, x6
+	; A[2] * B[0]
+	umulh	x17, x12, x6
+	mul	x16, x12, x6
+	; A[1] * B[0]
+	mul	x3, x11, x6
+	adds	x15, x15, x3
+	umulh	x4, x11, x6
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x11, x9
+	adc	x17, x17, xzr
+	mul	x19, x11, x9
+	; A[0] * B[1]
+	mul	x3, x10, x7
+	adds	x15, x15, x3
+	umulh	x4, x10, x7
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x12, x7
+	adcs	x17, x17, x3
+	umulh	x4, x12, x7
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x11, x8
+	adds	x17, x17, x3
+	umulh	x4, x11, x8
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x10, x8
+	adds	x16, x16, x3
+	umulh	x4, x10, x8
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x11, x7
+	adds	x16, x16, x3
+	umulh	x4, x11, x7
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x13, x7
+	adcs	x19, x19, x3
+	umulh	x4, x13, x7
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x12, x8
+	adds	x19, x19, x3
+	umulh	x4, x12, x8
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x13, x9
+	adcs	x21, x21, x3
+	umulh	x22, x13, x9
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x10, x9
+	adds	x17, x17, x3
+	umulh	x4, x10, x9
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x12, x9
+	adcs	x20, x20, x3
+	umulh	x4, x12, x9
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x13, x6
+	adds	x17, x17, x3
+	umulh	x4, x13, x6
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x13, x8
+	adcs	x20, x20, x3
+	umulh	x4, x13, x8
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	sub	x2, x1, #32
+	add	x0, x0, #0x40
+	; Multiply
+	ldp	x6, x7, [x2]
+	ldp	x8, x9, [x2, #16]
+	; A[0] * B[0]
+	umulh	x15, x10, x6
+	mul	x14, x10, x6
+	; A[2] * B[0]
+	umulh	x17, x12, x6
+	mul	x16, x12, x6
+	; A[1] * B[0]
+	mul	x3, x11, x6
+	adds	x15, x15, x3
+	umulh	x4, x11, x6
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x11, x9
+	adc	x17, x17, xzr
+	mul	x19, x11, x9
+	; A[0] * B[1]
+	mul	x3, x10, x7
+	adds	x15, x15, x3
+	umulh	x4, x10, x7
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x12, x7
+	adcs	x17, x17, x3
+	umulh	x4, x12, x7
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x11, x8
+	adds	x17, x17, x3
+	umulh	x4, x11, x8
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x10, x8
+	adds	x16, x16, x3
+	umulh	x4, x10, x8
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x11, x7
+	adds	x16, x16, x3
+	umulh	x4, x11, x7
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x13, x7
+	adcs	x19, x19, x3
+	umulh	x4, x13, x7
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x12, x8
+	adds	x19, x19, x3
+	umulh	x4, x12, x8
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x13, x9
+	adcs	x21, x21, x3
+	umulh	x22, x13, x9
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x10, x9
+	adds	x17, x17, x3
+	umulh	x4, x10, x9
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x12, x9
+	adcs	x20, x20, x3
+	umulh	x4, x12, x9
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x13, x6
+	adds	x17, x17, x3
+	umulh	x4, x13, x6
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x13, x8
+	adcs	x20, x20, x3
+	umulh	x4, x13, x8
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	sub	x1, x1, #0x40
+	sub	x0, x0, #32
+	; Multiply
+	ldp	x10, x11, [x1]
+	ldp	x12, x13, [x1, #16]
+	; A[0] * B[0]
+	umulh	x15, x10, x6
+	mul	x14, x10, x6
+	; A[2] * B[0]
+	umulh	x17, x12, x6
+	mul	x16, x12, x6
+	; A[1] * B[0]
+	mul	x3, x11, x6
+	adds	x15, x15, x3
+	umulh	x4, x11, x6
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x11, x9
+	adc	x17, x17, xzr
+	mul	x19, x11, x9
+	; A[0] * B[1]
+	mul	x3, x10, x7
+	adds	x15, x15, x3
+	umulh	x4, x10, x7
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x12, x7
+	adcs	x17, x17, x3
+	umulh	x4, x12, x7
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x11, x8
+	adds	x17, x17, x3
+	umulh	x4, x11, x8
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x10, x8
+	adds	x16, x16, x3
+	umulh	x4, x10, x8
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x11, x7
+	adds	x16, x16, x3
+	umulh	x4, x11, x7
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x13, x7
+	adcs	x19, x19, x3
+	umulh	x4, x13, x7
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x12, x8
+	adds	x19, x19, x3
+	umulh	x4, x12, x8
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x13, x9
+	adcs	x21, x21, x3
+	umulh	x22, x13, x9
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x10, x9
+	adds	x17, x17, x3
+	umulh	x4, x10, x9
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x12, x9
+	adcs	x20, x20, x3
+	umulh	x4, x12, x9
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x13, x6
+	adds	x17, x17, x3
+	umulh	x4, x13, x6
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x13, x8
+	adcs	x20, x20, x3
+	umulh	x4, x13, x8
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	ldp	x17, x19, [x29, #40]
+	ldp	x20, x21, [x29, #56]
+	ldr	x22, [x29, #72]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	ge_p1p1_to_p3
+ge_p1p1_to_p3 PROC
+	stp	x29, x30, [sp, #-112]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #40]
+	stp	x20, x21, [x29, #56]
+	stp	x22, x23, [x29, #72]
+	stp	x24, x25, [x29, #88]
+	str	x26, [x29, #104]
+	str	x0, [x29, #16]
+	str	x1, [x29, #24]
+	mov	x2, x1
+	add	x1, x1, #0x60
+	; Multiply
+	ldp	x10, x11, [x1]
+	ldp	x12, x13, [x1, #16]
+	ldp	x6, x7, [x2]
+	ldp	x8, x9, [x2, #16]
+	; A[0] * B[0]
+	umulh	x15, x10, x6
+	mul	x14, x10, x6
+	; A[2] * B[0]
+	umulh	x17, x12, x6
+	mul	x16, x12, x6
+	; A[1] * B[0]
+	mul	x3, x11, x6
+	adds	x15, x15, x3
+	umulh	x4, x11, x6
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x11, x9
+	adc	x17, x17, xzr
+	mul	x19, x11, x9
+	; A[0] * B[1]
+	mul	x3, x10, x7
+	adds	x15, x15, x3
+	umulh	x4, x10, x7
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x12, x7
+	adcs	x17, x17, x3
+	umulh	x4, x12, x7
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x11, x8
+	adds	x17, x17, x3
+	umulh	x4, x11, x8
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x10, x8
+	adds	x16, x16, x3
+	umulh	x4, x10, x8
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x11, x7
+	adds	x16, x16, x3
+	umulh	x4, x11, x7
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x13, x7
+	adcs	x19, x19, x3
+	umulh	x4, x13, x7
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x12, x8
+	adds	x19, x19, x3
+	umulh	x4, x12, x8
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x13, x9
+	adcs	x21, x21, x3
+	umulh	x22, x13, x9
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x10, x9
+	adds	x17, x17, x3
+	umulh	x4, x10, x9
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x12, x9
+	adcs	x20, x20, x3
+	umulh	x4, x12, x9
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x13, x6
+	adds	x17, x17, x3
+	umulh	x4, x13, x6
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x13, x8
+	adcs	x20, x20, x3
+	umulh	x4, x13, x8
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	sub	x1, x1, #0x40
+	add	x0, x0, #0x60
+	; Multiply
+	ldp	x23, x24, [x1]
+	ldp	x25, x26, [x1, #16]
+	; A[0] * B[0]
+	umulh	x15, x23, x6
+	mul	x14, x23, x6
+	; A[2] * B[0]
+	umulh	x17, x25, x6
+	mul	x16, x25, x6
+	; A[1] * B[0]
+	mul	x3, x24, x6
+	adds	x15, x15, x3
+	umulh	x4, x24, x6
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x24, x9
+	adc	x17, x17, xzr
+	mul	x19, x24, x9
+	; A[0] * B[1]
+	mul	x3, x23, x7
+	adds	x15, x15, x3
+	umulh	x4, x23, x7
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x25, x7
+	adcs	x17, x17, x3
+	umulh	x4, x25, x7
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x24, x8
+	adds	x17, x17, x3
+	umulh	x4, x24, x8
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x23, x8
+	adds	x16, x16, x3
+	umulh	x4, x23, x8
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x24, x7
+	adds	x16, x16, x3
+	umulh	x4, x24, x7
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x26, x7
+	adcs	x19, x19, x3
+	umulh	x4, x26, x7
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x25, x8
+	adds	x19, x19, x3
+	umulh	x4, x25, x8
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x26, x9
+	adcs	x21, x21, x3
+	umulh	x22, x26, x9
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x23, x9
+	adds	x17, x17, x3
+	umulh	x4, x23, x9
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x25, x9
+	adcs	x20, x20, x3
+	umulh	x4, x25, x9
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x26, x6
+	adds	x17, x17, x3
+	umulh	x4, x26, x6
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x26, x8
+	adcs	x20, x20, x3
+	umulh	x4, x26, x8
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	add	x2, x1, #32
+	sub	x0, x0, #0x40
+	; Multiply
+	ldp	x6, x7, [x2]
+	ldp	x8, x9, [x2, #16]
+	; A[0] * B[0]
+	umulh	x15, x23, x6
+	mul	x14, x23, x6
+	; A[2] * B[0]
+	umulh	x17, x25, x6
+	mul	x16, x25, x6
+	; A[1] * B[0]
+	mul	x3, x24, x6
+	adds	x15, x15, x3
+	umulh	x4, x24, x6
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x24, x9
+	adc	x17, x17, xzr
+	mul	x19, x24, x9
+	; A[0] * B[1]
+	mul	x3, x23, x7
+	adds	x15, x15, x3
+	umulh	x4, x23, x7
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x25, x7
+	adcs	x17, x17, x3
+	umulh	x4, x25, x7
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x24, x8
+	adds	x17, x17, x3
+	umulh	x4, x24, x8
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x23, x8
+	adds	x16, x16, x3
+	umulh	x4, x23, x8
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x24, x7
+	adds	x16, x16, x3
+	umulh	x4, x24, x7
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x26, x7
+	adcs	x19, x19, x3
+	umulh	x4, x26, x7
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x25, x8
+	adds	x19, x19, x3
+	umulh	x4, x25, x8
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x26, x9
+	adcs	x21, x21, x3
+	umulh	x22, x26, x9
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x23, x9
+	adds	x17, x17, x3
+	umulh	x4, x23, x9
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x25, x9
+	adcs	x20, x20, x3
+	umulh	x4, x25, x9
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x26, x6
+	adds	x17, x17, x3
+	umulh	x4, x26, x6
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x26, x8
+	adcs	x20, x20, x3
+	umulh	x4, x26, x8
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	add	x1, x1, #0x40
+	add	x0, x0, #32
+	; Multiply
+	; A[0] * B[0]
+	umulh	x15, x10, x6
+	mul	x14, x10, x6
+	; A[2] * B[0]
+	umulh	x17, x12, x6
+	mul	x16, x12, x6
+	; A[1] * B[0]
+	mul	x3, x11, x6
+	adds	x15, x15, x3
+	umulh	x4, x11, x6
+	adcs	x16, x16, x4
+	; A[1] * B[3]
+	umulh	x20, x11, x9
+	adc	x17, x17, xzr
+	mul	x19, x11, x9
+	; A[0] * B[1]
+	mul	x3, x10, x7
+	adds	x15, x15, x3
+	umulh	x4, x10, x7
+	adcs	x16, x16, x4
+	; A[2] * B[1]
+	mul	x3, x12, x7
+	adcs	x17, x17, x3
+	umulh	x4, x12, x7
+	adcs	x19, x19, x4
+	adc	x20, x20, xzr
+	; A[1] * B[2]
+	mul	x3, x11, x8
+	adds	x17, x17, x3
+	umulh	x4, x11, x8
+	adcs	x19, x19, x4
+	adcs	x20, x20, xzr
+	adc	x21, xzr, xzr
+	; A[0] * B[2]
+	mul	x3, x10, x8
+	adds	x16, x16, x3
+	umulh	x4, x10, x8
+	adcs	x17, x17, x4
+	adcs	x19, x19, xzr
+	adcs	x20, x20, xzr
+	adc	x21, x21, xzr
+	; A[1] * B[1]
+	mul	x3, x11, x7
+	adds	x16, x16, x3
+	umulh	x4, x11, x7
+	adcs	x17, x17, x4
+	; A[3] * B[1]
+	mul	x3, x13, x7
+	adcs	x19, x19, x3
+	umulh	x4, x13, x7
+	adcs	x20, x20, x4
+	adc	x21, x21, xzr
+	; A[2] * B[2]
+	mul	x3, x12, x8
+	adds	x19, x19, x3
+	umulh	x4, x12, x8
+	adcs	x20, x20, x4
+	; A[3] * B[3]
+	mul	x3, x13, x9
+	adcs	x21, x21, x3
+	umulh	x22, x13, x9
+	adc	x22, x22, xzr
+	; A[0] * B[3]
+	mul	x3, x10, x9
+	adds	x17, x17, x3
+	umulh	x4, x10, x9
+	adcs	x19, x19, x4
+	; A[2] * B[3]
+	mul	x3, x12, x9
+	adcs	x20, x20, x3
+	umulh	x4, x12, x9
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; A[3] * B[0]
+	mul	x3, x13, x6
+	adds	x17, x17, x3
+	umulh	x4, x13, x6
+	adcs	x19, x19, x4
+	; A[3] * B[2]
+	mul	x3, x13, x8
+	adcs	x20, x20, x3
+	umulh	x4, x13, x8
+	adcs	x21, x21, x4
+	adc	x22, x22, xzr
+	; Reduce
+	mov	x3, #38
+	mul	x4, x3, x22
+	adds	x17, x17, x4
+	umulh	x5, x3, x22
+	adc	x5, x5, xzr
+	mov	x3, #19
+	extr	x5, x5, x17, #63
+	mul	x5, x5, x3
+	and	x17, x17, #0x7fffffffffffffff
+	mov	x3, #38
+	mul	x4, x3, x19
+	adds	x14, x14, x4
+	umulh	x19, x3, x19
+	mul	x4, x3, x20
+	adcs	x15, x15, x4
+	umulh	x20, x3, x20
+	mul	x4, x3, x21
+	adcs	x16, x16, x4
+	umulh	x21, x3, x21
+	adc	x17, x17, xzr
+	;  Add high product results in
+	adds	x14, x14, x5
+	adcs	x15, x15, x19
+	adcs	x16, x16, x20
+	adc	x17, x17, x21
+	; Store
+	stp	x14, x15, [x0]
+	stp	x16, x17, [x0, #16]
+	ldp	x17, x19, [x29, #40]
+	ldp	x20, x21, [x29, #56]
+	ldp	x22, x23, [x29, #72]
+	ldp	x24, x25, [x29, #88]
+	ldr	x26, [x29, #104]
+	ldp	x29, x30, [sp], #0x70
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	ge_p2_dbl
+ge_p2_dbl PROC
+	stp	x29, x30, [sp, #-128]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #40]
+	stp	x20, x21, [x29, #56]
+	stp	x22, x23, [x29, #72]
+	stp	x24, x25, [x29, #88]
+	stp	x26, x27, [x29, #104]
+	str	x28, [x29, #120]
+	str	x0, [x29, #16]
+	str	x1, [x29, #24]
+	add	x0, x0, #0x40
+	; Square
+	ldp	x4, x5, [x1]
+	ldp	x6, x7, [x1, #16]
+	;  A[0] * A[1]
+	umulh	x10, x4, x5
+	mul	x9, x4, x5
+	;  A[0] * A[3]
+	umulh	x12, x4, x7
+	mul	x11, x4, x7
+	;  A[0] * A[2]
+	mul	x25, x4, x6
+	adds	x10, x10, x25
+	umulh	x26, x4, x6
+	adcs	x11, x11, x26
+	;  A[1] * A[3]
+	mul	x25, x5, x7
+	adcs	x12, x12, x25
+	umulh	x13, x5, x7
+	adc	x13, x13, xzr
+	;  A[1] * A[2]
+	mul	x25, x5, x6
+	adds	x11, x11, x25
+	umulh	x26, x5, x6
+	adcs	x12, x12, x26
+	;  A[2] * A[3]
+	mul	x25, x6, x7
+	adcs	x13, x13, x25
+	umulh	x14, x6, x7
+	adc	x14, x14, xzr
+	; Double
+	adds	x9, x9, x9
+	adcs	x10, x10, x10
+	adcs	x11, x11, x11
+	adcs	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adc	x15, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x26, x4, x4
+	mul	x8, x4, x4
+	;  A[1] * A[1]
+	mul	x25, x5, x5
+	adds	x9, x9, x26
+	umulh	x26, x5, x5
+	adcs	x10, x10, x25
+	;  A[2] * A[2]
+	mul	x25, x6, x6
+	adcs	x11, x11, x26
+	umulh	x26, x6, x6
+	adcs	x12, x12, x25
+	;  A[3] * A[3]
+	mul	x25, x7, x7
+	adcs	x13, x13, x26
+	umulh	x26, x7, x7
+	adcs	x14, x14, x25
+	adc	x15, x15, x26
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x15
+	adds	x11, x11, x26
+	umulh	x27, x25, x15
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x11, #63
+	mul	x27, x27, x25
+	and	x11, x11, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x12
+	adds	x8, x8, x26
+	umulh	x12, x25, x12
+	mul	x26, x25, x13
+	adcs	x9, x9, x26
+	umulh	x13, x25, x13
+	mul	x26, x25, x14
+	adcs	x10, x10, x26
+	umulh	x14, x25, x14
+	adc	x11, x11, xzr
+	;  Add high product results in
+	adds	x8, x8, x27
+	adcs	x9, x9, x12
+	adcs	x10, x10, x13
+	adc	x11, x11, x14
+	; Store
+	stp	x8, x9, [x0]
+	stp	x10, x11, [x0, #16]
+	add	x2, x1, #32
+	sub	x0, x0, #32
+	; Square
+	ldp	x16, x17, [x2]
+	ldp	x19, x20, [x2, #16]
+	;  A[0] * A[1]
+	umulh	x23, x16, x17
+	mul	x22, x16, x17
+	;  A[0] * A[3]
+	umulh	x4, x16, x20
+	mul	x24, x16, x20
+	;  A[0] * A[2]
+	mul	x25, x16, x19
+	adds	x23, x23, x25
+	umulh	x26, x16, x19
+	adcs	x24, x24, x26
+	;  A[1] * A[3]
+	mul	x25, x17, x20
+	adcs	x4, x4, x25
+	umulh	x5, x17, x20
+	adc	x5, x5, xzr
+	;  A[1] * A[2]
+	mul	x25, x17, x19
+	adds	x24, x24, x25
+	umulh	x26, x17, x19
+	adcs	x4, x4, x26
+	;  A[2] * A[3]
+	mul	x25, x19, x20
+	adcs	x5, x5, x25
+	umulh	x6, x19, x20
+	adc	x6, x6, xzr
+	; Double
+	adds	x22, x22, x22
+	adcs	x23, x23, x23
+	adcs	x24, x24, x24
+	adcs	x4, x4, x4
+	adcs	x5, x5, x5
+	adcs	x6, x6, x6
+	adc	x7, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x26, x16, x16
+	mul	x21, x16, x16
+	;  A[1] * A[1]
+	mul	x25, x17, x17
+	adds	x22, x22, x26
+	umulh	x26, x17, x17
+	adcs	x23, x23, x25
+	;  A[2] * A[2]
+	mul	x25, x19, x19
+	adcs	x24, x24, x26
+	umulh	x26, x19, x19
+	adcs	x4, x4, x25
+	;  A[3] * A[3]
+	mul	x25, x20, x20
+	adcs	x5, x5, x26
+	umulh	x26, x20, x20
+	adcs	x6, x6, x25
+	adc	x7, x7, x26
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x7
+	adds	x24, x24, x26
+	umulh	x27, x25, x7
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x24, #63
+	mul	x27, x27, x25
+	and	x24, x24, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x4
+	adds	x21, x21, x26
+	umulh	x4, x25, x4
+	mul	x26, x25, x5
+	adcs	x22, x22, x26
+	umulh	x5, x25, x5
+	mul	x26, x25, x6
+	adcs	x23, x23, x26
+	umulh	x6, x25, x6
+	adc	x24, x24, xzr
+	;  Add high product results in
+	adds	x21, x21, x27
+	adcs	x22, x22, x4
+	adcs	x23, x23, x5
+	adc	x24, x24, x6
+	add	x3, x0, #32
+	mov	x2, x0
+	add	x1, x0, #32
+	; Add
+	adds	x4, x21, x8
+	adcs	x5, x22, x9
+	adcs	x6, x23, x10
+	adcs	x7, x24, x11
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x7, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x4, x4, x25
+	adcs	x5, x5, xzr
+	and	x7, x7, #0x7fffffffffffffff
+	adcs	x6, x6, xzr
+	adc	x7, x7, xzr
+	; Sub
+	subs	x12, x21, x8
+	sbcs	x13, x22, x9
+	sbcs	x14, x23, x10
+	sbcs	x15, x24, x11
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	stp	x4, x5, [x0]
+	stp	x6, x7, [x0, #16]
+	stp	x12, x13, [x1]
+	stp	x14, x15, [x1, #16]
+	ldr	x1, [x29, #24]
+	add	x2, x1, #32
+	sub	x0, x0, #32
+	; Add
+	ldp	x8, x9, [x1]
+	ldp	x10, x11, [x1, #16]
+	adds	x8, x8, x16
+	adcs	x9, x9, x17
+	adcs	x10, x10, x19
+	adcs	x11, x11, x20
+	cset	x28, cs
+	mov	x25, #19
+	;   Mask the modulus
+	extr	x28, x28, x11, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x8, x8, x25
+	adcs	x9, x9, xzr
+	and	x11, x11, #0x7fffffffffffffff
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	mov	x1, x0
+	; Square
+	;  A[0] * A[1]
+	umulh	x23, x8, x9
+	mul	x22, x8, x9
+	;  A[0] * A[3]
+	umulh	x4, x8, x11
+	mul	x24, x8, x11
+	;  A[0] * A[2]
+	mul	x25, x8, x10
+	adds	x23, x23, x25
+	umulh	x26, x8, x10
+	adcs	x24, x24, x26
+	;  A[1] * A[3]
+	mul	x25, x9, x11
+	adcs	x4, x4, x25
+	umulh	x5, x9, x11
+	adc	x5, x5, xzr
+	;  A[1] * A[2]
+	mul	x25, x9, x10
+	adds	x24, x24, x25
+	umulh	x26, x9, x10
+	adcs	x4, x4, x26
+	;  A[2] * A[3]
+	mul	x25, x10, x11
+	adcs	x5, x5, x25
+	umulh	x6, x10, x11
+	adc	x6, x6, xzr
+	; Double
+	adds	x22, x22, x22
+	adcs	x23, x23, x23
+	adcs	x24, x24, x24
+	adcs	x4, x4, x4
+	adcs	x5, x5, x5
+	adcs	x6, x6, x6
+	adc	x7, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x26, x8, x8
+	mul	x21, x8, x8
+	;  A[1] * A[1]
+	mul	x25, x9, x9
+	adds	x22, x22, x26
+	umulh	x26, x9, x9
+	adcs	x23, x23, x25
+	;  A[2] * A[2]
+	mul	x25, x10, x10
+	adcs	x24, x24, x26
+	umulh	x26, x10, x10
+	adcs	x4, x4, x25
+	;  A[3] * A[3]
+	mul	x25, x11, x11
+	adcs	x5, x5, x26
+	umulh	x26, x11, x11
+	adcs	x6, x6, x25
+	adc	x7, x7, x26
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x7
+	adds	x24, x24, x26
+	umulh	x27, x25, x7
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x24, #63
+	mul	x27, x27, x25
+	and	x24, x24, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x4
+	adds	x21, x21, x26
+	umulh	x4, x25, x4
+	mul	x26, x25, x5
+	adcs	x22, x22, x26
+	umulh	x5, x25, x5
+	mul	x26, x25, x6
+	adcs	x23, x23, x26
+	umulh	x6, x25, x6
+	adc	x24, x24, xzr
+	;  Add high product results in
+	adds	x21, x21, x27
+	adcs	x22, x22, x4
+	adcs	x23, x23, x5
+	adc	x24, x24, x6
+	add	x2, x0, #32
+	; Sub
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	subs	x21, x21, x8
+	sbcs	x22, x22, x9
+	sbcs	x23, x23, x10
+	sbcs	x24, x24, x11
+	csetm	x28, cc
+	mov	x25, #-19
+	;   Mask the modulus
+	extr	x28, x28, x24, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x21, x21, x25
+	sbcs	x22, x22, xzr
+	and	x24, x24, #0x7fffffffffffffff
+	sbcs	x23, x23, xzr
+	sbc	x24, x24, xzr
+	stp	x21, x22, [x0]
+	stp	x23, x24, [x0, #16]
+	ldr	x2, [x29, #24]
+	add	x2, x2, #0x40
+	add	x0, x0, #0x60
+	; Square * 2
+	ldp	x16, x17, [x2]
+	ldp	x19, x20, [x2, #16]
+	;  A[0] * A[1]
+	umulh	x6, x16, x17
+	mul	x5, x16, x17
+	;  A[0] * A[3]
+	umulh	x8, x16, x20
+	mul	x7, x16, x20
+	;  A[0] * A[2]
+	mul	x25, x16, x19
+	adds	x6, x6, x25
+	umulh	x26, x16, x19
+	adcs	x7, x7, x26
+	;  A[1] * A[3]
+	mul	x25, x17, x20
+	adcs	x8, x8, x25
+	umulh	x9, x17, x20
+	adc	x9, x9, xzr
+	;  A[1] * A[2]
+	mul	x25, x17, x19
+	adds	x7, x7, x25
+	umulh	x26, x17, x19
+	adcs	x8, x8, x26
+	;  A[2] * A[3]
+	mul	x25, x19, x20
+	adcs	x9, x9, x25
+	umulh	x10, x19, x20
+	adc	x10, x10, xzr
+	; Double
+	adds	x5, x5, x5
+	adcs	x6, x6, x6
+	adcs	x7, x7, x7
+	adcs	x8, x8, x8
+	adcs	x9, x9, x9
+	adcs	x10, x10, x10
+	adc	x11, xzr, xzr
+	;  A[0] * A[0]
+	umulh	x26, x16, x16
+	mul	x4, x16, x16
+	;  A[1] * A[1]
+	mul	x25, x17, x17
+	adds	x5, x5, x26
+	umulh	x26, x17, x17
+	adcs	x6, x6, x25
+	;  A[2] * A[2]
+	mul	x25, x19, x19
+	adcs	x7, x7, x26
+	umulh	x26, x19, x19
+	adcs	x8, x8, x25
+	;  A[3] * A[3]
+	mul	x25, x20, x20
+	adcs	x9, x9, x26
+	umulh	x26, x20, x20
+	adcs	x10, x10, x25
+	adc	x11, x11, x26
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x7, x7, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x7, #63
+	mul	x27, x27, x25
+	and	x7, x7, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x4, x4, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x5, x5, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x6, x6, x26
+	umulh	x10, x25, x10
+	adc	x7, x7, xzr
+	;  Add high product results in
+	adds	x4, x4, x27
+	adcs	x5, x5, x8
+	adcs	x6, x6, x9
+	adc	x7, x7, x10
+	mov	x25, #19
+	lsr	x26, x7, #62
+	extr	x7, x7, x6, #63
+	extr	x6, x6, x5, #63
+	extr	x5, x5, x4, #63
+	lsl	x4, x4, #1
+	mul	x26, x26, x25
+	adds	x4, x4, x26
+	adcs	x5, x5, xzr
+	and	x7, x7, #0x7fffffffffffffff
+	adcs	x6, x6, xzr
+	adc	x7, x7, xzr
+	; Store
+	sub	x1, x0, #32
+	; Sub
+	subs	x4, x4, x12
+	sbcs	x5, x5, x13
+	sbcs	x6, x6, x14
+	sbcs	x7, x7, x15
+	csetm	x28, cc
+	mov	x25, #-19
+	;   Mask the modulus
+	extr	x28, x28, x7, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x4, x4, x25
+	sbcs	x5, x5, xzr
+	and	x7, x7, #0x7fffffffffffffff
+	sbcs	x6, x6, xzr
+	sbc	x7, x7, xzr
+	stp	x4, x5, [x0]
+	stp	x6, x7, [x0, #16]
+	ldp	x17, x19, [x29, #40]
+	ldp	x20, x21, [x29, #56]
+	ldp	x22, x23, [x29, #72]
+	ldp	x24, x25, [x29, #88]
+	ldp	x26, x27, [x29, #104]
+	ldr	x28, [x29, #120]
+	ldp	x29, x30, [sp], #0x80
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	ge_madd
+ge_madd PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #56]
+	stp	x20, x21, [x29, #72]
+	stp	x22, x23, [x29, #88]
+	stp	x24, x25, [x29, #104]
+	stp	x26, x27, [x29, #120]
+	str	x28, [x29, #136]
+	str	x0, [x29, #16]
+	str	x1, [x29, #24]
+	str	x2, [x29, #32]
+	mov	x3, x1
+	add	x2, x1, #32
+	add	x1, x0, #32
+	; Add
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	ldp	x4, x5, [x3]
+	ldp	x6, x7, [x3, #16]
+	adds	x16, x8, x4
+	adcs	x17, x9, x5
+	adcs	x19, x10, x6
+	adcs	x20, x11, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x20, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x16, x16, x25
+	adcs	x17, x17, xzr
+	and	x20, x20, #0x7fffffffffffffff
+	adcs	x19, x19, xzr
+	adc	x20, x20, xzr
+	; Sub
+	subs	x12, x8, x4
+	sbcs	x13, x9, x5
+	sbcs	x14, x10, x6
+	sbcs	x15, x11, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	ldr	x2, [x29, #32]
+	mov	x1, x0
+	; Multiply
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	; A[0] * B[0]
+	umulh	x22, x16, x8
+	mul	x21, x16, x8
+	; A[2] * B[0]
+	umulh	x24, x19, x8
+	mul	x23, x19, x8
+	; A[1] * B[0]
+	mul	x25, x17, x8
+	adds	x22, x22, x25
+	umulh	x26, x17, x8
+	adcs	x23, x23, x26
+	; A[1] * B[3]
+	umulh	x5, x17, x11
+	adc	x24, x24, xzr
+	mul	x4, x17, x11
+	; A[0] * B[1]
+	mul	x25, x16, x9
+	adds	x22, x22, x25
+	umulh	x26, x16, x9
+	adcs	x23, x23, x26
+	; A[2] * B[1]
+	mul	x25, x19, x9
+	adcs	x24, x24, x25
+	umulh	x26, x19, x9
+	adcs	x4, x4, x26
+	adc	x5, x5, xzr
+	; A[1] * B[2]
+	mul	x25, x17, x10
+	adds	x24, x24, x25
+	umulh	x26, x17, x10
+	adcs	x4, x4, x26
+	adcs	x5, x5, xzr
+	adc	x6, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x16, x10
+	adds	x23, x23, x25
+	umulh	x26, x16, x10
+	adcs	x24, x24, x26
+	adcs	x4, x4, xzr
+	adcs	x5, x5, xzr
+	adc	x6, x6, xzr
+	; A[1] * B[1]
+	mul	x25, x17, x9
+	adds	x23, x23, x25
+	umulh	x26, x17, x9
+	adcs	x24, x24, x26
+	; A[3] * B[1]
+	mul	x25, x20, x9
+	adcs	x4, x4, x25
+	umulh	x26, x20, x9
+	adcs	x5, x5, x26
+	adc	x6, x6, xzr
+	; A[2] * B[2]
+	mul	x25, x19, x10
+	adds	x4, x4, x25
+	umulh	x26, x19, x10
+	adcs	x5, x5, x26
+	; A[3] * B[3]
+	mul	x25, x20, x11
+	adcs	x6, x6, x25
+	umulh	x7, x20, x11
+	adc	x7, x7, xzr
+	; A[0] * B[3]
+	mul	x25, x16, x11
+	adds	x24, x24, x25
+	umulh	x26, x16, x11
+	adcs	x4, x4, x26
+	; A[2] * B[3]
+	mul	x25, x19, x11
+	adcs	x5, x5, x25
+	umulh	x26, x19, x11
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; A[3] * B[0]
+	mul	x25, x20, x8
+	adds	x24, x24, x25
+	umulh	x26, x20, x8
+	adcs	x4, x4, x26
+	; A[3] * B[2]
+	mul	x25, x20, x10
+	adcs	x5, x5, x25
+	umulh	x26, x20, x10
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x7
+	adds	x24, x24, x26
+	umulh	x27, x25, x7
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x24, #63
+	mul	x27, x27, x25
+	and	x24, x24, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x4
+	adds	x21, x21, x26
+	umulh	x4, x25, x4
+	mul	x26, x25, x5
+	adcs	x22, x22, x26
+	umulh	x5, x25, x5
+	mul	x26, x25, x6
+	adcs	x23, x23, x26
+	umulh	x6, x25, x6
+	adc	x24, x24, xzr
+	;  Add high product results in
+	adds	x21, x21, x27
+	adcs	x22, x22, x4
+	adcs	x23, x23, x5
+	adc	x24, x24, x6
+	add	x2, x2, #32
+	add	x1, x0, #32
+	add	x0, x0, #32
+	; Multiply
+	ldp	x16, x17, [x2]
+	ldp	x19, x20, [x2, #16]
+	; A[0] * B[0]
+	umulh	x5, x12, x16
+	mul	x4, x12, x16
+	; A[2] * B[0]
+	umulh	x7, x14, x16
+	mul	x6, x14, x16
+	; A[1] * B[0]
+	mul	x25, x13, x16
+	adds	x5, x5, x25
+	umulh	x26, x13, x16
+	adcs	x6, x6, x26
+	; A[1] * B[3]
+	umulh	x9, x13, x20
+	adc	x7, x7, xzr
+	mul	x8, x13, x20
+	; A[0] * B[1]
+	mul	x25, x12, x17
+	adds	x5, x5, x25
+	umulh	x26, x12, x17
+	adcs	x6, x6, x26
+	; A[2] * B[1]
+	mul	x25, x14, x17
+	adcs	x7, x7, x25
+	umulh	x26, x14, x17
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x13, x19
+	adds	x7, x7, x25
+	umulh	x26, x13, x19
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x12, x19
+	adds	x6, x6, x25
+	umulh	x26, x12, x19
+	adcs	x7, x7, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x13, x17
+	adds	x6, x6, x25
+	umulh	x26, x13, x17
+	adcs	x7, x7, x26
+	; A[3] * B[1]
+	mul	x25, x15, x17
+	adcs	x8, x8, x25
+	umulh	x26, x15, x17
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x14, x19
+	adds	x8, x8, x25
+	umulh	x26, x14, x19
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x15, x20
+	adcs	x10, x10, x25
+	umulh	x11, x15, x20
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x12, x20
+	adds	x7, x7, x25
+	umulh	x26, x12, x20
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x14, x20
+	adcs	x9, x9, x25
+	umulh	x26, x14, x20
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x15, x16
+	adds	x7, x7, x25
+	umulh	x26, x15, x16
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x15, x19
+	adcs	x9, x9, x25
+	umulh	x26, x15, x19
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x7, x7, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x7, #63
+	mul	x27, x27, x25
+	and	x7, x7, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x4, x4, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x5, x5, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x6, x6, x26
+	umulh	x10, x25, x10
+	adc	x7, x7, xzr
+	;  Add high product results in
+	adds	x4, x4, x27
+	adcs	x5, x5, x8
+	adcs	x6, x6, x9
+	adc	x7, x7, x10
+	mov	x3, x0
+	sub	x2, x0, #32
+	sub	x1, x0, #32
+	; Add
+	adds	x8, x21, x4
+	adcs	x9, x22, x5
+	adcs	x10, x23, x6
+	adcs	x11, x24, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x11, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x8, x8, x25
+	adcs	x9, x9, xzr
+	and	x11, x11, #0x7fffffffffffffff
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	; Sub
+	subs	x12, x21, x4
+	sbcs	x13, x22, x5
+	sbcs	x14, x23, x6
+	sbcs	x15, x24, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	stp	x8, x9, [x0]
+	stp	x10, x11, [x0, #16]
+	stp	x12, x13, [x1]
+	stp	x14, x15, [x1, #16]
+	ldr	x1, [x29, #24]
+	ldr	x2, [x29, #32]
+	add	x2, x2, #0x40
+	add	x1, x1, #0x60
+	add	x0, x0, #0x40
+	; Multiply
+	ldp	x21, x22, [x1]
+	ldp	x23, x24, [x1, #16]
+	ldp	x4, x5, [x2]
+	ldp	x6, x7, [x2, #16]
+	; A[0] * B[0]
+	umulh	x17, x21, x4
+	mul	x16, x21, x4
+	; A[2] * B[0]
+	umulh	x20, x23, x4
+	mul	x19, x23, x4
+	; A[1] * B[0]
+	mul	x25, x22, x4
+	adds	x17, x17, x25
+	umulh	x26, x22, x4
+	adcs	x19, x19, x26
+	; A[1] * B[3]
+	umulh	x9, x22, x7
+	adc	x20, x20, xzr
+	mul	x8, x22, x7
+	; A[0] * B[1]
+	mul	x25, x21, x5
+	adds	x17, x17, x25
+	umulh	x26, x21, x5
+	adcs	x19, x19, x26
+	; A[2] * B[1]
+	mul	x25, x23, x5
+	adcs	x20, x20, x25
+	umulh	x26, x23, x5
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x22, x6
+	adds	x20, x20, x25
+	umulh	x26, x22, x6
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x21, x6
+	adds	x19, x19, x25
+	umulh	x26, x21, x6
+	adcs	x20, x20, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x22, x5
+	adds	x19, x19, x25
+	umulh	x26, x22, x5
+	adcs	x20, x20, x26
+	; A[3] * B[1]
+	mul	x25, x24, x5
+	adcs	x8, x8, x25
+	umulh	x26, x24, x5
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x23, x6
+	adds	x8, x8, x25
+	umulh	x26, x23, x6
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x24, x7
+	adcs	x10, x10, x25
+	umulh	x11, x24, x7
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x21, x7
+	adds	x20, x20, x25
+	umulh	x26, x21, x7
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x23, x7
+	adcs	x9, x9, x25
+	umulh	x26, x23, x7
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x24, x4
+	adds	x20, x20, x25
+	umulh	x26, x24, x4
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x24, x6
+	adcs	x9, x9, x25
+	umulh	x26, x24, x6
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x20, x20, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x20, #63
+	mul	x27, x27, x25
+	and	x20, x20, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x16, x16, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x17, x17, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x19, x19, x26
+	umulh	x10, x25, x10
+	adc	x20, x20, xzr
+	;  Add high product results in
+	adds	x16, x16, x27
+	adcs	x17, x17, x8
+	adcs	x19, x19, x9
+	adc	x20, x20, x10
+	sub	x1, x1, #32
+	; Double
+	ldp	x12, x13, [x1]
+	ldp	x14, x15, [x1, #16]
+	adds	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adc	x15, x15, x15
+	mov	x25, #-19
+	asr	x28, x15, #63
+	;   Mask the modulus
+	and	x25, x28, x25
+	and	x26, x28, #0x7fffffffffffffff
+	;   Sub modulus (if overflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, x28
+	sbcs	x14, x14, x28
+	sbc	x15, x15, x26
+	mov	x3, x0
+	sub	x2, x0, #32
+	mov	x1, x0
+	sub	x0, x0, #32
+	; Add
+	adds	x8, x12, x16
+	adcs	x9, x13, x17
+	adcs	x10, x14, x19
+	adcs	x11, x15, x20
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x11, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x8, x8, x25
+	adcs	x9, x9, xzr
+	and	x11, x11, #0x7fffffffffffffff
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	; Sub
+	subs	x4, x12, x16
+	sbcs	x5, x13, x17
+	sbcs	x6, x14, x19
+	sbcs	x7, x15, x20
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x7, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x4, x4, x25
+	sbcs	x5, x5, xzr
+	and	x7, x7, #0x7fffffffffffffff
+	sbcs	x6, x6, xzr
+	sbc	x7, x7, xzr
+	stp	x8, x9, [x0]
+	stp	x10, x11, [x0, #16]
+	stp	x4, x5, [x1]
+	stp	x6, x7, [x1, #16]
+	ldp	x17, x19, [x29, #56]
+	ldp	x20, x21, [x29, #72]
+	ldp	x22, x23, [x29, #88]
+	ldp	x24, x25, [x29, #104]
+	ldp	x26, x27, [x29, #120]
+	ldr	x28, [x29, #136]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	ge_msub
+ge_msub PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #56]
+	stp	x20, x21, [x29, #72]
+	stp	x22, x23, [x29, #88]
+	stp	x24, x25, [x29, #104]
+	stp	x26, x27, [x29, #120]
+	str	x28, [x29, #136]
+	str	x0, [x29, #16]
+	str	x1, [x29, #24]
+	str	x2, [x29, #32]
+	mov	x3, x1
+	add	x2, x1, #32
+	add	x1, x0, #32
+	; Add
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	ldp	x4, x5, [x3]
+	ldp	x6, x7, [x3, #16]
+	adds	x16, x8, x4
+	adcs	x17, x9, x5
+	adcs	x19, x10, x6
+	adcs	x20, x11, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x20, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x16, x16, x25
+	adcs	x17, x17, xzr
+	and	x20, x20, #0x7fffffffffffffff
+	adcs	x19, x19, xzr
+	adc	x20, x20, xzr
+	; Sub
+	subs	x12, x8, x4
+	sbcs	x13, x9, x5
+	sbcs	x14, x10, x6
+	sbcs	x15, x11, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	ldr	x2, [x29, #32]
+	add	x2, x2, #32
+	mov	x1, x0
+	; Multiply
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	; A[0] * B[0]
+	umulh	x22, x16, x8
+	mul	x21, x16, x8
+	; A[2] * B[0]
+	umulh	x24, x19, x8
+	mul	x23, x19, x8
+	; A[1] * B[0]
+	mul	x25, x17, x8
+	adds	x22, x22, x25
+	umulh	x26, x17, x8
+	adcs	x23, x23, x26
+	; A[1] * B[3]
+	umulh	x5, x17, x11
+	adc	x24, x24, xzr
+	mul	x4, x17, x11
+	; A[0] * B[1]
+	mul	x25, x16, x9
+	adds	x22, x22, x25
+	umulh	x26, x16, x9
+	adcs	x23, x23, x26
+	; A[2] * B[1]
+	mul	x25, x19, x9
+	adcs	x24, x24, x25
+	umulh	x26, x19, x9
+	adcs	x4, x4, x26
+	adc	x5, x5, xzr
+	; A[1] * B[2]
+	mul	x25, x17, x10
+	adds	x24, x24, x25
+	umulh	x26, x17, x10
+	adcs	x4, x4, x26
+	adcs	x5, x5, xzr
+	adc	x6, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x16, x10
+	adds	x23, x23, x25
+	umulh	x26, x16, x10
+	adcs	x24, x24, x26
+	adcs	x4, x4, xzr
+	adcs	x5, x5, xzr
+	adc	x6, x6, xzr
+	; A[1] * B[1]
+	mul	x25, x17, x9
+	adds	x23, x23, x25
+	umulh	x26, x17, x9
+	adcs	x24, x24, x26
+	; A[3] * B[1]
+	mul	x25, x20, x9
+	adcs	x4, x4, x25
+	umulh	x26, x20, x9
+	adcs	x5, x5, x26
+	adc	x6, x6, xzr
+	; A[2] * B[2]
+	mul	x25, x19, x10
+	adds	x4, x4, x25
+	umulh	x26, x19, x10
+	adcs	x5, x5, x26
+	; A[3] * B[3]
+	mul	x25, x20, x11
+	adcs	x6, x6, x25
+	umulh	x7, x20, x11
+	adc	x7, x7, xzr
+	; A[0] * B[3]
+	mul	x25, x16, x11
+	adds	x24, x24, x25
+	umulh	x26, x16, x11
+	adcs	x4, x4, x26
+	; A[2] * B[3]
+	mul	x25, x19, x11
+	adcs	x5, x5, x25
+	umulh	x26, x19, x11
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; A[3] * B[0]
+	mul	x25, x20, x8
+	adds	x24, x24, x25
+	umulh	x26, x20, x8
+	adcs	x4, x4, x26
+	; A[3] * B[2]
+	mul	x25, x20, x10
+	adcs	x5, x5, x25
+	umulh	x26, x20, x10
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x7
+	adds	x24, x24, x26
+	umulh	x27, x25, x7
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x24, #63
+	mul	x27, x27, x25
+	and	x24, x24, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x4
+	adds	x21, x21, x26
+	umulh	x4, x25, x4
+	mul	x26, x25, x5
+	adcs	x22, x22, x26
+	umulh	x5, x25, x5
+	mul	x26, x25, x6
+	adcs	x23, x23, x26
+	umulh	x6, x25, x6
+	adc	x24, x24, xzr
+	;  Add high product results in
+	adds	x21, x21, x27
+	adcs	x22, x22, x4
+	adcs	x23, x23, x5
+	adc	x24, x24, x6
+	sub	x2, x2, #32
+	add	x1, x0, #32
+	add	x0, x0, #32
+	; Multiply
+	ldp	x16, x17, [x2]
+	ldp	x19, x20, [x2, #16]
+	; A[0] * B[0]
+	umulh	x5, x12, x16
+	mul	x4, x12, x16
+	; A[2] * B[0]
+	umulh	x7, x14, x16
+	mul	x6, x14, x16
+	; A[1] * B[0]
+	mul	x25, x13, x16
+	adds	x5, x5, x25
+	umulh	x26, x13, x16
+	adcs	x6, x6, x26
+	; A[1] * B[3]
+	umulh	x9, x13, x20
+	adc	x7, x7, xzr
+	mul	x8, x13, x20
+	; A[0] * B[1]
+	mul	x25, x12, x17
+	adds	x5, x5, x25
+	umulh	x26, x12, x17
+	adcs	x6, x6, x26
+	; A[2] * B[1]
+	mul	x25, x14, x17
+	adcs	x7, x7, x25
+	umulh	x26, x14, x17
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x13, x19
+	adds	x7, x7, x25
+	umulh	x26, x13, x19
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x12, x19
+	adds	x6, x6, x25
+	umulh	x26, x12, x19
+	adcs	x7, x7, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x13, x17
+	adds	x6, x6, x25
+	umulh	x26, x13, x17
+	adcs	x7, x7, x26
+	; A[3] * B[1]
+	mul	x25, x15, x17
+	adcs	x8, x8, x25
+	umulh	x26, x15, x17
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x14, x19
+	adds	x8, x8, x25
+	umulh	x26, x14, x19
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x15, x20
+	adcs	x10, x10, x25
+	umulh	x11, x15, x20
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x12, x20
+	adds	x7, x7, x25
+	umulh	x26, x12, x20
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x14, x20
+	adcs	x9, x9, x25
+	umulh	x26, x14, x20
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x15, x16
+	adds	x7, x7, x25
+	umulh	x26, x15, x16
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x15, x19
+	adcs	x9, x9, x25
+	umulh	x26, x15, x19
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x7, x7, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x7, #63
+	mul	x27, x27, x25
+	and	x7, x7, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x4, x4, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x5, x5, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x6, x6, x26
+	umulh	x10, x25, x10
+	adc	x7, x7, xzr
+	;  Add high product results in
+	adds	x4, x4, x27
+	adcs	x5, x5, x8
+	adcs	x6, x6, x9
+	adc	x7, x7, x10
+	mov	x3, x0
+	sub	x2, x0, #32
+	sub	x1, x0, #32
+	; Add
+	adds	x8, x21, x4
+	adcs	x9, x22, x5
+	adcs	x10, x23, x6
+	adcs	x11, x24, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x11, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x8, x8, x25
+	adcs	x9, x9, xzr
+	and	x11, x11, #0x7fffffffffffffff
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	; Sub
+	subs	x12, x21, x4
+	sbcs	x13, x22, x5
+	sbcs	x14, x23, x6
+	sbcs	x15, x24, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	stp	x8, x9, [x0]
+	stp	x10, x11, [x0, #16]
+	stp	x12, x13, [x1]
+	stp	x14, x15, [x1, #16]
+	ldr	x1, [x29, #24]
+	ldr	x2, [x29, #32]
+	add	x2, x2, #0x40
+	add	x1, x1, #0x60
+	add	x0, x0, #0x40
+	; Multiply
+	ldp	x21, x22, [x1]
+	ldp	x23, x24, [x1, #16]
+	ldp	x4, x5, [x2]
+	ldp	x6, x7, [x2, #16]
+	; A[0] * B[0]
+	umulh	x17, x21, x4
+	mul	x16, x21, x4
+	; A[2] * B[0]
+	umulh	x20, x23, x4
+	mul	x19, x23, x4
+	; A[1] * B[0]
+	mul	x25, x22, x4
+	adds	x17, x17, x25
+	umulh	x26, x22, x4
+	adcs	x19, x19, x26
+	; A[1] * B[3]
+	umulh	x9, x22, x7
+	adc	x20, x20, xzr
+	mul	x8, x22, x7
+	; A[0] * B[1]
+	mul	x25, x21, x5
+	adds	x17, x17, x25
+	umulh	x26, x21, x5
+	adcs	x19, x19, x26
+	; A[2] * B[1]
+	mul	x25, x23, x5
+	adcs	x20, x20, x25
+	umulh	x26, x23, x5
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x22, x6
+	adds	x20, x20, x25
+	umulh	x26, x22, x6
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x21, x6
+	adds	x19, x19, x25
+	umulh	x26, x21, x6
+	adcs	x20, x20, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x22, x5
+	adds	x19, x19, x25
+	umulh	x26, x22, x5
+	adcs	x20, x20, x26
+	; A[3] * B[1]
+	mul	x25, x24, x5
+	adcs	x8, x8, x25
+	umulh	x26, x24, x5
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x23, x6
+	adds	x8, x8, x25
+	umulh	x26, x23, x6
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x24, x7
+	adcs	x10, x10, x25
+	umulh	x11, x24, x7
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x21, x7
+	adds	x20, x20, x25
+	umulh	x26, x21, x7
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x23, x7
+	adcs	x9, x9, x25
+	umulh	x26, x23, x7
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x24, x4
+	adds	x20, x20, x25
+	umulh	x26, x24, x4
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x24, x6
+	adcs	x9, x9, x25
+	umulh	x26, x24, x6
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x20, x20, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x20, #63
+	mul	x27, x27, x25
+	and	x20, x20, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x16, x16, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x17, x17, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x19, x19, x26
+	umulh	x10, x25, x10
+	adc	x20, x20, xzr
+	;  Add high product results in
+	adds	x16, x16, x27
+	adcs	x17, x17, x8
+	adcs	x19, x19, x9
+	adc	x20, x20, x10
+	sub	x1, x1, #32
+	; Double
+	ldp	x12, x13, [x1]
+	ldp	x14, x15, [x1, #16]
+	adds	x12, x12, x12
+	adcs	x13, x13, x13
+	adcs	x14, x14, x14
+	adc	x15, x15, x15
+	mov	x25, #-19
+	asr	x28, x15, #63
+	;   Mask the modulus
+	and	x25, x28, x25
+	and	x26, x28, #0x7fffffffffffffff
+	;   Sub modulus (if overflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, x28
+	sbcs	x14, x14, x28
+	sbc	x15, x15, x26
+	mov	x3, x0
+	sub	x2, x0, #32
+	sub	x1, x0, #32
+	; Add
+	adds	x8, x12, x16
+	adcs	x9, x13, x17
+	adcs	x10, x14, x19
+	adcs	x11, x15, x20
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x11, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x8, x8, x25
+	adcs	x9, x9, xzr
+	and	x11, x11, #0x7fffffffffffffff
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	; Sub
+	subs	x4, x12, x16
+	sbcs	x5, x13, x17
+	sbcs	x6, x14, x19
+	sbcs	x7, x15, x20
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x7, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x4, x4, x25
+	sbcs	x5, x5, xzr
+	and	x7, x7, #0x7fffffffffffffff
+	sbcs	x6, x6, xzr
+	sbc	x7, x7, xzr
+	stp	x8, x9, [x0]
+	stp	x10, x11, [x0, #16]
+	stp	x4, x5, [x1]
+	stp	x6, x7, [x1, #16]
+	ldp	x17, x19, [x29, #56]
+	ldp	x20, x21, [x29, #72]
+	ldp	x22, x23, [x29, #88]
+	ldp	x24, x25, [x29, #104]
+	ldp	x26, x27, [x29, #120]
+	ldr	x28, [x29, #136]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	ge_add
+ge_add PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #56]
+	stp	x20, x21, [x29, #72]
+	stp	x22, x23, [x29, #88]
+	stp	x24, x25, [x29, #104]
+	stp	x26, x27, [x29, #120]
+	str	x28, [x29, #136]
+	str	x0, [x29, #16]
+	str	x1, [x29, #24]
+	str	x2, [x29, #32]
+	mov	x3, x1
+	add	x2, x1, #32
+	add	x1, x0, #32
+	; Add
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	ldp	x4, x5, [x3]
+	ldp	x6, x7, [x3, #16]
+	adds	x16, x8, x4
+	adcs	x17, x9, x5
+	adcs	x19, x10, x6
+	adcs	x20, x11, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x20, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x16, x16, x25
+	adcs	x17, x17, xzr
+	and	x20, x20, #0x7fffffffffffffff
+	adcs	x19, x19, xzr
+	adc	x20, x20, xzr
+	; Sub
+	subs	x12, x8, x4
+	sbcs	x13, x9, x5
+	sbcs	x14, x10, x6
+	sbcs	x15, x11, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	ldr	x2, [x29, #32]
+	mov	x1, x0
+	; Multiply
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	; A[0] * B[0]
+	umulh	x22, x16, x8
+	mul	x21, x16, x8
+	; A[2] * B[0]
+	umulh	x24, x19, x8
+	mul	x23, x19, x8
+	; A[1] * B[0]
+	mul	x25, x17, x8
+	adds	x22, x22, x25
+	umulh	x26, x17, x8
+	adcs	x23, x23, x26
+	; A[1] * B[3]
+	umulh	x5, x17, x11
+	adc	x24, x24, xzr
+	mul	x4, x17, x11
+	; A[0] * B[1]
+	mul	x25, x16, x9
+	adds	x22, x22, x25
+	umulh	x26, x16, x9
+	adcs	x23, x23, x26
+	; A[2] * B[1]
+	mul	x25, x19, x9
+	adcs	x24, x24, x25
+	umulh	x26, x19, x9
+	adcs	x4, x4, x26
+	adc	x5, x5, xzr
+	; A[1] * B[2]
+	mul	x25, x17, x10
+	adds	x24, x24, x25
+	umulh	x26, x17, x10
+	adcs	x4, x4, x26
+	adcs	x5, x5, xzr
+	adc	x6, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x16, x10
+	adds	x23, x23, x25
+	umulh	x26, x16, x10
+	adcs	x24, x24, x26
+	adcs	x4, x4, xzr
+	adcs	x5, x5, xzr
+	adc	x6, x6, xzr
+	; A[1] * B[1]
+	mul	x25, x17, x9
+	adds	x23, x23, x25
+	umulh	x26, x17, x9
+	adcs	x24, x24, x26
+	; A[3] * B[1]
+	mul	x25, x20, x9
+	adcs	x4, x4, x25
+	umulh	x26, x20, x9
+	adcs	x5, x5, x26
+	adc	x6, x6, xzr
+	; A[2] * B[2]
+	mul	x25, x19, x10
+	adds	x4, x4, x25
+	umulh	x26, x19, x10
+	adcs	x5, x5, x26
+	; A[3] * B[3]
+	mul	x25, x20, x11
+	adcs	x6, x6, x25
+	umulh	x7, x20, x11
+	adc	x7, x7, xzr
+	; A[0] * B[3]
+	mul	x25, x16, x11
+	adds	x24, x24, x25
+	umulh	x26, x16, x11
+	adcs	x4, x4, x26
+	; A[2] * B[3]
+	mul	x25, x19, x11
+	adcs	x5, x5, x25
+	umulh	x26, x19, x11
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; A[3] * B[0]
+	mul	x25, x20, x8
+	adds	x24, x24, x25
+	umulh	x26, x20, x8
+	adcs	x4, x4, x26
+	; A[3] * B[2]
+	mul	x25, x20, x10
+	adcs	x5, x5, x25
+	umulh	x26, x20, x10
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x7
+	adds	x24, x24, x26
+	umulh	x27, x25, x7
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x24, #63
+	mul	x27, x27, x25
+	and	x24, x24, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x4
+	adds	x21, x21, x26
+	umulh	x4, x25, x4
+	mul	x26, x25, x5
+	adcs	x22, x22, x26
+	umulh	x5, x25, x5
+	mul	x26, x25, x6
+	adcs	x23, x23, x26
+	umulh	x6, x25, x6
+	adc	x24, x24, xzr
+	;  Add high product results in
+	adds	x21, x21, x27
+	adcs	x22, x22, x4
+	adcs	x23, x23, x5
+	adc	x24, x24, x6
+	; Store
+	stp	x21, x22, [x0]
+	stp	x23, x24, [x0, #16]
+	add	x2, x2, #32
+	add	x1, x0, #32
+	add	x0, x0, #32
+	; Multiply
+	ldp	x16, x17, [x2]
+	ldp	x19, x20, [x2, #16]
+	; A[0] * B[0]
+	umulh	x5, x12, x16
+	mul	x4, x12, x16
+	; A[2] * B[0]
+	umulh	x7, x14, x16
+	mul	x6, x14, x16
+	; A[1] * B[0]
+	mul	x25, x13, x16
+	adds	x5, x5, x25
+	umulh	x26, x13, x16
+	adcs	x6, x6, x26
+	; A[1] * B[3]
+	umulh	x9, x13, x20
+	adc	x7, x7, xzr
+	mul	x8, x13, x20
+	; A[0] * B[1]
+	mul	x25, x12, x17
+	adds	x5, x5, x25
+	umulh	x26, x12, x17
+	adcs	x6, x6, x26
+	; A[2] * B[1]
+	mul	x25, x14, x17
+	adcs	x7, x7, x25
+	umulh	x26, x14, x17
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x13, x19
+	adds	x7, x7, x25
+	umulh	x26, x13, x19
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x12, x19
+	adds	x6, x6, x25
+	umulh	x26, x12, x19
+	adcs	x7, x7, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x13, x17
+	adds	x6, x6, x25
+	umulh	x26, x13, x17
+	adcs	x7, x7, x26
+	; A[3] * B[1]
+	mul	x25, x15, x17
+	adcs	x8, x8, x25
+	umulh	x26, x15, x17
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x14, x19
+	adds	x8, x8, x25
+	umulh	x26, x14, x19
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x15, x20
+	adcs	x10, x10, x25
+	umulh	x11, x15, x20
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x12, x20
+	adds	x7, x7, x25
+	umulh	x26, x12, x20
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x14, x20
+	adcs	x9, x9, x25
+	umulh	x26, x14, x20
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x15, x16
+	adds	x7, x7, x25
+	umulh	x26, x15, x16
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x15, x19
+	adcs	x9, x9, x25
+	umulh	x26, x15, x19
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x7, x7, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x7, #63
+	mul	x27, x27, x25
+	and	x7, x7, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x4, x4, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x5, x5, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x6, x6, x26
+	umulh	x10, x25, x10
+	adc	x7, x7, xzr
+	;  Add high product results in
+	adds	x4, x4, x27
+	adcs	x5, x5, x8
+	adcs	x6, x6, x9
+	adc	x7, x7, x10
+	; Store
+	stp	x4, x5, [x0]
+	stp	x6, x7, [x0, #16]
+	mov	x3, x0
+	sub	x2, x0, #32
+	sub	x1, x0, #32
+	; Add
+	adds	x8, x21, x4
+	adcs	x9, x22, x5
+	adcs	x10, x23, x6
+	adcs	x11, x24, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x11, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x8, x8, x25
+	adcs	x9, x9, xzr
+	and	x11, x11, #0x7fffffffffffffff
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	; Sub
+	subs	x12, x21, x4
+	sbcs	x13, x22, x5
+	sbcs	x14, x23, x6
+	sbcs	x15, x24, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	stp	x8, x9, [x0]
+	stp	x10, x11, [x0, #16]
+	stp	x12, x13, [x1]
+	stp	x14, x15, [x1, #16]
+	ldr	x1, [x29, #24]
+	ldr	x2, [x29, #32]
+	add	x2, x2, #0x60
+	add	x1, x1, #0x60
+	add	x0, x0, #0x40
+	; Multiply
+	ldp	x21, x22, [x1]
+	ldp	x23, x24, [x1, #16]
+	ldp	x4, x5, [x2]
+	ldp	x6, x7, [x2, #16]
+	; A[0] * B[0]
+	umulh	x17, x21, x4
+	mul	x16, x21, x4
+	; A[2] * B[0]
+	umulh	x20, x23, x4
+	mul	x19, x23, x4
+	; A[1] * B[0]
+	mul	x25, x22, x4
+	adds	x17, x17, x25
+	umulh	x26, x22, x4
+	adcs	x19, x19, x26
+	; A[1] * B[3]
+	umulh	x9, x22, x7
+	adc	x20, x20, xzr
+	mul	x8, x22, x7
+	; A[0] * B[1]
+	mul	x25, x21, x5
+	adds	x17, x17, x25
+	umulh	x26, x21, x5
+	adcs	x19, x19, x26
+	; A[2] * B[1]
+	mul	x25, x23, x5
+	adcs	x20, x20, x25
+	umulh	x26, x23, x5
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x22, x6
+	adds	x20, x20, x25
+	umulh	x26, x22, x6
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x21, x6
+	adds	x19, x19, x25
+	umulh	x26, x21, x6
+	adcs	x20, x20, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x22, x5
+	adds	x19, x19, x25
+	umulh	x26, x22, x5
+	adcs	x20, x20, x26
+	; A[3] * B[1]
+	mul	x25, x24, x5
+	adcs	x8, x8, x25
+	umulh	x26, x24, x5
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x23, x6
+	adds	x8, x8, x25
+	umulh	x26, x23, x6
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x24, x7
+	adcs	x10, x10, x25
+	umulh	x11, x24, x7
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x21, x7
+	adds	x20, x20, x25
+	umulh	x26, x21, x7
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x23, x7
+	adcs	x9, x9, x25
+	umulh	x26, x23, x7
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x24, x4
+	adds	x20, x20, x25
+	umulh	x26, x24, x4
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x24, x6
+	adcs	x9, x9, x25
+	umulh	x26, x24, x6
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x20, x20, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x20, #63
+	mul	x27, x27, x25
+	and	x20, x20, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x16, x16, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x17, x17, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x19, x19, x26
+	umulh	x10, x25, x10
+	adc	x20, x20, xzr
+	;  Add high product results in
+	adds	x16, x16, x27
+	adcs	x17, x17, x8
+	adcs	x19, x19, x9
+	adc	x20, x20, x10
+	; Store
+	stp	x16, x17, [x0]
+	stp	x19, x20, [x0, #16]
+	sub	x3, x2, #32
+	sub	x2, x1, #32
+	sub	x1, x0, #32
+	; Multiply
+	ldp	x4, x5, [x2]
+	ldp	x6, x7, [x2, #16]
+	ldp	x12, x13, [x3]
+	ldp	x14, x15, [x3, #16]
+	; A[0] * B[0]
+	umulh	x9, x4, x12
+	mul	x8, x4, x12
+	; A[2] * B[0]
+	umulh	x11, x6, x12
+	mul	x10, x6, x12
+	; A[1] * B[0]
+	mul	x25, x5, x12
+	adds	x9, x9, x25
+	umulh	x26, x5, x12
+	adcs	x10, x10, x26
+	; A[1] * B[3]
+	umulh	x17, x5, x15
+	adc	x11, x11, xzr
+	mul	x16, x5, x15
+	; A[0] * B[1]
+	mul	x25, x4, x13
+	adds	x9, x9, x25
+	umulh	x26, x4, x13
+	adcs	x10, x10, x26
+	; A[2] * B[1]
+	mul	x25, x6, x13
+	adcs	x11, x11, x25
+	umulh	x26, x6, x13
+	adcs	x16, x16, x26
+	adc	x17, x17, xzr
+	; A[1] * B[2]
+	mul	x25, x5, x14
+	adds	x11, x11, x25
+	umulh	x26, x5, x14
+	adcs	x16, x16, x26
+	adcs	x17, x17, xzr
+	adc	x19, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x4, x14
+	adds	x10, x10, x25
+	umulh	x26, x4, x14
+	adcs	x11, x11, x26
+	adcs	x16, x16, xzr
+	adcs	x17, x17, xzr
+	adc	x19, x19, xzr
+	; A[1] * B[1]
+	mul	x25, x5, x13
+	adds	x10, x10, x25
+	umulh	x26, x5, x13
+	adcs	x11, x11, x26
+	; A[3] * B[1]
+	mul	x25, x7, x13
+	adcs	x16, x16, x25
+	umulh	x26, x7, x13
+	adcs	x17, x17, x26
+	adc	x19, x19, xzr
+	; A[2] * B[2]
+	mul	x25, x6, x14
+	adds	x16, x16, x25
+	umulh	x26, x6, x14
+	adcs	x17, x17, x26
+	; A[3] * B[3]
+	mul	x25, x7, x15
+	adcs	x19, x19, x25
+	umulh	x20, x7, x15
+	adc	x20, x20, xzr
+	; A[0] * B[3]
+	mul	x25, x4, x15
+	adds	x11, x11, x25
+	umulh	x26, x4, x15
+	adcs	x16, x16, x26
+	; A[2] * B[3]
+	mul	x25, x6, x15
+	adcs	x17, x17, x25
+	umulh	x26, x6, x15
+	adcs	x19, x19, x26
+	adc	x20, x20, xzr
+	; A[3] * B[0]
+	mul	x25, x7, x12
+	adds	x11, x11, x25
+	umulh	x26, x7, x12
+	adcs	x16, x16, x26
+	; A[3] * B[2]
+	mul	x25, x7, x14
+	adcs	x17, x17, x25
+	umulh	x26, x7, x14
+	adcs	x19, x19, x26
+	adc	x20, x20, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x20
+	adds	x11, x11, x26
+	umulh	x27, x25, x20
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x11, #63
+	mul	x27, x27, x25
+	and	x11, x11, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x16
+	adds	x8, x8, x26
+	umulh	x16, x25, x16
+	mul	x26, x25, x17
+	adcs	x9, x9, x26
+	umulh	x17, x25, x17
+	mul	x26, x25, x19
+	adcs	x10, x10, x26
+	umulh	x19, x25, x19
+	adc	x11, x11, xzr
+	;  Add high product results in
+	adds	x8, x8, x27
+	adcs	x9, x9, x16
+	adcs	x10, x10, x17
+	adc	x11, x11, x19
+	; Double
+	adds	x8, x8, x8
+	adcs	x9, x9, x9
+	adcs	x10, x10, x10
+	adc	x11, x11, x11
+	mov	x25, #-19
+	asr	x28, x11, #63
+	;   Mask the modulus
+	and	x25, x28, x25
+	and	x26, x28, #0x7fffffffffffffff
+	;   Sub modulus (if overflow)
+	subs	x8, x8, x25
+	sbcs	x9, x9, x28
+	sbcs	x10, x10, x28
+	sbc	x11, x11, x26
+	mov	x3, x0
+	sub	x2, x0, #32
+	mov	x1, x0
+	sub	x0, x0, #32
+	; Add
+	ldp	x4, x5, [x3]
+	ldp	x6, x7, [x3, #16]
+	adds	x21, x8, x4
+	adcs	x22, x9, x5
+	adcs	x23, x10, x6
+	adcs	x24, x11, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x24, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x21, x21, x25
+	adcs	x22, x22, xzr
+	and	x24, x24, #0x7fffffffffffffff
+	adcs	x23, x23, xzr
+	adc	x24, x24, xzr
+	; Sub
+	subs	x12, x8, x4
+	sbcs	x13, x9, x5
+	sbcs	x14, x10, x6
+	sbcs	x15, x11, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	stp	x21, x22, [x0]
+	stp	x23, x24, [x0, #16]
+	stp	x12, x13, [x1]
+	stp	x14, x15, [x1, #16]
+	ldp	x17, x19, [x29, #56]
+	ldp	x20, x21, [x29, #72]
+	ldp	x22, x23, [x29, #88]
+	ldp	x24, x25, [x29, #104]
+	ldp	x26, x27, [x29, #120]
+	ldr	x28, [x29, #136]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	ge_sub
+ge_sub PROC
+	stp	x29, x30, [sp, #-144]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #56]
+	stp	x20, x21, [x29, #72]
+	stp	x22, x23, [x29, #88]
+	stp	x24, x25, [x29, #104]
+	stp	x26, x27, [x29, #120]
+	str	x28, [x29, #136]
+	str	x0, [x29, #16]
+	str	x1, [x29, #24]
+	str	x2, [x29, #32]
+	mov	x3, x1
+	add	x2, x1, #32
+	add	x1, x0, #32
+	; Add
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	ldp	x4, x5, [x3]
+	ldp	x6, x7, [x3, #16]
+	adds	x16, x8, x4
+	adcs	x17, x9, x5
+	adcs	x19, x10, x6
+	adcs	x20, x11, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x20, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x16, x16, x25
+	adcs	x17, x17, xzr
+	and	x20, x20, #0x7fffffffffffffff
+	adcs	x19, x19, xzr
+	adc	x20, x20, xzr
+	; Sub
+	subs	x12, x8, x4
+	sbcs	x13, x9, x5
+	sbcs	x14, x10, x6
+	sbcs	x15, x11, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	ldr	x2, [x29, #32]
+	add	x2, x2, #32
+	mov	x1, x0
+	; Multiply
+	ldp	x8, x9, [x2]
+	ldp	x10, x11, [x2, #16]
+	; A[0] * B[0]
+	umulh	x22, x16, x8
+	mul	x21, x16, x8
+	; A[2] * B[0]
+	umulh	x24, x19, x8
+	mul	x23, x19, x8
+	; A[1] * B[0]
+	mul	x25, x17, x8
+	adds	x22, x22, x25
+	umulh	x26, x17, x8
+	adcs	x23, x23, x26
+	; A[1] * B[3]
+	umulh	x5, x17, x11
+	adc	x24, x24, xzr
+	mul	x4, x17, x11
+	; A[0] * B[1]
+	mul	x25, x16, x9
+	adds	x22, x22, x25
+	umulh	x26, x16, x9
+	adcs	x23, x23, x26
+	; A[2] * B[1]
+	mul	x25, x19, x9
+	adcs	x24, x24, x25
+	umulh	x26, x19, x9
+	adcs	x4, x4, x26
+	adc	x5, x5, xzr
+	; A[1] * B[2]
+	mul	x25, x17, x10
+	adds	x24, x24, x25
+	umulh	x26, x17, x10
+	adcs	x4, x4, x26
+	adcs	x5, x5, xzr
+	adc	x6, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x16, x10
+	adds	x23, x23, x25
+	umulh	x26, x16, x10
+	adcs	x24, x24, x26
+	adcs	x4, x4, xzr
+	adcs	x5, x5, xzr
+	adc	x6, x6, xzr
+	; A[1] * B[1]
+	mul	x25, x17, x9
+	adds	x23, x23, x25
+	umulh	x26, x17, x9
+	adcs	x24, x24, x26
+	; A[3] * B[1]
+	mul	x25, x20, x9
+	adcs	x4, x4, x25
+	umulh	x26, x20, x9
+	adcs	x5, x5, x26
+	adc	x6, x6, xzr
+	; A[2] * B[2]
+	mul	x25, x19, x10
+	adds	x4, x4, x25
+	umulh	x26, x19, x10
+	adcs	x5, x5, x26
+	; A[3] * B[3]
+	mul	x25, x20, x11
+	adcs	x6, x6, x25
+	umulh	x7, x20, x11
+	adc	x7, x7, xzr
+	; A[0] * B[3]
+	mul	x25, x16, x11
+	adds	x24, x24, x25
+	umulh	x26, x16, x11
+	adcs	x4, x4, x26
+	; A[2] * B[3]
+	mul	x25, x19, x11
+	adcs	x5, x5, x25
+	umulh	x26, x19, x11
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; A[3] * B[0]
+	mul	x25, x20, x8
+	adds	x24, x24, x25
+	umulh	x26, x20, x8
+	adcs	x4, x4, x26
+	; A[3] * B[2]
+	mul	x25, x20, x10
+	adcs	x5, x5, x25
+	umulh	x26, x20, x10
+	adcs	x6, x6, x26
+	adc	x7, x7, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x7
+	adds	x24, x24, x26
+	umulh	x27, x25, x7
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x24, #63
+	mul	x27, x27, x25
+	and	x24, x24, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x4
+	adds	x21, x21, x26
+	umulh	x4, x25, x4
+	mul	x26, x25, x5
+	adcs	x22, x22, x26
+	umulh	x5, x25, x5
+	mul	x26, x25, x6
+	adcs	x23, x23, x26
+	umulh	x6, x25, x6
+	adc	x24, x24, xzr
+	;  Add high product results in
+	adds	x21, x21, x27
+	adcs	x22, x22, x4
+	adcs	x23, x23, x5
+	adc	x24, x24, x6
+	; Reduce if top bit set
+	mov	x25, #19
+	and	x26, x25, x24, asr 63
+	adds	x21, x21, x26
+	adcs	x22, x22, xzr
+	and	x24, x24, #0x7fffffffffffffff
+	adcs	x23, x23, xzr
+	adc	x24, x24, xzr
+	; Store
+	stp	x21, x22, [x0]
+	stp	x23, x24, [x0, #16]
+	sub	x2, x2, #32
+	add	x1, x0, #32
+	add	x0, x0, #32
+	; Multiply
+	ldp	x16, x17, [x2]
+	ldp	x19, x20, [x2, #16]
+	; A[0] * B[0]
+	umulh	x5, x12, x16
+	mul	x4, x12, x16
+	; A[2] * B[0]
+	umulh	x7, x14, x16
+	mul	x6, x14, x16
+	; A[1] * B[0]
+	mul	x25, x13, x16
+	adds	x5, x5, x25
+	umulh	x26, x13, x16
+	adcs	x6, x6, x26
+	; A[1] * B[3]
+	umulh	x9, x13, x20
+	adc	x7, x7, xzr
+	mul	x8, x13, x20
+	; A[0] * B[1]
+	mul	x25, x12, x17
+	adds	x5, x5, x25
+	umulh	x26, x12, x17
+	adcs	x6, x6, x26
+	; A[2] * B[1]
+	mul	x25, x14, x17
+	adcs	x7, x7, x25
+	umulh	x26, x14, x17
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x13, x19
+	adds	x7, x7, x25
+	umulh	x26, x13, x19
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x12, x19
+	adds	x6, x6, x25
+	umulh	x26, x12, x19
+	adcs	x7, x7, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x13, x17
+	adds	x6, x6, x25
+	umulh	x26, x13, x17
+	adcs	x7, x7, x26
+	; A[3] * B[1]
+	mul	x25, x15, x17
+	adcs	x8, x8, x25
+	umulh	x26, x15, x17
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x14, x19
+	adds	x8, x8, x25
+	umulh	x26, x14, x19
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x15, x20
+	adcs	x10, x10, x25
+	umulh	x11, x15, x20
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x12, x20
+	adds	x7, x7, x25
+	umulh	x26, x12, x20
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x14, x20
+	adcs	x9, x9, x25
+	umulh	x26, x14, x20
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x15, x16
+	adds	x7, x7, x25
+	umulh	x26, x15, x16
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x15, x19
+	adcs	x9, x9, x25
+	umulh	x26, x15, x19
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x7, x7, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x7, #63
+	mul	x27, x27, x25
+	and	x7, x7, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x4, x4, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x5, x5, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x6, x6, x26
+	umulh	x10, x25, x10
+	adc	x7, x7, xzr
+	;  Add high product results in
+	adds	x4, x4, x27
+	adcs	x5, x5, x8
+	adcs	x6, x6, x9
+	adc	x7, x7, x10
+	; Store
+	stp	x4, x5, [x0]
+	stp	x6, x7, [x0, #16]
+	mov	x3, x0
+	sub	x2, x0, #32
+	sub	x1, x0, #32
+	; Add
+	adds	x8, x21, x4
+	adcs	x9, x22, x5
+	adcs	x10, x23, x6
+	adcs	x11, x24, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x11, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x8, x8, x25
+	adcs	x9, x9, xzr
+	and	x11, x11, #0x7fffffffffffffff
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	; Sub
+	subs	x12, x21, x4
+	sbcs	x13, x22, x5
+	sbcs	x14, x23, x6
+	sbcs	x15, x24, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x12, x12, x25
+	sbcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	sbcs	x14, x14, xzr
+	sbc	x15, x15, xzr
+	stp	x8, x9, [x0]
+	stp	x10, x11, [x0, #16]
+	stp	x12, x13, [x1]
+	stp	x14, x15, [x1, #16]
+	ldr	x1, [x29, #24]
+	ldr	x2, [x29, #32]
+	add	x2, x2, #0x60
+	add	x1, x1, #0x60
+	add	x0, x0, #0x40
+	; Multiply
+	ldp	x21, x22, [x1]
+	ldp	x23, x24, [x1, #16]
+	ldp	x4, x5, [x2]
+	ldp	x6, x7, [x2, #16]
+	; A[0] * B[0]
+	umulh	x17, x21, x4
+	mul	x16, x21, x4
+	; A[2] * B[0]
+	umulh	x20, x23, x4
+	mul	x19, x23, x4
+	; A[1] * B[0]
+	mul	x25, x22, x4
+	adds	x17, x17, x25
+	umulh	x26, x22, x4
+	adcs	x19, x19, x26
+	; A[1] * B[3]
+	umulh	x9, x22, x7
+	adc	x20, x20, xzr
+	mul	x8, x22, x7
+	; A[0] * B[1]
+	mul	x25, x21, x5
+	adds	x17, x17, x25
+	umulh	x26, x21, x5
+	adcs	x19, x19, x26
+	; A[2] * B[1]
+	mul	x25, x23, x5
+	adcs	x20, x20, x25
+	umulh	x26, x23, x5
+	adcs	x8, x8, x26
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x25, x22, x6
+	adds	x20, x20, x25
+	umulh	x26, x22, x6
+	adcs	x8, x8, x26
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x21, x6
+	adds	x19, x19, x25
+	umulh	x26, x21, x6
+	adcs	x20, x20, x26
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x25, x22, x5
+	adds	x19, x19, x25
+	umulh	x26, x22, x5
+	adcs	x20, x20, x26
+	; A[3] * B[1]
+	mul	x25, x24, x5
+	adcs	x8, x8, x25
+	umulh	x26, x24, x5
+	adcs	x9, x9, x26
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x25, x23, x6
+	adds	x8, x8, x25
+	umulh	x26, x23, x6
+	adcs	x9, x9, x26
+	; A[3] * B[3]
+	mul	x25, x24, x7
+	adcs	x10, x10, x25
+	umulh	x11, x24, x7
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x25, x21, x7
+	adds	x20, x20, x25
+	umulh	x26, x21, x7
+	adcs	x8, x8, x26
+	; A[2] * B[3]
+	mul	x25, x23, x7
+	adcs	x9, x9, x25
+	umulh	x26, x23, x7
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x25, x24, x4
+	adds	x20, x20, x25
+	umulh	x26, x24, x4
+	adcs	x8, x8, x26
+	; A[3] * B[2]
+	mul	x25, x24, x6
+	adcs	x9, x9, x25
+	umulh	x26, x24, x6
+	adcs	x10, x10, x26
+	adc	x11, x11, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x11
+	adds	x20, x20, x26
+	umulh	x27, x25, x11
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x20, #63
+	mul	x27, x27, x25
+	and	x20, x20, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x8
+	adds	x16, x16, x26
+	umulh	x8, x25, x8
+	mul	x26, x25, x9
+	adcs	x17, x17, x26
+	umulh	x9, x25, x9
+	mul	x26, x25, x10
+	adcs	x19, x19, x26
+	umulh	x10, x25, x10
+	adc	x20, x20, xzr
+	;  Add high product results in
+	adds	x16, x16, x27
+	adcs	x17, x17, x8
+	adcs	x19, x19, x9
+	adc	x20, x20, x10
+	; Reduce if top bit set
+	mov	x25, #19
+	and	x26, x25, x20, asr 63
+	adds	x16, x16, x26
+	adcs	x17, x17, xzr
+	and	x20, x20, #0x7fffffffffffffff
+	adcs	x19, x19, xzr
+	adc	x20, x20, xzr
+	; Store
+	stp	x16, x17, [x0]
+	stp	x19, x20, [x0, #16]
+	sub	x3, x2, #32
+	sub	x2, x1, #32
+	sub	x1, x0, #32
+	; Multiply
+	ldp	x4, x5, [x2]
+	ldp	x6, x7, [x2, #16]
+	ldp	x12, x13, [x3]
+	ldp	x14, x15, [x3, #16]
+	; A[0] * B[0]
+	umulh	x9, x4, x12
+	mul	x8, x4, x12
+	; A[2] * B[0]
+	umulh	x11, x6, x12
+	mul	x10, x6, x12
+	; A[1] * B[0]
+	mul	x25, x5, x12
+	adds	x9, x9, x25
+	umulh	x26, x5, x12
+	adcs	x10, x10, x26
+	; A[1] * B[3]
+	umulh	x17, x5, x15
+	adc	x11, x11, xzr
+	mul	x16, x5, x15
+	; A[0] * B[1]
+	mul	x25, x4, x13
+	adds	x9, x9, x25
+	umulh	x26, x4, x13
+	adcs	x10, x10, x26
+	; A[2] * B[1]
+	mul	x25, x6, x13
+	adcs	x11, x11, x25
+	umulh	x26, x6, x13
+	adcs	x16, x16, x26
+	adc	x17, x17, xzr
+	; A[1] * B[2]
+	mul	x25, x5, x14
+	adds	x11, x11, x25
+	umulh	x26, x5, x14
+	adcs	x16, x16, x26
+	adcs	x17, x17, xzr
+	adc	x19, xzr, xzr
+	; A[0] * B[2]
+	mul	x25, x4, x14
+	adds	x10, x10, x25
+	umulh	x26, x4, x14
+	adcs	x11, x11, x26
+	adcs	x16, x16, xzr
+	adcs	x17, x17, xzr
+	adc	x19, x19, xzr
+	; A[1] * B[1]
+	mul	x25, x5, x13
+	adds	x10, x10, x25
+	umulh	x26, x5, x13
+	adcs	x11, x11, x26
+	; A[3] * B[1]
+	mul	x25, x7, x13
+	adcs	x16, x16, x25
+	umulh	x26, x7, x13
+	adcs	x17, x17, x26
+	adc	x19, x19, xzr
+	; A[2] * B[2]
+	mul	x25, x6, x14
+	adds	x16, x16, x25
+	umulh	x26, x6, x14
+	adcs	x17, x17, x26
+	; A[3] * B[3]
+	mul	x25, x7, x15
+	adcs	x19, x19, x25
+	umulh	x20, x7, x15
+	adc	x20, x20, xzr
+	; A[0] * B[3]
+	mul	x25, x4, x15
+	adds	x11, x11, x25
+	umulh	x26, x4, x15
+	adcs	x16, x16, x26
+	; A[2] * B[3]
+	mul	x25, x6, x15
+	adcs	x17, x17, x25
+	umulh	x26, x6, x15
+	adcs	x19, x19, x26
+	adc	x20, x20, xzr
+	; A[3] * B[0]
+	mul	x25, x7, x12
+	adds	x11, x11, x25
+	umulh	x26, x7, x12
+	adcs	x16, x16, x26
+	; A[3] * B[2]
+	mul	x25, x7, x14
+	adcs	x17, x17, x25
+	umulh	x26, x7, x14
+	adcs	x19, x19, x26
+	adc	x20, x20, xzr
+	; Reduce
+	mov	x25, #38
+	mul	x26, x25, x20
+	adds	x11, x11, x26
+	umulh	x27, x25, x20
+	adc	x27, x27, xzr
+	mov	x25, #19
+	extr	x27, x27, x11, #63
+	mul	x27, x27, x25
+	and	x11, x11, #0x7fffffffffffffff
+	mov	x25, #38
+	mul	x26, x25, x16
+	adds	x8, x8, x26
+	umulh	x16, x25, x16
+	mul	x26, x25, x17
+	adcs	x9, x9, x26
+	umulh	x17, x25, x17
+	mul	x26, x25, x19
+	adcs	x10, x10, x26
+	umulh	x19, x25, x19
+	adc	x11, x11, xzr
+	;  Add high product results in
+	adds	x8, x8, x27
+	adcs	x9, x9, x16
+	adcs	x10, x10, x17
+	adc	x11, x11, x19
+	; Double
+	adds	x8, x8, x8
+	adcs	x9, x9, x9
+	adcs	x10, x10, x10
+	adc	x11, x11, x11
+	mov	x25, #-19
+	asr	x28, x11, #63
+	;   Mask the modulus
+	and	x25, x28, x25
+	and	x26, x28, #0x7fffffffffffffff
+	;   Sub modulus (if overflow)
+	subs	x8, x8, x25
+	sbcs	x9, x9, x28
+	sbcs	x10, x10, x28
+	sbc	x11, x11, x26
+	mov	x3, x0
+	sub	x2, x0, #32
+	; Add
+	ldp	x4, x5, [x3]
+	ldp	x6, x7, [x3, #16]
+	adds	x12, x8, x4
+	adcs	x13, x9, x5
+	adcs	x14, x10, x6
+	adcs	x15, x11, x7
+	cset	x28, cs
+	mov	x25, #19
+	extr	x28, x28, x15, #63
+	mul	x25, x28, x25
+	;   Sub modulus (if overflow)
+	adds	x12, x12, x25
+	adcs	x13, x13, xzr
+	and	x15, x15, #0x7fffffffffffffff
+	adcs	x14, x14, xzr
+	adc	x15, x15, xzr
+	; Sub
+	subs	x21, x8, x4
+	sbcs	x22, x9, x5
+	sbcs	x23, x10, x6
+	sbcs	x24, x11, x7
+	csetm	x28, cc
+	mov	x25, #-19
+	extr	x28, x28, x24, #63
+	mul	x25, x28, x25
+	;   Add modulus (if underflow)
+	subs	x21, x21, x25
+	sbcs	x22, x22, xzr
+	and	x24, x24, #0x7fffffffffffffff
+	sbcs	x23, x23, xzr
+	sbc	x24, x24, xzr
+	stp	x12, x13, [x0]
+	stp	x14, x15, [x0, #16]
+	stp	x21, x22, [x1]
+	stp	x23, x24, [x1, #16]
+	ldp	x17, x19, [x29, #56]
+	ldp	x20, x21, [x29, #72]
+	ldp	x22, x23, [x29, #88]
+	ldp	x24, x25, [x29, #104]
+	ldp	x26, x27, [x29, #120]
+	ldr	x28, [x29, #136]
+	ldp	x29, x30, [sp], #0x90
+	ret
+	ENDP
+	IF :DEF:HAVE_ED25519
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	sc_reduce
+sc_reduce PROC
+	stp	x29, x30, [sp, #-64]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	stp	x22, x23, [x29, #48]
+	ldp	x2, x3, [x0]
+	ldp	x4, x5, [x0, #16]
+	ldp	x6, x7, [x0, #32]
+	ldp	x8, x9, [x0, #48]
+	lsr	x23, x9, #56
+	lsl	x9, x9, #4
+	orr	x9, x9, x8, lsr 60
+	lsl	x8, x8, #4
+	orr	x8, x8, x7, lsr 60
+	lsl	x7, x7, #4
+	orr	x7, x7, x6, lsr 60
+	lsl	x6, x6, #4
+	mov	x1, #15
+	orr	x6, x6, x5, lsr 60
+	bic	x5, x5, x1, lsl 60
+	bic	x9, x9, x1, lsl 60
+	; Add order times bits 504..511
+	mov	x11, #0x2c13
+	movk	x11, #0xa30a, lsl 16
+	movk	x11, #0x9ce5, lsl 32
+	movk	x11, #0xa7ed, lsl 48
+	mov	x13, #0x6329
+	movk	x13, #0x5d08, lsl 16
+	movk	x13, #0x621, lsl 32
+	movk	x13, #0xeb21, lsl 48
+	mul	x10, x23, x11
+	umulh	x11, x23, x11
+	mul	x12, x23, x13
+	umulh	x13, x23, x13
+	adds	x6, x6, x10
+	adcs	x7, x7, x11
+	adcs	x8, x8, xzr
+	adc	x9, x9, xzr
+	adds	x7, x7, x12
+	adcs	x8, x8, x13
+	adc	x9, x9, xzr
+	subs	x8, x8, x23
+	sbc	x9, x9, xzr
+	; Sub product of top 4 words and order
+	mov	x1, #0x2c13
+	movk	x1, #0xa30a, lsl 16
+	movk	x1, #0x9ce5, lsl 32
+	movk	x1, #0xa7ed, lsl 48
+	mul	x10, x6, x1
+	umulh	x11, x6, x1
+	mul	x12, x7, x1
+	umulh	x13, x7, x1
+	mul	x14, x8, x1
+	umulh	x15, x8, x1
+	mul	x16, x9, x1
+	umulh	x17, x9, x1
+	adds	x2, x2, x10
+	adcs	x3, x3, x11
+	adcs	x4, x4, x14
+	adcs	x5, x5, x15
+	adc	x19, xzr, xzr
+	adds	x3, x3, x12
+	adcs	x4, x4, x13
+	adcs	x5, x5, x16
+	adc	x19, x19, x17
+	mov	x1, #0x6329
+	movk	x1, #0x5d08, lsl 16
+	movk	x1, #0x621, lsl 32
+	movk	x1, #0xeb21, lsl 48
+	mul	x10, x6, x1
+	umulh	x11, x6, x1
+	mul	x12, x7, x1
+	umulh	x13, x7, x1
+	mul	x14, x8, x1
+	umulh	x15, x8, x1
+	mul	x16, x9, x1
+	umulh	x17, x9, x1
+	adds	x3, x3, x10
+	adcs	x4, x4, x11
+	adcs	x5, x5, x14
+	adcs	x19, x19, x15
+	adc	x20, xzr, xzr
+	adds	x4, x4, x12
+	adcs	x5, x5, x13
+	adcs	x19, x19, x16
+	adc	x20, x20, x17
+	subs	x4, x4, x6
+	sbcs	x5, x5, x7
+	sbcs	x6, x19, x8
+	sbc	x7, x20, x9
+	asr	x23, x7, #57
+	;   Conditionally subtract order starting at bit 125
+	mov	x10, xzr
+	mov	x13, xzr
+	mov	x11, #0xba7d
+	movk	x11, #0x4b9e, lsl 16
+	movk	x11, #0x4c63, lsl 32
+	movk	x11, #0xcb02, lsl 48
+	mov	x12, #0xf39a
+	movk	x12, #0xd45e, lsl 16
+	movk	x12, #0xdf3b, lsl 32
+	movk	x12, #0x29b, lsl 48
+	movk	x10, #0xa000, lsl 48
+	movk	x13, #0x200, lsl 48
+	and	x10, x10, x23
+	and	x11, x11, x23
+	and	x12, x12, x23
+	and	x13, x13, x23
+	adds	x3, x3, x10
+	adcs	x4, x4, x11
+	adcs	x5, x5, x12
+	adcs	x6, x6, xzr
+	adc	x7, x7, x13
+	;   Move bits 252-376 to own registers
+	lsl	x7, x7, #4
+	orr	x7, x7, x6, lsr 60
+	lsl	x6, x6, #4
+	mov	x23, #15
+	orr	x6, x6, x5, lsr 60
+	bic	x5, x5, x23, lsl 60
+	; Sub product of top 2 words and order
+	;   * -5812631a5cf5d3ed
+	mov	x1, #0x2c13
+	movk	x1, #0xa30a, lsl 16
+	movk	x1, #0x9ce5, lsl 32
+	movk	x1, #0xa7ed, lsl 48
+	mul	x10, x6, x1
+	umulh	x11, x6, x1
+	mul	x12, x7, x1
+	umulh	x13, x7, x1
+	adds	x2, x2, x10
+	adcs	x3, x3, x11
+	adc	x19, xzr, xzr
+	adds	x3, x3, x12
+	adc	x19, x19, x13
+	;   * -14def9dea2f79cd7
+	mov	x1, #0x6329
+	movk	x1, #0x5d08, lsl 16
+	movk	x1, #0x621, lsl 32
+	movk	x1, #0xeb21, lsl 48
+	mul	x10, x6, x1
+	umulh	x11, x6, x1
+	mul	x12, x7, x1
+	umulh	x13, x7, x1
+	adds	x3, x3, x10
+	adcs	x4, x4, x11
+	adc	x20, xzr, xzr
+	adds	x4, x4, x12
+	adc	x20, x20, x13
+	;   Add overflows at 2 * 64
+	mov	x1, #15
+	bic	x5, x5, x1, lsl 60
+	adds	x4, x4, x19
+	adc	x5, x5, x20
+	;   Subtract top at 2 * 64
+	subs	x4, x4, x6
+	sbcs	x5, x5, x7
+	sbc	x1, x1, x1
+	;   Conditional sub order
+	mov	x10, #0xd3ed
+	movk	x10, #0x5cf5, lsl 16
+	movk	x10, #0x631a, lsl 32
+	movk	x10, #0x5812, lsl 48
+	mov	x11, #0x9cd6
+	movk	x11, #0xa2f7, lsl 16
+	movk	x11, #0xf9de, lsl 32
+	movk	x11, #0x14de, lsl 48
+	and	x10, x10, x1
+	and	x11, x11, x1
+	adds	x2, x2, x10
+	adcs	x3, x3, x11
+	and	x1, x1, #0x1000000000000000
+	adcs	x4, x4, xzr
+	mov	x23, #15
+	adc	x5, x5, x1
+	bic	x5, x5, x23, lsl 60
+	; Store result
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x22, x23, [x29, #48]
+	ldp	x29, x30, [sp], #0x40
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	sc_muladd
+sc_muladd PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	stp	x24, x25, [x29, #72]
+	str	x26, [x29, #88]
+	; Multiply
+	ldp	x12, x13, [x1]
+	ldp	x14, x15, [x1, #16]
+	ldp	x16, x17, [x2]
+	ldp	x19, x20, [x2, #16]
+	; A[0] * B[0]
+	umulh	x5, x12, x16
+	mul	x4, x12, x16
+	; A[2] * B[0]
+	umulh	x7, x14, x16
+	mul	x6, x14, x16
+	; A[1] * B[0]
+	mul	x21, x13, x16
+	adds	x5, x5, x21
+	umulh	x22, x13, x16
+	adcs	x6, x6, x22
+	; A[1] * B[3]
+	umulh	x9, x13, x20
+	adc	x7, x7, xzr
+	mul	x8, x13, x20
+	; A[0] * B[1]
+	mul	x21, x12, x17
+	adds	x5, x5, x21
+	umulh	x22, x12, x17
+	adcs	x6, x6, x22
+	; A[2] * B[1]
+	mul	x21, x14, x17
+	adcs	x7, x7, x21
+	umulh	x22, x14, x17
+	adcs	x8, x8, x22
+	adc	x9, x9, xzr
+	; A[1] * B[2]
+	mul	x21, x13, x19
+	adds	x7, x7, x21
+	umulh	x22, x13, x19
+	adcs	x8, x8, x22
+	adcs	x9, x9, xzr
+	adc	x10, xzr, xzr
+	; A[0] * B[2]
+	mul	x21, x12, x19
+	adds	x6, x6, x21
+	umulh	x22, x12, x19
+	adcs	x7, x7, x22
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adc	x10, x10, xzr
+	; A[1] * B[1]
+	mul	x21, x13, x17
+	adds	x6, x6, x21
+	umulh	x22, x13, x17
+	adcs	x7, x7, x22
+	; A[3] * B[1]
+	mul	x21, x15, x17
+	adcs	x8, x8, x21
+	umulh	x22, x15, x17
+	adcs	x9, x9, x22
+	adc	x10, x10, xzr
+	; A[2] * B[2]
+	mul	x21, x14, x19
+	adds	x8, x8, x21
+	umulh	x22, x14, x19
+	adcs	x9, x9, x22
+	; A[3] * B[3]
+	mul	x21, x15, x20
+	adcs	x10, x10, x21
+	umulh	x11, x15, x20
+	adc	x11, x11, xzr
+	; A[0] * B[3]
+	mul	x21, x12, x20
+	adds	x7, x7, x21
+	umulh	x22, x12, x20
+	adcs	x8, x8, x22
+	; A[2] * B[3]
+	mul	x21, x14, x20
+	adcs	x9, x9, x21
+	umulh	x22, x14, x20
+	adcs	x10, x10, x22
+	adc	x11, x11, xzr
+	; A[3] * B[0]
+	mul	x21, x15, x16
+	adds	x7, x7, x21
+	umulh	x22, x15, x16
+	adcs	x8, x8, x22
+	; A[3] * B[2]
+	mul	x21, x15, x19
+	adcs	x9, x9, x21
+	umulh	x22, x15, x19
+	adcs	x10, x10, x22
+	adc	x11, x11, xzr
+	; Add c to a * b
+	ldp	x12, x13, [x3]
+	ldp	x14, x15, [x3, #16]
+	adds	x4, x4, x12
+	adcs	x5, x5, x13
+	adcs	x6, x6, x14
+	adcs	x7, x7, x15
+	adcs	x8, x8, xzr
+	adcs	x9, x9, xzr
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	lsr	x25, x11, #56
+	lsl	x11, x11, #4
+	orr	x11, x11, x10, lsr 60
+	lsl	x10, x10, #4
+	orr	x10, x10, x9, lsr 60
+	lsl	x9, x9, #4
+	orr	x9, x9, x8, lsr 60
+	lsl	x8, x8, #4
+	mov	x26, #15
+	orr	x8, x8, x7, lsr 60
+	bic	x7, x7, x26, lsl 60
+	bic	x11, x11, x26, lsl 60
+	; Add order times bits 504..507
+	mov	x22, #0x2c13
+	movk	x22, #0xa30a, lsl 16
+	movk	x22, #0x9ce5, lsl 32
+	movk	x22, #0xa7ed, lsl 48
+	mov	x24, #0x6329
+	movk	x24, #0x5d08, lsl 16
+	movk	x24, #0x621, lsl 32
+	movk	x24, #0xeb21, lsl 48
+	mul	x21, x25, x22
+	umulh	x22, x25, x22
+	mul	x23, x25, x24
+	umulh	x24, x25, x24
+	adds	x8, x8, x21
+	adcs	x9, x9, x22
+	adcs	x10, x10, xzr
+	adc	x11, x11, xzr
+	adds	x9, x9, x23
+	adcs	x10, x10, x24
+	adc	x11, x11, xzr
+	subs	x10, x10, x25
+	sbc	x11, x11, xzr
+	; Sub product of top 4 words and order
+	mov	x26, #0x2c13
+	movk	x26, #0xa30a, lsl 16
+	movk	x26, #0x9ce5, lsl 32
+	movk	x26, #0xa7ed, lsl 48
+	mul	x16, x8, x26
+	umulh	x17, x8, x26
+	mul	x19, x9, x26
+	umulh	x20, x9, x26
+	mul	x21, x10, x26
+	umulh	x22, x10, x26
+	mul	x23, x11, x26
+	umulh	x24, x11, x26
+	adds	x4, x4, x16
+	adcs	x5, x5, x17
+	adcs	x6, x6, x21
+	adcs	x7, x7, x22
+	adc	x12, xzr, xzr
+	adds	x5, x5, x19
+	adcs	x6, x6, x20
+	adcs	x7, x7, x23
+	adc	x12, x12, x24
+	mov	x26, #0x6329
+	movk	x26, #0x5d08, lsl 16
+	movk	x26, #0x621, lsl 32
+	movk	x26, #0xeb21, lsl 48
+	mul	x16, x8, x26
+	umulh	x17, x8, x26
+	mul	x19, x9, x26
+	umulh	x20, x9, x26
+	mul	x21, x10, x26
+	umulh	x22, x10, x26
+	mul	x23, x11, x26
+	umulh	x24, x11, x26
+	adds	x5, x5, x16
+	adcs	x6, x6, x17
+	adcs	x7, x7, x21
+	adcs	x12, x12, x22
+	adc	x13, xzr, xzr
+	adds	x6, x6, x19
+	adcs	x7, x7, x20
+	adcs	x12, x12, x23
+	adc	x13, x13, x24
+	subs	x6, x6, x8
+	sbcs	x7, x7, x9
+	sbcs	x8, x12, x10
+	sbc	x9, x13, x11
+	asr	x25, x9, #57
+	;   Conditionally subtract order starting at bit 125
+	mov	x16, xzr
+	mov	x20, xzr
+	mov	x17, #0xba7d
+	movk	x17, #0x4b9e, lsl 16
+	movk	x17, #0x4c63, lsl 32
+	movk	x17, #0xcb02, lsl 48
+	mov	x19, #0xf39a
+	movk	x19, #0xd45e, lsl 16
+	movk	x19, #0xdf3b, lsl 32
+	movk	x19, #0x29b, lsl 48
+	movk	x16, #0xa000, lsl 48
+	movk	x20, #0x200, lsl 48
+	and	x16, x16, x25
+	and	x17, x17, x25
+	and	x19, x19, x25
+	and	x20, x20, x25
+	adds	x5, x5, x16
+	adcs	x6, x6, x17
+	adcs	x7, x7, x19
+	adcs	x8, x8, xzr
+	adc	x9, x9, x20
+	;   Move bits 252-376 to own registers
+	lsl	x9, x9, #4
+	orr	x9, x9, x8, lsr 60
+	lsl	x8, x8, #4
+	mov	x25, #15
+	orr	x8, x8, x7, lsr 60
+	bic	x7, x7, x25, lsl 60
+	; Sub product of top 2 words and order
+	;   * -5812631a5cf5d3ed
+	mov	x26, #0x2c13
+	movk	x26, #0xa30a, lsl 16
+	movk	x26, #0x9ce5, lsl 32
+	movk	x26, #0xa7ed, lsl 48
+	mul	x16, x8, x26
+	umulh	x17, x8, x26
+	mul	x19, x9, x26
+	umulh	x20, x9, x26
+	adds	x4, x4, x16
+	adcs	x5, x5, x17
+	adc	x12, xzr, xzr
+	adds	x5, x5, x19
+	adc	x12, x12, x20
+	;   * -14def9dea2f79cd7
+	mov	x26, #0x6329
+	movk	x26, #0x5d08, lsl 16
+	movk	x26, #0x621, lsl 32
+	movk	x26, #0xeb21, lsl 48
+	mul	x16, x8, x26
+	umulh	x17, x8, x26
+	mul	x19, x9, x26
+	umulh	x20, x9, x26
+	adds	x5, x5, x16
+	adcs	x6, x6, x17
+	adc	x13, xzr, xzr
+	adds	x6, x6, x19
+	adc	x13, x13, x20
+	;   Add overflows at 2 * 64
+	mov	x26, #15
+	bic	x7, x7, x26, lsl 60
+	adds	x6, x6, x12
+	adc	x7, x7, x13
+	;   Subtract top at 2 * 64
+	subs	x6, x6, x8
+	sbcs	x7, x7, x9
+	sbc	x26, x26, x26
+	;   Conditional sub order
+	mov	x16, #0xd3ed
+	movk	x16, #0x5cf5, lsl 16
+	movk	x16, #0x631a, lsl 32
+	movk	x16, #0x5812, lsl 48
+	mov	x17, #0x9cd6
+	movk	x17, #0xa2f7, lsl 16
+	movk	x17, #0xf9de, lsl 32
+	movk	x17, #0x14de, lsl 48
+	and	x16, x16, x26
+	and	x17, x17, x26
+	adds	x4, x4, x16
+	adcs	x5, x5, x17
+	and	x26, x26, #0x1000000000000000
+	adcs	x6, x6, xzr
+	mov	x25, #15
+	adc	x7, x7, x26
+	bic	x7, x7, x25, lsl 60
+	; Store result
+	stp	x4, x5, [x0]
+	stp	x6, x7, [x0, #16]
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldp	x24, x25, [x29, #72]
+	ldr	x26, [x29, #88]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	ENDIF
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm b/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm
new file mode 100644
index 0000000000..cc8271d85e
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm
@@ -0,0 +1,11426 @@
+; /* armv8-mlkem-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./kyber/kyber.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-mlkem-asm.asm
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_aarch64_consts
+	DCW	0x0d01, 0xf301, 0x4ebf, 0x0549, 0x5049, 0x0000, 0x0000, 0x0000
+	IF :DEF:WOLFSSL_HAVE_MLKEM
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_aarch64_zetas
+	DCW	0x08ed, 0x0a0b, 0x0b9a, 0x0714, 0x05d5, 0x058e, 0x011f, 0x00ca
+	DCW	0x0c56, 0x026e, 0x0629, 0x00b6, 0x03c2, 0x084f, 0x073f, 0x05bc
+	DCW	0x023d, 0x07d4, 0x0108, 0x017f, 0x09c4, 0x05b2, 0x06bf, 0x0c7f
+	DCW	0x0a58, 0x03f9, 0x02dc, 0x0260, 0x06fb, 0x019b, 0x0c34, 0x06de
+	DCW	0x04c7, 0x04c7, 0x04c7, 0x04c7, 0x028c, 0x028c, 0x028c, 0x028c
+	DCW	0x0ad9, 0x0ad9, 0x0ad9, 0x0ad9, 0x03f7, 0x03f7, 0x03f7, 0x03f7
+	DCW	0x07f4, 0x07f4, 0x07f4, 0x07f4, 0x05d3, 0x05d3, 0x05d3, 0x05d3
+	DCW	0x0be7, 0x0be7, 0x0be7, 0x0be7, 0x06f9, 0x06f9, 0x06f9, 0x06f9
+	DCW	0x0204, 0x0204, 0x0204, 0x0204, 0x0cf9, 0x0cf9, 0x0cf9, 0x0cf9
+	DCW	0x0bc1, 0x0bc1, 0x0bc1, 0x0bc1, 0x0a67, 0x0a67, 0x0a67, 0x0a67
+	DCW	0x06af, 0x06af, 0x06af, 0x06af, 0x0877, 0x0877, 0x0877, 0x0877
+	DCW	0x007e, 0x007e, 0x007e, 0x007e, 0x05bd, 0x05bd, 0x05bd, 0x05bd
+	DCW	0x09ac, 0x09ac, 0x09ac, 0x09ac, 0x0ca7, 0x0ca7, 0x0ca7, 0x0ca7
+	DCW	0x0bf2, 0x0bf2, 0x0bf2, 0x0bf2, 0x033e, 0x033e, 0x033e, 0x033e
+	DCW	0x006b, 0x006b, 0x006b, 0x006b, 0x0774, 0x0774, 0x0774, 0x0774
+	DCW	0x0c0a, 0x0c0a, 0x0c0a, 0x0c0a, 0x094a, 0x094a, 0x094a, 0x094a
+	DCW	0x0b73, 0x0b73, 0x0b73, 0x0b73, 0x03c1, 0x03c1, 0x03c1, 0x03c1
+	DCW	0x071d, 0x071d, 0x071d, 0x071d, 0x0a2c, 0x0a2c, 0x0a2c, 0x0a2c
+	DCW	0x01c0, 0x01c0, 0x01c0, 0x01c0, 0x08d8, 0x08d8, 0x08d8, 0x08d8
+	DCW	0x02a5, 0x02a5, 0x02a5, 0x02a5, 0x0806, 0x0806, 0x0806, 0x0806
+	DCW	0x08b2, 0x08b2, 0x01ae, 0x01ae, 0x022b, 0x022b, 0x034b, 0x034b
+	DCW	0x081e, 0x081e, 0x0367, 0x0367, 0x060e, 0x060e, 0x0069, 0x0069
+	DCW	0x01a6, 0x01a6, 0x024b, 0x024b, 0x00b1, 0x00b1, 0x0c16, 0x0c16
+	DCW	0x0bde, 0x0bde, 0x0b35, 0x0b35, 0x0626, 0x0626, 0x0675, 0x0675
+	DCW	0x0c0b, 0x0c0b, 0x030a, 0x030a, 0x0487, 0x0487, 0x0c6e, 0x0c6e
+	DCW	0x09f8, 0x09f8, 0x05cb, 0x05cb, 0x0aa7, 0x0aa7, 0x045f, 0x045f
+	DCW	0x06cb, 0x06cb, 0x0284, 0x0284, 0x0999, 0x0999, 0x015d, 0x015d
+	DCW	0x01a2, 0x01a2, 0x0149, 0x0149, 0x0c65, 0x0c65, 0x0cb6, 0x0cb6
+	DCW	0x0331, 0x0331, 0x0449, 0x0449, 0x025b, 0x025b, 0x0262, 0x0262
+	DCW	0x052a, 0x052a, 0x07fc, 0x07fc, 0x0748, 0x0748, 0x0180, 0x0180
+	DCW	0x0842, 0x0842, 0x0c79, 0x0c79, 0x04c2, 0x04c2, 0x07ca, 0x07ca
+	DCW	0x0997, 0x0997, 0x00dc, 0x00dc, 0x085e, 0x085e, 0x0686, 0x0686
+	DCW	0x0860, 0x0860, 0x0707, 0x0707, 0x0803, 0x0803, 0x031a, 0x031a
+	DCW	0x071b, 0x071b, 0x09ab, 0x09ab, 0x099b, 0x099b, 0x01de, 0x01de
+	DCW	0x0c95, 0x0c95, 0x0bcd, 0x0bcd, 0x03e4, 0x03e4, 0x03df, 0x03df
+	DCW	0x03be, 0x03be, 0x074d, 0x074d, 0x05f2, 0x05f2, 0x065c, 0x065c
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_aarch64_zetas_qinv
+	DCW	0xffed, 0x7b0b, 0x399a, 0x0314, 0x34d5, 0xcf8e, 0x6e1f, 0xbeca
+	DCW	0xae56, 0x6c6e, 0xf129, 0xc2b6, 0x29c2, 0x054f, 0xd43f, 0x79bc
+	DCW	0xe93d, 0x43d4, 0x9908, 0x8e7f, 0x15c4, 0xfbb2, 0x53bf, 0x997f
+	DCW	0x9258, 0x5ef9, 0xd6dc, 0x2260, 0x47fb, 0x229b, 0x6834, 0xc0de
+	DCW	0xe9c7, 0xe9c7, 0xe9c7, 0xe9c7, 0xe68c, 0xe68c, 0xe68c, 0xe68c
+	DCW	0x05d9, 0x05d9, 0x05d9, 0x05d9, 0x78f7, 0x78f7, 0x78f7, 0x78f7
+	DCW	0xa3f4, 0xa3f4, 0xa3f4, 0xa3f4, 0x4ed3, 0x4ed3, 0x4ed3, 0x4ed3
+	DCW	0x50e7, 0x50e7, 0x50e7, 0x50e7, 0x61f9, 0x61f9, 0x61f9, 0x61f9
+	DCW	0xce04, 0xce04, 0xce04, 0xce04, 0x67f9, 0x67f9, 0x67f9, 0x67f9
+	DCW	0x3ec1, 0x3ec1, 0x3ec1, 0x3ec1, 0xcf67, 0xcf67, 0xcf67, 0xcf67
+	DCW	0x23af, 0x23af, 0x23af, 0x23af, 0xfd77, 0xfd77, 0xfd77, 0xfd77
+	DCW	0x9a7e, 0x9a7e, 0x9a7e, 0x9a7e, 0x6cbd, 0x6cbd, 0x6cbd, 0x6cbd
+	DCW	0x4dac, 0x4dac, 0x4dac, 0x4dac, 0x91a7, 0x91a7, 0x91a7, 0x91a7
+	DCW	0xc1f2, 0xc1f2, 0xc1f2, 0xc1f2, 0xdd3e, 0xdd3e, 0xdd3e, 0xdd3e
+	DCW	0x916b, 0x916b, 0x916b, 0x916b, 0x2374, 0x2374, 0x2374, 0x2374
+	DCW	0x8a0a, 0x8a0a, 0x8a0a, 0x8a0a, 0x474a, 0x474a, 0x474a, 0x474a
+	DCW	0x3473, 0x3473, 0x3473, 0x3473, 0x36c1, 0x36c1, 0x36c1, 0x36c1
+	DCW	0x8e1d, 0x8e1d, 0x8e1d, 0x8e1d, 0xce2c, 0xce2c, 0xce2c, 0xce2c
+	DCW	0x41c0, 0x41c0, 0x41c0, 0x41c0, 0x10d8, 0x10d8, 0x10d8, 0x10d8
+	DCW	0xa1a5, 0xa1a5, 0xa1a5, 0xa1a5, 0xba06, 0xba06, 0xba06, 0xba06
+	DCW	0xfeb2, 0xfeb2, 0x2bae, 0x2bae, 0xd32b, 0xd32b, 0x344b, 0x344b
+	DCW	0x821e, 0x821e, 0xc867, 0xc867, 0x500e, 0x500e, 0xab69, 0xab69
+	DCW	0x93a6, 0x93a6, 0x334b, 0x334b, 0x03b1, 0x03b1, 0xee16, 0xee16
+	DCW	0xc5de, 0xc5de, 0x5a35, 0x5a35, 0x1826, 0x1826, 0x1575, 0x1575
+	DCW	0x7d0b, 0x7d0b, 0x810a, 0x810a, 0x2987, 0x2987, 0x766e, 0x766e
+	DCW	0x71f8, 0x71f8, 0xb6cb, 0xb6cb, 0x8fa7, 0x8fa7, 0x315f, 0x315f
+	DCW	0xb7cb, 0xb7cb, 0x4e84, 0x4e84, 0x4499, 0x4499, 0x485d, 0x485d
+	DCW	0xc7a2, 0xc7a2, 0x4c49, 0x4c49, 0xeb65, 0xeb65, 0xceb6, 0xceb6
+	DCW	0x8631, 0x8631, 0x4f49, 0x4f49, 0x635b, 0x635b, 0x0862, 0x0862
+	DCW	0xe32a, 0xe32a, 0x3bfc, 0x3bfc, 0x5f48, 0x5f48, 0x8180, 0x8180
+	DCW	0xae42, 0xae42, 0xe779, 0xe779, 0x2ac2, 0x2ac2, 0xc5ca, 0xc5ca
+	DCW	0x5e97, 0x5e97, 0xd4dc, 0xd4dc, 0x425e, 0x425e, 0x3886, 0x3886
+	DCW	0x2860, 0x2860, 0xac07, 0xac07, 0xe103, 0xe103, 0xb11a, 0xb11a
+	DCW	0xa81b, 0xa81b, 0x5aab, 0x5aab, 0x2a9b, 0x2a9b, 0xbbde, 0xbbde
+	DCW	0x7b95, 0x7b95, 0xa2cd, 0xa2cd, 0x6fe4, 0x6fe4, 0xb0df, 0xb0df
+	DCW	0x5dbe, 0x5dbe, 0x1e4d, 0x1e4d, 0xbbf2, 0xbbf2, 0x5a5c, 0x5a5c
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_ntt
+mlkem_ntt PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x2, L_mlkem_aarch64_zetas
+	add	x2, x2, L_mlkem_aarch64_zetas
+	adrp	x3, L_mlkem_aarch64_zetas_qinv
+	add	x3, x3, L_mlkem_aarch64_zetas_qinv
+	adrp	x4, L_mlkem_aarch64_consts
+	add	x4, x4, L_mlkem_aarch64_consts
+	add	x1, x0, #0x100
+	ldr	q4, [x4]
+	ldr	q5, [x0]
+	ldr	q6, [x0, #32]
+	ldr	q7, [x0, #64]
+	ldr	q8, [x0, #96]
+	ldr	q9, [x0, #128]
+	ldr	q10, [x0, #160]
+	ldr	q11, [x0, #192]
+	ldr	q12, [x0, #224]
+	ldr	q13, [x1]
+	ldr	q14, [x1, #32]
+	ldr	q15, [x1, #64]
+	ldr	q16, [x1, #96]
+	ldr	q17, [x1, #128]
+	ldr	q18, [x1, #160]
+	ldr	q19, [x1, #192]
+	ldr	q20, [x1, #224]
+	ldr	q0, [x2]
+	ldr	q1, [x3]
+	mul	v29.8h, v13.8h, v1.h[1]
+	mul	v30.8h, v14.8h, v1.h[1]
+	sqrdmulh	v21.8h, v13.8h, v0.h[1]
+	sqrdmulh	v22.8h, v14.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v15.8h, v1.h[1]
+	mul	v30.8h, v16.8h, v1.h[1]
+	sqrdmulh	v23.8h, v15.8h, v0.h[1]
+	sqrdmulh	v24.8h, v16.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[1]
+	mul	v30.8h, v18.8h, v1.h[1]
+	sqrdmulh	v25.8h, v17.8h, v0.h[1]
+	sqrdmulh	v26.8h, v18.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[1]
+	mul	v30.8h, v20.8h, v1.h[1]
+	sqrdmulh	v27.8h, v19.8h, v0.h[1]
+	sqrdmulh	v28.8h, v20.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v13.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v14.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v15.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v16.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v9.8h, v25.8h
+	add	v9.8h, v9.8h, v25.8h
+	sub	v18.8h, v10.8h, v26.8h
+	add	v10.8h, v10.8h, v26.8h
+	sub	v19.8h, v11.8h, v27.8h
+	add	v11.8h, v11.8h, v27.8h
+	sub	v20.8h, v12.8h, v28.8h
+	add	v12.8h, v12.8h, v28.8h
+	mul	v29.8h, v9.8h, v1.h[2]
+	mul	v30.8h, v10.8h, v1.h[2]
+	sqrdmulh	v21.8h, v9.8h, v0.h[2]
+	sqrdmulh	v22.8h, v10.8h, v0.h[2]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[2]
+	sqrdmulh	v23.8h, v11.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[2]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[3]
+	mul	v30.8h, v18.8h, v1.h[3]
+	sqrdmulh	v25.8h, v17.8h, v0.h[3]
+	sqrdmulh	v26.8h, v18.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[3]
+	mul	v30.8h, v20.8h, v1.h[3]
+	sqrdmulh	v27.8h, v19.8h, v0.h[3]
+	sqrdmulh	v28.8h, v20.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v9.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v10.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v12.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v18.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v15.8h, v27.8h
+	add	v15.8h, v15.8h, v27.8h
+	sub	v20.8h, v16.8h, v28.8h
+	add	v16.8h, v16.8h, v28.8h
+	mul	v29.8h, v7.8h, v1.h[4]
+	mul	v30.8h, v8.8h, v1.h[4]
+	sqrdmulh	v21.8h, v7.8h, v0.h[4]
+	sqrdmulh	v22.8h, v8.8h, v0.h[4]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[5]
+	mul	v30.8h, v12.8h, v1.h[5]
+	sqrdmulh	v23.8h, v11.8h, v0.h[5]
+	sqrdmulh	v24.8h, v12.8h, v0.h[5]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v15.8h, v1.h[6]
+	mul	v30.8h, v16.8h, v1.h[6]
+	sqrdmulh	v25.8h, v15.8h, v0.h[6]
+	sqrdmulh	v26.8h, v16.8h, v0.h[6]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[7]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v19.8h, v0.h[7]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v7.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v10.8h, v24.8h
+	add	v10.8h, v10.8h, v24.8h
+	sub	v15.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v18.8h, v28.8h
+	add	v18.8h, v18.8h, v28.8h
+	ldr	q0, [x2, #16]
+	ldr	q1, [x3, #16]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	str	q5, [x0]
+	str	q6, [x0, #32]
+	str	q7, [x0, #64]
+	str	q8, [x0, #96]
+	str	q9, [x0, #128]
+	str	q10, [x0, #160]
+	str	q11, [x0, #192]
+	str	q12, [x0, #224]
+	str	q13, [x1]
+	str	q14, [x1, #32]
+	str	q15, [x1, #64]
+	str	q16, [x1, #96]
+	str	q17, [x1, #128]
+	str	q18, [x1, #160]
+	str	q19, [x1, #192]
+	str	q20, [x1, #224]
+	ldr	q5, [x0, #16]
+	ldr	q6, [x0, #48]
+	ldr	q7, [x0, #80]
+	ldr	q8, [x0, #112]
+	ldr	q9, [x0, #144]
+	ldr	q10, [x0, #176]
+	ldr	q11, [x0, #208]
+	ldr	q12, [x0, #240]
+	ldr	q13, [x1, #16]
+	ldr	q14, [x1, #48]
+	ldr	q15, [x1, #80]
+	ldr	q16, [x1, #112]
+	ldr	q17, [x1, #144]
+	ldr	q18, [x1, #176]
+	ldr	q19, [x1, #208]
+	ldr	q20, [x1, #240]
+	ldr	q0, [x2]
+	ldr	q1, [x3]
+	mul	v29.8h, v13.8h, v1.h[1]
+	mul	v30.8h, v14.8h, v1.h[1]
+	sqrdmulh	v21.8h, v13.8h, v0.h[1]
+	sqrdmulh	v22.8h, v14.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v15.8h, v1.h[1]
+	mul	v30.8h, v16.8h, v1.h[1]
+	sqrdmulh	v23.8h, v15.8h, v0.h[1]
+	sqrdmulh	v24.8h, v16.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[1]
+	mul	v30.8h, v18.8h, v1.h[1]
+	sqrdmulh	v25.8h, v17.8h, v0.h[1]
+	sqrdmulh	v26.8h, v18.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[1]
+	mul	v30.8h, v20.8h, v1.h[1]
+	sqrdmulh	v27.8h, v19.8h, v0.h[1]
+	sqrdmulh	v28.8h, v20.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v13.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v14.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v15.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v16.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v9.8h, v25.8h
+	add	v9.8h, v9.8h, v25.8h
+	sub	v18.8h, v10.8h, v26.8h
+	add	v10.8h, v10.8h, v26.8h
+	sub	v19.8h, v11.8h, v27.8h
+	add	v11.8h, v11.8h, v27.8h
+	sub	v20.8h, v12.8h, v28.8h
+	add	v12.8h, v12.8h, v28.8h
+	mul	v29.8h, v9.8h, v1.h[2]
+	mul	v30.8h, v10.8h, v1.h[2]
+	sqrdmulh	v21.8h, v9.8h, v0.h[2]
+	sqrdmulh	v22.8h, v10.8h, v0.h[2]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[2]
+	sqrdmulh	v23.8h, v11.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[2]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[3]
+	mul	v30.8h, v18.8h, v1.h[3]
+	sqrdmulh	v25.8h, v17.8h, v0.h[3]
+	sqrdmulh	v26.8h, v18.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[3]
+	mul	v30.8h, v20.8h, v1.h[3]
+	sqrdmulh	v27.8h, v19.8h, v0.h[3]
+	sqrdmulh	v28.8h, v20.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v9.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v10.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v12.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v18.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v15.8h, v27.8h
+	add	v15.8h, v15.8h, v27.8h
+	sub	v20.8h, v16.8h, v28.8h
+	add	v16.8h, v16.8h, v28.8h
+	mul	v29.8h, v7.8h, v1.h[4]
+	mul	v30.8h, v8.8h, v1.h[4]
+	sqrdmulh	v21.8h, v7.8h, v0.h[4]
+	sqrdmulh	v22.8h, v8.8h, v0.h[4]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[5]
+	mul	v30.8h, v12.8h, v1.h[5]
+	sqrdmulh	v23.8h, v11.8h, v0.h[5]
+	sqrdmulh	v24.8h, v12.8h, v0.h[5]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v15.8h, v1.h[6]
+	mul	v30.8h, v16.8h, v1.h[6]
+	sqrdmulh	v25.8h, v15.8h, v0.h[6]
+	sqrdmulh	v26.8h, v16.8h, v0.h[6]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[7]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v19.8h, v0.h[7]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v7.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v10.8h, v24.8h
+	add	v10.8h, v10.8h, v24.8h
+	sub	v15.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v18.8h, v28.8h
+	add	v18.8h, v18.8h, v28.8h
+	ldr	q0, [x2, #16]
+	ldr	q1, [x3, #16]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	str	q5, [x0, #16]
+	str	q6, [x0, #48]
+	str	q7, [x0, #80]
+	str	q8, [x0, #112]
+	str	q9, [x0, #144]
+	str	q10, [x0, #176]
+	str	q11, [x0, #208]
+	str	q12, [x0, #240]
+	str	q13, [x1, #16]
+	str	q14, [x1, #48]
+	str	q15, [x1, #80]
+	str	q16, [x1, #112]
+	str	q17, [x1, #144]
+	str	q18, [x1, #176]
+	str	q19, [x1, #208]
+	str	q20, [x1, #240]
+	ldp	q5, q6, [x0]
+	ldp	q7, q8, [x0, #32]
+	ldp	q9, q10, [x0, #64]
+	ldp	q11, q12, [x0, #96]
+	ldp	q13, q14, [x0, #128]
+	ldp	q15, q16, [x0, #160]
+	ldp	q17, q18, [x0, #192]
+	ldp	q19, q20, [x0, #224]
+	ldr	q0, [x2, #32]
+	ldr	q1, [x3, #32]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #64]
+	ldr	q2, [x2, #80]
+	ldr	q1, [x3, #64]
+	ldr	q3, [x3, #80]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	trn2	v8.2d, v30.2d, v8.2d
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #96]
+	ldr	q2, [x2, #112]
+	ldr	q1, [x3, #96]
+	ldr	q3, [x3, #112]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	trn2	v12.2d, v30.2d, v12.2d
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #128]
+	ldr	q2, [x2, #144]
+	ldr	q1, [x3, #128]
+	ldr	q3, [x3, #144]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	trn2	v16.2d, v30.2d, v16.2d
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #160]
+	ldr	q2, [x2, #176]
+	ldr	q1, [x3, #160]
+	ldr	q3, [x3, #176]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	trn2	v20.2d, v30.2d, v20.2d
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #320]
+	ldr	q2, [x2, #336]
+	ldr	q1, [x3, #320]
+	ldr	q3, [x3, #336]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	trn2	v8.4s, v30.4s, v8.4s
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #352]
+	ldr	q2, [x2, #368]
+	ldr	q1, [x3, #352]
+	ldr	q3, [x3, #368]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	trn2	v12.4s, v30.4s, v12.4s
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #384]
+	ldr	q2, [x2, #400]
+	ldr	q1, [x3, #384]
+	ldr	q3, [x3, #400]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	trn2	v16.4s, v30.4s, v16.4s
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #416]
+	ldr	q2, [x2, #432]
+	ldr	q1, [x3, #416]
+	ldr	q3, [x3, #432]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	trn2	v20.4s, v30.4s, v20.4s
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	sqdmulh	v21.8h, v5.8h, v4.h[2]
+	sqdmulh	v22.8h, v6.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v5.8h, v21.8h, v4.h[0]
+	mls	v6.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v7.8h, v4.h[2]
+	sqdmulh	v22.8h, v8.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v7.8h, v21.8h, v4.h[0]
+	mls	v8.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v9.8h, v4.h[2]
+	sqdmulh	v22.8h, v10.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v9.8h, v21.8h, v4.h[0]
+	mls	v10.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v11.8h, v4.h[2]
+	sqdmulh	v22.8h, v12.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v11.8h, v21.8h, v4.h[0]
+	mls	v12.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v13.8h, v4.h[2]
+	sqdmulh	v22.8h, v14.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v13.8h, v21.8h, v4.h[0]
+	mls	v14.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v15.8h, v4.h[2]
+	sqdmulh	v22.8h, v16.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v15.8h, v21.8h, v4.h[0]
+	mls	v16.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v17.8h, v4.h[2]
+	sqdmulh	v22.8h, v18.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v17.8h, v21.8h, v4.h[0]
+	mls	v18.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v19.8h, v4.h[2]
+	sqdmulh	v22.8h, v20.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v19.8h, v21.8h, v4.h[0]
+	mls	v20.8h, v22.8h, v4.h[0]
+	mov	v29.16b, v5.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	mov	v29.16b, v5.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	mov	v29.16b, v7.16b
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v8.4s, v29.4s, v8.4s
+	mov	v29.16b, v7.16b
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v8.2d, v29.2d, v8.2d
+	mov	v29.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	mov	v29.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	mov	v29.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v29.4s, v12.4s
+	mov	v29.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v29.2d, v12.2d
+	mov	v29.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	mov	v29.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	mov	v29.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v29.4s, v16.4s
+	mov	v29.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v29.2d, v16.2d
+	mov	v29.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	mov	v29.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	mov	v29.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v29.4s, v20.4s
+	mov	v29.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v29.2d, v20.2d
+	stp	q5, q6, [x0]
+	stp	q7, q8, [x0, #32]
+	stp	q9, q10, [x0, #64]
+	stp	q11, q12, [x0, #96]
+	stp	q13, q14, [x0, #128]
+	stp	q15, q16, [x0, #160]
+	stp	q17, q18, [x0, #192]
+	stp	q19, q20, [x0, #224]
+	ldp	q5, q6, [x1]
+	ldp	q7, q8, [x1, #32]
+	ldp	q9, q10, [x1, #64]
+	ldp	q11, q12, [x1, #96]
+	ldp	q13, q14, [x1, #128]
+	ldp	q15, q16, [x1, #160]
+	ldp	q17, q18, [x1, #192]
+	ldp	q19, q20, [x1, #224]
+	ldr	q0, [x2, #48]
+	ldr	q1, [x3, #48]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #192]
+	ldr	q2, [x2, #208]
+	ldr	q1, [x3, #192]
+	ldr	q3, [x3, #208]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	trn2	v8.2d, v30.2d, v8.2d
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #224]
+	ldr	q2, [x2, #240]
+	ldr	q1, [x3, #224]
+	ldr	q3, [x3, #240]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	trn2	v12.2d, v30.2d, v12.2d
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #256]
+	ldr	q2, [x2, #272]
+	ldr	q1, [x3, #256]
+	ldr	q3, [x3, #272]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	trn2	v16.2d, v30.2d, v16.2d
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #288]
+	ldr	q2, [x2, #304]
+	ldr	q1, [x3, #288]
+	ldr	q3, [x3, #304]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	trn2	v20.2d, v30.2d, v20.2d
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #448]
+	ldr	q2, [x2, #464]
+	ldr	q1, [x3, #448]
+	ldr	q3, [x3, #464]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	trn2	v8.4s, v30.4s, v8.4s
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v21.8h, v21.8h, v29.8h
+	sub	v22.8h, v22.8h, v30.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #480]
+	ldr	q2, [x2, #496]
+	ldr	q1, [x3, #480]
+	ldr	q3, [x3, #496]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	trn2	v12.4s, v30.4s, v12.4s
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v23.8h, v23.8h, v29.8h
+	sub	v24.8h, v24.8h, v30.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #512]
+	ldr	q2, [x2, #528]
+	ldr	q1, [x3, #512]
+	ldr	q3, [x3, #528]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	trn2	v16.4s, v30.4s, v16.4s
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v25.8h, v25.8h, v29.8h
+	sub	v26.8h, v26.8h, v30.8h
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #544]
+	ldr	q2, [x2, #560]
+	ldr	q1, [x3, #544]
+	ldr	q3, [x3, #560]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	trn2	v20.4s, v30.4s, v20.4s
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmulh	v29.8h, v29.8h, v4.h[0]
+	sqrdmulh	v30.8h, v30.8h, v4.h[0]
+	sub	v27.8h, v27.8h, v29.8h
+	sub	v28.8h, v28.8h, v30.8h
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	sqdmulh	v21.8h, v5.8h, v4.h[2]
+	sqdmulh	v22.8h, v6.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v5.8h, v21.8h, v4.h[0]
+	mls	v6.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v7.8h, v4.h[2]
+	sqdmulh	v22.8h, v8.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v7.8h, v21.8h, v4.h[0]
+	mls	v8.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v9.8h, v4.h[2]
+	sqdmulh	v22.8h, v10.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v9.8h, v21.8h, v4.h[0]
+	mls	v10.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v11.8h, v4.h[2]
+	sqdmulh	v22.8h, v12.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v11.8h, v21.8h, v4.h[0]
+	mls	v12.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v13.8h, v4.h[2]
+	sqdmulh	v22.8h, v14.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v13.8h, v21.8h, v4.h[0]
+	mls	v14.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v15.8h, v4.h[2]
+	sqdmulh	v22.8h, v16.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v15.8h, v21.8h, v4.h[0]
+	mls	v16.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v17.8h, v4.h[2]
+	sqdmulh	v22.8h, v18.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v17.8h, v21.8h, v4.h[0]
+	mls	v18.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v19.8h, v4.h[2]
+	sqdmulh	v22.8h, v20.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v19.8h, v21.8h, v4.h[0]
+	mls	v20.8h, v22.8h, v4.h[0]
+	mov	v29.16b, v5.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	mov	v29.16b, v5.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	mov	v29.16b, v7.16b
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v8.4s, v29.4s, v8.4s
+	mov	v29.16b, v7.16b
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v8.2d, v29.2d, v8.2d
+	mov	v29.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	mov	v29.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	mov	v29.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v29.4s, v12.4s
+	mov	v29.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v29.2d, v12.2d
+	mov	v29.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	mov	v29.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	mov	v29.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v29.4s, v16.4s
+	mov	v29.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v29.2d, v16.2d
+	mov	v29.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	mov	v29.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	mov	v29.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v29.4s, v20.4s
+	mov	v29.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v29.2d, v20.2d
+	stp	q5, q6, [x1]
+	stp	q7, q8, [x1, #32]
+	stp	q9, q10, [x1, #64]
+	stp	q11, q12, [x1, #96]
+	stp	q13, q14, [x1, #128]
+	stp	q15, q16, [x1, #160]
+	stp	q17, q18, [x1, #192]
+	stp	q19, q20, [x1, #224]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_aarch64_zetas_inv
+	DCW	0x06a5, 0x06a5, 0x070f, 0x070f, 0x05b4, 0x05b4, 0x0943, 0x0943
+	DCW	0x0922, 0x0922, 0x091d, 0x091d, 0x0134, 0x0134, 0x006c, 0x006c
+	DCW	0x0b23, 0x0b23, 0x0366, 0x0366, 0x0356, 0x0356, 0x05e6, 0x05e6
+	DCW	0x09e7, 0x09e7, 0x04fe, 0x04fe, 0x05fa, 0x05fa, 0x04a1, 0x04a1
+	DCW	0x067b, 0x067b, 0x04a3, 0x04a3, 0x0c25, 0x0c25, 0x036a, 0x036a
+	DCW	0x0537, 0x0537, 0x083f, 0x083f, 0x0088, 0x0088, 0x04bf, 0x04bf
+	DCW	0x0b81, 0x0b81, 0x05b9, 0x05b9, 0x0505, 0x0505, 0x07d7, 0x07d7
+	DCW	0x0a9f, 0x0a9f, 0x0aa6, 0x0aa6, 0x08b8, 0x08b8, 0x09d0, 0x09d0
+	DCW	0x004b, 0x004b, 0x009c, 0x009c, 0x0bb8, 0x0bb8, 0x0b5f, 0x0b5f
+	DCW	0x0ba4, 0x0ba4, 0x0368, 0x0368, 0x0a7d, 0x0a7d, 0x0636, 0x0636
+	DCW	0x08a2, 0x08a2, 0x025a, 0x025a, 0x0736, 0x0736, 0x0309, 0x0309
+	DCW	0x0093, 0x0093, 0x087a, 0x087a, 0x09f7, 0x09f7, 0x00f6, 0x00f6
+	DCW	0x068c, 0x068c, 0x06db, 0x06db, 0x01cc, 0x01cc, 0x0123, 0x0123
+	DCW	0x00eb, 0x00eb, 0x0c50, 0x0c50, 0x0ab6, 0x0ab6, 0x0b5b, 0x0b5b
+	DCW	0x0c98, 0x0c98, 0x06f3, 0x06f3, 0x099a, 0x099a, 0x04e3, 0x04e3
+	DCW	0x09b6, 0x09b6, 0x0ad6, 0x0ad6, 0x0b53, 0x0b53, 0x044f, 0x044f
+	DCW	0x04fb, 0x04fb, 0x04fb, 0x04fb, 0x0a5c, 0x0a5c, 0x0a5c, 0x0a5c
+	DCW	0x0429, 0x0429, 0x0429, 0x0429, 0x0b41, 0x0b41, 0x0b41, 0x0b41
+	DCW	0x02d5, 0x02d5, 0x02d5, 0x02d5, 0x05e4, 0x05e4, 0x05e4, 0x05e4
+	DCW	0x0940, 0x0940, 0x0940, 0x0940, 0x018e, 0x018e, 0x018e, 0x018e
+	DCW	0x03b7, 0x03b7, 0x03b7, 0x03b7, 0x00f7, 0x00f7, 0x00f7, 0x00f7
+	DCW	0x058d, 0x058d, 0x058d, 0x058d, 0x0c96, 0x0c96, 0x0c96, 0x0c96
+	DCW	0x09c3, 0x09c3, 0x09c3, 0x09c3, 0x010f, 0x010f, 0x010f, 0x010f
+	DCW	0x005a, 0x005a, 0x005a, 0x005a, 0x0355, 0x0355, 0x0355, 0x0355
+	DCW	0x0744, 0x0744, 0x0744, 0x0744, 0x0c83, 0x0c83, 0x0c83, 0x0c83
+	DCW	0x048a, 0x048a, 0x048a, 0x048a, 0x0652, 0x0652, 0x0652, 0x0652
+	DCW	0x029a, 0x029a, 0x029a, 0x029a, 0x0140, 0x0140, 0x0140, 0x0140
+	DCW	0x0008, 0x0008, 0x0008, 0x0008, 0x0afd, 0x0afd, 0x0afd, 0x0afd
+	DCW	0x0608, 0x0608, 0x0608, 0x0608, 0x011a, 0x011a, 0x011a, 0x011a
+	DCW	0x072e, 0x072e, 0x072e, 0x072e, 0x050d, 0x050d, 0x050d, 0x050d
+	DCW	0x090a, 0x090a, 0x090a, 0x090a, 0x0228, 0x0228, 0x0228, 0x0228
+	DCW	0x0a75, 0x0a75, 0x0a75, 0x0a75, 0x083a, 0x083a, 0x083a, 0x083a
+	DCW	0x0623, 0x00cd, 0x0b66, 0x0606, 0x0aa1, 0x0a25, 0x0908, 0x02a9
+	DCW	0x0082, 0x0642, 0x074f, 0x033d, 0x0b82, 0x0bf9, 0x052d, 0x0ac4
+	DCW	0x0745, 0x05c2, 0x04b2, 0x093f, 0x0c4b, 0x06d8, 0x0a93, 0x00ab
+	DCW	0x0c37, 0x0be2, 0x0773, 0x072c, 0x05ed, 0x0167, 0x02f6, 0x05a1
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_aarch64_zetas_inv_qinv
+	DCW	0xa5a5, 0xa5a5, 0x440f, 0x440f, 0xe1b4, 0xe1b4, 0xa243, 0xa243
+	DCW	0x4f22, 0x4f22, 0x901d, 0x901d, 0x5d34, 0x5d34, 0x846c, 0x846c
+	DCW	0x4423, 0x4423, 0xd566, 0xd566, 0xa556, 0xa556, 0x57e6, 0x57e6
+	DCW	0x4ee7, 0x4ee7, 0x1efe, 0x1efe, 0x53fa, 0x53fa, 0xd7a1, 0xd7a1
+	DCW	0xc77b, 0xc77b, 0xbda3, 0xbda3, 0x2b25, 0x2b25, 0xa16a, 0xa16a
+	DCW	0x3a37, 0x3a37, 0xd53f, 0xd53f, 0x1888, 0x1888, 0x51bf, 0x51bf
+	DCW	0x7e81, 0x7e81, 0xa0b9, 0xa0b9, 0xc405, 0xc405, 0x1cd7, 0x1cd7
+	DCW	0xf79f, 0xf79f, 0x9ca6, 0x9ca6, 0xb0b8, 0xb0b8, 0x79d0, 0x79d0
+	DCW	0x314b, 0x314b, 0x149c, 0x149c, 0xb3b8, 0xb3b8, 0x385f, 0x385f
+	DCW	0xb7a4, 0xb7a4, 0xbb68, 0xbb68, 0xb17d, 0xb17d, 0x4836, 0x4836
+	DCW	0xcea2, 0xcea2, 0x705a, 0x705a, 0x4936, 0x4936, 0x8e09, 0x8e09
+	DCW	0x8993, 0x8993, 0xd67a, 0xd67a, 0x7ef7, 0x7ef7, 0x82f6, 0x82f6
+	DCW	0xea8c, 0xea8c, 0xe7db, 0xe7db, 0xa5cc, 0xa5cc, 0x3a23, 0x3a23
+	DCW	0x11eb, 0x11eb, 0xfc50, 0xfc50, 0xccb6, 0xccb6, 0x6c5b, 0x6c5b
+	DCW	0x5498, 0x5498, 0xaff3, 0xaff3, 0x379a, 0x379a, 0x7de3, 0x7de3
+	DCW	0xcbb6, 0xcbb6, 0x2cd6, 0x2cd6, 0xd453, 0xd453, 0x014f, 0x014f
+	DCW	0x45fb, 0x45fb, 0x45fb, 0x45fb, 0x5e5c, 0x5e5c, 0x5e5c, 0x5e5c
+	DCW	0xef29, 0xef29, 0xef29, 0xef29, 0xbe41, 0xbe41, 0xbe41, 0xbe41
+	DCW	0x31d5, 0x31d5, 0x31d5, 0x31d5, 0x71e4, 0x71e4, 0x71e4, 0x71e4
+	DCW	0xc940, 0xc940, 0xc940, 0xc940, 0xcb8e, 0xcb8e, 0xcb8e, 0xcb8e
+	DCW	0xb8b7, 0xb8b7, 0xb8b7, 0xb8b7, 0x75f7, 0x75f7, 0x75f7, 0x75f7
+	DCW	0xdc8d, 0xdc8d, 0xdc8d, 0xdc8d, 0x6e96, 0x6e96, 0x6e96, 0x6e96
+	DCW	0x22c3, 0x22c3, 0x22c3, 0x22c3, 0x3e0f, 0x3e0f, 0x3e0f, 0x3e0f
+	DCW	0x6e5a, 0x6e5a, 0x6e5a, 0x6e5a, 0xb255, 0xb255, 0xb255, 0xb255
+	DCW	0x9344, 0x9344, 0x9344, 0x9344, 0x6583, 0x6583, 0x6583, 0x6583
+	DCW	0x028a, 0x028a, 0x028a, 0x028a, 0xdc52, 0xdc52, 0xdc52, 0xdc52
+	DCW	0x309a, 0x309a, 0x309a, 0x309a, 0xc140, 0xc140, 0xc140, 0xc140
+	DCW	0x9808, 0x9808, 0x9808, 0x9808, 0x31fd, 0x31fd, 0x31fd, 0x31fd
+	DCW	0x9e08, 0x9e08, 0x9e08, 0x9e08, 0xaf1a, 0xaf1a, 0xaf1a, 0xaf1a
+	DCW	0xb12e, 0xb12e, 0xb12e, 0xb12e, 0x5c0d, 0x5c0d, 0x5c0d, 0x5c0d
+	DCW	0x870a, 0x870a, 0x870a, 0x870a, 0xfa28, 0xfa28, 0xfa28, 0xfa28
+	DCW	0x1975, 0x1975, 0x1975, 0x1975, 0x163a, 0x163a, 0x163a, 0x163a
+	DCW	0x3f23, 0x97cd, 0xdd66, 0xb806, 0xdda1, 0x2925, 0xa108, 0x6da9
+	DCW	0x6682, 0xac42, 0x044f, 0xea3d, 0x7182, 0x66f9, 0xbc2d, 0x16c4
+	DCW	0x8645, 0x2bc2, 0xfab2, 0xd63f, 0x3d4b, 0x0ed8, 0x9393, 0x51ab
+	DCW	0x4137, 0x91e2, 0x3073, 0xcb2c, 0xfced, 0xc667, 0x84f6, 0xd8a1
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_invntt
+mlkem_invntt PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x2, L_mlkem_aarch64_zetas_inv
+	add	x2, x2, L_mlkem_aarch64_zetas_inv
+	adrp	x3, L_mlkem_aarch64_zetas_inv_qinv
+	add	x3, x3, L_mlkem_aarch64_zetas_inv_qinv
+	adrp	x4, L_mlkem_aarch64_consts
+	add	x4, x4, L_mlkem_aarch64_consts
+	add	x1, x0, #0x100
+	ldr	q8, [x4]
+	ldp	q9, q10, [x0]
+	ldp	q11, q12, [x0, #32]
+	ldp	q13, q14, [x0, #64]
+	ldp	q15, q16, [x0, #96]
+	ldp	q17, q18, [x0, #128]
+	ldp	q19, q20, [x0, #160]
+	ldp	q21, q22, [x0, #192]
+	ldp	q23, q24, [x0, #224]
+	mov	v25.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	mov	v25.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	mov	v25.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v25.2d, v12.2d
+	mov	v25.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v25.4s, v12.4s
+	mov	v25.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	mov	v25.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	mov	v25.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v25.2d, v16.2d
+	mov	v25.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v25.4s, v16.4s
+	mov	v25.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	mov	v25.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	mov	v25.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v25.2d, v20.2d
+	mov	v25.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v25.4s, v20.4s
+	mov	v25.16b, v21.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	mov	v25.16b, v21.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	mov	v25.16b, v23.16b
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v24.2d, v25.2d, v24.2d
+	mov	v25.16b, v23.16b
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v24.4s, v25.4s, v24.4s
+	ldr	q0, [x2]
+	ldr	q1, [x2, #16]
+	ldr	q2, [x3]
+	ldr	q3, [x3, #16]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #32]
+	ldr	q1, [x2, #48]
+	ldr	q2, [x3, #32]
+	ldr	q3, [x3, #48]
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #64]
+	ldr	q1, [x2, #80]
+	ldr	q2, [x3, #64]
+	ldr	q3, [x3, #80]
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #96]
+	ldr	q1, [x2, #112]
+	ldr	q2, [x3, #96]
+	ldr	q3, [x3, #112]
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #256]
+	ldr	q1, [x2, #272]
+	ldr	q2, [x3, #256]
+	ldr	q3, [x3, #272]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	trn2	v12.4s, v26.4s, v12.4s
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #288]
+	ldr	q1, [x2, #304]
+	ldr	q2, [x3, #288]
+	ldr	q3, [x3, #304]
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	trn2	v16.4s, v26.4s, v16.4s
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #320]
+	ldr	q1, [x2, #336]
+	ldr	q2, [x3, #320]
+	ldr	q3, [x3, #336]
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	trn2	v20.4s, v26.4s, v20.4s
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #352]
+	ldr	q1, [x2, #368]
+	ldr	q2, [x3, #352]
+	ldr	q3, [x3, #368]
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	trn2	v24.4s, v26.4s, v24.4s
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #512]
+	ldr	q2, [x3, #512]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	trn2	v12.2d, v26.2d, v12.2d
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.h[0]
+	mul	v27.8h, v28.8h, v2.h[1]
+	sqrdmulh	v10.8h, v26.8h, v0.h[0]
+	sqrdmulh	v12.8h, v28.8h, v0.h[1]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	trn2	v16.2d, v26.2d, v16.2d
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.h[2]
+	mul	v27.8h, v28.8h, v2.h[3]
+	sqrdmulh	v14.8h, v26.8h, v0.h[2]
+	sqrdmulh	v16.8h, v28.8h, v0.h[3]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	trn2	v20.2d, v26.2d, v20.2d
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.h[4]
+	mul	v27.8h, v28.8h, v2.h[5]
+	sqrdmulh	v18.8h, v26.8h, v0.h[4]
+	sqrdmulh	v20.8h, v28.8h, v0.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	trn2	v24.2d, v26.2d, v24.2d
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.h[6]
+	mul	v27.8h, v28.8h, v2.h[7]
+	sqrdmulh	v22.8h, v26.8h, v0.h[6]
+	sqrdmulh	v24.8h, v28.8h, v0.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v11.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v11.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v13.8h, v8.h[2]
+	sqdmulh	v26.8h, v15.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v13.8h, v25.8h, v8.h[0]
+	mls	v15.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v19.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v19.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v21.8h, v8.h[2]
+	sqdmulh	v26.8h, v23.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v21.8h, v25.8h, v8.h[0]
+	mls	v23.8h, v26.8h, v8.h[0]
+	stp	q9, q10, [x0]
+	stp	q11, q12, [x0, #32]
+	stp	q13, q14, [x0, #64]
+	stp	q15, q16, [x0, #96]
+	stp	q17, q18, [x0, #128]
+	stp	q19, q20, [x0, #160]
+	stp	q21, q22, [x0, #192]
+	stp	q23, q24, [x0, #224]
+	ldp	q9, q10, [x1]
+	ldp	q11, q12, [x1, #32]
+	ldp	q13, q14, [x1, #64]
+	ldp	q15, q16, [x1, #96]
+	ldp	q17, q18, [x1, #128]
+	ldp	q19, q20, [x1, #160]
+	ldp	q21, q22, [x1, #192]
+	ldp	q23, q24, [x1, #224]
+	mov	v25.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	mov	v25.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	mov	v25.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v25.2d, v12.2d
+	mov	v25.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v25.4s, v12.4s
+	mov	v25.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	mov	v25.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	mov	v25.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v25.2d, v16.2d
+	mov	v25.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v25.4s, v16.4s
+	mov	v25.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	mov	v25.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	mov	v25.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v25.2d, v20.2d
+	mov	v25.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v25.4s, v20.4s
+	mov	v25.16b, v21.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	mov	v25.16b, v21.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	mov	v25.16b, v23.16b
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v24.2d, v25.2d, v24.2d
+	mov	v25.16b, v23.16b
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v24.4s, v25.4s, v24.4s
+	ldr	q0, [x2, #128]
+	ldr	q1, [x2, #144]
+	ldr	q2, [x3, #128]
+	ldr	q3, [x3, #144]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #160]
+	ldr	q1, [x2, #176]
+	ldr	q2, [x3, #160]
+	ldr	q3, [x3, #176]
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #192]
+	ldr	q1, [x2, #208]
+	ldr	q2, [x3, #192]
+	ldr	q3, [x3, #208]
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #224]
+	ldr	q1, [x2, #240]
+	ldr	q2, [x3, #224]
+	ldr	q3, [x3, #240]
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #384]
+	ldr	q1, [x2, #400]
+	ldr	q2, [x3, #384]
+	ldr	q3, [x3, #400]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	trn2	v12.4s, v26.4s, v12.4s
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #416]
+	ldr	q1, [x2, #432]
+	ldr	q2, [x3, #416]
+	ldr	q3, [x3, #432]
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	trn2	v16.4s, v26.4s, v16.4s
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #448]
+	ldr	q1, [x2, #464]
+	ldr	q2, [x3, #448]
+	ldr	q3, [x3, #464]
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	trn2	v20.4s, v26.4s, v20.4s
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #480]
+	ldr	q1, [x2, #496]
+	ldr	q2, [x3, #480]
+	ldr	q3, [x3, #496]
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	trn2	v24.4s, v26.4s, v24.4s
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #528]
+	ldr	q2, [x3, #528]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	trn2	v12.2d, v26.2d, v12.2d
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.h[0]
+	mul	v27.8h, v28.8h, v2.h[1]
+	sqrdmulh	v10.8h, v26.8h, v0.h[0]
+	sqrdmulh	v12.8h, v28.8h, v0.h[1]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	trn2	v16.2d, v26.2d, v16.2d
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.h[2]
+	mul	v27.8h, v28.8h, v2.h[3]
+	sqrdmulh	v14.8h, v26.8h, v0.h[2]
+	sqrdmulh	v16.8h, v28.8h, v0.h[3]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	trn2	v20.2d, v26.2d, v20.2d
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.h[4]
+	mul	v27.8h, v28.8h, v2.h[5]
+	sqrdmulh	v18.8h, v26.8h, v0.h[4]
+	sqrdmulh	v20.8h, v28.8h, v0.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	trn2	v24.2d, v26.2d, v24.2d
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.h[6]
+	mul	v27.8h, v28.8h, v2.h[7]
+	sqrdmulh	v22.8h, v26.8h, v0.h[6]
+	sqrdmulh	v24.8h, v28.8h, v0.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v11.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v11.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v13.8h, v8.h[2]
+	sqdmulh	v26.8h, v15.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v13.8h, v25.8h, v8.h[0]
+	mls	v15.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v19.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v19.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v21.8h, v8.h[2]
+	sqdmulh	v26.8h, v23.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v21.8h, v25.8h, v8.h[0]
+	mls	v23.8h, v26.8h, v8.h[0]
+	stp	q9, q10, [x1]
+	stp	q11, q12, [x1, #32]
+	stp	q13, q14, [x1, #64]
+	stp	q15, q16, [x1, #96]
+	stp	q17, q18, [x1, #128]
+	stp	q19, q20, [x1, #160]
+	stp	q21, q22, [x1, #192]
+	stp	q23, q24, [x1, #224]
+	ldr	q4, [x2, #544]
+	ldr	q5, [x2, #560]
+	ldr	q6, [x3, #544]
+	ldr	q7, [x3, #560]
+	ldr	q9, [x0]
+	ldr	q10, [x0, #32]
+	ldr	q11, [x0, #64]
+	ldr	q12, [x0, #96]
+	ldr	q13, [x0, #128]
+	ldr	q14, [x0, #160]
+	ldr	q15, [x0, #192]
+	ldr	q16, [x0, #224]
+	ldr	q17, [x1]
+	ldr	q18, [x1, #32]
+	ldr	q19, [x1, #64]
+	ldr	q20, [x1, #96]
+	ldr	q21, [x1, #128]
+	ldr	q22, [x1, #160]
+	ldr	q23, [x1, #192]
+	ldr	q24, [x1, #224]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v6.h[0]
+	mul	v27.8h, v28.8h, v6.h[1]
+	sqrdmulh	v10.8h, v26.8h, v4.h[0]
+	sqrdmulh	v12.8h, v28.8h, v4.h[1]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v6.h[2]
+	mul	v27.8h, v28.8h, v6.h[3]
+	sqrdmulh	v14.8h, v26.8h, v4.h[2]
+	sqrdmulh	v16.8h, v28.8h, v4.h[3]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v6.h[4]
+	mul	v27.8h, v28.8h, v6.h[5]
+	sqrdmulh	v18.8h, v26.8h, v4.h[4]
+	sqrdmulh	v20.8h, v28.8h, v4.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v6.h[6]
+	mul	v27.8h, v28.8h, v6.h[7]
+	sqrdmulh	v22.8h, v26.8h, v4.h[6]
+	sqrdmulh	v24.8h, v28.8h, v4.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v11.8h
+	sub	v28.8h, v10.8h, v12.8h
+	add	v9.8h, v9.8h, v11.8h
+	add	v10.8h, v10.8h, v12.8h
+	mul	v25.8h, v26.8h, v7.h[0]
+	mul	v27.8h, v28.8h, v7.h[0]
+	sqrdmulh	v11.8h, v26.8h, v5.h[0]
+	sqrdmulh	v12.8h, v28.8h, v5.h[0]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v11.8h, v11.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v15.8h
+	sub	v28.8h, v14.8h, v16.8h
+	add	v13.8h, v13.8h, v15.8h
+	add	v14.8h, v14.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[1]
+	mul	v27.8h, v28.8h, v7.h[1]
+	sqrdmulh	v15.8h, v26.8h, v5.h[1]
+	sqrdmulh	v16.8h, v28.8h, v5.h[1]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v15.8h, v15.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v19.8h
+	sub	v28.8h, v18.8h, v20.8h
+	add	v17.8h, v17.8h, v19.8h
+	add	v18.8h, v18.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[2]
+	mul	v27.8h, v28.8h, v7.h[2]
+	sqrdmulh	v19.8h, v26.8h, v5.h[2]
+	sqrdmulh	v20.8h, v28.8h, v5.h[2]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v19.8h, v19.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v23.8h
+	sub	v28.8h, v22.8h, v24.8h
+	add	v21.8h, v21.8h, v23.8h
+	add	v22.8h, v22.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[3]
+	mul	v27.8h, v28.8h, v7.h[3]
+	sqrdmulh	v23.8h, v26.8h, v5.h[3]
+	sqrdmulh	v24.8h, v28.8h, v5.h[3]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v13.8h
+	sub	v28.8h, v10.8h, v14.8h
+	add	v9.8h, v9.8h, v13.8h
+	add	v10.8h, v10.8h, v14.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v13.8h, v26.8h, v5.h[4]
+	sqrdmulh	v14.8h, v28.8h, v5.h[4]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v13.8h, v13.8h, v25.8h
+	sub	v14.8h, v14.8h, v27.8h
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	sub	v26.8h, v11.8h, v15.8h
+	sub	v28.8h, v12.8h, v16.8h
+	add	v11.8h, v11.8h, v15.8h
+	add	v12.8h, v12.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v15.8h, v26.8h, v5.h[4]
+	sqrdmulh	v16.8h, v28.8h, v5.h[4]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v15.8h, v15.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v21.8h
+	sub	v28.8h, v18.8h, v22.8h
+	add	v17.8h, v17.8h, v21.8h
+	add	v18.8h, v18.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v21.8h, v26.8h, v5.h[5]
+	sqrdmulh	v22.8h, v28.8h, v5.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v21.8h, v21.8h, v25.8h
+	sub	v22.8h, v22.8h, v27.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v19.8h, v23.8h
+	sub	v28.8h, v20.8h, v24.8h
+	add	v19.8h, v19.8h, v23.8h
+	add	v20.8h, v20.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v23.8h, v26.8h, v5.h[5]
+	sqrdmulh	v24.8h, v28.8h, v5.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v10.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v10.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v11.8h, v8.h[2]
+	sqdmulh	v26.8h, v12.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v11.8h, v25.8h, v8.h[0]
+	mls	v12.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v18.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v18.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v19.8h, v8.h[2]
+	sqdmulh	v26.8h, v20.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v19.8h, v25.8h, v8.h[0]
+	mls	v20.8h, v26.8h, v8.h[0]
+	sub	v26.8h, v9.8h, v17.8h
+	sub	v28.8h, v10.8h, v18.8h
+	add	v9.8h, v9.8h, v17.8h
+	add	v10.8h, v10.8h, v18.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v17.8h, v26.8h, v5.h[6]
+	sqrdmulh	v18.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v17.8h, v17.8h, v25.8h
+	sub	v18.8h, v18.8h, v27.8h
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	sub	v26.8h, v11.8h, v19.8h
+	sub	v28.8h, v12.8h, v20.8h
+	add	v11.8h, v11.8h, v19.8h
+	add	v12.8h, v12.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v19.8h, v26.8h, v5.h[6]
+	sqrdmulh	v20.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v19.8h, v19.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v13.8h, v21.8h
+	sub	v28.8h, v14.8h, v22.8h
+	add	v13.8h, v13.8h, v21.8h
+	add	v14.8h, v14.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v21.8h, v26.8h, v5.h[6]
+	sqrdmulh	v22.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v21.8h, v21.8h, v25.8h
+	sub	v22.8h, v22.8h, v27.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v15.8h, v23.8h
+	sub	v28.8h, v16.8h, v24.8h
+	add	v15.8h, v15.8h, v23.8h
+	add	v16.8h, v16.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v23.8h, v26.8h, v5.h[6]
+	sqrdmulh	v24.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v25.8h, v9.8h, v7.h[7]
+	mul	v26.8h, v10.8h, v7.h[7]
+	sqrdmulh	v9.8h, v9.8h, v5.h[7]
+	sqrdmulh	v10.8h, v10.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v9.8h, v9.8h, v25.8h
+	sub	v10.8h, v10.8h, v26.8h
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v25.8h, v11.8h, v7.h[7]
+	mul	v26.8h, v12.8h, v7.h[7]
+	sqrdmulh	v11.8h, v11.8h, v5.h[7]
+	sqrdmulh	v12.8h, v12.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v11.8h, v11.8h, v25.8h
+	sub	v12.8h, v12.8h, v26.8h
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v25.8h, v13.8h, v7.h[7]
+	mul	v26.8h, v14.8h, v7.h[7]
+	sqrdmulh	v13.8h, v13.8h, v5.h[7]
+	sqrdmulh	v14.8h, v14.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v13.8h, v13.8h, v25.8h
+	sub	v14.8h, v14.8h, v26.8h
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v25.8h, v15.8h, v7.h[7]
+	mul	v26.8h, v16.8h, v7.h[7]
+	sqrdmulh	v15.8h, v15.8h, v5.h[7]
+	sqrdmulh	v16.8h, v16.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v15.8h, v15.8h, v25.8h
+	sub	v16.8h, v16.8h, v26.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mul	v25.8h, v17.8h, v7.h[7]
+	mul	v26.8h, v18.8h, v7.h[7]
+	sqrdmulh	v17.8h, v17.8h, v5.h[7]
+	sqrdmulh	v18.8h, v18.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v17.8h, v17.8h, v25.8h
+	sub	v18.8h, v18.8h, v26.8h
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	mul	v25.8h, v19.8h, v7.h[7]
+	mul	v26.8h, v20.8h, v7.h[7]
+	sqrdmulh	v19.8h, v19.8h, v5.h[7]
+	sqrdmulh	v20.8h, v20.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v19.8h, v19.8h, v25.8h
+	sub	v20.8h, v20.8h, v26.8h
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mul	v25.8h, v21.8h, v7.h[7]
+	mul	v26.8h, v22.8h, v7.h[7]
+	sqrdmulh	v21.8h, v21.8h, v5.h[7]
+	sqrdmulh	v22.8h, v22.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v21.8h, v21.8h, v25.8h
+	sub	v22.8h, v22.8h, v26.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v25.8h, v23.8h, v7.h[7]
+	mul	v26.8h, v24.8h, v7.h[7]
+	sqrdmulh	v23.8h, v23.8h, v5.h[7]
+	sqrdmulh	v24.8h, v24.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v26.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	str	q9, [x0]
+	str	q10, [x0, #32]
+	str	q11, [x0, #64]
+	str	q12, [x0, #96]
+	str	q13, [x0, #128]
+	str	q14, [x0, #160]
+	str	q15, [x0, #192]
+	str	q16, [x0, #224]
+	str	q17, [x1]
+	str	q18, [x1, #32]
+	str	q19, [x1, #64]
+	str	q20, [x1, #96]
+	str	q21, [x1, #128]
+	str	q22, [x1, #160]
+	str	q23, [x1, #192]
+	str	q24, [x1, #224]
+	ldr	q9, [x0, #16]
+	ldr	q10, [x0, #48]
+	ldr	q11, [x0, #80]
+	ldr	q12, [x0, #112]
+	ldr	q13, [x0, #144]
+	ldr	q14, [x0, #176]
+	ldr	q15, [x0, #208]
+	ldr	q16, [x0, #240]
+	ldr	q17, [x1, #16]
+	ldr	q18, [x1, #48]
+	ldr	q19, [x1, #80]
+	ldr	q20, [x1, #112]
+	ldr	q21, [x1, #144]
+	ldr	q22, [x1, #176]
+	ldr	q23, [x1, #208]
+	ldr	q24, [x1, #240]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v6.h[0]
+	mul	v27.8h, v28.8h, v6.h[1]
+	sqrdmulh	v10.8h, v26.8h, v4.h[0]
+	sqrdmulh	v12.8h, v28.8h, v4.h[1]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v10.8h, v10.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v6.h[2]
+	mul	v27.8h, v28.8h, v6.h[3]
+	sqrdmulh	v14.8h, v26.8h, v4.h[2]
+	sqrdmulh	v16.8h, v28.8h, v4.h[3]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v14.8h, v14.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v6.h[4]
+	mul	v27.8h, v28.8h, v6.h[5]
+	sqrdmulh	v18.8h, v26.8h, v4.h[4]
+	sqrdmulh	v20.8h, v28.8h, v4.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v18.8h, v18.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v6.h[6]
+	mul	v27.8h, v28.8h, v6.h[7]
+	sqrdmulh	v22.8h, v26.8h, v4.h[6]
+	sqrdmulh	v24.8h, v28.8h, v4.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v22.8h, v22.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v11.8h
+	sub	v28.8h, v10.8h, v12.8h
+	add	v9.8h, v9.8h, v11.8h
+	add	v10.8h, v10.8h, v12.8h
+	mul	v25.8h, v26.8h, v7.h[0]
+	mul	v27.8h, v28.8h, v7.h[0]
+	sqrdmulh	v11.8h, v26.8h, v5.h[0]
+	sqrdmulh	v12.8h, v28.8h, v5.h[0]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v11.8h, v11.8h, v25.8h
+	sub	v12.8h, v12.8h, v27.8h
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v15.8h
+	sub	v28.8h, v14.8h, v16.8h
+	add	v13.8h, v13.8h, v15.8h
+	add	v14.8h, v14.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[1]
+	mul	v27.8h, v28.8h, v7.h[1]
+	sqrdmulh	v15.8h, v26.8h, v5.h[1]
+	sqrdmulh	v16.8h, v28.8h, v5.h[1]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v15.8h, v15.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v19.8h
+	sub	v28.8h, v18.8h, v20.8h
+	add	v17.8h, v17.8h, v19.8h
+	add	v18.8h, v18.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[2]
+	mul	v27.8h, v28.8h, v7.h[2]
+	sqrdmulh	v19.8h, v26.8h, v5.h[2]
+	sqrdmulh	v20.8h, v28.8h, v5.h[2]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v19.8h, v19.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v23.8h
+	sub	v28.8h, v22.8h, v24.8h
+	add	v21.8h, v21.8h, v23.8h
+	add	v22.8h, v22.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[3]
+	mul	v27.8h, v28.8h, v7.h[3]
+	sqrdmulh	v23.8h, v26.8h, v5.h[3]
+	sqrdmulh	v24.8h, v28.8h, v5.h[3]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v13.8h
+	sub	v28.8h, v10.8h, v14.8h
+	add	v9.8h, v9.8h, v13.8h
+	add	v10.8h, v10.8h, v14.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v13.8h, v26.8h, v5.h[4]
+	sqrdmulh	v14.8h, v28.8h, v5.h[4]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v13.8h, v13.8h, v25.8h
+	sub	v14.8h, v14.8h, v27.8h
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	sub	v26.8h, v11.8h, v15.8h
+	sub	v28.8h, v12.8h, v16.8h
+	add	v11.8h, v11.8h, v15.8h
+	add	v12.8h, v12.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v15.8h, v26.8h, v5.h[4]
+	sqrdmulh	v16.8h, v28.8h, v5.h[4]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v15.8h, v15.8h, v25.8h
+	sub	v16.8h, v16.8h, v27.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v21.8h
+	sub	v28.8h, v18.8h, v22.8h
+	add	v17.8h, v17.8h, v21.8h
+	add	v18.8h, v18.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v21.8h, v26.8h, v5.h[5]
+	sqrdmulh	v22.8h, v28.8h, v5.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v21.8h, v21.8h, v25.8h
+	sub	v22.8h, v22.8h, v27.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v19.8h, v23.8h
+	sub	v28.8h, v20.8h, v24.8h
+	add	v19.8h, v19.8h, v23.8h
+	add	v20.8h, v20.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v23.8h, v26.8h, v5.h[5]
+	sqrdmulh	v24.8h, v28.8h, v5.h[5]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v10.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v10.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v11.8h, v8.h[2]
+	sqdmulh	v26.8h, v12.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v11.8h, v25.8h, v8.h[0]
+	mls	v12.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v18.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v18.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v19.8h, v8.h[2]
+	sqdmulh	v26.8h, v20.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v19.8h, v25.8h, v8.h[0]
+	mls	v20.8h, v26.8h, v8.h[0]
+	sub	v26.8h, v9.8h, v17.8h
+	sub	v28.8h, v10.8h, v18.8h
+	add	v9.8h, v9.8h, v17.8h
+	add	v10.8h, v10.8h, v18.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v17.8h, v26.8h, v5.h[6]
+	sqrdmulh	v18.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v17.8h, v17.8h, v25.8h
+	sub	v18.8h, v18.8h, v27.8h
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	sub	v26.8h, v11.8h, v19.8h
+	sub	v28.8h, v12.8h, v20.8h
+	add	v11.8h, v11.8h, v19.8h
+	add	v12.8h, v12.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v19.8h, v26.8h, v5.h[6]
+	sqrdmulh	v20.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v19.8h, v19.8h, v25.8h
+	sub	v20.8h, v20.8h, v27.8h
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v13.8h, v21.8h
+	sub	v28.8h, v14.8h, v22.8h
+	add	v13.8h, v13.8h, v21.8h
+	add	v14.8h, v14.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v21.8h, v26.8h, v5.h[6]
+	sqrdmulh	v22.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v21.8h, v21.8h, v25.8h
+	sub	v22.8h, v22.8h, v27.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v15.8h, v23.8h
+	sub	v28.8h, v16.8h, v24.8h
+	add	v15.8h, v15.8h, v23.8h
+	add	v16.8h, v16.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v23.8h, v26.8h, v5.h[6]
+	sqrdmulh	v24.8h, v28.8h, v5.h[6]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v27.8h, v27.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v27.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v25.8h, v9.8h, v7.h[7]
+	mul	v26.8h, v10.8h, v7.h[7]
+	sqrdmulh	v9.8h, v9.8h, v5.h[7]
+	sqrdmulh	v10.8h, v10.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v9.8h, v9.8h, v25.8h
+	sub	v10.8h, v10.8h, v26.8h
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v25.8h, v11.8h, v7.h[7]
+	mul	v26.8h, v12.8h, v7.h[7]
+	sqrdmulh	v11.8h, v11.8h, v5.h[7]
+	sqrdmulh	v12.8h, v12.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v11.8h, v11.8h, v25.8h
+	sub	v12.8h, v12.8h, v26.8h
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v25.8h, v13.8h, v7.h[7]
+	mul	v26.8h, v14.8h, v7.h[7]
+	sqrdmulh	v13.8h, v13.8h, v5.h[7]
+	sqrdmulh	v14.8h, v14.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v13.8h, v13.8h, v25.8h
+	sub	v14.8h, v14.8h, v26.8h
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v25.8h, v15.8h, v7.h[7]
+	mul	v26.8h, v16.8h, v7.h[7]
+	sqrdmulh	v15.8h, v15.8h, v5.h[7]
+	sqrdmulh	v16.8h, v16.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v15.8h, v15.8h, v25.8h
+	sub	v16.8h, v16.8h, v26.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mul	v25.8h, v17.8h, v7.h[7]
+	mul	v26.8h, v18.8h, v7.h[7]
+	sqrdmulh	v17.8h, v17.8h, v5.h[7]
+	sqrdmulh	v18.8h, v18.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v17.8h, v17.8h, v25.8h
+	sub	v18.8h, v18.8h, v26.8h
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	mul	v25.8h, v19.8h, v7.h[7]
+	mul	v26.8h, v20.8h, v7.h[7]
+	sqrdmulh	v19.8h, v19.8h, v5.h[7]
+	sqrdmulh	v20.8h, v20.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v19.8h, v19.8h, v25.8h
+	sub	v20.8h, v20.8h, v26.8h
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mul	v25.8h, v21.8h, v7.h[7]
+	mul	v26.8h, v22.8h, v7.h[7]
+	sqrdmulh	v21.8h, v21.8h, v5.h[7]
+	sqrdmulh	v22.8h, v22.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v21.8h, v21.8h, v25.8h
+	sub	v22.8h, v22.8h, v26.8h
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v25.8h, v23.8h, v7.h[7]
+	mul	v26.8h, v24.8h, v7.h[7]
+	sqrdmulh	v23.8h, v23.8h, v5.h[7]
+	sqrdmulh	v24.8h, v24.8h, v5.h[7]
+	sqrdmulh	v25.8h, v25.8h, v8.h[0]
+	sqrdmulh	v26.8h, v26.8h, v8.h[0]
+	sub	v23.8h, v23.8h, v25.8h
+	sub	v24.8h, v24.8h, v26.8h
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	str	q9, [x0, #16]
+	str	q10, [x0, #48]
+	str	q11, [x0, #80]
+	str	q12, [x0, #112]
+	str	q13, [x0, #144]
+	str	q14, [x0, #176]
+	str	q15, [x0, #208]
+	str	q16, [x0, #240]
+	str	q17, [x1, #16]
+	str	q18, [x1, #48]
+	str	q19, [x1, #80]
+	str	q20, [x1, #112]
+	str	q21, [x1, #144]
+	str	q22, [x1, #176]
+	str	q23, [x1, #208]
+	str	q24, [x1, #240]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	IF :LNOT::DEF:WOLFSSL_AARCH64_NO_SQRDMLSH
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_ntt_sqrdmlsh
+mlkem_ntt_sqrdmlsh PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x2, L_mlkem_aarch64_zetas
+	add	x2, x2, L_mlkem_aarch64_zetas
+	adrp	x3, L_mlkem_aarch64_zetas_qinv
+	add	x3, x3, L_mlkem_aarch64_zetas_qinv
+	adrp	x4, L_mlkem_aarch64_consts
+	add	x4, x4, L_mlkem_aarch64_consts
+	add	x1, x0, #0x100
+	ldr	q4, [x4]
+	ldr	q5, [x0]
+	ldr	q6, [x0, #32]
+	ldr	q7, [x0, #64]
+	ldr	q8, [x0, #96]
+	ldr	q9, [x0, #128]
+	ldr	q10, [x0, #160]
+	ldr	q11, [x0, #192]
+	ldr	q12, [x0, #224]
+	ldr	q13, [x1]
+	ldr	q14, [x1, #32]
+	ldr	q15, [x1, #64]
+	ldr	q16, [x1, #96]
+	ldr	q17, [x1, #128]
+	ldr	q18, [x1, #160]
+	ldr	q19, [x1, #192]
+	ldr	q20, [x1, #224]
+	ldr	q0, [x2]
+	ldr	q1, [x3]
+	mul	v29.8h, v13.8h, v1.h[1]
+	mul	v30.8h, v14.8h, v1.h[1]
+	sqrdmulh	v21.8h, v13.8h, v0.h[1]
+	sqrdmulh	v22.8h, v14.8h, v0.h[1]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v15.8h, v1.h[1]
+	mul	v30.8h, v16.8h, v1.h[1]
+	sqrdmulh	v23.8h, v15.8h, v0.h[1]
+	sqrdmulh	v24.8h, v16.8h, v0.h[1]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[1]
+	mul	v30.8h, v18.8h, v1.h[1]
+	sqrdmulh	v25.8h, v17.8h, v0.h[1]
+	sqrdmulh	v26.8h, v18.8h, v0.h[1]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[1]
+	mul	v30.8h, v20.8h, v1.h[1]
+	sqrdmulh	v27.8h, v19.8h, v0.h[1]
+	sqrdmulh	v28.8h, v20.8h, v0.h[1]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v13.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v14.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v15.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v16.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v9.8h, v25.8h
+	add	v9.8h, v9.8h, v25.8h
+	sub	v18.8h, v10.8h, v26.8h
+	add	v10.8h, v10.8h, v26.8h
+	sub	v19.8h, v11.8h, v27.8h
+	add	v11.8h, v11.8h, v27.8h
+	sub	v20.8h, v12.8h, v28.8h
+	add	v12.8h, v12.8h, v28.8h
+	mul	v29.8h, v9.8h, v1.h[2]
+	mul	v30.8h, v10.8h, v1.h[2]
+	sqrdmulh	v21.8h, v9.8h, v0.h[2]
+	sqrdmulh	v22.8h, v10.8h, v0.h[2]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[2]
+	sqrdmulh	v23.8h, v11.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[2]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[3]
+	mul	v30.8h, v18.8h, v1.h[3]
+	sqrdmulh	v25.8h, v17.8h, v0.h[3]
+	sqrdmulh	v26.8h, v18.8h, v0.h[3]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[3]
+	mul	v30.8h, v20.8h, v1.h[3]
+	sqrdmulh	v27.8h, v19.8h, v0.h[3]
+	sqrdmulh	v28.8h, v20.8h, v0.h[3]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v9.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v10.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v12.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v18.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v15.8h, v27.8h
+	add	v15.8h, v15.8h, v27.8h
+	sub	v20.8h, v16.8h, v28.8h
+	add	v16.8h, v16.8h, v28.8h
+	mul	v29.8h, v7.8h, v1.h[4]
+	mul	v30.8h, v8.8h, v1.h[4]
+	sqrdmulh	v21.8h, v7.8h, v0.h[4]
+	sqrdmulh	v22.8h, v8.8h, v0.h[4]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[5]
+	mul	v30.8h, v12.8h, v1.h[5]
+	sqrdmulh	v23.8h, v11.8h, v0.h[5]
+	sqrdmulh	v24.8h, v12.8h, v0.h[5]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v15.8h, v1.h[6]
+	mul	v30.8h, v16.8h, v1.h[6]
+	sqrdmulh	v25.8h, v15.8h, v0.h[6]
+	sqrdmulh	v26.8h, v16.8h, v0.h[6]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[7]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v19.8h, v0.h[7]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v7.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v10.8h, v24.8h
+	add	v10.8h, v10.8h, v24.8h
+	sub	v15.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v18.8h, v28.8h
+	add	v18.8h, v18.8h, v28.8h
+	ldr	q0, [x2, #16]
+	ldr	q1, [x3, #16]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	str	q5, [x0]
+	str	q6, [x0, #32]
+	str	q7, [x0, #64]
+	str	q8, [x0, #96]
+	str	q9, [x0, #128]
+	str	q10, [x0, #160]
+	str	q11, [x0, #192]
+	str	q12, [x0, #224]
+	str	q13, [x1]
+	str	q14, [x1, #32]
+	str	q15, [x1, #64]
+	str	q16, [x1, #96]
+	str	q17, [x1, #128]
+	str	q18, [x1, #160]
+	str	q19, [x1, #192]
+	str	q20, [x1, #224]
+	ldr	q5, [x0, #16]
+	ldr	q6, [x0, #48]
+	ldr	q7, [x0, #80]
+	ldr	q8, [x0, #112]
+	ldr	q9, [x0, #144]
+	ldr	q10, [x0, #176]
+	ldr	q11, [x0, #208]
+	ldr	q12, [x0, #240]
+	ldr	q13, [x1, #16]
+	ldr	q14, [x1, #48]
+	ldr	q15, [x1, #80]
+	ldr	q16, [x1, #112]
+	ldr	q17, [x1, #144]
+	ldr	q18, [x1, #176]
+	ldr	q19, [x1, #208]
+	ldr	q20, [x1, #240]
+	ldr	q0, [x2]
+	ldr	q1, [x3]
+	mul	v29.8h, v13.8h, v1.h[1]
+	mul	v30.8h, v14.8h, v1.h[1]
+	sqrdmulh	v21.8h, v13.8h, v0.h[1]
+	sqrdmulh	v22.8h, v14.8h, v0.h[1]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v15.8h, v1.h[1]
+	mul	v30.8h, v16.8h, v1.h[1]
+	sqrdmulh	v23.8h, v15.8h, v0.h[1]
+	sqrdmulh	v24.8h, v16.8h, v0.h[1]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[1]
+	mul	v30.8h, v18.8h, v1.h[1]
+	sqrdmulh	v25.8h, v17.8h, v0.h[1]
+	sqrdmulh	v26.8h, v18.8h, v0.h[1]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[1]
+	mul	v30.8h, v20.8h, v1.h[1]
+	sqrdmulh	v27.8h, v19.8h, v0.h[1]
+	sqrdmulh	v28.8h, v20.8h, v0.h[1]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v13.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v14.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v15.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v16.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v9.8h, v25.8h
+	add	v9.8h, v9.8h, v25.8h
+	sub	v18.8h, v10.8h, v26.8h
+	add	v10.8h, v10.8h, v26.8h
+	sub	v19.8h, v11.8h, v27.8h
+	add	v11.8h, v11.8h, v27.8h
+	sub	v20.8h, v12.8h, v28.8h
+	add	v12.8h, v12.8h, v28.8h
+	mul	v29.8h, v9.8h, v1.h[2]
+	mul	v30.8h, v10.8h, v1.h[2]
+	sqrdmulh	v21.8h, v9.8h, v0.h[2]
+	sqrdmulh	v22.8h, v10.8h, v0.h[2]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[2]
+	sqrdmulh	v23.8h, v11.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[2]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v17.8h, v1.h[3]
+	mul	v30.8h, v18.8h, v1.h[3]
+	sqrdmulh	v25.8h, v17.8h, v0.h[3]
+	sqrdmulh	v26.8h, v18.8h, v0.h[3]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[3]
+	mul	v30.8h, v20.8h, v1.h[3]
+	sqrdmulh	v27.8h, v19.8h, v0.h[3]
+	sqrdmulh	v28.8h, v20.8h, v0.h[3]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v9.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v10.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v7.8h, v23.8h
+	add	v7.8h, v7.8h, v23.8h
+	sub	v12.8h, v8.8h, v24.8h
+	add	v8.8h, v8.8h, v24.8h
+	sub	v17.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v18.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v15.8h, v27.8h
+	add	v15.8h, v15.8h, v27.8h
+	sub	v20.8h, v16.8h, v28.8h
+	add	v16.8h, v16.8h, v28.8h
+	mul	v29.8h, v7.8h, v1.h[4]
+	mul	v30.8h, v8.8h, v1.h[4]
+	sqrdmulh	v21.8h, v7.8h, v0.h[4]
+	sqrdmulh	v22.8h, v8.8h, v0.h[4]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v11.8h, v1.h[5]
+	mul	v30.8h, v12.8h, v1.h[5]
+	sqrdmulh	v23.8h, v11.8h, v0.h[5]
+	sqrdmulh	v24.8h, v12.8h, v0.h[5]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v15.8h, v1.h[6]
+	mul	v30.8h, v16.8h, v1.h[6]
+	sqrdmulh	v25.8h, v15.8h, v0.h[6]
+	sqrdmulh	v26.8h, v16.8h, v0.h[6]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v19.8h, v1.h[7]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v19.8h, v0.h[7]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v7.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v6.8h, v22.8h
+	add	v6.8h, v6.8h, v22.8h
+	sub	v11.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v10.8h, v24.8h
+	add	v10.8h, v10.8h, v24.8h
+	sub	v15.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v14.8h, v26.8h
+	add	v14.8h, v14.8h, v26.8h
+	sub	v19.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v18.8h, v28.8h
+	add	v18.8h, v18.8h, v28.8h
+	ldr	q0, [x2, #16]
+	ldr	q1, [x3, #16]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	str	q5, [x0, #16]
+	str	q6, [x0, #48]
+	str	q7, [x0, #80]
+	str	q8, [x0, #112]
+	str	q9, [x0, #144]
+	str	q10, [x0, #176]
+	str	q11, [x0, #208]
+	str	q12, [x0, #240]
+	str	q13, [x1, #16]
+	str	q14, [x1, #48]
+	str	q15, [x1, #80]
+	str	q16, [x1, #112]
+	str	q17, [x1, #144]
+	str	q18, [x1, #176]
+	str	q19, [x1, #208]
+	str	q20, [x1, #240]
+	ldp	q5, q6, [x0]
+	ldp	q7, q8, [x0, #32]
+	ldp	q9, q10, [x0, #64]
+	ldp	q11, q12, [x0, #96]
+	ldp	q13, q14, [x0, #128]
+	ldp	q15, q16, [x0, #160]
+	ldp	q17, q18, [x0, #192]
+	ldp	q19, q20, [x0, #224]
+	ldr	q0, [x2, #32]
+	ldr	q1, [x3, #32]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #64]
+	ldr	q2, [x2, #80]
+	ldr	q1, [x3, #64]
+	ldr	q3, [x3, #80]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	trn2	v8.2d, v30.2d, v8.2d
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #96]
+	ldr	q2, [x2, #112]
+	ldr	q1, [x3, #96]
+	ldr	q3, [x3, #112]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	trn2	v12.2d, v30.2d, v12.2d
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #128]
+	ldr	q2, [x2, #144]
+	ldr	q1, [x3, #128]
+	ldr	q3, [x3, #144]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	trn2	v16.2d, v30.2d, v16.2d
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #160]
+	ldr	q2, [x2, #176]
+	ldr	q1, [x3, #160]
+	ldr	q3, [x3, #176]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	trn2	v20.2d, v30.2d, v20.2d
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #320]
+	ldr	q2, [x2, #336]
+	ldr	q1, [x3, #320]
+	ldr	q3, [x3, #336]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	trn2	v8.4s, v30.4s, v8.4s
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #352]
+	ldr	q2, [x2, #368]
+	ldr	q1, [x3, #352]
+	ldr	q3, [x3, #368]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	trn2	v12.4s, v30.4s, v12.4s
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #384]
+	ldr	q2, [x2, #400]
+	ldr	q1, [x3, #384]
+	ldr	q3, [x3, #400]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	trn2	v16.4s, v30.4s, v16.4s
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #416]
+	ldr	q2, [x2, #432]
+	ldr	q1, [x3, #416]
+	ldr	q3, [x3, #432]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	trn2	v20.4s, v30.4s, v20.4s
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	sqdmulh	v21.8h, v5.8h, v4.h[2]
+	sqdmulh	v22.8h, v6.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v5.8h, v21.8h, v4.h[0]
+	mls	v6.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v7.8h, v4.h[2]
+	sqdmulh	v22.8h, v8.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v7.8h, v21.8h, v4.h[0]
+	mls	v8.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v9.8h, v4.h[2]
+	sqdmulh	v22.8h, v10.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v9.8h, v21.8h, v4.h[0]
+	mls	v10.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v11.8h, v4.h[2]
+	sqdmulh	v22.8h, v12.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v11.8h, v21.8h, v4.h[0]
+	mls	v12.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v13.8h, v4.h[2]
+	sqdmulh	v22.8h, v14.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v13.8h, v21.8h, v4.h[0]
+	mls	v14.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v15.8h, v4.h[2]
+	sqdmulh	v22.8h, v16.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v15.8h, v21.8h, v4.h[0]
+	mls	v16.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v17.8h, v4.h[2]
+	sqdmulh	v22.8h, v18.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v17.8h, v21.8h, v4.h[0]
+	mls	v18.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v19.8h, v4.h[2]
+	sqdmulh	v22.8h, v20.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v19.8h, v21.8h, v4.h[0]
+	mls	v20.8h, v22.8h, v4.h[0]
+	mov	v29.16b, v5.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	mov	v29.16b, v5.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	mov	v29.16b, v7.16b
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v8.4s, v29.4s, v8.4s
+	mov	v29.16b, v7.16b
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v8.2d, v29.2d, v8.2d
+	mov	v29.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	mov	v29.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	mov	v29.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v29.4s, v12.4s
+	mov	v29.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v29.2d, v12.2d
+	mov	v29.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	mov	v29.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	mov	v29.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v29.4s, v16.4s
+	mov	v29.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v29.2d, v16.2d
+	mov	v29.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	mov	v29.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	mov	v29.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v29.4s, v20.4s
+	mov	v29.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v29.2d, v20.2d
+	stp	q5, q6, [x0]
+	stp	q7, q8, [x0, #32]
+	stp	q9, q10, [x0, #64]
+	stp	q11, q12, [x0, #96]
+	stp	q13, q14, [x0, #128]
+	stp	q15, q16, [x0, #160]
+	stp	q17, q18, [x0, #192]
+	stp	q19, q20, [x0, #224]
+	ldp	q5, q6, [x1]
+	ldp	q7, q8, [x1, #32]
+	ldp	q9, q10, [x1, #64]
+	ldp	q11, q12, [x1, #96]
+	ldp	q13, q14, [x1, #128]
+	ldp	q15, q16, [x1, #160]
+	ldp	q17, q18, [x1, #192]
+	ldp	q19, q20, [x1, #224]
+	ldr	q0, [x2, #48]
+	ldr	q1, [x3, #48]
+	mul	v29.8h, v6.8h, v1.h[0]
+	mul	v30.8h, v8.8h, v1.h[1]
+	sqrdmulh	v21.8h, v6.8h, v0.h[0]
+	sqrdmulh	v22.8h, v8.8h, v0.h[1]
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v29.8h, v10.8h, v1.h[2]
+	mul	v30.8h, v12.8h, v1.h[3]
+	sqrdmulh	v23.8h, v10.8h, v0.h[2]
+	sqrdmulh	v24.8h, v12.8h, v0.h[3]
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v29.8h, v14.8h, v1.h[4]
+	mul	v30.8h, v16.8h, v1.h[5]
+	sqrdmulh	v25.8h, v14.8h, v0.h[4]
+	sqrdmulh	v26.8h, v16.8h, v0.h[5]
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	mul	v29.8h, v18.8h, v1.h[6]
+	mul	v30.8h, v20.8h, v1.h[7]
+	sqrdmulh	v27.8h, v18.8h, v0.h[6]
+	sqrdmulh	v28.8h, v20.8h, v0.h[7]
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #192]
+	ldr	q2, [x2, #208]
+	ldr	q1, [x3, #192]
+	ldr	q3, [x3, #208]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	trn2	v8.2d, v30.2d, v8.2d
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #224]
+	ldr	q2, [x2, #240]
+	ldr	q1, [x3, #224]
+	ldr	q3, [x3, #240]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	trn2	v12.2d, v30.2d, v12.2d
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #256]
+	ldr	q2, [x2, #272]
+	ldr	q1, [x3, #256]
+	ldr	q3, [x3, #272]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	trn2	v16.2d, v30.2d, v16.2d
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #288]
+	ldr	q2, [x2, #304]
+	ldr	q1, [x3, #288]
+	ldr	q3, [x3, #304]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	trn2	v20.2d, v30.2d, v20.2d
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	ldr	q0, [x2, #448]
+	ldr	q2, [x2, #464]
+	ldr	q1, [x3, #448]
+	ldr	q3, [x3, #464]
+	mov	v29.16b, v5.16b
+	mov	v30.16b, v7.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	trn2	v8.4s, v30.4s, v8.4s
+	mul	v29.8h, v6.8h, v1.8h
+	mul	v30.8h, v8.8h, v3.8h
+	sqrdmulh	v21.8h, v6.8h, v0.8h
+	sqrdmulh	v22.8h, v8.8h, v2.8h
+	sqrdmlsh	v21.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v22.8h, v30.8h, v4.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	ldr	q0, [x2, #480]
+	ldr	q2, [x2, #496]
+	ldr	q1, [x3, #480]
+	ldr	q3, [x3, #496]
+	mov	v29.16b, v9.16b
+	mov	v30.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	trn2	v12.4s, v30.4s, v12.4s
+	mul	v29.8h, v10.8h, v1.8h
+	mul	v30.8h, v12.8h, v3.8h
+	sqrdmulh	v23.8h, v10.8h, v0.8h
+	sqrdmulh	v24.8h, v12.8h, v2.8h
+	sqrdmlsh	v23.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v24.8h, v30.8h, v4.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #512]
+	ldr	q2, [x2, #528]
+	ldr	q1, [x3, #512]
+	ldr	q3, [x3, #528]
+	mov	v29.16b, v13.16b
+	mov	v30.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	trn2	v16.4s, v30.4s, v16.4s
+	mul	v29.8h, v14.8h, v1.8h
+	mul	v30.8h, v16.8h, v3.8h
+	sqrdmulh	v25.8h, v14.8h, v0.8h
+	sqrdmulh	v26.8h, v16.8h, v2.8h
+	sqrdmlsh	v25.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v26.8h, v30.8h, v4.h[0]
+	sshr	v25.8h, v25.8h, #1
+	sshr	v26.8h, v26.8h, #1
+	ldr	q0, [x2, #544]
+	ldr	q2, [x2, #560]
+	ldr	q1, [x3, #544]
+	ldr	q3, [x3, #560]
+	mov	v29.16b, v17.16b
+	mov	v30.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	trn2	v20.4s, v30.4s, v20.4s
+	mul	v29.8h, v18.8h, v1.8h
+	mul	v30.8h, v20.8h, v3.8h
+	sqrdmulh	v27.8h, v18.8h, v0.8h
+	sqrdmulh	v28.8h, v20.8h, v2.8h
+	sqrdmlsh	v27.8h, v29.8h, v4.h[0]
+	sqrdmlsh	v28.8h, v30.8h, v4.h[0]
+	sshr	v27.8h, v27.8h, #1
+	sshr	v28.8h, v28.8h, #1
+	sub	v6.8h, v5.8h, v21.8h
+	add	v5.8h, v5.8h, v21.8h
+	sub	v8.8h, v7.8h, v22.8h
+	add	v7.8h, v7.8h, v22.8h
+	sub	v10.8h, v9.8h, v23.8h
+	add	v9.8h, v9.8h, v23.8h
+	sub	v12.8h, v11.8h, v24.8h
+	add	v11.8h, v11.8h, v24.8h
+	sub	v14.8h, v13.8h, v25.8h
+	add	v13.8h, v13.8h, v25.8h
+	sub	v16.8h, v15.8h, v26.8h
+	add	v15.8h, v15.8h, v26.8h
+	sub	v18.8h, v17.8h, v27.8h
+	add	v17.8h, v17.8h, v27.8h
+	sub	v20.8h, v19.8h, v28.8h
+	add	v19.8h, v19.8h, v28.8h
+	sqdmulh	v21.8h, v5.8h, v4.h[2]
+	sqdmulh	v22.8h, v6.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v5.8h, v21.8h, v4.h[0]
+	mls	v6.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v7.8h, v4.h[2]
+	sqdmulh	v22.8h, v8.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v7.8h, v21.8h, v4.h[0]
+	mls	v8.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v9.8h, v4.h[2]
+	sqdmulh	v22.8h, v10.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v9.8h, v21.8h, v4.h[0]
+	mls	v10.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v11.8h, v4.h[2]
+	sqdmulh	v22.8h, v12.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v11.8h, v21.8h, v4.h[0]
+	mls	v12.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v13.8h, v4.h[2]
+	sqdmulh	v22.8h, v14.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v13.8h, v21.8h, v4.h[0]
+	mls	v14.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v15.8h, v4.h[2]
+	sqdmulh	v22.8h, v16.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v15.8h, v21.8h, v4.h[0]
+	mls	v16.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v17.8h, v4.h[2]
+	sqdmulh	v22.8h, v18.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v17.8h, v21.8h, v4.h[0]
+	mls	v18.8h, v22.8h, v4.h[0]
+	sqdmulh	v21.8h, v19.8h, v4.h[2]
+	sqdmulh	v22.8h, v20.8h, v4.h[2]
+	sshr	v21.8h, v21.8h, #11
+	sshr	v22.8h, v22.8h, #11
+	mls	v19.8h, v21.8h, v4.h[0]
+	mls	v20.8h, v22.8h, v4.h[0]
+	mov	v29.16b, v5.16b
+	trn1	v5.4s, v5.4s, v6.4s
+	trn2	v6.4s, v29.4s, v6.4s
+	mov	v29.16b, v5.16b
+	trn1	v5.2d, v5.2d, v6.2d
+	trn2	v6.2d, v29.2d, v6.2d
+	mov	v29.16b, v7.16b
+	trn1	v7.4s, v7.4s, v8.4s
+	trn2	v8.4s, v29.4s, v8.4s
+	mov	v29.16b, v7.16b
+	trn1	v7.2d, v7.2d, v8.2d
+	trn2	v8.2d, v29.2d, v8.2d
+	mov	v29.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v29.4s, v10.4s
+	mov	v29.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v29.2d, v10.2d
+	mov	v29.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v29.4s, v12.4s
+	mov	v29.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v29.2d, v12.2d
+	mov	v29.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v29.4s, v14.4s
+	mov	v29.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v29.2d, v14.2d
+	mov	v29.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v29.4s, v16.4s
+	mov	v29.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v29.2d, v16.2d
+	mov	v29.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v29.4s, v18.4s
+	mov	v29.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v29.2d, v18.2d
+	mov	v29.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v29.4s, v20.4s
+	mov	v29.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v29.2d, v20.2d
+	stp	q5, q6, [x1]
+	stp	q7, q8, [x1, #32]
+	stp	q9, q10, [x1, #64]
+	stp	q11, q12, [x1, #96]
+	stp	q13, q14, [x1, #128]
+	stp	q15, q16, [x1, #160]
+	stp	q17, q18, [x1, #192]
+	stp	q19, q20, [x1, #224]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_invntt_sqrdmlsh
+mlkem_invntt_sqrdmlsh PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x2, L_mlkem_aarch64_zetas_inv
+	add	x2, x2, L_mlkem_aarch64_zetas_inv
+	adrp	x3, L_mlkem_aarch64_zetas_inv_qinv
+	add	x3, x3, L_mlkem_aarch64_zetas_inv_qinv
+	adrp	x4, L_mlkem_aarch64_consts
+	add	x4, x4, L_mlkem_aarch64_consts
+	add	x1, x0, #0x100
+	ldr	q8, [x4]
+	ldp	q9, q10, [x0]
+	ldp	q11, q12, [x0, #32]
+	ldp	q13, q14, [x0, #64]
+	ldp	q15, q16, [x0, #96]
+	ldp	q17, q18, [x0, #128]
+	ldp	q19, q20, [x0, #160]
+	ldp	q21, q22, [x0, #192]
+	ldp	q23, q24, [x0, #224]
+	mov	v25.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	mov	v25.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	mov	v25.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v25.2d, v12.2d
+	mov	v25.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v25.4s, v12.4s
+	mov	v25.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	mov	v25.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	mov	v25.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v25.2d, v16.2d
+	mov	v25.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v25.4s, v16.4s
+	mov	v25.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	mov	v25.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	mov	v25.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v25.2d, v20.2d
+	mov	v25.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v25.4s, v20.4s
+	mov	v25.16b, v21.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	mov	v25.16b, v21.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	mov	v25.16b, v23.16b
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v24.2d, v25.2d, v24.2d
+	mov	v25.16b, v23.16b
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v24.4s, v25.4s, v24.4s
+	ldr	q0, [x2]
+	ldr	q1, [x2, #16]
+	ldr	q2, [x3]
+	ldr	q3, [x3, #16]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #32]
+	ldr	q1, [x2, #48]
+	ldr	q2, [x3, #32]
+	ldr	q3, [x3, #48]
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #64]
+	ldr	q1, [x2, #80]
+	ldr	q2, [x3, #64]
+	ldr	q3, [x3, #80]
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #96]
+	ldr	q1, [x2, #112]
+	ldr	q2, [x3, #96]
+	ldr	q3, [x3, #112]
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #256]
+	ldr	q1, [x2, #272]
+	ldr	q2, [x3, #256]
+	ldr	q3, [x3, #272]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	trn2	v12.4s, v26.4s, v12.4s
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #288]
+	ldr	q1, [x2, #304]
+	ldr	q2, [x3, #288]
+	ldr	q3, [x3, #304]
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	trn2	v16.4s, v26.4s, v16.4s
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #320]
+	ldr	q1, [x2, #336]
+	ldr	q2, [x3, #320]
+	ldr	q3, [x3, #336]
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	trn2	v20.4s, v26.4s, v20.4s
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #352]
+	ldr	q1, [x2, #368]
+	ldr	q2, [x3, #352]
+	ldr	q3, [x3, #368]
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	trn2	v24.4s, v26.4s, v24.4s
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #512]
+	ldr	q2, [x3, #512]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	trn2	v12.2d, v26.2d, v12.2d
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.h[0]
+	mul	v27.8h, v28.8h, v2.h[1]
+	sqrdmulh	v10.8h, v26.8h, v0.h[0]
+	sqrdmulh	v12.8h, v28.8h, v0.h[1]
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	trn2	v16.2d, v26.2d, v16.2d
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.h[2]
+	mul	v27.8h, v28.8h, v2.h[3]
+	sqrdmulh	v14.8h, v26.8h, v0.h[2]
+	sqrdmulh	v16.8h, v28.8h, v0.h[3]
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	trn2	v20.2d, v26.2d, v20.2d
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.h[4]
+	mul	v27.8h, v28.8h, v2.h[5]
+	sqrdmulh	v18.8h, v26.8h, v0.h[4]
+	sqrdmulh	v20.8h, v28.8h, v0.h[5]
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	trn2	v24.2d, v26.2d, v24.2d
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.h[6]
+	mul	v27.8h, v28.8h, v2.h[7]
+	sqrdmulh	v22.8h, v26.8h, v0.h[6]
+	sqrdmulh	v24.8h, v28.8h, v0.h[7]
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v11.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v11.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v13.8h, v8.h[2]
+	sqdmulh	v26.8h, v15.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v13.8h, v25.8h, v8.h[0]
+	mls	v15.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v19.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v19.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v21.8h, v8.h[2]
+	sqdmulh	v26.8h, v23.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v21.8h, v25.8h, v8.h[0]
+	mls	v23.8h, v26.8h, v8.h[0]
+	stp	q9, q10, [x0]
+	stp	q11, q12, [x0, #32]
+	stp	q13, q14, [x0, #64]
+	stp	q15, q16, [x0, #96]
+	stp	q17, q18, [x0, #128]
+	stp	q19, q20, [x0, #160]
+	stp	q21, q22, [x0, #192]
+	stp	q23, q24, [x0, #224]
+	ldp	q9, q10, [x1]
+	ldp	q11, q12, [x1, #32]
+	ldp	q13, q14, [x1, #64]
+	ldp	q15, q16, [x1, #96]
+	ldp	q17, q18, [x1, #128]
+	ldp	q19, q20, [x1, #160]
+	ldp	q21, q22, [x1, #192]
+	ldp	q23, q24, [x1, #224]
+	mov	v25.16b, v9.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	mov	v25.16b, v9.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	mov	v25.16b, v11.16b
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v12.2d, v25.2d, v12.2d
+	mov	v25.16b, v11.16b
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v12.4s, v25.4s, v12.4s
+	mov	v25.16b, v13.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	mov	v25.16b, v13.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	mov	v25.16b, v15.16b
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v16.2d, v25.2d, v16.2d
+	mov	v25.16b, v15.16b
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v16.4s, v25.4s, v16.4s
+	mov	v25.16b, v17.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	mov	v25.16b, v17.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	mov	v25.16b, v19.16b
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v20.2d, v25.2d, v20.2d
+	mov	v25.16b, v19.16b
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v20.4s, v25.4s, v20.4s
+	mov	v25.16b, v21.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	mov	v25.16b, v21.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	mov	v25.16b, v23.16b
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v24.2d, v25.2d, v24.2d
+	mov	v25.16b, v23.16b
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v24.4s, v25.4s, v24.4s
+	ldr	q0, [x2, #128]
+	ldr	q1, [x2, #144]
+	ldr	q2, [x3, #128]
+	ldr	q3, [x3, #144]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #160]
+	ldr	q1, [x2, #176]
+	ldr	q2, [x3, #160]
+	ldr	q3, [x3, #176]
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #192]
+	ldr	q1, [x2, #208]
+	ldr	q2, [x3, #192]
+	ldr	q3, [x3, #208]
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #224]
+	ldr	q1, [x2, #240]
+	ldr	q2, [x3, #224]
+	ldr	q3, [x3, #240]
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #384]
+	ldr	q1, [x2, #400]
+	ldr	q2, [x3, #384]
+	ldr	q3, [x3, #400]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.4s, v9.4s, v10.4s
+	trn1	v11.4s, v11.4s, v12.4s
+	trn2	v10.4s, v25.4s, v10.4s
+	trn2	v12.4s, v26.4s, v12.4s
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v10.8h, v26.8h, v0.8h
+	sqrdmulh	v12.8h, v28.8h, v1.8h
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	ldr	q0, [x2, #416]
+	ldr	q1, [x2, #432]
+	ldr	q2, [x3, #416]
+	ldr	q3, [x3, #432]
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.4s, v13.4s, v14.4s
+	trn1	v15.4s, v15.4s, v16.4s
+	trn2	v14.4s, v25.4s, v14.4s
+	trn2	v16.4s, v26.4s, v16.4s
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v14.8h, v26.8h, v0.8h
+	sqrdmulh	v16.8h, v28.8h, v1.8h
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	ldr	q0, [x2, #448]
+	ldr	q1, [x2, #464]
+	ldr	q2, [x3, #448]
+	ldr	q3, [x3, #464]
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.4s, v17.4s, v18.4s
+	trn1	v19.4s, v19.4s, v20.4s
+	trn2	v18.4s, v25.4s, v18.4s
+	trn2	v20.4s, v26.4s, v20.4s
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v18.8h, v26.8h, v0.8h
+	sqrdmulh	v20.8h, v28.8h, v1.8h
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	ldr	q0, [x2, #480]
+	ldr	q1, [x2, #496]
+	ldr	q2, [x3, #480]
+	ldr	q3, [x3, #496]
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.4s, v21.4s, v22.4s
+	trn1	v23.4s, v23.4s, v24.4s
+	trn2	v22.4s, v25.4s, v22.4s
+	trn2	v24.4s, v26.4s, v24.4s
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.8h
+	mul	v27.8h, v28.8h, v3.8h
+	sqrdmulh	v22.8h, v26.8h, v0.8h
+	sqrdmulh	v24.8h, v28.8h, v1.8h
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	ldr	q0, [x2, #528]
+	ldr	q2, [x3, #528]
+	mov	v25.16b, v9.16b
+	mov	v26.16b, v11.16b
+	trn1	v9.2d, v9.2d, v10.2d
+	trn1	v11.2d, v11.2d, v12.2d
+	trn2	v10.2d, v25.2d, v10.2d
+	trn2	v12.2d, v26.2d, v12.2d
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v2.h[0]
+	mul	v27.8h, v28.8h, v2.h[1]
+	sqrdmulh	v10.8h, v26.8h, v0.h[0]
+	sqrdmulh	v12.8h, v28.8h, v0.h[1]
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mov	v25.16b, v13.16b
+	mov	v26.16b, v15.16b
+	trn1	v13.2d, v13.2d, v14.2d
+	trn1	v15.2d, v15.2d, v16.2d
+	trn2	v14.2d, v25.2d, v14.2d
+	trn2	v16.2d, v26.2d, v16.2d
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v2.h[2]
+	mul	v27.8h, v28.8h, v2.h[3]
+	sqrdmulh	v14.8h, v26.8h, v0.h[2]
+	sqrdmulh	v16.8h, v28.8h, v0.h[3]
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mov	v25.16b, v17.16b
+	mov	v26.16b, v19.16b
+	trn1	v17.2d, v17.2d, v18.2d
+	trn1	v19.2d, v19.2d, v20.2d
+	trn2	v18.2d, v25.2d, v18.2d
+	trn2	v20.2d, v26.2d, v20.2d
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v2.h[4]
+	mul	v27.8h, v28.8h, v2.h[5]
+	sqrdmulh	v18.8h, v26.8h, v0.h[4]
+	sqrdmulh	v20.8h, v28.8h, v0.h[5]
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mov	v25.16b, v21.16b
+	mov	v26.16b, v23.16b
+	trn1	v21.2d, v21.2d, v22.2d
+	trn1	v23.2d, v23.2d, v24.2d
+	trn2	v22.2d, v25.2d, v22.2d
+	trn2	v24.2d, v26.2d, v24.2d
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v2.h[6]
+	mul	v27.8h, v28.8h, v2.h[7]
+	sqrdmulh	v22.8h, v26.8h, v0.h[6]
+	sqrdmulh	v24.8h, v28.8h, v0.h[7]
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v11.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v11.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v13.8h, v8.h[2]
+	sqdmulh	v26.8h, v15.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v13.8h, v25.8h, v8.h[0]
+	mls	v15.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v19.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v19.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v21.8h, v8.h[2]
+	sqdmulh	v26.8h, v23.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v21.8h, v25.8h, v8.h[0]
+	mls	v23.8h, v26.8h, v8.h[0]
+	stp	q9, q10, [x1]
+	stp	q11, q12, [x1, #32]
+	stp	q13, q14, [x1, #64]
+	stp	q15, q16, [x1, #96]
+	stp	q17, q18, [x1, #128]
+	stp	q19, q20, [x1, #160]
+	stp	q21, q22, [x1, #192]
+	stp	q23, q24, [x1, #224]
+	ldr	q4, [x2, #544]
+	ldr	q5, [x2, #560]
+	ldr	q6, [x3, #544]
+	ldr	q7, [x3, #560]
+	ldr	q9, [x0]
+	ldr	q10, [x0, #32]
+	ldr	q11, [x0, #64]
+	ldr	q12, [x0, #96]
+	ldr	q13, [x0, #128]
+	ldr	q14, [x0, #160]
+	ldr	q15, [x0, #192]
+	ldr	q16, [x0, #224]
+	ldr	q17, [x1]
+	ldr	q18, [x1, #32]
+	ldr	q19, [x1, #64]
+	ldr	q20, [x1, #96]
+	ldr	q21, [x1, #128]
+	ldr	q22, [x1, #160]
+	ldr	q23, [x1, #192]
+	ldr	q24, [x1, #224]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v6.h[0]
+	mul	v27.8h, v28.8h, v6.h[1]
+	sqrdmulh	v10.8h, v26.8h, v4.h[0]
+	sqrdmulh	v12.8h, v28.8h, v4.h[1]
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v6.h[2]
+	mul	v27.8h, v28.8h, v6.h[3]
+	sqrdmulh	v14.8h, v26.8h, v4.h[2]
+	sqrdmulh	v16.8h, v28.8h, v4.h[3]
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v6.h[4]
+	mul	v27.8h, v28.8h, v6.h[5]
+	sqrdmulh	v18.8h, v26.8h, v4.h[4]
+	sqrdmulh	v20.8h, v28.8h, v4.h[5]
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v6.h[6]
+	mul	v27.8h, v28.8h, v6.h[7]
+	sqrdmulh	v22.8h, v26.8h, v4.h[6]
+	sqrdmulh	v24.8h, v28.8h, v4.h[7]
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v11.8h
+	sub	v28.8h, v10.8h, v12.8h
+	add	v9.8h, v9.8h, v11.8h
+	add	v10.8h, v10.8h, v12.8h
+	mul	v25.8h, v26.8h, v7.h[0]
+	mul	v27.8h, v28.8h, v7.h[0]
+	sqrdmulh	v11.8h, v26.8h, v5.h[0]
+	sqrdmulh	v12.8h, v28.8h, v5.h[0]
+	sqrdmlsh	v11.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v15.8h
+	sub	v28.8h, v14.8h, v16.8h
+	add	v13.8h, v13.8h, v15.8h
+	add	v14.8h, v14.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[1]
+	mul	v27.8h, v28.8h, v7.h[1]
+	sqrdmulh	v15.8h, v26.8h, v5.h[1]
+	sqrdmulh	v16.8h, v28.8h, v5.h[1]
+	sqrdmlsh	v15.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v19.8h
+	sub	v28.8h, v18.8h, v20.8h
+	add	v17.8h, v17.8h, v19.8h
+	add	v18.8h, v18.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[2]
+	mul	v27.8h, v28.8h, v7.h[2]
+	sqrdmulh	v19.8h, v26.8h, v5.h[2]
+	sqrdmulh	v20.8h, v28.8h, v5.h[2]
+	sqrdmlsh	v19.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v23.8h
+	sub	v28.8h, v22.8h, v24.8h
+	add	v21.8h, v21.8h, v23.8h
+	add	v22.8h, v22.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[3]
+	mul	v27.8h, v28.8h, v7.h[3]
+	sqrdmulh	v23.8h, v26.8h, v5.h[3]
+	sqrdmulh	v24.8h, v28.8h, v5.h[3]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v13.8h
+	sub	v28.8h, v10.8h, v14.8h
+	add	v9.8h, v9.8h, v13.8h
+	add	v10.8h, v10.8h, v14.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v13.8h, v26.8h, v5.h[4]
+	sqrdmulh	v14.8h, v28.8h, v5.h[4]
+	sqrdmlsh	v13.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v14.8h, v27.8h, v8.h[0]
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	sub	v26.8h, v11.8h, v15.8h
+	sub	v28.8h, v12.8h, v16.8h
+	add	v11.8h, v11.8h, v15.8h
+	add	v12.8h, v12.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v15.8h, v26.8h, v5.h[4]
+	sqrdmulh	v16.8h, v28.8h, v5.h[4]
+	sqrdmlsh	v15.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v21.8h
+	sub	v28.8h, v18.8h, v22.8h
+	add	v17.8h, v17.8h, v21.8h
+	add	v18.8h, v18.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v21.8h, v26.8h, v5.h[5]
+	sqrdmulh	v22.8h, v28.8h, v5.h[5]
+	sqrdmlsh	v21.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v22.8h, v27.8h, v8.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v19.8h, v23.8h
+	sub	v28.8h, v20.8h, v24.8h
+	add	v19.8h, v19.8h, v23.8h
+	add	v20.8h, v20.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v23.8h, v26.8h, v5.h[5]
+	sqrdmulh	v24.8h, v28.8h, v5.h[5]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v10.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v10.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v11.8h, v8.h[2]
+	sqdmulh	v26.8h, v12.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v11.8h, v25.8h, v8.h[0]
+	mls	v12.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v18.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v18.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v19.8h, v8.h[2]
+	sqdmulh	v26.8h, v20.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v19.8h, v25.8h, v8.h[0]
+	mls	v20.8h, v26.8h, v8.h[0]
+	sub	v26.8h, v9.8h, v17.8h
+	sub	v28.8h, v10.8h, v18.8h
+	add	v9.8h, v9.8h, v17.8h
+	add	v10.8h, v10.8h, v18.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v17.8h, v26.8h, v5.h[6]
+	sqrdmulh	v18.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v17.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v18.8h, v27.8h, v8.h[0]
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	sub	v26.8h, v11.8h, v19.8h
+	sub	v28.8h, v12.8h, v20.8h
+	add	v11.8h, v11.8h, v19.8h
+	add	v12.8h, v12.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v19.8h, v26.8h, v5.h[6]
+	sqrdmulh	v20.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v19.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v13.8h, v21.8h
+	sub	v28.8h, v14.8h, v22.8h
+	add	v13.8h, v13.8h, v21.8h
+	add	v14.8h, v14.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v21.8h, v26.8h, v5.h[6]
+	sqrdmulh	v22.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v21.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v22.8h, v27.8h, v8.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v15.8h, v23.8h
+	sub	v28.8h, v16.8h, v24.8h
+	add	v15.8h, v15.8h, v23.8h
+	add	v16.8h, v16.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v23.8h, v26.8h, v5.h[6]
+	sqrdmulh	v24.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v25.8h, v9.8h, v7.h[7]
+	mul	v26.8h, v10.8h, v7.h[7]
+	sqrdmulh	v9.8h, v9.8h, v5.h[7]
+	sqrdmulh	v10.8h, v10.8h, v5.h[7]
+	sqrdmlsh	v9.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v10.8h, v26.8h, v8.h[0]
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v25.8h, v11.8h, v7.h[7]
+	mul	v26.8h, v12.8h, v7.h[7]
+	sqrdmulh	v11.8h, v11.8h, v5.h[7]
+	sqrdmulh	v12.8h, v12.8h, v5.h[7]
+	sqrdmlsh	v11.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v26.8h, v8.h[0]
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v25.8h, v13.8h, v7.h[7]
+	mul	v26.8h, v14.8h, v7.h[7]
+	sqrdmulh	v13.8h, v13.8h, v5.h[7]
+	sqrdmulh	v14.8h, v14.8h, v5.h[7]
+	sqrdmlsh	v13.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v14.8h, v26.8h, v8.h[0]
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v25.8h, v15.8h, v7.h[7]
+	mul	v26.8h, v16.8h, v7.h[7]
+	sqrdmulh	v15.8h, v15.8h, v5.h[7]
+	sqrdmulh	v16.8h, v16.8h, v5.h[7]
+	sqrdmlsh	v15.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v26.8h, v8.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mul	v25.8h, v17.8h, v7.h[7]
+	mul	v26.8h, v18.8h, v7.h[7]
+	sqrdmulh	v17.8h, v17.8h, v5.h[7]
+	sqrdmulh	v18.8h, v18.8h, v5.h[7]
+	sqrdmlsh	v17.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v18.8h, v26.8h, v8.h[0]
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	mul	v25.8h, v19.8h, v7.h[7]
+	mul	v26.8h, v20.8h, v7.h[7]
+	sqrdmulh	v19.8h, v19.8h, v5.h[7]
+	sqrdmulh	v20.8h, v20.8h, v5.h[7]
+	sqrdmlsh	v19.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v26.8h, v8.h[0]
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mul	v25.8h, v21.8h, v7.h[7]
+	mul	v26.8h, v22.8h, v7.h[7]
+	sqrdmulh	v21.8h, v21.8h, v5.h[7]
+	sqrdmulh	v22.8h, v22.8h, v5.h[7]
+	sqrdmlsh	v21.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v22.8h, v26.8h, v8.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v25.8h, v23.8h, v7.h[7]
+	mul	v26.8h, v24.8h, v7.h[7]
+	sqrdmulh	v23.8h, v23.8h, v5.h[7]
+	sqrdmulh	v24.8h, v24.8h, v5.h[7]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v26.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	str	q9, [x0]
+	str	q10, [x0, #32]
+	str	q11, [x0, #64]
+	str	q12, [x0, #96]
+	str	q13, [x0, #128]
+	str	q14, [x0, #160]
+	str	q15, [x0, #192]
+	str	q16, [x0, #224]
+	str	q17, [x1]
+	str	q18, [x1, #32]
+	str	q19, [x1, #64]
+	str	q20, [x1, #96]
+	str	q21, [x1, #128]
+	str	q22, [x1, #160]
+	str	q23, [x1, #192]
+	str	q24, [x1, #224]
+	ldr	q9, [x0, #16]
+	ldr	q10, [x0, #48]
+	ldr	q11, [x0, #80]
+	ldr	q12, [x0, #112]
+	ldr	q13, [x0, #144]
+	ldr	q14, [x0, #176]
+	ldr	q15, [x0, #208]
+	ldr	q16, [x0, #240]
+	ldr	q17, [x1, #16]
+	ldr	q18, [x1, #48]
+	ldr	q19, [x1, #80]
+	ldr	q20, [x1, #112]
+	ldr	q21, [x1, #144]
+	ldr	q22, [x1, #176]
+	ldr	q23, [x1, #208]
+	ldr	q24, [x1, #240]
+	sub	v26.8h, v9.8h, v10.8h
+	sub	v28.8h, v11.8h, v12.8h
+	add	v9.8h, v9.8h, v10.8h
+	add	v11.8h, v11.8h, v12.8h
+	mul	v25.8h, v26.8h, v6.h[0]
+	mul	v27.8h, v28.8h, v6.h[1]
+	sqrdmulh	v10.8h, v26.8h, v4.h[0]
+	sqrdmulh	v12.8h, v28.8h, v4.h[1]
+	sqrdmlsh	v10.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v10.8h, v10.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v14.8h
+	sub	v28.8h, v15.8h, v16.8h
+	add	v13.8h, v13.8h, v14.8h
+	add	v15.8h, v15.8h, v16.8h
+	mul	v25.8h, v26.8h, v6.h[2]
+	mul	v27.8h, v28.8h, v6.h[3]
+	sqrdmulh	v14.8h, v26.8h, v4.h[2]
+	sqrdmulh	v16.8h, v28.8h, v4.h[3]
+	sqrdmlsh	v14.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v14.8h, v14.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v18.8h
+	sub	v28.8h, v19.8h, v20.8h
+	add	v17.8h, v17.8h, v18.8h
+	add	v19.8h, v19.8h, v20.8h
+	mul	v25.8h, v26.8h, v6.h[4]
+	mul	v27.8h, v28.8h, v6.h[5]
+	sqrdmulh	v18.8h, v26.8h, v4.h[4]
+	sqrdmulh	v20.8h, v28.8h, v4.h[5]
+	sqrdmlsh	v18.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v18.8h, v18.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v22.8h
+	sub	v28.8h, v23.8h, v24.8h
+	add	v21.8h, v21.8h, v22.8h
+	add	v23.8h, v23.8h, v24.8h
+	mul	v25.8h, v26.8h, v6.h[6]
+	mul	v27.8h, v28.8h, v6.h[7]
+	sqrdmulh	v22.8h, v26.8h, v4.h[6]
+	sqrdmulh	v24.8h, v28.8h, v4.h[7]
+	sqrdmlsh	v22.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v22.8h, v22.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v11.8h
+	sub	v28.8h, v10.8h, v12.8h
+	add	v9.8h, v9.8h, v11.8h
+	add	v10.8h, v10.8h, v12.8h
+	mul	v25.8h, v26.8h, v7.h[0]
+	mul	v27.8h, v28.8h, v7.h[0]
+	sqrdmulh	v11.8h, v26.8h, v5.h[0]
+	sqrdmulh	v12.8h, v28.8h, v5.h[0]
+	sqrdmlsh	v11.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v27.8h, v8.h[0]
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	sub	v26.8h, v13.8h, v15.8h
+	sub	v28.8h, v14.8h, v16.8h
+	add	v13.8h, v13.8h, v15.8h
+	add	v14.8h, v14.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[1]
+	mul	v27.8h, v28.8h, v7.h[1]
+	sqrdmulh	v15.8h, v26.8h, v5.h[1]
+	sqrdmulh	v16.8h, v28.8h, v5.h[1]
+	sqrdmlsh	v15.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v19.8h
+	sub	v28.8h, v18.8h, v20.8h
+	add	v17.8h, v17.8h, v19.8h
+	add	v18.8h, v18.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[2]
+	mul	v27.8h, v28.8h, v7.h[2]
+	sqrdmulh	v19.8h, v26.8h, v5.h[2]
+	sqrdmulh	v20.8h, v28.8h, v5.h[2]
+	sqrdmlsh	v19.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v21.8h, v23.8h
+	sub	v28.8h, v22.8h, v24.8h
+	add	v21.8h, v21.8h, v23.8h
+	add	v22.8h, v22.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[3]
+	mul	v27.8h, v28.8h, v7.h[3]
+	sqrdmulh	v23.8h, v26.8h, v5.h[3]
+	sqrdmulh	v24.8h, v28.8h, v5.h[3]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sub	v26.8h, v9.8h, v13.8h
+	sub	v28.8h, v10.8h, v14.8h
+	add	v9.8h, v9.8h, v13.8h
+	add	v10.8h, v10.8h, v14.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v13.8h, v26.8h, v5.h[4]
+	sqrdmulh	v14.8h, v28.8h, v5.h[4]
+	sqrdmlsh	v13.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v14.8h, v27.8h, v8.h[0]
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	sub	v26.8h, v11.8h, v15.8h
+	sub	v28.8h, v12.8h, v16.8h
+	add	v11.8h, v11.8h, v15.8h
+	add	v12.8h, v12.8h, v16.8h
+	mul	v25.8h, v26.8h, v7.h[4]
+	mul	v27.8h, v28.8h, v7.h[4]
+	sqrdmulh	v15.8h, v26.8h, v5.h[4]
+	sqrdmulh	v16.8h, v28.8h, v5.h[4]
+	sqrdmlsh	v15.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v27.8h, v8.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	sub	v26.8h, v17.8h, v21.8h
+	sub	v28.8h, v18.8h, v22.8h
+	add	v17.8h, v17.8h, v21.8h
+	add	v18.8h, v18.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v21.8h, v26.8h, v5.h[5]
+	sqrdmulh	v22.8h, v28.8h, v5.h[5]
+	sqrdmlsh	v21.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v22.8h, v27.8h, v8.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v19.8h, v23.8h
+	sub	v28.8h, v20.8h, v24.8h
+	add	v19.8h, v19.8h, v23.8h
+	add	v20.8h, v20.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[5]
+	mul	v27.8h, v28.8h, v7.h[5]
+	sqrdmulh	v23.8h, v26.8h, v5.h[5]
+	sqrdmulh	v24.8h, v28.8h, v5.h[5]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	sqdmulh	v25.8h, v9.8h, v8.h[2]
+	sqdmulh	v26.8h, v10.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v9.8h, v25.8h, v8.h[0]
+	mls	v10.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v11.8h, v8.h[2]
+	sqdmulh	v26.8h, v12.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v11.8h, v25.8h, v8.h[0]
+	mls	v12.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v17.8h, v8.h[2]
+	sqdmulh	v26.8h, v18.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v17.8h, v25.8h, v8.h[0]
+	mls	v18.8h, v26.8h, v8.h[0]
+	sqdmulh	v25.8h, v19.8h, v8.h[2]
+	sqdmulh	v26.8h, v20.8h, v8.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v19.8h, v25.8h, v8.h[0]
+	mls	v20.8h, v26.8h, v8.h[0]
+	sub	v26.8h, v9.8h, v17.8h
+	sub	v28.8h, v10.8h, v18.8h
+	add	v9.8h, v9.8h, v17.8h
+	add	v10.8h, v10.8h, v18.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v17.8h, v26.8h, v5.h[6]
+	sqrdmulh	v18.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v17.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v18.8h, v27.8h, v8.h[0]
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	sub	v26.8h, v11.8h, v19.8h
+	sub	v28.8h, v12.8h, v20.8h
+	add	v11.8h, v11.8h, v19.8h
+	add	v12.8h, v12.8h, v20.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v19.8h, v26.8h, v5.h[6]
+	sqrdmulh	v20.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v19.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v27.8h, v8.h[0]
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	sub	v26.8h, v13.8h, v21.8h
+	sub	v28.8h, v14.8h, v22.8h
+	add	v13.8h, v13.8h, v21.8h
+	add	v14.8h, v14.8h, v22.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v21.8h, v26.8h, v5.h[6]
+	sqrdmulh	v22.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v21.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v22.8h, v27.8h, v8.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	sub	v26.8h, v15.8h, v23.8h
+	sub	v28.8h, v16.8h, v24.8h
+	add	v15.8h, v15.8h, v23.8h
+	add	v16.8h, v16.8h, v24.8h
+	mul	v25.8h, v26.8h, v7.h[6]
+	mul	v27.8h, v28.8h, v7.h[6]
+	sqrdmulh	v23.8h, v26.8h, v5.h[6]
+	sqrdmulh	v24.8h, v28.8h, v5.h[6]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v27.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	mul	v25.8h, v9.8h, v7.h[7]
+	mul	v26.8h, v10.8h, v7.h[7]
+	sqrdmulh	v9.8h, v9.8h, v5.h[7]
+	sqrdmulh	v10.8h, v10.8h, v5.h[7]
+	sqrdmlsh	v9.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v10.8h, v26.8h, v8.h[0]
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v25.8h, v11.8h, v7.h[7]
+	mul	v26.8h, v12.8h, v7.h[7]
+	sqrdmulh	v11.8h, v11.8h, v5.h[7]
+	sqrdmulh	v12.8h, v12.8h, v5.h[7]
+	sqrdmlsh	v11.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v12.8h, v26.8h, v8.h[0]
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v25.8h, v13.8h, v7.h[7]
+	mul	v26.8h, v14.8h, v7.h[7]
+	sqrdmulh	v13.8h, v13.8h, v5.h[7]
+	sqrdmulh	v14.8h, v14.8h, v5.h[7]
+	sqrdmlsh	v13.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v14.8h, v26.8h, v8.h[0]
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v25.8h, v15.8h, v7.h[7]
+	mul	v26.8h, v16.8h, v7.h[7]
+	sqrdmulh	v15.8h, v15.8h, v5.h[7]
+	sqrdmulh	v16.8h, v16.8h, v5.h[7]
+	sqrdmlsh	v15.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v16.8h, v26.8h, v8.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	mul	v25.8h, v17.8h, v7.h[7]
+	mul	v26.8h, v18.8h, v7.h[7]
+	sqrdmulh	v17.8h, v17.8h, v5.h[7]
+	sqrdmulh	v18.8h, v18.8h, v5.h[7]
+	sqrdmlsh	v17.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v18.8h, v26.8h, v8.h[0]
+	sshr	v17.8h, v17.8h, #1
+	sshr	v18.8h, v18.8h, #1
+	mul	v25.8h, v19.8h, v7.h[7]
+	mul	v26.8h, v20.8h, v7.h[7]
+	sqrdmulh	v19.8h, v19.8h, v5.h[7]
+	sqrdmulh	v20.8h, v20.8h, v5.h[7]
+	sqrdmlsh	v19.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v20.8h, v26.8h, v8.h[0]
+	sshr	v19.8h, v19.8h, #1
+	sshr	v20.8h, v20.8h, #1
+	mul	v25.8h, v21.8h, v7.h[7]
+	mul	v26.8h, v22.8h, v7.h[7]
+	sqrdmulh	v21.8h, v21.8h, v5.h[7]
+	sqrdmulh	v22.8h, v22.8h, v5.h[7]
+	sqrdmlsh	v21.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v22.8h, v26.8h, v8.h[0]
+	sshr	v21.8h, v21.8h, #1
+	sshr	v22.8h, v22.8h, #1
+	mul	v25.8h, v23.8h, v7.h[7]
+	mul	v26.8h, v24.8h, v7.h[7]
+	sqrdmulh	v23.8h, v23.8h, v5.h[7]
+	sqrdmulh	v24.8h, v24.8h, v5.h[7]
+	sqrdmlsh	v23.8h, v25.8h, v8.h[0]
+	sqrdmlsh	v24.8h, v26.8h, v8.h[0]
+	sshr	v23.8h, v23.8h, #1
+	sshr	v24.8h, v24.8h, #1
+	str	q9, [x0, #16]
+	str	q10, [x0, #48]
+	str	q11, [x0, #80]
+	str	q12, [x0, #112]
+	str	q13, [x0, #144]
+	str	q14, [x0, #176]
+	str	q15, [x0, #208]
+	str	q16, [x0, #240]
+	str	q17, [x1, #16]
+	str	q18, [x1, #48]
+	str	q19, [x1, #80]
+	str	q20, [x1, #112]
+	str	q21, [x1, #144]
+	str	q22, [x1, #176]
+	str	q23, [x1, #208]
+	str	q24, [x1, #240]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_aarch64_zetas_mul
+	DCW	0x08b2, 0xf74e, 0x01ae, 0xfe52, 0x022b, 0xfdd5, 0x034b, 0xfcb5
+	DCW	0x081e, 0xf7e2, 0x0367, 0xfc99, 0x060e, 0xf9f2, 0x0069, 0xff97
+	DCW	0x01a6, 0xfe5a, 0x024b, 0xfdb5, 0x00b1, 0xff4f, 0x0c16, 0xf3ea
+	DCW	0x0bde, 0xf422, 0x0b35, 0xf4cb, 0x0626, 0xf9da, 0x0675, 0xf98b
+	DCW	0x0c0b, 0xf3f5, 0x030a, 0xfcf6, 0x0487, 0xfb79, 0x0c6e, 0xf392
+	DCW	0x09f8, 0xf608, 0x05cb, 0xfa35, 0x0aa7, 0xf559, 0x045f, 0xfba1
+	DCW	0x06cb, 0xf935, 0x0284, 0xfd7c, 0x0999, 0xf667, 0x015d, 0xfea3
+	DCW	0x01a2, 0xfe5e, 0x0149, 0xfeb7, 0x0c65, 0xf39b, 0x0cb6, 0xf34a
+	DCW	0x0331, 0xfccf, 0x0449, 0xfbb7, 0x025b, 0xfda5, 0x0262, 0xfd9e
+	DCW	0x052a, 0xfad6, 0x07fc, 0xf804, 0x0748, 0xf8b8, 0x0180, 0xfe80
+	DCW	0x0842, 0xf7be, 0x0c79, 0xf387, 0x04c2, 0xfb3e, 0x07ca, 0xf836
+	DCW	0x0997, 0xf669, 0x00dc, 0xff24, 0x085e, 0xf7a2, 0x0686, 0xf97a
+	DCW	0x0860, 0xf7a0, 0x0707, 0xf8f9, 0x0803, 0xf7fd, 0x031a, 0xfce6
+	DCW	0x071b, 0xf8e5, 0x09ab, 0xf655, 0x099b, 0xf665, 0x01de, 0xfe22
+	DCW	0x0c95, 0xf36b, 0x0bcd, 0xf433, 0x03e4, 0xfc1c, 0x03df, 0xfc21
+	DCW	0x03be, 0xfc42, 0x074d, 0xf8b3, 0x05f2, 0xfa0e, 0x065c, 0xf9a4
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_basemul_mont
+mlkem_basemul_mont PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x3, L_mlkem_aarch64_zetas_mul
+	add	x3, x3, L_mlkem_aarch64_zetas_mul
+	adrp	x4, L_mlkem_aarch64_consts
+	add	x4, x4, L_mlkem_aarch64_consts
+	ldr	q1, [x4]
+	ldp	q2, q3, [x1]
+	ldp	q4, q5, [x1, #32]
+	ldp	q6, q7, [x1, #64]
+	ldp	q8, q9, [x1, #96]
+	ldp	q10, q11, [x2]
+	ldp	q12, q13, [x2, #32]
+	ldp	q14, q15, [x2, #64]
+	ldp	q16, q17, [x2, #96]
+	ldr	q0, [x3]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0]
+	ldr	q0, [x3, #16]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #32]
+	ldr	q0, [x3, #32]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #64]
+	ldr	q0, [x3, #48]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #96]
+	ldp	q2, q3, [x1, #128]
+	ldp	q4, q5, [x1, #160]
+	ldp	q6, q7, [x1, #192]
+	ldp	q8, q9, [x1, #224]
+	ldp	q10, q11, [x2, #128]
+	ldp	q12, q13, [x2, #160]
+	ldp	q14, q15, [x2, #192]
+	ldp	q16, q17, [x2, #224]
+	ldr	q0, [x3, #64]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #128]
+	ldr	q0, [x3, #80]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #160]
+	ldr	q0, [x3, #96]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #192]
+	ldr	q0, [x3, #112]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #224]
+	ldp	q2, q3, [x1, #256]
+	ldp	q4, q5, [x1, #288]
+	ldp	q6, q7, [x1, #320]
+	ldp	q8, q9, [x1, #352]
+	ldp	q10, q11, [x2, #256]
+	ldp	q12, q13, [x2, #288]
+	ldp	q14, q15, [x2, #320]
+	ldp	q16, q17, [x2, #352]
+	ldr	q0, [x3, #128]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #256]
+	ldr	q0, [x3, #144]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #288]
+	ldr	q0, [x3, #160]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #320]
+	ldr	q0, [x3, #176]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #352]
+	ldp	q2, q3, [x1, #384]
+	ldp	q4, q5, [x1, #416]
+	ldp	q6, q7, [x1, #448]
+	ldp	q8, q9, [x1, #480]
+	ldp	q10, q11, [x2, #384]
+	ldp	q12, q13, [x2, #416]
+	ldp	q14, q15, [x2, #448]
+	ldp	q16, q17, [x2, #480]
+	ldr	q0, [x3, #192]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #384]
+	ldr	q0, [x3, #208]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #416]
+	ldr	q0, [x3, #224]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #448]
+	ldr	q0, [x3, #240]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	stp	q24, q25, [x0, #480]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_basemul_mont_add
+mlkem_basemul_mont_add PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x3, L_mlkem_aarch64_zetas_mul
+	add	x3, x3, L_mlkem_aarch64_zetas_mul
+	adrp	x4, L_mlkem_aarch64_consts
+	add	x4, x4, L_mlkem_aarch64_consts
+	ldr	q1, [x4]
+	ldp	q2, q3, [x1]
+	ldp	q4, q5, [x1, #32]
+	ldp	q6, q7, [x1, #64]
+	ldp	q8, q9, [x1, #96]
+	ldp	q10, q11, [x2]
+	ldp	q12, q13, [x2, #32]
+	ldp	q14, q15, [x2, #64]
+	ldp	q16, q17, [x2, #96]
+	ldp	q28, q29, [x0]
+	ldr	q0, [x3]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0]
+	ldp	q28, q29, [x0, #32]
+	ldr	q0, [x3, #16]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #32]
+	ldp	q28, q29, [x0, #64]
+	ldr	q0, [x3, #32]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #64]
+	ldp	q28, q29, [x0, #96]
+	ldr	q0, [x3, #48]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #96]
+	ldp	q2, q3, [x1, #128]
+	ldp	q4, q5, [x1, #160]
+	ldp	q6, q7, [x1, #192]
+	ldp	q8, q9, [x1, #224]
+	ldp	q10, q11, [x2, #128]
+	ldp	q12, q13, [x2, #160]
+	ldp	q14, q15, [x2, #192]
+	ldp	q16, q17, [x2, #224]
+	ldp	q28, q29, [x0, #128]
+	ldr	q0, [x3, #64]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #128]
+	ldp	q28, q29, [x0, #160]
+	ldr	q0, [x3, #80]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #160]
+	ldp	q28, q29, [x0, #192]
+	ldr	q0, [x3, #96]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #192]
+	ldp	q28, q29, [x0, #224]
+	ldr	q0, [x3, #112]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #224]
+	ldp	q2, q3, [x1, #256]
+	ldp	q4, q5, [x1, #288]
+	ldp	q6, q7, [x1, #320]
+	ldp	q8, q9, [x1, #352]
+	ldp	q10, q11, [x2, #256]
+	ldp	q12, q13, [x2, #288]
+	ldp	q14, q15, [x2, #320]
+	ldp	q16, q17, [x2, #352]
+	ldp	q28, q29, [x0, #256]
+	ldr	q0, [x3, #128]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #256]
+	ldp	q28, q29, [x0, #288]
+	ldr	q0, [x3, #144]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #288]
+	ldp	q28, q29, [x0, #320]
+	ldr	q0, [x3, #160]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #320]
+	ldp	q28, q29, [x0, #352]
+	ldr	q0, [x3, #176]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #352]
+	ldp	q2, q3, [x1, #384]
+	ldp	q4, q5, [x1, #416]
+	ldp	q6, q7, [x1, #448]
+	ldp	q8, q9, [x1, #480]
+	ldp	q10, q11, [x2, #384]
+	ldp	q12, q13, [x2, #416]
+	ldp	q14, q15, [x2, #448]
+	ldp	q16, q17, [x2, #480]
+	ldp	q28, q29, [x0, #384]
+	ldr	q0, [x3, #192]
+	uzp1	v18.8h, v2.8h, v3.8h
+	uzp2	v19.8h, v2.8h, v3.8h
+	uzp1	v20.8h, v10.8h, v11.8h
+	uzp2	v21.8h, v10.8h, v11.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #384]
+	ldp	q28, q29, [x0, #416]
+	ldr	q0, [x3, #208]
+	uzp1	v18.8h, v4.8h, v5.8h
+	uzp2	v19.8h, v4.8h, v5.8h
+	uzp1	v20.8h, v12.8h, v13.8h
+	uzp2	v21.8h, v12.8h, v13.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #416]
+	ldp	q28, q29, [x0, #448]
+	ldr	q0, [x3, #224]
+	uzp1	v18.8h, v6.8h, v7.8h
+	uzp2	v19.8h, v6.8h, v7.8h
+	uzp1	v20.8h, v14.8h, v15.8h
+	uzp2	v21.8h, v14.8h, v15.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #448]
+	ldp	q28, q29, [x0, #480]
+	ldr	q0, [x3, #240]
+	uzp1	v18.8h, v8.8h, v9.8h
+	uzp2	v19.8h, v8.8h, v9.8h
+	uzp1	v20.8h, v16.8h, v17.8h
+	uzp2	v21.8h, v16.8h, v17.8h
+	smull	v26.4s, v18.4h, v20.4h
+	smull2	v27.4s, v18.8h, v20.8h
+	smull	v23.4s, v19.4h, v21.4h
+	smull2	v24.4s, v19.8h, v21.8h
+	xtn	v25.4h, v23.4s
+	xtn2	v25.8h, v24.4s
+	mul	v25.8h, v25.8h, v1.h[1]
+	smlsl	v23.4s, v25.4h, v1.h[0]
+	smlsl2	v24.4s, v25.8h, v1.h[0]
+	shrn	v22.4h, v23.4s, #16
+	shrn2	v22.8h, v24.4s, #16
+	smlal	v26.4s, v22.4h, v0.4h
+	smlal2	v27.4s, v22.8h, v0.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v22.4h, v26.4s, #16
+	shrn2	v22.8h, v27.4s, #16
+	smull	v26.4s, v18.4h, v21.4h
+	smull2	v27.4s, v18.8h, v21.8h
+	smlal	v26.4s, v19.4h, v20.4h
+	smlal2	v27.4s, v19.8h, v20.8h
+	xtn	v24.4h, v26.4s
+	xtn2	v24.8h, v27.4s
+	mul	v24.8h, v24.8h, v1.h[1]
+	smlsl	v26.4s, v24.4h, v1.h[0]
+	smlsl2	v27.4s, v24.8h, v1.h[0]
+	shrn	v23.4h, v26.4s, #16
+	shrn2	v23.8h, v27.4s, #16
+	zip1	v24.8h, v22.8h, v23.8h
+	zip2	v25.8h, v22.8h, v23.8h
+	add	v28.8h, v28.8h, v24.8h
+	add	v29.8h, v29.8h, v25.8h
+	stp	q28, q29, [x0, #480]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_aarch64_q
+	DCW	0x0d01, 0x0d01, 0x0d01, 0x0d01, 0x0d01, 0x0d01, 0x0d01, 0x0d01
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_csubq_neon
+mlkem_csubq_neon PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x1, L_mlkem_aarch64_q
+	add	x1, x1, L_mlkem_aarch64_q
+	ldr	q20, [x1]
+	ld4	{v0.8h, v1.8h, v2.8h, v3.8h}, [x0], #0x40
+	ld4	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	ld4	{v8.8h, v9.8h, v10.8h, v11.8h}, [x0], #0x40
+	ld4	{v12.8h, v13.8h, v14.8h, v15.8h}, [x0], #0x40
+	sub	x0, x0, #0x100
+	sub	v0.8h, v0.8h, v20.8h
+	sub	v1.8h, v1.8h, v20.8h
+	sub	v2.8h, v2.8h, v20.8h
+	sub	v3.8h, v3.8h, v20.8h
+	sub	v4.8h, v4.8h, v20.8h
+	sub	v5.8h, v5.8h, v20.8h
+	sub	v6.8h, v6.8h, v20.8h
+	sub	v7.8h, v7.8h, v20.8h
+	sub	v8.8h, v8.8h, v20.8h
+	sub	v9.8h, v9.8h, v20.8h
+	sub	v10.8h, v10.8h, v20.8h
+	sub	v11.8h, v11.8h, v20.8h
+	sub	v12.8h, v12.8h, v20.8h
+	sub	v13.8h, v13.8h, v20.8h
+	sub	v14.8h, v14.8h, v20.8h
+	sub	v15.8h, v15.8h, v20.8h
+	sshr	v16.8h, v0.8h, #15
+	sshr	v17.8h, v1.8h, #15
+	sshr	v18.8h, v2.8h, #15
+	sshr	v19.8h, v3.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v0.8h, v0.8h, v16.8h
+	add	v1.8h, v1.8h, v17.8h
+	add	v2.8h, v2.8h, v18.8h
+	add	v3.8h, v3.8h, v19.8h
+	sshr	v16.8h, v4.8h, #15
+	sshr	v17.8h, v5.8h, #15
+	sshr	v18.8h, v6.8h, #15
+	sshr	v19.8h, v7.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v4.8h, v4.8h, v16.8h
+	add	v5.8h, v5.8h, v17.8h
+	add	v6.8h, v6.8h, v18.8h
+	add	v7.8h, v7.8h, v19.8h
+	sshr	v16.8h, v8.8h, #15
+	sshr	v17.8h, v9.8h, #15
+	sshr	v18.8h, v10.8h, #15
+	sshr	v19.8h, v11.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v8.8h, v8.8h, v16.8h
+	add	v9.8h, v9.8h, v17.8h
+	add	v10.8h, v10.8h, v18.8h
+	add	v11.8h, v11.8h, v19.8h
+	sshr	v16.8h, v12.8h, #15
+	sshr	v17.8h, v13.8h, #15
+	sshr	v18.8h, v14.8h, #15
+	sshr	v19.8h, v15.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v12.8h, v12.8h, v16.8h
+	add	v13.8h, v13.8h, v17.8h
+	add	v14.8h, v14.8h, v18.8h
+	add	v15.8h, v15.8h, v19.8h
+	st4	{v0.8h, v1.8h, v2.8h, v3.8h}, [x0], #0x40
+	st4	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	st4	{v8.8h, v9.8h, v10.8h, v11.8h}, [x0], #0x40
+	st4	{v12.8h, v13.8h, v14.8h, v15.8h}, [x0], #0x40
+	ld4	{v0.8h, v1.8h, v2.8h, v3.8h}, [x0], #0x40
+	ld4	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	ld4	{v8.8h, v9.8h, v10.8h, v11.8h}, [x0], #0x40
+	ld4	{v12.8h, v13.8h, v14.8h, v15.8h}, [x0], #0x40
+	sub	x0, x0, #0x100
+	sub	v0.8h, v0.8h, v20.8h
+	sub	v1.8h, v1.8h, v20.8h
+	sub	v2.8h, v2.8h, v20.8h
+	sub	v3.8h, v3.8h, v20.8h
+	sub	v4.8h, v4.8h, v20.8h
+	sub	v5.8h, v5.8h, v20.8h
+	sub	v6.8h, v6.8h, v20.8h
+	sub	v7.8h, v7.8h, v20.8h
+	sub	v8.8h, v8.8h, v20.8h
+	sub	v9.8h, v9.8h, v20.8h
+	sub	v10.8h, v10.8h, v20.8h
+	sub	v11.8h, v11.8h, v20.8h
+	sub	v12.8h, v12.8h, v20.8h
+	sub	v13.8h, v13.8h, v20.8h
+	sub	v14.8h, v14.8h, v20.8h
+	sub	v15.8h, v15.8h, v20.8h
+	sshr	v16.8h, v0.8h, #15
+	sshr	v17.8h, v1.8h, #15
+	sshr	v18.8h, v2.8h, #15
+	sshr	v19.8h, v3.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v0.8h, v0.8h, v16.8h
+	add	v1.8h, v1.8h, v17.8h
+	add	v2.8h, v2.8h, v18.8h
+	add	v3.8h, v3.8h, v19.8h
+	sshr	v16.8h, v4.8h, #15
+	sshr	v17.8h, v5.8h, #15
+	sshr	v18.8h, v6.8h, #15
+	sshr	v19.8h, v7.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v4.8h, v4.8h, v16.8h
+	add	v5.8h, v5.8h, v17.8h
+	add	v6.8h, v6.8h, v18.8h
+	add	v7.8h, v7.8h, v19.8h
+	sshr	v16.8h, v8.8h, #15
+	sshr	v17.8h, v9.8h, #15
+	sshr	v18.8h, v10.8h, #15
+	sshr	v19.8h, v11.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v8.8h, v8.8h, v16.8h
+	add	v9.8h, v9.8h, v17.8h
+	add	v10.8h, v10.8h, v18.8h
+	add	v11.8h, v11.8h, v19.8h
+	sshr	v16.8h, v12.8h, #15
+	sshr	v17.8h, v13.8h, #15
+	sshr	v18.8h, v14.8h, #15
+	sshr	v19.8h, v15.8h, #15
+	and	v16.16b, v16.16b, v20.16b
+	and	v17.16b, v17.16b, v20.16b
+	and	v18.16b, v18.16b, v20.16b
+	and	v19.16b, v19.16b, v20.16b
+	add	v12.8h, v12.8h, v16.8h
+	add	v13.8h, v13.8h, v17.8h
+	add	v14.8h, v14.8h, v18.8h
+	add	v15.8h, v15.8h, v19.8h
+	st4	{v0.8h, v1.8h, v2.8h, v3.8h}, [x0], #0x40
+	st4	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	st4	{v8.8h, v9.8h, v10.8h, v11.8h}, [x0], #0x40
+	st4	{v12.8h, v13.8h, v14.8h, v15.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_add_reduce
+mlkem_add_reduce PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x2, L_mlkem_aarch64_consts
+	add	x2, x2, L_mlkem_aarch64_consts
+	ldr	q0, [x2]
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_add3_reduce
+mlkem_add3_reduce PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x3, L_mlkem_aarch64_consts
+	add	x3, x3, L_mlkem_aarch64_consts
+	ldr	q0, [x3]
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	ld4	{v17.8h, v18.8h, v19.8h, v20.8h}, [x2], #0x40
+	ld4	{v21.8h, v22.8h, v23.8h, v24.8h}, [x2], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	add	v1.8h, v1.8h, v17.8h
+	add	v2.8h, v2.8h, v18.8h
+	add	v3.8h, v3.8h, v19.8h
+	add	v4.8h, v4.8h, v20.8h
+	add	v5.8h, v5.8h, v21.8h
+	add	v6.8h, v6.8h, v22.8h
+	add	v7.8h, v7.8h, v23.8h
+	add	v8.8h, v8.8h, v24.8h
+	sqdmulh	v25.8h, v1.8h, v0.h[2]
+	sqdmulh	v26.8h, v2.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v1.8h, v25.8h, v0.h[0]
+	mls	v2.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v3.8h, v0.h[2]
+	sqdmulh	v26.8h, v4.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v3.8h, v25.8h, v0.h[0]
+	mls	v4.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v5.8h, v0.h[2]
+	sqdmulh	v26.8h, v6.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v5.8h, v25.8h, v0.h[0]
+	mls	v6.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v7.8h, v0.h[2]
+	sqdmulh	v26.8h, v8.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v7.8h, v25.8h, v0.h[0]
+	mls	v8.8h, v26.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	ld4	{v17.8h, v18.8h, v19.8h, v20.8h}, [x2], #0x40
+	ld4	{v21.8h, v22.8h, v23.8h, v24.8h}, [x2], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	add	v1.8h, v1.8h, v17.8h
+	add	v2.8h, v2.8h, v18.8h
+	add	v3.8h, v3.8h, v19.8h
+	add	v4.8h, v4.8h, v20.8h
+	add	v5.8h, v5.8h, v21.8h
+	add	v6.8h, v6.8h, v22.8h
+	add	v7.8h, v7.8h, v23.8h
+	add	v8.8h, v8.8h, v24.8h
+	sqdmulh	v25.8h, v1.8h, v0.h[2]
+	sqdmulh	v26.8h, v2.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v1.8h, v25.8h, v0.h[0]
+	mls	v2.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v3.8h, v0.h[2]
+	sqdmulh	v26.8h, v4.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v3.8h, v25.8h, v0.h[0]
+	mls	v4.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v5.8h, v0.h[2]
+	sqdmulh	v26.8h, v6.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v5.8h, v25.8h, v0.h[0]
+	mls	v6.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v7.8h, v0.h[2]
+	sqdmulh	v26.8h, v8.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v7.8h, v25.8h, v0.h[0]
+	mls	v8.8h, v26.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	ld4	{v17.8h, v18.8h, v19.8h, v20.8h}, [x2], #0x40
+	ld4	{v21.8h, v22.8h, v23.8h, v24.8h}, [x2], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	add	v1.8h, v1.8h, v17.8h
+	add	v2.8h, v2.8h, v18.8h
+	add	v3.8h, v3.8h, v19.8h
+	add	v4.8h, v4.8h, v20.8h
+	add	v5.8h, v5.8h, v21.8h
+	add	v6.8h, v6.8h, v22.8h
+	add	v7.8h, v7.8h, v23.8h
+	add	v8.8h, v8.8h, v24.8h
+	sqdmulh	v25.8h, v1.8h, v0.h[2]
+	sqdmulh	v26.8h, v2.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v1.8h, v25.8h, v0.h[0]
+	mls	v2.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v3.8h, v0.h[2]
+	sqdmulh	v26.8h, v4.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v3.8h, v25.8h, v0.h[0]
+	mls	v4.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v5.8h, v0.h[2]
+	sqdmulh	v26.8h, v6.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v5.8h, v25.8h, v0.h[0]
+	mls	v6.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v7.8h, v0.h[2]
+	sqdmulh	v26.8h, v8.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v7.8h, v25.8h, v0.h[0]
+	mls	v8.8h, v26.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	ld4	{v17.8h, v18.8h, v19.8h, v20.8h}, [x2], #0x40
+	ld4	{v21.8h, v22.8h, v23.8h, v24.8h}, [x2], #0x40
+	sub	x0, x0, #0x80
+	add	v1.8h, v1.8h, v9.8h
+	add	v2.8h, v2.8h, v10.8h
+	add	v3.8h, v3.8h, v11.8h
+	add	v4.8h, v4.8h, v12.8h
+	add	v5.8h, v5.8h, v13.8h
+	add	v6.8h, v6.8h, v14.8h
+	add	v7.8h, v7.8h, v15.8h
+	add	v8.8h, v8.8h, v16.8h
+	add	v1.8h, v1.8h, v17.8h
+	add	v2.8h, v2.8h, v18.8h
+	add	v3.8h, v3.8h, v19.8h
+	add	v4.8h, v4.8h, v20.8h
+	add	v5.8h, v5.8h, v21.8h
+	add	v6.8h, v6.8h, v22.8h
+	add	v7.8h, v7.8h, v23.8h
+	add	v8.8h, v8.8h, v24.8h
+	sqdmulh	v25.8h, v1.8h, v0.h[2]
+	sqdmulh	v26.8h, v2.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v1.8h, v25.8h, v0.h[0]
+	mls	v2.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v3.8h, v0.h[2]
+	sqdmulh	v26.8h, v4.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v3.8h, v25.8h, v0.h[0]
+	mls	v4.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v5.8h, v0.h[2]
+	sqdmulh	v26.8h, v6.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v5.8h, v25.8h, v0.h[0]
+	mls	v6.8h, v26.8h, v0.h[0]
+	sqdmulh	v25.8h, v7.8h, v0.h[2]
+	sqdmulh	v26.8h, v8.8h, v0.h[2]
+	sshr	v25.8h, v25.8h, #11
+	sshr	v26.8h, v26.8h, #11
+	mls	v7.8h, v25.8h, v0.h[0]
+	mls	v8.8h, v26.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_rsub_reduce
+mlkem_rsub_reduce PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x2, L_mlkem_aarch64_consts
+	add	x2, x2, L_mlkem_aarch64_consts
+	ldr	q0, [x2]
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	sub	v1.8h, v9.8h, v1.8h
+	sub	v2.8h, v10.8h, v2.8h
+	sub	v3.8h, v11.8h, v3.8h
+	sub	v4.8h, v12.8h, v4.8h
+	sub	v5.8h, v13.8h, v5.8h
+	sub	v6.8h, v14.8h, v6.8h
+	sub	v7.8h, v15.8h, v7.8h
+	sub	v8.8h, v16.8h, v8.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	sub	v1.8h, v9.8h, v1.8h
+	sub	v2.8h, v10.8h, v2.8h
+	sub	v3.8h, v11.8h, v3.8h
+	sub	v4.8h, v12.8h, v4.8h
+	sub	v5.8h, v13.8h, v5.8h
+	sub	v6.8h, v14.8h, v6.8h
+	sub	v7.8h, v15.8h, v7.8h
+	sub	v8.8h, v16.8h, v8.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	sub	v1.8h, v9.8h, v1.8h
+	sub	v2.8h, v10.8h, v2.8h
+	sub	v3.8h, v11.8h, v3.8h
+	sub	v4.8h, v12.8h, v4.8h
+	sub	v5.8h, v13.8h, v5.8h
+	sub	v6.8h, v14.8h, v6.8h
+	sub	v7.8h, v15.8h, v7.8h
+	sub	v8.8h, v16.8h, v8.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x1], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x1], #0x40
+	sub	x0, x0, #0x80
+	sub	v1.8h, v9.8h, v1.8h
+	sub	v2.8h, v10.8h, v2.8h
+	sub	v3.8h, v11.8h, v3.8h
+	sub	v4.8h, v12.8h, v4.8h
+	sub	v5.8h, v13.8h, v5.8h
+	sub	v6.8h, v14.8h, v6.8h
+	sub	v7.8h, v15.8h, v7.8h
+	sub	v8.8h, v16.8h, v8.8h
+	sqdmulh	v17.8h, v1.8h, v0.h[2]
+	sqdmulh	v18.8h, v2.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v1.8h, v17.8h, v0.h[0]
+	mls	v2.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v3.8h, v0.h[2]
+	sqdmulh	v18.8h, v4.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v3.8h, v17.8h, v0.h[0]
+	mls	v4.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v5.8h, v0.h[2]
+	sqdmulh	v18.8h, v6.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v5.8h, v17.8h, v0.h[0]
+	mls	v6.8h, v18.8h, v0.h[0]
+	sqdmulh	v17.8h, v7.8h, v0.h[2]
+	sqdmulh	v18.8h, v8.8h, v0.h[2]
+	sshr	v17.8h, v17.8h, #11
+	sshr	v18.8h, v18.8h, #11
+	mls	v7.8h, v17.8h, v0.h[0]
+	mls	v8.8h, v18.8h, v0.h[0]
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_to_mont
+mlkem_to_mont PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x1, L_mlkem_aarch64_consts
+	add	x1, x1, L_mlkem_aarch64_consts
+	ldr	q0, [x1]
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	sub	x0, x0, #0x100
+	mul	v17.8h, v1.8h, v0.h[4]
+	mul	v18.8h, v2.8h, v0.h[4]
+	sqrdmulh	v1.8h, v1.8h, v0.h[3]
+	sqrdmulh	v2.8h, v2.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v1.8h, v1.8h, v17.8h
+	sub	v2.8h, v2.8h, v18.8h
+	sshr	v1.8h, v1.8h, #1
+	sshr	v2.8h, v2.8h, #1
+	mul	v17.8h, v3.8h, v0.h[4]
+	mul	v18.8h, v4.8h, v0.h[4]
+	sqrdmulh	v3.8h, v3.8h, v0.h[3]
+	sqrdmulh	v4.8h, v4.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v3.8h, v3.8h, v17.8h
+	sub	v4.8h, v4.8h, v18.8h
+	sshr	v3.8h, v3.8h, #1
+	sshr	v4.8h, v4.8h, #1
+	mul	v17.8h, v5.8h, v0.h[4]
+	mul	v18.8h, v6.8h, v0.h[4]
+	sqrdmulh	v5.8h, v5.8h, v0.h[3]
+	sqrdmulh	v6.8h, v6.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v5.8h, v5.8h, v17.8h
+	sub	v6.8h, v6.8h, v18.8h
+	sshr	v5.8h, v5.8h, #1
+	sshr	v6.8h, v6.8h, #1
+	mul	v17.8h, v7.8h, v0.h[4]
+	mul	v18.8h, v8.8h, v0.h[4]
+	sqrdmulh	v7.8h, v7.8h, v0.h[3]
+	sqrdmulh	v8.8h, v8.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v7.8h, v7.8h, v17.8h
+	sub	v8.8h, v8.8h, v18.8h
+	sshr	v7.8h, v7.8h, #1
+	sshr	v8.8h, v8.8h, #1
+	mul	v17.8h, v9.8h, v0.h[4]
+	mul	v18.8h, v10.8h, v0.h[4]
+	sqrdmulh	v9.8h, v9.8h, v0.h[3]
+	sqrdmulh	v10.8h, v10.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v9.8h, v9.8h, v17.8h
+	sub	v10.8h, v10.8h, v18.8h
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v17.8h, v11.8h, v0.h[4]
+	mul	v18.8h, v12.8h, v0.h[4]
+	sqrdmulh	v11.8h, v11.8h, v0.h[3]
+	sqrdmulh	v12.8h, v12.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v11.8h, v11.8h, v17.8h
+	sub	v12.8h, v12.8h, v18.8h
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v17.8h, v13.8h, v0.h[4]
+	mul	v18.8h, v14.8h, v0.h[4]
+	sqrdmulh	v13.8h, v13.8h, v0.h[3]
+	sqrdmulh	v14.8h, v14.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v13.8h, v13.8h, v17.8h
+	sub	v14.8h, v14.8h, v18.8h
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v17.8h, v15.8h, v0.h[4]
+	mul	v18.8h, v16.8h, v0.h[4]
+	sqrdmulh	v15.8h, v15.8h, v0.h[3]
+	sqrdmulh	v16.8h, v16.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v15.8h, v15.8h, v17.8h
+	sub	v16.8h, v16.8h, v18.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	st4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	st4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	sub	x0, x0, #0x100
+	mul	v17.8h, v1.8h, v0.h[4]
+	mul	v18.8h, v2.8h, v0.h[4]
+	sqrdmulh	v1.8h, v1.8h, v0.h[3]
+	sqrdmulh	v2.8h, v2.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v1.8h, v1.8h, v17.8h
+	sub	v2.8h, v2.8h, v18.8h
+	sshr	v1.8h, v1.8h, #1
+	sshr	v2.8h, v2.8h, #1
+	mul	v17.8h, v3.8h, v0.h[4]
+	mul	v18.8h, v4.8h, v0.h[4]
+	sqrdmulh	v3.8h, v3.8h, v0.h[3]
+	sqrdmulh	v4.8h, v4.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v3.8h, v3.8h, v17.8h
+	sub	v4.8h, v4.8h, v18.8h
+	sshr	v3.8h, v3.8h, #1
+	sshr	v4.8h, v4.8h, #1
+	mul	v17.8h, v5.8h, v0.h[4]
+	mul	v18.8h, v6.8h, v0.h[4]
+	sqrdmulh	v5.8h, v5.8h, v0.h[3]
+	sqrdmulh	v6.8h, v6.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v5.8h, v5.8h, v17.8h
+	sub	v6.8h, v6.8h, v18.8h
+	sshr	v5.8h, v5.8h, #1
+	sshr	v6.8h, v6.8h, #1
+	mul	v17.8h, v7.8h, v0.h[4]
+	mul	v18.8h, v8.8h, v0.h[4]
+	sqrdmulh	v7.8h, v7.8h, v0.h[3]
+	sqrdmulh	v8.8h, v8.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v7.8h, v7.8h, v17.8h
+	sub	v8.8h, v8.8h, v18.8h
+	sshr	v7.8h, v7.8h, #1
+	sshr	v8.8h, v8.8h, #1
+	mul	v17.8h, v9.8h, v0.h[4]
+	mul	v18.8h, v10.8h, v0.h[4]
+	sqrdmulh	v9.8h, v9.8h, v0.h[3]
+	sqrdmulh	v10.8h, v10.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v9.8h, v9.8h, v17.8h
+	sub	v10.8h, v10.8h, v18.8h
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v17.8h, v11.8h, v0.h[4]
+	mul	v18.8h, v12.8h, v0.h[4]
+	sqrdmulh	v11.8h, v11.8h, v0.h[3]
+	sqrdmulh	v12.8h, v12.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v11.8h, v11.8h, v17.8h
+	sub	v12.8h, v12.8h, v18.8h
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v17.8h, v13.8h, v0.h[4]
+	mul	v18.8h, v14.8h, v0.h[4]
+	sqrdmulh	v13.8h, v13.8h, v0.h[3]
+	sqrdmulh	v14.8h, v14.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v13.8h, v13.8h, v17.8h
+	sub	v14.8h, v14.8h, v18.8h
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v17.8h, v15.8h, v0.h[4]
+	mul	v18.8h, v16.8h, v0.h[4]
+	sqrdmulh	v15.8h, v15.8h, v0.h[3]
+	sqrdmulh	v16.8h, v16.8h, v0.h[3]
+	sqrdmulh	v17.8h, v17.8h, v0.h[0]
+	sqrdmulh	v18.8h, v18.8h, v0.h[0]
+	sub	v15.8h, v15.8h, v17.8h
+	sub	v16.8h, v16.8h, v18.8h
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	st4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	st4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	IF :LNOT::DEF:WOLFSSL_AARCH64_NO_SQRDMLSH
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_to_mont_sqrdmlsh
+mlkem_to_mont_sqrdmlsh PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x1, L_mlkem_aarch64_consts
+	add	x1, x1, L_mlkem_aarch64_consts
+	ldr	q0, [x1]
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	sub	x0, x0, #0x100
+	mul	v17.8h, v1.8h, v0.h[4]
+	mul	v18.8h, v2.8h, v0.h[4]
+	sqrdmulh	v1.8h, v1.8h, v0.h[3]
+	sqrdmulh	v2.8h, v2.8h, v0.h[3]
+	sqrdmlsh	v1.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v2.8h, v18.8h, v0.h[0]
+	sshr	v1.8h, v1.8h, #1
+	sshr	v2.8h, v2.8h, #1
+	mul	v17.8h, v3.8h, v0.h[4]
+	mul	v18.8h, v4.8h, v0.h[4]
+	sqrdmulh	v3.8h, v3.8h, v0.h[3]
+	sqrdmulh	v4.8h, v4.8h, v0.h[3]
+	sqrdmlsh	v3.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v4.8h, v18.8h, v0.h[0]
+	sshr	v3.8h, v3.8h, #1
+	sshr	v4.8h, v4.8h, #1
+	mul	v17.8h, v5.8h, v0.h[4]
+	mul	v18.8h, v6.8h, v0.h[4]
+	sqrdmulh	v5.8h, v5.8h, v0.h[3]
+	sqrdmulh	v6.8h, v6.8h, v0.h[3]
+	sqrdmlsh	v5.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v6.8h, v18.8h, v0.h[0]
+	sshr	v5.8h, v5.8h, #1
+	sshr	v6.8h, v6.8h, #1
+	mul	v17.8h, v7.8h, v0.h[4]
+	mul	v18.8h, v8.8h, v0.h[4]
+	sqrdmulh	v7.8h, v7.8h, v0.h[3]
+	sqrdmulh	v8.8h, v8.8h, v0.h[3]
+	sqrdmlsh	v7.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v8.8h, v18.8h, v0.h[0]
+	sshr	v7.8h, v7.8h, #1
+	sshr	v8.8h, v8.8h, #1
+	mul	v17.8h, v9.8h, v0.h[4]
+	mul	v18.8h, v10.8h, v0.h[4]
+	sqrdmulh	v9.8h, v9.8h, v0.h[3]
+	sqrdmulh	v10.8h, v10.8h, v0.h[3]
+	sqrdmlsh	v9.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v10.8h, v18.8h, v0.h[0]
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v17.8h, v11.8h, v0.h[4]
+	mul	v18.8h, v12.8h, v0.h[4]
+	sqrdmulh	v11.8h, v11.8h, v0.h[3]
+	sqrdmulh	v12.8h, v12.8h, v0.h[3]
+	sqrdmlsh	v11.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v12.8h, v18.8h, v0.h[0]
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v17.8h, v13.8h, v0.h[4]
+	mul	v18.8h, v14.8h, v0.h[4]
+	sqrdmulh	v13.8h, v13.8h, v0.h[3]
+	sqrdmulh	v14.8h, v14.8h, v0.h[3]
+	sqrdmlsh	v13.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v14.8h, v18.8h, v0.h[0]
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v17.8h, v15.8h, v0.h[4]
+	mul	v18.8h, v16.8h, v0.h[4]
+	sqrdmulh	v15.8h, v15.8h, v0.h[3]
+	sqrdmulh	v16.8h, v16.8h, v0.h[3]
+	sqrdmlsh	v15.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v16.8h, v18.8h, v0.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	st4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	st4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	ld4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	ld4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	ld4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	ld4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	sub	x0, x0, #0x100
+	mul	v17.8h, v1.8h, v0.h[4]
+	mul	v18.8h, v2.8h, v0.h[4]
+	sqrdmulh	v1.8h, v1.8h, v0.h[3]
+	sqrdmulh	v2.8h, v2.8h, v0.h[3]
+	sqrdmlsh	v1.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v2.8h, v18.8h, v0.h[0]
+	sshr	v1.8h, v1.8h, #1
+	sshr	v2.8h, v2.8h, #1
+	mul	v17.8h, v3.8h, v0.h[4]
+	mul	v18.8h, v4.8h, v0.h[4]
+	sqrdmulh	v3.8h, v3.8h, v0.h[3]
+	sqrdmulh	v4.8h, v4.8h, v0.h[3]
+	sqrdmlsh	v3.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v4.8h, v18.8h, v0.h[0]
+	sshr	v3.8h, v3.8h, #1
+	sshr	v4.8h, v4.8h, #1
+	mul	v17.8h, v5.8h, v0.h[4]
+	mul	v18.8h, v6.8h, v0.h[4]
+	sqrdmulh	v5.8h, v5.8h, v0.h[3]
+	sqrdmulh	v6.8h, v6.8h, v0.h[3]
+	sqrdmlsh	v5.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v6.8h, v18.8h, v0.h[0]
+	sshr	v5.8h, v5.8h, #1
+	sshr	v6.8h, v6.8h, #1
+	mul	v17.8h, v7.8h, v0.h[4]
+	mul	v18.8h, v8.8h, v0.h[4]
+	sqrdmulh	v7.8h, v7.8h, v0.h[3]
+	sqrdmulh	v8.8h, v8.8h, v0.h[3]
+	sqrdmlsh	v7.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v8.8h, v18.8h, v0.h[0]
+	sshr	v7.8h, v7.8h, #1
+	sshr	v8.8h, v8.8h, #1
+	mul	v17.8h, v9.8h, v0.h[4]
+	mul	v18.8h, v10.8h, v0.h[4]
+	sqrdmulh	v9.8h, v9.8h, v0.h[3]
+	sqrdmulh	v10.8h, v10.8h, v0.h[3]
+	sqrdmlsh	v9.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v10.8h, v18.8h, v0.h[0]
+	sshr	v9.8h, v9.8h, #1
+	sshr	v10.8h, v10.8h, #1
+	mul	v17.8h, v11.8h, v0.h[4]
+	mul	v18.8h, v12.8h, v0.h[4]
+	sqrdmulh	v11.8h, v11.8h, v0.h[3]
+	sqrdmulh	v12.8h, v12.8h, v0.h[3]
+	sqrdmlsh	v11.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v12.8h, v18.8h, v0.h[0]
+	sshr	v11.8h, v11.8h, #1
+	sshr	v12.8h, v12.8h, #1
+	mul	v17.8h, v13.8h, v0.h[4]
+	mul	v18.8h, v14.8h, v0.h[4]
+	sqrdmulh	v13.8h, v13.8h, v0.h[3]
+	sqrdmulh	v14.8h, v14.8h, v0.h[3]
+	sqrdmlsh	v13.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v14.8h, v18.8h, v0.h[0]
+	sshr	v13.8h, v13.8h, #1
+	sshr	v14.8h, v14.8h, #1
+	mul	v17.8h, v15.8h, v0.h[4]
+	mul	v18.8h, v16.8h, v0.h[4]
+	sqrdmulh	v15.8h, v15.8h, v0.h[3]
+	sqrdmulh	v16.8h, v16.8h, v0.h[3]
+	sqrdmlsh	v15.8h, v17.8h, v0.h[0]
+	sqrdmlsh	v16.8h, v18.8h, v0.h[0]
+	sshr	v15.8h, v15.8h, #1
+	sshr	v16.8h, v16.8h, #1
+	st4	{v1.8h, v2.8h, v3.8h, v4.8h}, [x0], #0x40
+	st4	{v5.8h, v6.8h, v7.8h, v8.8h}, [x0], #0x40
+	st4	{v9.8h, v10.8h, v11.8h, v12.8h}, [x0], #0x40
+	st4	{v13.8h, v14.8h, v15.8h, v16.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_to_msg_low
+	DCW	0x0373, 0x0373, 0x0373, 0x0373, 0x0373, 0x0373, 0x0373, 0x0373
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_to_msg_high
+	DCW	0x09c0, 0x09c0, 0x09c0, 0x09c0, 0x09c0, 0x09c0, 0x09c0, 0x09c0
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_to_msg_bits
+	DCW	0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_to_msg_neon
+mlkem_to_msg_neon PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x2, L_mlkem_to_msg_low
+	add	x2, x2, L_mlkem_to_msg_low
+	adrp	x3, L_mlkem_to_msg_high
+	add	x3, x3, L_mlkem_to_msg_high
+	adrp	x4, L_mlkem_to_msg_bits
+	add	x4, x4, L_mlkem_to_msg_bits
+	ldr	q0, [x2]
+	ldr	q1, [x3]
+	ldr	q26, [x4]
+	ld1	{v2.8h, v3.8h, v4.8h, v5.8h}, [x1], #0x40
+	ld1	{v6.8h, v7.8h, v8.8h, v9.8h}, [x1], #0x40
+	cmge	v10.8h, v2.8h, v0.8h
+	cmge	v18.8h, v1.8h, v2.8h
+	cmge	v11.8h, v3.8h, v0.8h
+	cmge	v19.8h, v1.8h, v3.8h
+	cmge	v12.8h, v4.8h, v0.8h
+	cmge	v20.8h, v1.8h, v4.8h
+	cmge	v13.8h, v5.8h, v0.8h
+	cmge	v21.8h, v1.8h, v5.8h
+	cmge	v14.8h, v6.8h, v0.8h
+	cmge	v22.8h, v1.8h, v6.8h
+	cmge	v15.8h, v7.8h, v0.8h
+	cmge	v23.8h, v1.8h, v7.8h
+	cmge	v16.8h, v8.8h, v0.8h
+	cmge	v24.8h, v1.8h, v8.8h
+	cmge	v17.8h, v9.8h, v0.8h
+	cmge	v25.8h, v1.8h, v9.8h
+	and	v18.16b, v18.16b, v10.16b
+	and	v19.16b, v19.16b, v11.16b
+	and	v20.16b, v20.16b, v12.16b
+	and	v21.16b, v21.16b, v13.16b
+	and	v22.16b, v22.16b, v14.16b
+	and	v23.16b, v23.16b, v15.16b
+	and	v24.16b, v24.16b, v16.16b
+	and	v25.16b, v25.16b, v17.16b
+	and	v18.16b, v18.16b, v26.16b
+	and	v19.16b, v19.16b, v26.16b
+	and	v20.16b, v20.16b, v26.16b
+	and	v21.16b, v21.16b, v26.16b
+	and	v22.16b, v22.16b, v26.16b
+	and	v23.16b, v23.16b, v26.16b
+	and	v24.16b, v24.16b, v26.16b
+	and	v25.16b, v25.16b, v26.16b
+	addv	h18, v18.8h
+	addv	h19, v19.8h
+	addv	h20, v20.8h
+	addv	h21, v21.8h
+	addv	h22, v22.8h
+	addv	h23, v23.8h
+	addv	h24, v24.8h
+	addv	h25, v25.8h
+	ins	v18.b[1], v19.b[0]
+	ins	v18.b[2], v20.b[0]
+	ins	v18.b[3], v21.b[0]
+	ins	v18.b[4], v22.b[0]
+	ins	v18.b[5], v23.b[0]
+	ins	v18.b[6], v24.b[0]
+	ins	v18.b[7], v25.b[0]
+	st1	{v18.8b}, [x0], #8
+	ld1	{v2.8h, v3.8h, v4.8h, v5.8h}, [x1], #0x40
+	ld1	{v6.8h, v7.8h, v8.8h, v9.8h}, [x1], #0x40
+	cmge	v10.8h, v2.8h, v0.8h
+	cmge	v18.8h, v1.8h, v2.8h
+	cmge	v11.8h, v3.8h, v0.8h
+	cmge	v19.8h, v1.8h, v3.8h
+	cmge	v12.8h, v4.8h, v0.8h
+	cmge	v20.8h, v1.8h, v4.8h
+	cmge	v13.8h, v5.8h, v0.8h
+	cmge	v21.8h, v1.8h, v5.8h
+	cmge	v14.8h, v6.8h, v0.8h
+	cmge	v22.8h, v1.8h, v6.8h
+	cmge	v15.8h, v7.8h, v0.8h
+	cmge	v23.8h, v1.8h, v7.8h
+	cmge	v16.8h, v8.8h, v0.8h
+	cmge	v24.8h, v1.8h, v8.8h
+	cmge	v17.8h, v9.8h, v0.8h
+	cmge	v25.8h, v1.8h, v9.8h
+	and	v18.16b, v18.16b, v10.16b
+	and	v19.16b, v19.16b, v11.16b
+	and	v20.16b, v20.16b, v12.16b
+	and	v21.16b, v21.16b, v13.16b
+	and	v22.16b, v22.16b, v14.16b
+	and	v23.16b, v23.16b, v15.16b
+	and	v24.16b, v24.16b, v16.16b
+	and	v25.16b, v25.16b, v17.16b
+	and	v18.16b, v18.16b, v26.16b
+	and	v19.16b, v19.16b, v26.16b
+	and	v20.16b, v20.16b, v26.16b
+	and	v21.16b, v21.16b, v26.16b
+	and	v22.16b, v22.16b, v26.16b
+	and	v23.16b, v23.16b, v26.16b
+	and	v24.16b, v24.16b, v26.16b
+	and	v25.16b, v25.16b, v26.16b
+	addv	h18, v18.8h
+	addv	h19, v19.8h
+	addv	h20, v20.8h
+	addv	h21, v21.8h
+	addv	h22, v22.8h
+	addv	h23, v23.8h
+	addv	h24, v24.8h
+	addv	h25, v25.8h
+	ins	v18.b[1], v19.b[0]
+	ins	v18.b[2], v20.b[0]
+	ins	v18.b[3], v21.b[0]
+	ins	v18.b[4], v22.b[0]
+	ins	v18.b[5], v23.b[0]
+	ins	v18.b[6], v24.b[0]
+	ins	v18.b[7], v25.b[0]
+	st1	{v18.8b}, [x0], #8
+	ld1	{v2.8h, v3.8h, v4.8h, v5.8h}, [x1], #0x40
+	ld1	{v6.8h, v7.8h, v8.8h, v9.8h}, [x1], #0x40
+	cmge	v10.8h, v2.8h, v0.8h
+	cmge	v18.8h, v1.8h, v2.8h
+	cmge	v11.8h, v3.8h, v0.8h
+	cmge	v19.8h, v1.8h, v3.8h
+	cmge	v12.8h, v4.8h, v0.8h
+	cmge	v20.8h, v1.8h, v4.8h
+	cmge	v13.8h, v5.8h, v0.8h
+	cmge	v21.8h, v1.8h, v5.8h
+	cmge	v14.8h, v6.8h, v0.8h
+	cmge	v22.8h, v1.8h, v6.8h
+	cmge	v15.8h, v7.8h, v0.8h
+	cmge	v23.8h, v1.8h, v7.8h
+	cmge	v16.8h, v8.8h, v0.8h
+	cmge	v24.8h, v1.8h, v8.8h
+	cmge	v17.8h, v9.8h, v0.8h
+	cmge	v25.8h, v1.8h, v9.8h
+	and	v18.16b, v18.16b, v10.16b
+	and	v19.16b, v19.16b, v11.16b
+	and	v20.16b, v20.16b, v12.16b
+	and	v21.16b, v21.16b, v13.16b
+	and	v22.16b, v22.16b, v14.16b
+	and	v23.16b, v23.16b, v15.16b
+	and	v24.16b, v24.16b, v16.16b
+	and	v25.16b, v25.16b, v17.16b
+	and	v18.16b, v18.16b, v26.16b
+	and	v19.16b, v19.16b, v26.16b
+	and	v20.16b, v20.16b, v26.16b
+	and	v21.16b, v21.16b, v26.16b
+	and	v22.16b, v22.16b, v26.16b
+	and	v23.16b, v23.16b, v26.16b
+	and	v24.16b, v24.16b, v26.16b
+	and	v25.16b, v25.16b, v26.16b
+	addv	h18, v18.8h
+	addv	h19, v19.8h
+	addv	h20, v20.8h
+	addv	h21, v21.8h
+	addv	h22, v22.8h
+	addv	h23, v23.8h
+	addv	h24, v24.8h
+	addv	h25, v25.8h
+	ins	v18.b[1], v19.b[0]
+	ins	v18.b[2], v20.b[0]
+	ins	v18.b[3], v21.b[0]
+	ins	v18.b[4], v22.b[0]
+	ins	v18.b[5], v23.b[0]
+	ins	v18.b[6], v24.b[0]
+	ins	v18.b[7], v25.b[0]
+	st1	{v18.8b}, [x0], #8
+	ld1	{v2.8h, v3.8h, v4.8h, v5.8h}, [x1], #0x40
+	ld1	{v6.8h, v7.8h, v8.8h, v9.8h}, [x1], #0x40
+	cmge	v10.8h, v2.8h, v0.8h
+	cmge	v18.8h, v1.8h, v2.8h
+	cmge	v11.8h, v3.8h, v0.8h
+	cmge	v19.8h, v1.8h, v3.8h
+	cmge	v12.8h, v4.8h, v0.8h
+	cmge	v20.8h, v1.8h, v4.8h
+	cmge	v13.8h, v5.8h, v0.8h
+	cmge	v21.8h, v1.8h, v5.8h
+	cmge	v14.8h, v6.8h, v0.8h
+	cmge	v22.8h, v1.8h, v6.8h
+	cmge	v15.8h, v7.8h, v0.8h
+	cmge	v23.8h, v1.8h, v7.8h
+	cmge	v16.8h, v8.8h, v0.8h
+	cmge	v24.8h, v1.8h, v8.8h
+	cmge	v17.8h, v9.8h, v0.8h
+	cmge	v25.8h, v1.8h, v9.8h
+	and	v18.16b, v18.16b, v10.16b
+	and	v19.16b, v19.16b, v11.16b
+	and	v20.16b, v20.16b, v12.16b
+	and	v21.16b, v21.16b, v13.16b
+	and	v22.16b, v22.16b, v14.16b
+	and	v23.16b, v23.16b, v15.16b
+	and	v24.16b, v24.16b, v16.16b
+	and	v25.16b, v25.16b, v17.16b
+	and	v18.16b, v18.16b, v26.16b
+	and	v19.16b, v19.16b, v26.16b
+	and	v20.16b, v20.16b, v26.16b
+	and	v21.16b, v21.16b, v26.16b
+	and	v22.16b, v22.16b, v26.16b
+	and	v23.16b, v23.16b, v26.16b
+	and	v24.16b, v24.16b, v26.16b
+	and	v25.16b, v25.16b, v26.16b
+	addv	h18, v18.8h
+	addv	h19, v19.8h
+	addv	h20, v20.8h
+	addv	h21, v21.8h
+	addv	h22, v22.8h
+	addv	h23, v23.8h
+	addv	h24, v24.8h
+	addv	h25, v25.8h
+	ins	v18.b[1], v19.b[0]
+	ins	v18.b[2], v20.b[0]
+	ins	v18.b[3], v21.b[0]
+	ins	v18.b[4], v22.b[0]
+	ins	v18.b[5], v23.b[0]
+	ins	v18.b[6], v24.b[0]
+	ins	v18.b[7], v25.b[0]
+	st1	{v18.8b}, [x0], #8
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_from_msg_q1half
+	DCW	0x0681, 0x0681, 0x0681, 0x0681, 0x0681, 0x0681, 0x0681, 0x0681
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_from_msg_bits
+	DCB	0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80
+	DCB	0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_from_msg_neon
+mlkem_from_msg_neon PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	adrp	x2, L_mlkem_from_msg_q1half
+	add	x2, x2, L_mlkem_from_msg_q1half
+	adrp	x3, L_mlkem_from_msg_bits
+	add	x3, x3, L_mlkem_from_msg_bits
+	ld1	{v2.16b, v3.16b}, [x1]
+	ldr	q1, [x2]
+	ldr	q0, [x3]
+	dup	v4.8b, v2.b[0]
+	dup	v5.8b, v2.b[1]
+	dup	v6.8b, v2.b[2]
+	dup	v7.8b, v2.b[3]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	dup	v4.8b, v2.b[4]
+	dup	v5.8b, v2.b[5]
+	dup	v6.8b, v2.b[6]
+	dup	v7.8b, v2.b[7]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	dup	v4.8b, v2.b[8]
+	dup	v5.8b, v2.b[9]
+	dup	v6.8b, v2.b[10]
+	dup	v7.8b, v2.b[11]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	dup	v4.8b, v2.b[12]
+	dup	v5.8b, v2.b[13]
+	dup	v6.8b, v2.b[14]
+	dup	v7.8b, v2.b[15]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	dup	v4.8b, v3.b[0]
+	dup	v5.8b, v3.b[1]
+	dup	v6.8b, v3.b[2]
+	dup	v7.8b, v3.b[3]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	dup	v4.8b, v3.b[4]
+	dup	v5.8b, v3.b[5]
+	dup	v6.8b, v3.b[6]
+	dup	v7.8b, v3.b[7]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	dup	v4.8b, v3.b[8]
+	dup	v5.8b, v3.b[9]
+	dup	v6.8b, v3.b[10]
+	dup	v7.8b, v3.b[11]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	dup	v4.8b, v3.b[12]
+	dup	v5.8b, v3.b[13]
+	dup	v6.8b, v3.b[14]
+	dup	v7.8b, v3.b[15]
+	cmtst	v4.8b, v4.8b, v0.8b
+	cmtst	v5.8b, v5.8b, v0.8b
+	cmtst	v6.8b, v6.8b, v0.8b
+	cmtst	v7.8b, v7.8b, v0.8b
+	zip1	v4.16b, v4.16b, v4.16b
+	zip1	v5.16b, v5.16b, v5.16b
+	zip1	v6.16b, v6.16b, v6.16b
+	zip1	v7.16b, v7.16b, v7.16b
+	and	v4.16b, v4.16b, v1.16b
+	and	v5.16b, v5.16b, v1.16b
+	and	v6.16b, v6.16b, v1.16b
+	and	v7.16b, v7.16b, v1.16b
+	st1	{v4.8h, v5.8h, v6.8h, v7.8h}, [x0], #0x40
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_cmp_neon
+mlkem_cmp_neon PROC
+	stp	x29, x30, [sp, #-48]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v8.16b, v0.16b, v4.16b
+	eor	v9.16b, v1.16b, v5.16b
+	eor	v10.16b, v2.16b, v6.16b
+	eor	v11.16b, v3.16b, v7.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	subs	w2, w2, #0x300
+	beq	L_mlkem_aarch64_cmp_neon_done
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	subs	w2, w2, #0x140
+	beq	L_mlkem_aarch64_cmp_neon_done
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld4	{v0.16b, v1.16b, v2.16b, v3.16b}, [x0], #0x40
+	ld4	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	eor	v2.16b, v2.16b, v6.16b
+	eor	v3.16b, v3.16b, v7.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+	orr	v10.16b, v10.16b, v2.16b
+	orr	v11.16b, v11.16b, v3.16b
+	ld2	{v0.16b, v1.16b}, [x0]
+	ld2	{v4.16b, v5.16b}, [x1]
+	eor	v0.16b, v0.16b, v4.16b
+	eor	v1.16b, v1.16b, v5.16b
+	orr	v8.16b, v8.16b, v0.16b
+	orr	v9.16b, v9.16b, v1.16b
+L_mlkem_aarch64_cmp_neon_done
+	orr	v8.16b, v8.16b, v9.16b
+	orr	v10.16b, v10.16b, v11.16b
+	orr	v8.16b, v8.16b, v10.16b
+	ext	v9.16b, v8.16b, v8.16b, #8
+	orr	v8.16b, v8.16b, v9.16b
+	mov	x0, v8.d[0]
+	subs	x0, x0, xzr
+	csetm	w0, ne
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	x29, x30, [sp], #48
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_rej_uniform_mask
+	DCW	0x0fff, 0x0fff, 0x0fff, 0x0fff, 0x0fff, 0x0fff, 0x0fff, 0x0fff
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_rej_uniform_bits
+	DCW	0x0001, 0x0002, 0x0004, 0x0008, 0x0010, 0x0020, 0x0040, 0x0080
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_mlkem_rej_uniform_indices
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x08, 0x09, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0xff, 0xff, 0xff, 0xff
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x08, 0x09, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0xff, 0xff
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x08, 0x09, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x08, 0x09, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+	DCB	0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d
+	DCB	0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x02, 0x03, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b
+	DCB	0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff, 0xff, 0xff
+	DCB	0x00, 0x01, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09
+	DCB	0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0xff, 0xff
+	DCB	0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07
+	DCB	0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_rej_uniform_neon
+mlkem_rej_uniform_neon PROC
+	stp	x29, x30, [sp, #-64]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	adrp	x4, L_mlkem_rej_uniform_mask
+	add	x4, x4, L_mlkem_rej_uniform_mask
+	adrp	x5, L_mlkem_aarch64_q
+	add	x5, x5, L_mlkem_aarch64_q
+	adrp	x6, L_mlkem_rej_uniform_bits
+	add	x6, x6, L_mlkem_rej_uniform_bits
+	adrp	x7, L_mlkem_rej_uniform_indices
+	add	x7, x7, L_mlkem_rej_uniform_indices
+	eor	v1.16b, v1.16b, v1.16b
+	eor	v12.16b, v12.16b, v12.16b
+	eor	v13.16b, v13.16b, v13.16b
+	eor	x12, x12, x12
+	eor	v10.16b, v10.16b, v10.16b
+	eor	v11.16b, v11.16b, v11.16b
+	mov	x13, #0xd01
+	ldr	q0, [x4]
+	ldr	q3, [x5]
+	ldr	q2, [x6]
+	subs	wzr, w1, #0
+	beq	L_mlkem_rej_uniform_done
+	subs	wzr, w1, #16
+	blt	L_mlkem_rej_uniform_loop_4
+L_mlkem_rej_uniform_loop_16
+	ld3	{v4.8b, v5.8b, v6.8b}, [x2], #24
+	zip1	v4.16b, v4.16b, v1.16b
+	zip1	v5.16b, v5.16b, v1.16b
+	zip1	v6.16b, v6.16b, v1.16b
+	shl	v7.8h, v5.8h, #8
+	ushr	v8.8h, v5.8h, #4
+	shl	v6.8h, v6.8h, #4
+	orr	v4.16b, v4.16b, v7.16b
+	orr	v5.16b, v8.16b, v6.16b
+	and	v7.16b, v4.16b, v0.16b
+	and	v8.16b, v5.16b, v0.16b
+	zip1	v4.8h, v7.8h, v8.8h
+	zip2	v5.8h, v7.8h, v8.8h
+	cmgt	v7.8h, v3.8h, v4.8h
+	cmgt	v8.8h, v3.8h, v5.8h
+	ushr	v12.8h, v7.8h, #15
+	ushr	v13.8h, v8.8h, #15
+	addv	h12, v12.8h
+	addv	h13, v13.8h
+	mov	x10, v12.d[0]
+	mov	x11, v13.d[0]
+	and	v10.16b, v7.16b, v2.16b
+	and	v11.16b, v8.16b, v2.16b
+	addv	h10, v10.8h
+	addv	h11, v11.8h
+	mov	w8, v10.s[0]
+	mov	w9, v11.s[0]
+	lsl	w8, w8, #4
+	lsl	w9, w9, #4
+	ldr	q10, [x7, x8]
+	ldr	q11, [x7, x9]
+	tbl	v7.16b, {v4.16b}, v10.16b
+	tbl	v8.16b, {v5.16b}, v11.16b
+	str	q7, [x0]
+	add	x0, x0, x10, lsl 1
+	add	x12, x12, x10
+	str	q8, [x0]
+	add	x0, x0, x11, lsl 1
+	add	x12, x12, x11
+	subs	w3, w3, #24
+	beq	L_mlkem_rej_uniform_done
+	sub	w10, w1, w12
+	subs	x10, x10, #16
+	blt	L_mlkem_rej_uniform_loop_4
+	b	L_mlkem_rej_uniform_loop_16
+L_mlkem_rej_uniform_loop_4
+	subs	w10, w1, w12
+	beq	L_mlkem_rej_uniform_done
+	subs	x10, x10, #4
+	blt	L_mlkem_rej_uniform_loop_lt_4
+	ldr	x4, [x2], #6
+	lsr	x5, x4, #12
+	lsr	x6, x4, #24
+	lsr	x7, x4, #36
+	and	x4, x4, #0xfff
+	and	x5, x5, #0xfff
+	and	x6, x6, #0xfff
+	and	x7, x7, #0xfff
+	strh	w4, [x0]
+	subs	xzr, x4, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	strh	w5, [x0]
+	subs	xzr, x5, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	strh	w6, [x0]
+	subs	xzr, x6, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	strh	w7, [x0]
+	subs	xzr, x7, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	subs	w3, w3, #6
+	beq	L_mlkem_rej_uniform_done
+	b	L_mlkem_rej_uniform_loop_4
+L_mlkem_rej_uniform_loop_lt_4
+	ldr	x4, [x2], #6
+	lsr	x5, x4, #12
+	lsr	x6, x4, #24
+	lsr	x7, x4, #36
+	and	x4, x4, #0xfff
+	and	x5, x5, #0xfff
+	and	x6, x6, #0xfff
+	and	x7, x7, #0xfff
+	strh	w4, [x0]
+	subs	xzr, x4, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	subs	wzr, w1, w12
+	beq	L_mlkem_rej_uniform_done
+	strh	w5, [x0]
+	subs	xzr, x5, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	subs	wzr, w1, w12
+	beq	L_mlkem_rej_uniform_done
+	strh	w6, [x0]
+	subs	xzr, x6, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	subs	wzr, w1, w12
+	beq	L_mlkem_rej_uniform_done
+	strh	w7, [x0]
+	subs	xzr, x7, x13
+	cinc	x0, x0, lt
+	cinc	x0, x0, lt
+	cinc	x12, x12, lt
+	subs	wzr, w1, w12
+	beq	L_mlkem_rej_uniform_done
+	subs	w3, w3, #6
+	beq	L_mlkem_rej_uniform_done
+	b	L_mlkem_rej_uniform_loop_lt_4
+L_mlkem_rej_uniform_done
+	mov	x0, x12
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	x29, x30, [sp], #0x40
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	16
+L_sha3_aarch64_r
+	DCQ	0x0000000000000001, 0x0000000000008082
+	DCQ	0x800000000000808a, 0x8000000080008000
+	DCQ	0x000000000000808b, 0x0000000080000001
+	DCQ	0x8000000080008081, 0x8000000000008009
+	DCQ	0x000000000000008a, 0x0000000000000088
+	DCQ	0x0000000080008009, 0x000000008000000a
+	DCQ	0x000000008000808b, 0x800000000000008b
+	DCQ	0x8000000000008089, 0x8000000000008003
+	DCQ	0x8000000000008002, 0x8000000000000080
+	DCQ	0x000000000000800a, 0x800000008000000a
+	DCQ	0x8000000080008081, 0x8000000000008080
+	DCQ	0x0000000080000001, 0x8000000080008008
+	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_sha3_blocksx3_neon
+mlkem_sha3_blocksx3_neon PROC
+	stp	x29, x30, [sp, #-224]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #72]
+	stp	x20, x21, [x29, #88]
+	stp	x22, x23, [x29, #104]
+	stp	x24, x25, [x29, #120]
+	stp	x26, x27, [x29, #136]
+	str	x28, [x29, #152]
+	stp	d8, d9, [x29, #160]
+	stp	d10, d11, [x29, #176]
+	stp	d12, d13, [x29, #192]
+	stp	d14, d15, [x29, #208]
+	adrp	x27, L_sha3_aarch64_r
+	add	x27, x27, L_sha3_aarch64_r
+	str	x0, [x29, #40]
+	ld4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	ld1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	ld4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	ld1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	ldp	x1, x2, [x0]
+	ldp	x3, x4, [x0, #16]
+	ldp	x5, x6, [x0, #32]
+	ldp	x7, x8, [x0, #48]
+	ldp	x9, x10, [x0, #64]
+	ldp	x11, x12, [x0, #80]
+	ldp	x13, x14, [x0, #96]
+	ldp	x15, x16, [x0, #112]
+	ldp	x17, x19, [x0, #128]
+	ldp	x20, x21, [x0, #144]
+	ldp	x22, x23, [x0, #160]
+	ldp	x24, x25, [x0, #176]
+	ldr	x26, [x0, #192]
+	mov	x28, #24
+	; Start of 24 rounds
+L_SHA3_transform_blocksx3_neon_begin
+	stp	x27, x28, [x29, #48]
+	; Col Mix
+	eor3	v31.16b, v0.16b, v5.16b, v10.16b
+	eor	x0, x5, x10
+	eor3	v27.16b, v1.16b, v6.16b, v11.16b
+	eor	x30, x1, x6
+	eor3	v28.16b, v2.16b, v7.16b, v12.16b
+	eor	x28, x3, x8
+	eor3	v29.16b, v3.16b, v8.16b, v13.16b
+	eor	x0, x0, x15
+	eor3	v30.16b, v4.16b, v9.16b, v14.16b
+	eor	x30, x30, x11
+	eor3	v31.16b, v31.16b, v15.16b, v20.16b
+	eor	x28, x28, x13
+	eor3	v27.16b, v27.16b, v16.16b, v21.16b
+	eor	x0, x0, x21
+	eor3	v28.16b, v28.16b, v17.16b, v22.16b
+	eor	x30, x30, x16
+	eor3	v29.16b, v29.16b, v18.16b, v23.16b
+	eor	x28, x28, x19
+	eor3	v30.16b, v30.16b, v19.16b, v24.16b
+	eor	x0, x0, x26
+	rax1	v25.2d, v30.2d, v27.2d
+	eor	x30, x30, x22
+	rax1	v26.2d, v31.2d, v28.2d
+	eor	x28, x28, x24
+	rax1	v27.2d, v27.2d, v29.2d
+	str	x0, [x29, #32]
+	rax1	v28.2d, v28.2d, v30.2d
+	str	x28, [x29, #24]
+	rax1	v29.2d, v29.2d, v31.2d
+	eor	x27, x2, x7
+	eor	v0.16b, v0.16b, v25.16b
+	xar	v30.2d, v1.2d, v26.2d, #63
+	eor	x28, x4, x9
+	xar	v1.2d, v6.2d, v26.2d, #20
+	eor	x27, x27, x12
+	xar	v6.2d, v9.2d, v29.2d, #44
+	eor	x28, x28, x14
+	xar	v9.2d, v22.2d, v27.2d, #3
+	eor	x27, x27, x17
+	xar	v22.2d, v14.2d, v29.2d, #25
+	eor	x28, x28, x20
+	xar	v14.2d, v20.2d, v25.2d, #46
+	eor	x27, x27, x23
+	xar	v20.2d, v2.2d, v27.2d, #2
+	eor	x28, x28, x25
+	xar	v2.2d, v12.2d, v27.2d, #21
+	eor	x0, x0, x27, ror 63
+	xar	v12.2d, v13.2d, v28.2d, #39
+	eor	x27, x27, x28, ror 63
+	xar	v13.2d, v19.2d, v29.2d, #56
+	eor	x1, x1, x0
+	xar	v19.2d, v23.2d, v28.2d, #8
+	eor	x6, x6, x0
+	xar	v23.2d, v15.2d, v25.2d, #23
+	eor	x11, x11, x0
+	xar	v15.2d, v4.2d, v29.2d, #37
+	eor	x16, x16, x0
+	xar	v4.2d, v24.2d, v29.2d, #50
+	eor	x22, x22, x0
+	xar	v24.2d, v21.2d, v26.2d, #62
+	eor	x3, x3, x27
+	xar	v21.2d, v8.2d, v28.2d, #9
+	eor	x8, x8, x27
+	xar	v8.2d, v16.2d, v26.2d, #19
+	eor	x13, x13, x27
+	xar	v16.2d, v5.2d, v25.2d, #28
+	eor	x19, x19, x27
+	xar	v5.2d, v3.2d, v28.2d, #36
+	eor	x24, x24, x27
+	xar	v3.2d, v18.2d, v28.2d, #43
+	ldr	x0, [x29, #32]
+	xar	v18.2d, v17.2d, v27.2d, #49
+	ldr	x27, [x29, #24]
+	xar	v17.2d, v11.2d, v26.2d, #54
+	eor	x28, x28, x30, ror 63
+	xar	v11.2d, v7.2d, v27.2d, #58
+	eor	x30, x30, x27, ror 63
+	xar	v7.2d, v10.2d, v25.2d, #61
+	eor	x27, x27, x0, ror 63
+	; Row Mix
+	mov	v25.16b, v0.16b
+	eor	x5, x5, x28
+	mov	v26.16b, v1.16b
+	eor	x10, x10, x28
+	bcax	v0.16b, v25.16b, v2.16b, v26.16b
+	eor	x15, x15, x28
+	bcax	v1.16b, v26.16b, v3.16b, v2.16b
+	eor	x21, x21, x28
+	bcax	v2.16b, v2.16b, v4.16b, v3.16b
+	eor	x26, x26, x28
+	bcax	v3.16b, v3.16b, v25.16b, v4.16b
+	eor	x2, x2, x30
+	bcax	v4.16b, v4.16b, v26.16b, v25.16b
+	eor	x7, x7, x30
+	mov	v25.16b, v5.16b
+	eor	x12, x12, x30
+	mov	v26.16b, v6.16b
+	eor	x17, x17, x30
+	bcax	v5.16b, v25.16b, v7.16b, v26.16b
+	eor	x23, x23, x30
+	bcax	v6.16b, v26.16b, v8.16b, v7.16b
+	eor	x4, x4, x27
+	bcax	v7.16b, v7.16b, v9.16b, v8.16b
+	eor	x9, x9, x27
+	bcax	v8.16b, v8.16b, v25.16b, v9.16b
+	eor	x14, x14, x27
+	bcax	v9.16b, v9.16b, v26.16b, v25.16b
+	eor	x20, x20, x27
+	mov	v26.16b, v11.16b
+	eor	x25, x25, x27
+	; Swap Rotate Base
+	bcax	v10.16b, v30.16b, v12.16b, v26.16b
+	ror	x0, x2, #63
+	bcax	v11.16b, v26.16b, v13.16b, v12.16b
+	ror	x2, x7, #20
+	bcax	v12.16b, v12.16b, v14.16b, v13.16b
+	ror	x7, x10, #44
+	bcax	v13.16b, v13.16b, v30.16b, v14.16b
+	ror	x10, x24, #3
+	bcax	v14.16b, v14.16b, v26.16b, v30.16b
+	ror	x24, x15, #25
+	mov	v25.16b, v15.16b
+	ror	x15, x22, #46
+	mov	v26.16b, v16.16b
+	ror	x22, x3, #2
+	bcax	v15.16b, v25.16b, v17.16b, v26.16b
+	ror	x3, x13, #21
+	bcax	v16.16b, v26.16b, v18.16b, v17.16b
+	ror	x13, x14, #39
+	bcax	v17.16b, v17.16b, v19.16b, v18.16b
+	ror	x14, x21, #56
+	bcax	v18.16b, v18.16b, v25.16b, v19.16b
+	ror	x21, x25, #8
+	bcax	v19.16b, v19.16b, v26.16b, v25.16b
+	ror	x25, x16, #23
+	mov	v25.16b, v20.16b
+	ror	x16, x5, #37
+	mov	v26.16b, v21.16b
+	ror	x5, x26, #50
+	bcax	v20.16b, v25.16b, v22.16b, v26.16b
+	ror	x26, x23, #62
+	bcax	v21.16b, v26.16b, v23.16b, v22.16b
+	ror	x23, x9, #9
+	bcax	v22.16b, v22.16b, v24.16b, v23.16b
+	ror	x9, x17, #19
+	bcax	v23.16b, v23.16b, v25.16b, v24.16b
+	ror	x17, x6, #28
+	bcax	v24.16b, v24.16b, v26.16b, v25.16b
+	ror	x6, x4, #36
+	ror	x4, x20, #43
+	ror	x20, x19, #49
+	ror	x19, x12, #54
+	ror	x12, x8, #58
+	ror	x8, x11, #61
+	; Row Mix Base
+	bic	x11, x3, x2
+	bic	x27, x4, x3
+	bic	x28, x1, x5
+	bic	x30, x2, x1
+	eor	x1, x1, x11
+	eor	x2, x2, x27
+	bic	x11, x5, x4
+	eor	x4, x4, x28
+	eor	x3, x3, x11
+	eor	x5, x5, x30
+	bic	x11, x8, x7
+	bic	x27, x9, x8
+	bic	x28, x6, x10
+	bic	x30, x7, x6
+	eor	x6, x6, x11
+	eor	x7, x7, x27
+	bic	x11, x10, x9
+	eor	x9, x9, x28
+	eor	x8, x8, x11
+	eor	x10, x10, x30
+	bic	x11, x13, x12
+	bic	x27, x14, x13
+	bic	x28, x0, x15
+	bic	x30, x12, x0
+	eor	x11, x0, x11
+	eor	x12, x12, x27
+	bic	x0, x15, x14
+	eor	x14, x14, x28
+	eor	x13, x13, x0
+	eor	x15, x15, x30
+	bic	x0, x19, x17
+	bic	x27, x20, x19
+	bic	x28, x16, x21
+	bic	x30, x17, x16
+	eor	x16, x16, x0
+	eor	x17, x17, x27
+	bic	x0, x21, x20
+	eor	x20, x20, x28
+	eor	x19, x19, x0
+	eor	x21, x21, x30
+	bic	x0, x24, x23
+	bic	x27, x25, x24
+	bic	x28, x22, x26
+	bic	x30, x23, x22
+	eor	x22, x22, x0
+	eor	x23, x23, x27
+	bic	x0, x26, x25
+	eor	x25, x25, x28
+	eor	x24, x24, x0
+	eor	x26, x26, x30
+	; Done transforming
+	ldp	x27, x28, [x29, #48]
+	ldr	x0, [x27], #8
+	subs	x28, x28, #1
+	mov	v30.d[0], x0
+	mov	v30.d[1], x0
+	eor	x1, x1, x0
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_SHA3_transform_blocksx3_neon_begin
+	ldr	x0, [x29, #40]
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	stp	x1, x2, [x0]
+	stp	x3, x4, [x0, #16]
+	stp	x5, x6, [x0, #32]
+	stp	x7, x8, [x0, #48]
+	stp	x9, x10, [x0, #64]
+	stp	x11, x12, [x0, #80]
+	stp	x13, x14, [x0, #96]
+	stp	x15, x16, [x0, #112]
+	stp	x17, x19, [x0, #128]
+	stp	x20, x21, [x0, #144]
+	stp	x22, x23, [x0, #160]
+	stp	x24, x25, [x0, #176]
+	str	x26, [x0, #192]
+	ldp	x17, x19, [x29, #72]
+	ldp	x20, x21, [x29, #88]
+	ldp	x22, x23, [x29, #104]
+	ldp	x24, x25, [x29, #120]
+	ldp	x26, x27, [x29, #136]
+	ldr	x28, [x29, #152]
+	ldp	d8, d9, [x29, #160]
+	ldp	d10, d11, [x29, #176]
+	ldp	d12, d13, [x29, #192]
+	ldp	d14, d15, [x29, #208]
+	ldp	x29, x30, [sp], #0xe0
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_shake128_blocksx3_seed_neon
+mlkem_shake128_blocksx3_seed_neon PROC
+	stp	x29, x30, [sp, #-224]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #72]
+	stp	x20, x21, [x29, #88]
+	stp	x22, x23, [x29, #104]
+	stp	x24, x25, [x29, #120]
+	stp	x26, x27, [x29, #136]
+	str	x28, [x29, #152]
+	stp	d8, d9, [x29, #160]
+	stp	d10, d11, [x29, #176]
+	stp	d12, d13, [x29, #192]
+	stp	d14, d15, [x29, #208]
+	adrp	x28, L_sha3_aarch64_r
+	add	x28, x28, L_sha3_aarch64_r
+	str	x0, [x29, #40]
+	add	x0, x0, #32
+	ld1	{v4.d}[0], [x0]
+	ldp	x2, x3, [x1], #16
+	add	x0, x0, #0xc8
+	ld1	{v4.d}[1], [x0]
+	ldp	x4, x5, [x1], #16
+	ldr	x6, [x0, #200]
+	eor	v5.16b, v5.16b, v5.16b
+	eor	x7, x7, x7
+	eor	v6.16b, v6.16b, v6.16b
+	eor	x8, x8, x8
+	eor	v7.16b, v7.16b, v7.16b
+	eor	x9, x9, x9
+	eor	v8.16b, v8.16b, v8.16b
+	eor	x10, x10, x10
+	eor	v9.16b, v9.16b, v9.16b
+	eor	x11, x11, x11
+	eor	v10.16b, v10.16b, v10.16b
+	eor	x12, x12, x12
+	eor	v11.16b, v11.16b, v11.16b
+	eor	x13, x13, x13
+	eor	v12.16b, v12.16b, v12.16b
+	eor	x14, x14, x14
+	eor	v13.16b, v13.16b, v13.16b
+	eor	x15, x15, x15
+	eor	v14.16b, v14.16b, v14.16b
+	eor	x16, x16, x16
+	eor	v15.16b, v15.16b, v15.16b
+	eor	x17, x17, x17
+	eor	v16.16b, v16.16b, v16.16b
+	eor	x19, x19, x19
+	eor	v17.16b, v17.16b, v17.16b
+	eor	x20, x20, x20
+	eor	v18.16b, v18.16b, v18.16b
+	eor	x21, x21, x21
+	eor	v19.16b, v19.16b, v19.16b
+	eor	x22, x22, x22
+	movz	x23, #0x8000, lsl 48
+	eor	v21.16b, v21.16b, v21.16b
+	eor	x24, x24, x24
+	eor	v22.16b, v22.16b, v22.16b
+	eor	x25, x25, x25
+	eor	v23.16b, v23.16b, v23.16b
+	eor	x26, x26, x26
+	eor	v24.16b, v24.16b, v24.16b
+	eor	x27, x27, x27
+	dup	v0.2d, x2
+	dup	v1.2d, x3
+	dup	v2.2d, x4
+	dup	v3.2d, x5
+	dup	v20.2d, x23
+	mov	x1, #24
+	; Start of 24 rounds
+L_SHA3_shake128_blocksx3_seed_neon_begin
+	stp	x28, x1, [x29, #48]
+	; Col Mix
+	eor3	v31.16b, v0.16b, v5.16b, v10.16b
+	eor	x0, x6, x11
+	eor3	v27.16b, v1.16b, v6.16b, v11.16b
+	eor	x30, x2, x7
+	eor3	v28.16b, v2.16b, v7.16b, v12.16b
+	eor	x28, x4, x9
+	eor3	v29.16b, v3.16b, v8.16b, v13.16b
+	eor	x0, x0, x16
+	eor3	v30.16b, v4.16b, v9.16b, v14.16b
+	eor	x30, x30, x12
+	eor3	v31.16b, v31.16b, v15.16b, v20.16b
+	eor	x28, x28, x14
+	eor3	v27.16b, v27.16b, v16.16b, v21.16b
+	eor	x0, x0, x22
+	eor3	v28.16b, v28.16b, v17.16b, v22.16b
+	eor	x30, x30, x17
+	eor3	v29.16b, v29.16b, v18.16b, v23.16b
+	eor	x28, x28, x20
+	eor3	v30.16b, v30.16b, v19.16b, v24.16b
+	eor	x0, x0, x27
+	rax1	v25.2d, v30.2d, v27.2d
+	eor	x30, x30, x23
+	rax1	v26.2d, v31.2d, v28.2d
+	eor	x28, x28, x25
+	rax1	v27.2d, v27.2d, v29.2d
+	str	x0, [x29, #32]
+	rax1	v28.2d, v28.2d, v30.2d
+	str	x28, [x29, #24]
+	rax1	v29.2d, v29.2d, v31.2d
+	eor	x1, x3, x8
+	eor	v0.16b, v0.16b, v25.16b
+	xar	v30.2d, v1.2d, v26.2d, #63
+	eor	x28, x5, x10
+	xar	v1.2d, v6.2d, v26.2d, #20
+	eor	x1, x1, x13
+	xar	v6.2d, v9.2d, v29.2d, #44
+	eor	x28, x28, x15
+	xar	v9.2d, v22.2d, v27.2d, #3
+	eor	x1, x1, x19
+	xar	v22.2d, v14.2d, v29.2d, #25
+	eor	x28, x28, x21
+	xar	v14.2d, v20.2d, v25.2d, #46
+	eor	x1, x1, x24
+	xar	v20.2d, v2.2d, v27.2d, #2
+	eor	x28, x28, x26
+	xar	v2.2d, v12.2d, v27.2d, #21
+	eor	x0, x0, x1, ror 63
+	xar	v12.2d, v13.2d, v28.2d, #39
+	eor	x1, x1, x28, ror 63
+	xar	v13.2d, v19.2d, v29.2d, #56
+	eor	x2, x2, x0
+	xar	v19.2d, v23.2d, v28.2d, #8
+	eor	x7, x7, x0
+	xar	v23.2d, v15.2d, v25.2d, #23
+	eor	x12, x12, x0
+	xar	v15.2d, v4.2d, v29.2d, #37
+	eor	x17, x17, x0
+	xar	v4.2d, v24.2d, v29.2d, #50
+	eor	x23, x23, x0
+	xar	v24.2d, v21.2d, v26.2d, #62
+	eor	x4, x4, x1
+	xar	v21.2d, v8.2d, v28.2d, #9
+	eor	x9, x9, x1
+	xar	v8.2d, v16.2d, v26.2d, #19
+	eor	x14, x14, x1
+	xar	v16.2d, v5.2d, v25.2d, #28
+	eor	x20, x20, x1
+	xar	v5.2d, v3.2d, v28.2d, #36
+	eor	x25, x25, x1
+	xar	v3.2d, v18.2d, v28.2d, #43
+	ldr	x0, [x29, #32]
+	xar	v18.2d, v17.2d, v27.2d, #49
+	ldr	x1, [x29, #24]
+	xar	v17.2d, v11.2d, v26.2d, #54
+	eor	x28, x28, x30, ror 63
+	xar	v11.2d, v7.2d, v27.2d, #58
+	eor	x30, x30, x1, ror 63
+	xar	v7.2d, v10.2d, v25.2d, #61
+	eor	x1, x1, x0, ror 63
+	; Row Mix
+	mov	v25.16b, v0.16b
+	eor	x6, x6, x28
+	mov	v26.16b, v1.16b
+	eor	x11, x11, x28
+	bcax	v0.16b, v25.16b, v2.16b, v26.16b
+	eor	x16, x16, x28
+	bcax	v1.16b, v26.16b, v3.16b, v2.16b
+	eor	x22, x22, x28
+	bcax	v2.16b, v2.16b, v4.16b, v3.16b
+	eor	x27, x27, x28
+	bcax	v3.16b, v3.16b, v25.16b, v4.16b
+	eor	x3, x3, x30
+	bcax	v4.16b, v4.16b, v26.16b, v25.16b
+	eor	x8, x8, x30
+	mov	v25.16b, v5.16b
+	eor	x13, x13, x30
+	mov	v26.16b, v6.16b
+	eor	x19, x19, x30
+	bcax	v5.16b, v25.16b, v7.16b, v26.16b
+	eor	x24, x24, x30
+	bcax	v6.16b, v26.16b, v8.16b, v7.16b
+	eor	x5, x5, x1
+	bcax	v7.16b, v7.16b, v9.16b, v8.16b
+	eor	x10, x10, x1
+	bcax	v8.16b, v8.16b, v25.16b, v9.16b
+	eor	x15, x15, x1
+	bcax	v9.16b, v9.16b, v26.16b, v25.16b
+	eor	x21, x21, x1
+	mov	v26.16b, v11.16b
+	eor	x26, x26, x1
+	; Swap Rotate Base
+	bcax	v10.16b, v30.16b, v12.16b, v26.16b
+	ror	x0, x3, #63
+	bcax	v11.16b, v26.16b, v13.16b, v12.16b
+	ror	x3, x8, #20
+	bcax	v12.16b, v12.16b, v14.16b, v13.16b
+	ror	x8, x11, #44
+	bcax	v13.16b, v13.16b, v30.16b, v14.16b
+	ror	x11, x25, #3
+	bcax	v14.16b, v14.16b, v26.16b, v30.16b
+	ror	x25, x16, #25
+	mov	v25.16b, v15.16b
+	ror	x16, x23, #46
+	mov	v26.16b, v16.16b
+	ror	x23, x4, #2
+	bcax	v15.16b, v25.16b, v17.16b, v26.16b
+	ror	x4, x14, #21
+	bcax	v16.16b, v26.16b, v18.16b, v17.16b
+	ror	x14, x15, #39
+	bcax	v17.16b, v17.16b, v19.16b, v18.16b
+	ror	x15, x22, #56
+	bcax	v18.16b, v18.16b, v25.16b, v19.16b
+	ror	x22, x26, #8
+	bcax	v19.16b, v19.16b, v26.16b, v25.16b
+	ror	x26, x17, #23
+	mov	v25.16b, v20.16b
+	ror	x17, x6, #37
+	mov	v26.16b, v21.16b
+	ror	x6, x27, #50
+	bcax	v20.16b, v25.16b, v22.16b, v26.16b
+	ror	x27, x24, #62
+	bcax	v21.16b, v26.16b, v23.16b, v22.16b
+	ror	x24, x10, #9
+	bcax	v22.16b, v22.16b, v24.16b, v23.16b
+	ror	x10, x19, #19
+	bcax	v23.16b, v23.16b, v25.16b, v24.16b
+	ror	x19, x7, #28
+	bcax	v24.16b, v24.16b, v26.16b, v25.16b
+	ror	x7, x5, #36
+	ror	x5, x21, #43
+	ror	x21, x20, #49
+	ror	x20, x13, #54
+	ror	x13, x9, #58
+	ror	x9, x12, #61
+	; Row Mix Base
+	bic	x12, x4, x3
+	bic	x1, x5, x4
+	bic	x28, x2, x6
+	bic	x30, x3, x2
+	eor	x2, x2, x12
+	eor	x3, x3, x1
+	bic	x12, x6, x5
+	eor	x5, x5, x28
+	eor	x4, x4, x12
+	eor	x6, x6, x30
+	bic	x12, x9, x8
+	bic	x1, x10, x9
+	bic	x28, x7, x11
+	bic	x30, x8, x7
+	eor	x7, x7, x12
+	eor	x8, x8, x1
+	bic	x12, x11, x10
+	eor	x10, x10, x28
+	eor	x9, x9, x12
+	eor	x11, x11, x30
+	bic	x12, x14, x13
+	bic	x1, x15, x14
+	bic	x28, x0, x16
+	bic	x30, x13, x0
+	eor	x12, x0, x12
+	eor	x13, x13, x1
+	bic	x0, x16, x15
+	eor	x15, x15, x28
+	eor	x14, x14, x0
+	eor	x16, x16, x30
+	bic	x0, x20, x19
+	bic	x1, x21, x20
+	bic	x28, x17, x22
+	bic	x30, x19, x17
+	eor	x17, x17, x0
+	eor	x19, x19, x1
+	bic	x0, x22, x21
+	eor	x21, x21, x28
+	eor	x20, x20, x0
+	eor	x22, x22, x30
+	bic	x0, x25, x24
+	bic	x1, x26, x25
+	bic	x28, x23, x27
+	bic	x30, x24, x23
+	eor	x23, x23, x0
+	eor	x24, x24, x1
+	bic	x0, x27, x26
+	eor	x26, x26, x28
+	eor	x25, x25, x0
+	eor	x27, x27, x30
+	; Done transforming
+	ldp	x28, x1, [x29, #48]
+	ldr	x0, [x28], #8
+	subs	x1, x1, #1
+	mov	v30.d[0], x0
+	mov	v30.d[1], x0
+	eor	x2, x2, x0
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_SHA3_shake128_blocksx3_seed_neon_begin
+	ldr	x0, [x29, #40]
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	stp	x6, x7, [x0, #32]
+	stp	x8, x9, [x0, #48]
+	stp	x10, x11, [x0, #64]
+	stp	x12, x13, [x0, #80]
+	stp	x14, x15, [x0, #96]
+	stp	x16, x17, [x0, #112]
+	stp	x19, x20, [x0, #128]
+	stp	x21, x22, [x0, #144]
+	stp	x23, x24, [x0, #160]
+	stp	x25, x26, [x0, #176]
+	str	x27, [x0, #192]
+	ldp	x17, x19, [x29, #72]
+	ldp	x20, x21, [x29, #88]
+	ldp	x22, x23, [x29, #104]
+	ldp	x24, x25, [x29, #120]
+	ldp	x26, x27, [x29, #136]
+	ldr	x28, [x29, #152]
+	ldp	d8, d9, [x29, #160]
+	ldp	d10, d11, [x29, #176]
+	ldp	d12, d13, [x29, #192]
+	ldp	d14, d15, [x29, #208]
+	ldp	x29, x30, [sp], #0xe0
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_shake256_blocksx3_seed_neon
+mlkem_shake256_blocksx3_seed_neon PROC
+	stp	x29, x30, [sp, #-224]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #72]
+	stp	x20, x21, [x29, #88]
+	stp	x22, x23, [x29, #104]
+	stp	x24, x25, [x29, #120]
+	stp	x26, x27, [x29, #136]
+	str	x28, [x29, #152]
+	stp	d8, d9, [x29, #160]
+	stp	d10, d11, [x29, #176]
+	stp	d12, d13, [x29, #192]
+	stp	d14, d15, [x29, #208]
+	adrp	x28, L_sha3_aarch64_r
+	add	x28, x28, L_sha3_aarch64_r
+	str	x0, [x29, #40]
+	add	x0, x0, #32
+	ld1	{v4.d}[0], [x0]
+	ldp	x2, x3, [x1], #16
+	add	x0, x0, #0xc8
+	ld1	{v4.d}[1], [x0]
+	ldp	x4, x5, [x1], #16
+	ldr	x6, [x0, #200]
+	eor	v5.16b, v5.16b, v5.16b
+	eor	x7, x7, x7
+	eor	v6.16b, v6.16b, v6.16b
+	eor	x8, x8, x8
+	eor	v7.16b, v7.16b, v7.16b
+	eor	x9, x9, x9
+	eor	v8.16b, v8.16b, v8.16b
+	eor	x10, x10, x10
+	eor	v9.16b, v9.16b, v9.16b
+	eor	x11, x11, x11
+	eor	v10.16b, v10.16b, v10.16b
+	eor	x12, x12, x12
+	eor	v11.16b, v11.16b, v11.16b
+	eor	x13, x13, x13
+	eor	v12.16b, v12.16b, v12.16b
+	eor	x14, x14, x14
+	eor	v13.16b, v13.16b, v13.16b
+	eor	x15, x15, x15
+	eor	v14.16b, v14.16b, v14.16b
+	eor	x16, x16, x16
+	eor	v15.16b, v15.16b, v15.16b
+	eor	x17, x17, x17
+	movz	x19, #0x8000, lsl 48
+	eor	v17.16b, v17.16b, v17.16b
+	eor	x20, x20, x20
+	eor	v18.16b, v18.16b, v18.16b
+	eor	x21, x21, x21
+	eor	v19.16b, v19.16b, v19.16b
+	eor	x22, x22, x22
+	eor	v20.16b, v20.16b, v20.16b
+	eor	x23, x23, x23
+	eor	v21.16b, v21.16b, v21.16b
+	eor	x24, x24, x24
+	eor	v22.16b, v22.16b, v22.16b
+	eor	x25, x25, x25
+	eor	v23.16b, v23.16b, v23.16b
+	eor	x26, x26, x26
+	eor	v24.16b, v24.16b, v24.16b
+	eor	x27, x27, x27
+	dup	v0.2d, x2
+	dup	v1.2d, x3
+	dup	v2.2d, x4
+	dup	v3.2d, x5
+	dup	v16.2d, x19
+	mov	x1, #24
+	; Start of 24 rounds
+L_SHA3_shake256_blocksx3_seed_neon_begin
+	stp	x28, x1, [x29, #48]
+	; Col Mix
+	eor3	v31.16b, v0.16b, v5.16b, v10.16b
+	eor	x0, x6, x11
+	eor3	v27.16b, v1.16b, v6.16b, v11.16b
+	eor	x30, x2, x7
+	eor3	v28.16b, v2.16b, v7.16b, v12.16b
+	eor	x28, x4, x9
+	eor3	v29.16b, v3.16b, v8.16b, v13.16b
+	eor	x0, x0, x16
+	eor3	v30.16b, v4.16b, v9.16b, v14.16b
+	eor	x30, x30, x12
+	eor3	v31.16b, v31.16b, v15.16b, v20.16b
+	eor	x28, x28, x14
+	eor3	v27.16b, v27.16b, v16.16b, v21.16b
+	eor	x0, x0, x22
+	eor3	v28.16b, v28.16b, v17.16b, v22.16b
+	eor	x30, x30, x17
+	eor3	v29.16b, v29.16b, v18.16b, v23.16b
+	eor	x28, x28, x20
+	eor3	v30.16b, v30.16b, v19.16b, v24.16b
+	eor	x0, x0, x27
+	rax1	v25.2d, v30.2d, v27.2d
+	eor	x30, x30, x23
+	rax1	v26.2d, v31.2d, v28.2d
+	eor	x28, x28, x25
+	rax1	v27.2d, v27.2d, v29.2d
+	str	x0, [x29, #32]
+	rax1	v28.2d, v28.2d, v30.2d
+	str	x28, [x29, #24]
+	rax1	v29.2d, v29.2d, v31.2d
+	eor	x1, x3, x8
+	eor	v0.16b, v0.16b, v25.16b
+	xar	v30.2d, v1.2d, v26.2d, #63
+	eor	x28, x5, x10
+	xar	v1.2d, v6.2d, v26.2d, #20
+	eor	x1, x1, x13
+	xar	v6.2d, v9.2d, v29.2d, #44
+	eor	x28, x28, x15
+	xar	v9.2d, v22.2d, v27.2d, #3
+	eor	x1, x1, x19
+	xar	v22.2d, v14.2d, v29.2d, #25
+	eor	x28, x28, x21
+	xar	v14.2d, v20.2d, v25.2d, #46
+	eor	x1, x1, x24
+	xar	v20.2d, v2.2d, v27.2d, #2
+	eor	x28, x28, x26
+	xar	v2.2d, v12.2d, v27.2d, #21
+	eor	x0, x0, x1, ror 63
+	xar	v12.2d, v13.2d, v28.2d, #39
+	eor	x1, x1, x28, ror 63
+	xar	v13.2d, v19.2d, v29.2d, #56
+	eor	x2, x2, x0
+	xar	v19.2d, v23.2d, v28.2d, #8
+	eor	x7, x7, x0
+	xar	v23.2d, v15.2d, v25.2d, #23
+	eor	x12, x12, x0
+	xar	v15.2d, v4.2d, v29.2d, #37
+	eor	x17, x17, x0
+	xar	v4.2d, v24.2d, v29.2d, #50
+	eor	x23, x23, x0
+	xar	v24.2d, v21.2d, v26.2d, #62
+	eor	x4, x4, x1
+	xar	v21.2d, v8.2d, v28.2d, #9
+	eor	x9, x9, x1
+	xar	v8.2d, v16.2d, v26.2d, #19
+	eor	x14, x14, x1
+	xar	v16.2d, v5.2d, v25.2d, #28
+	eor	x20, x20, x1
+	xar	v5.2d, v3.2d, v28.2d, #36
+	eor	x25, x25, x1
+	xar	v3.2d, v18.2d, v28.2d, #43
+	ldr	x0, [x29, #32]
+	xar	v18.2d, v17.2d, v27.2d, #49
+	ldr	x1, [x29, #24]
+	xar	v17.2d, v11.2d, v26.2d, #54
+	eor	x28, x28, x30, ror 63
+	xar	v11.2d, v7.2d, v27.2d, #58
+	eor	x30, x30, x1, ror 63
+	xar	v7.2d, v10.2d, v25.2d, #61
+	eor	x1, x1, x0, ror 63
+	; Row Mix
+	mov	v25.16b, v0.16b
+	eor	x6, x6, x28
+	mov	v26.16b, v1.16b
+	eor	x11, x11, x28
+	bcax	v0.16b, v25.16b, v2.16b, v26.16b
+	eor	x16, x16, x28
+	bcax	v1.16b, v26.16b, v3.16b, v2.16b
+	eor	x22, x22, x28
+	bcax	v2.16b, v2.16b, v4.16b, v3.16b
+	eor	x27, x27, x28
+	bcax	v3.16b, v3.16b, v25.16b, v4.16b
+	eor	x3, x3, x30
+	bcax	v4.16b, v4.16b, v26.16b, v25.16b
+	eor	x8, x8, x30
+	mov	v25.16b, v5.16b
+	eor	x13, x13, x30
+	mov	v26.16b, v6.16b
+	eor	x19, x19, x30
+	bcax	v5.16b, v25.16b, v7.16b, v26.16b
+	eor	x24, x24, x30
+	bcax	v6.16b, v26.16b, v8.16b, v7.16b
+	eor	x5, x5, x1
+	bcax	v7.16b, v7.16b, v9.16b, v8.16b
+	eor	x10, x10, x1
+	bcax	v8.16b, v8.16b, v25.16b, v9.16b
+	eor	x15, x15, x1
+	bcax	v9.16b, v9.16b, v26.16b, v25.16b
+	eor	x21, x21, x1
+	mov	v26.16b, v11.16b
+	eor	x26, x26, x1
+	; Swap Rotate Base
+	bcax	v10.16b, v30.16b, v12.16b, v26.16b
+	ror	x0, x3, #63
+	bcax	v11.16b, v26.16b, v13.16b, v12.16b
+	ror	x3, x8, #20
+	bcax	v12.16b, v12.16b, v14.16b, v13.16b
+	ror	x8, x11, #44
+	bcax	v13.16b, v13.16b, v30.16b, v14.16b
+	ror	x11, x25, #3
+	bcax	v14.16b, v14.16b, v26.16b, v30.16b
+	ror	x25, x16, #25
+	mov	v25.16b, v15.16b
+	ror	x16, x23, #46
+	mov	v26.16b, v16.16b
+	ror	x23, x4, #2
+	bcax	v15.16b, v25.16b, v17.16b, v26.16b
+	ror	x4, x14, #21
+	bcax	v16.16b, v26.16b, v18.16b, v17.16b
+	ror	x14, x15, #39
+	bcax	v17.16b, v17.16b, v19.16b, v18.16b
+	ror	x15, x22, #56
+	bcax	v18.16b, v18.16b, v25.16b, v19.16b
+	ror	x22, x26, #8
+	bcax	v19.16b, v19.16b, v26.16b, v25.16b
+	ror	x26, x17, #23
+	mov	v25.16b, v20.16b
+	ror	x17, x6, #37
+	mov	v26.16b, v21.16b
+	ror	x6, x27, #50
+	bcax	v20.16b, v25.16b, v22.16b, v26.16b
+	ror	x27, x24, #62
+	bcax	v21.16b, v26.16b, v23.16b, v22.16b
+	ror	x24, x10, #9
+	bcax	v22.16b, v22.16b, v24.16b, v23.16b
+	ror	x10, x19, #19
+	bcax	v23.16b, v23.16b, v25.16b, v24.16b
+	ror	x19, x7, #28
+	bcax	v24.16b, v24.16b, v26.16b, v25.16b
+	ror	x7, x5, #36
+	ror	x5, x21, #43
+	ror	x21, x20, #49
+	ror	x20, x13, #54
+	ror	x13, x9, #58
+	ror	x9, x12, #61
+	; Row Mix Base
+	bic	x12, x4, x3
+	bic	x1, x5, x4
+	bic	x28, x2, x6
+	bic	x30, x3, x2
+	eor	x2, x2, x12
+	eor	x3, x3, x1
+	bic	x12, x6, x5
+	eor	x5, x5, x28
+	eor	x4, x4, x12
+	eor	x6, x6, x30
+	bic	x12, x9, x8
+	bic	x1, x10, x9
+	bic	x28, x7, x11
+	bic	x30, x8, x7
+	eor	x7, x7, x12
+	eor	x8, x8, x1
+	bic	x12, x11, x10
+	eor	x10, x10, x28
+	eor	x9, x9, x12
+	eor	x11, x11, x30
+	bic	x12, x14, x13
+	bic	x1, x15, x14
+	bic	x28, x0, x16
+	bic	x30, x13, x0
+	eor	x12, x0, x12
+	eor	x13, x13, x1
+	bic	x0, x16, x15
+	eor	x15, x15, x28
+	eor	x14, x14, x0
+	eor	x16, x16, x30
+	bic	x0, x20, x19
+	bic	x1, x21, x20
+	bic	x28, x17, x22
+	bic	x30, x19, x17
+	eor	x17, x17, x0
+	eor	x19, x19, x1
+	bic	x0, x22, x21
+	eor	x21, x21, x28
+	eor	x20, x20, x0
+	eor	x22, x22, x30
+	bic	x0, x25, x24
+	bic	x1, x26, x25
+	bic	x28, x23, x27
+	bic	x30, x24, x23
+	eor	x23, x23, x0
+	eor	x24, x24, x1
+	bic	x0, x27, x26
+	eor	x26, x26, x28
+	eor	x25, x25, x0
+	eor	x27, x27, x30
+	; Done transforming
+	ldp	x28, x1, [x29, #48]
+	ldr	x0, [x28], #8
+	subs	x1, x1, #1
+	mov	v30.d[0], x0
+	mov	v30.d[1], x0
+	eor	x2, x2, x0
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_SHA3_shake256_blocksx3_seed_neon_begin
+	ldr	x0, [x29, #40]
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	stp	x6, x7, [x0, #32]
+	stp	x8, x9, [x0, #48]
+	stp	x10, x11, [x0, #64]
+	stp	x12, x13, [x0, #80]
+	stp	x14, x15, [x0, #96]
+	stp	x16, x17, [x0, #112]
+	stp	x19, x20, [x0, #128]
+	stp	x21, x22, [x0, #144]
+	stp	x23, x24, [x0, #160]
+	stp	x25, x26, [x0, #176]
+	str	x27, [x0, #192]
+	ldp	x17, x19, [x29, #72]
+	ldp	x20, x21, [x29, #88]
+	ldp	x22, x23, [x29, #104]
+	ldp	x24, x25, [x29, #120]
+	ldp	x26, x27, [x29, #136]
+	ldr	x28, [x29, #152]
+	ldp	d8, d9, [x29, #160]
+	ldp	d10, d11, [x29, #176]
+	ldp	d12, d13, [x29, #192]
+	ldp	d14, d15, [x29, #208]
+	ldp	x29, x30, [sp], #0xe0
+	ret
+	ENDP
+	ELSE
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_sha3_blocksx3_neon
+mlkem_sha3_blocksx3_neon PROC
+	stp	x29, x30, [sp, #-224]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #72]
+	stp	x20, x21, [x29, #88]
+	stp	x22, x23, [x29, #104]
+	stp	x24, x25, [x29, #120]
+	stp	x26, x27, [x29, #136]
+	str	x28, [x29, #152]
+	stp	d8, d9, [x29, #160]
+	stp	d10, d11, [x29, #176]
+	stp	d12, d13, [x29, #192]
+	stp	d14, d15, [x29, #208]
+	adrp	x27, L_sha3_aarch64_r
+	add	x27, x27, L_sha3_aarch64_r
+	str	x0, [x29, #40]
+	ld4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	ld1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	ld4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	ld1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	ldp	x1, x2, [x0]
+	ldp	x3, x4, [x0, #16]
+	ldp	x5, x6, [x0, #32]
+	ldp	x7, x8, [x0, #48]
+	ldp	x9, x10, [x0, #64]
+	ldp	x11, x12, [x0, #80]
+	ldp	x13, x14, [x0, #96]
+	ldp	x15, x16, [x0, #112]
+	ldp	x17, x19, [x0, #128]
+	ldp	x20, x21, [x0, #144]
+	ldp	x22, x23, [x0, #160]
+	ldp	x24, x25, [x0, #176]
+	ldr	x26, [x0, #192]
+	mov	x28, #24
+	; Start of 24 rounds
+L_SHA3_transform_blocksx3_neon_begin
+	stp	x27, x28, [x29, #48]
+	; Col Mix NEON
+	eor	v30.16b, v4.16b, v9.16b
+	eor	x0, x5, x10
+	eor	v27.16b, v1.16b, v6.16b
+	eor	x30, x1, x6
+	eor	v30.16b, v30.16b, v14.16b
+	eor	x28, x3, x8
+	eor	v27.16b, v27.16b, v11.16b
+	eor	x0, x0, x15
+	eor	v30.16b, v30.16b, v19.16b
+	eor	x30, x30, x11
+	eor	v27.16b, v27.16b, v16.16b
+	eor	x28, x28, x13
+	eor	v30.16b, v30.16b, v24.16b
+	eor	x0, x0, x21
+	eor	v27.16b, v27.16b, v21.16b
+	eor	x30, x30, x16
+	ushr	v25.2d, v27.2d, #63
+	eor	x28, x28, x19
+	sli	v25.2d, v27.2d, #1
+	eor	x0, x0, x26
+	eor	v25.16b, v25.16b, v30.16b
+	eor	x30, x30, x22
+	eor	v31.16b, v0.16b, v5.16b
+	eor	x28, x28, x24
+	eor	v28.16b, v2.16b, v7.16b
+	str	x0, [x29, #32]
+	eor	v31.16b, v31.16b, v10.16b
+	str	x28, [x29, #24]
+	eor	v28.16b, v28.16b, v12.16b
+	eor	x27, x2, x7
+	eor	v31.16b, v31.16b, v15.16b
+	eor	x28, x4, x9
+	eor	v28.16b, v28.16b, v17.16b
+	eor	x27, x27, x12
+	eor	v31.16b, v31.16b, v20.16b
+	eor	x28, x28, x14
+	eor	v28.16b, v28.16b, v22.16b
+	eor	x27, x27, x17
+	ushr	v29.2d, v30.2d, #63
+	eor	x28, x28, x20
+	ushr	v26.2d, v28.2d, #63
+	eor	x27, x27, x23
+	sli	v29.2d, v30.2d, #1
+	eor	x28, x28, x25
+	sli	v26.2d, v28.2d, #1
+	eor	x0, x0, x27, ror 63
+	eor	v28.16b, v28.16b, v29.16b
+	eor	x27, x27, x28, ror 63
+	eor	v29.16b, v3.16b, v8.16b
+	eor	x1, x1, x0
+	eor	v26.16b, v26.16b, v31.16b
+	eor	x6, x6, x0
+	eor	v29.16b, v29.16b, v13.16b
+	eor	x11, x11, x0
+	eor	v29.16b, v29.16b, v18.16b
+	eor	x16, x16, x0
+	eor	v29.16b, v29.16b, v23.16b
+	eor	x22, x22, x0
+	ushr	v30.2d, v29.2d, #63
+	eor	x3, x3, x27
+	sli	v30.2d, v29.2d, #1
+	eor	x8, x8, x27
+	eor	v27.16b, v27.16b, v30.16b
+	eor	x13, x13, x27
+	ushr	v30.2d, v31.2d, #63
+	eor	x19, x19, x27
+	sli	v30.2d, v31.2d, #1
+	eor	x24, x24, x27
+	eor	v29.16b, v29.16b, v30.16b
+	ldr	x0, [x29, #32]
+	; Swap Rotate NEON
+	eor	v0.16b, v0.16b, v25.16b
+	eor	v31.16b, v1.16b, v26.16b
+	ldr	x27, [x29, #24]
+	eor	v6.16b, v6.16b, v26.16b
+	eor	x28, x28, x30, ror 63
+	ushr	v30.2d, v31.2d, #63
+	eor	x30, x30, x27, ror 63
+	ushr	v1.2d, v6.2d, #20
+	eor	x27, x27, x0, ror 63
+	sli	v30.2d, v31.2d, #1
+	eor	x5, x5, x28
+	sli	v1.2d, v6.2d, #44
+	eor	x10, x10, x28
+	eor	v31.16b, v9.16b, v29.16b
+	eor	x15, x15, x28
+	eor	v22.16b, v22.16b, v27.16b
+	eor	x21, x21, x28
+	ushr	v6.2d, v31.2d, #44
+	eor	x26, x26, x28
+	ushr	v9.2d, v22.2d, #3
+	eor	x2, x2, x30
+	sli	v6.2d, v31.2d, #20
+	eor	x7, x7, x30
+	sli	v9.2d, v22.2d, #61
+	eor	x12, x12, x30
+	eor	v31.16b, v14.16b, v29.16b
+	eor	x17, x17, x30
+	eor	v20.16b, v20.16b, v25.16b
+	eor	x23, x23, x30
+	ushr	v22.2d, v31.2d, #25
+	eor	x4, x4, x27
+	ushr	v14.2d, v20.2d, #46
+	eor	x9, x9, x27
+	sli	v22.2d, v31.2d, #39
+	eor	x14, x14, x27
+	sli	v14.2d, v20.2d, #18
+	eor	x20, x20, x27
+	eor	v31.16b, v2.16b, v27.16b
+	eor	x25, x25, x27
+	; Swap Rotate Base
+	eor	v12.16b, v12.16b, v27.16b
+	ror	x0, x2, #63
+	ushr	v20.2d, v31.2d, #2
+	ror	x2, x7, #20
+	ushr	v2.2d, v12.2d, #21
+	ror	x7, x10, #44
+	sli	v20.2d, v31.2d, #62
+	ror	x10, x24, #3
+	sli	v2.2d, v12.2d, #43
+	ror	x24, x15, #25
+	eor	v31.16b, v13.16b, v28.16b
+	ror	x15, x22, #46
+	eor	v19.16b, v19.16b, v29.16b
+	ror	x22, x3, #2
+	ushr	v12.2d, v31.2d, #39
+	ror	x3, x13, #21
+	ushr	v13.2d, v19.2d, #56
+	ror	x13, x14, #39
+	sli	v12.2d, v31.2d, #25
+	ror	x14, x21, #56
+	sli	v13.2d, v19.2d, #8
+	ror	x21, x25, #8
+	eor	v31.16b, v23.16b, v28.16b
+	ror	x25, x16, #23
+	eor	v15.16b, v15.16b, v25.16b
+	ror	x16, x5, #37
+	ushr	v19.2d, v31.2d, #8
+	ror	x5, x26, #50
+	ushr	v23.2d, v15.2d, #23
+	ror	x26, x23, #62
+	sli	v19.2d, v31.2d, #56
+	ror	x23, x9, #9
+	sli	v23.2d, v15.2d, #41
+	ror	x9, x17, #19
+	eor	v31.16b, v4.16b, v29.16b
+	ror	x17, x6, #28
+	eor	v24.16b, v24.16b, v29.16b
+	ror	x6, x4, #36
+	ushr	v15.2d, v31.2d, #37
+	ror	x4, x20, #43
+	ushr	v4.2d, v24.2d, #50
+	ror	x20, x19, #49
+	sli	v15.2d, v31.2d, #27
+	ror	x19, x12, #54
+	sli	v4.2d, v24.2d, #14
+	ror	x12, x8, #58
+	eor	v31.16b, v21.16b, v26.16b
+	ror	x8, x11, #61
+	; Row Mix Base
+	eor	v8.16b, v8.16b, v28.16b
+	bic	x11, x3, x2
+	ushr	v24.2d, v31.2d, #62
+	bic	x27, x4, x3
+	ushr	v21.2d, v8.2d, #9
+	bic	x28, x1, x5
+	sli	v24.2d, v31.2d, #2
+	bic	x30, x2, x1
+	sli	v21.2d, v8.2d, #55
+	eor	x1, x1, x11
+	eor	v31.16b, v16.16b, v26.16b
+	eor	x2, x2, x27
+	eor	v5.16b, v5.16b, v25.16b
+	bic	x11, x5, x4
+	ushr	v8.2d, v31.2d, #19
+	eor	x4, x4, x28
+	ushr	v16.2d, v5.2d, #28
+	eor	x3, x3, x11
+	sli	v8.2d, v31.2d, #45
+	eor	x5, x5, x30
+	sli	v16.2d, v5.2d, #36
+	bic	x11, x8, x7
+	eor	v31.16b, v3.16b, v28.16b
+	bic	x27, x9, x8
+	eor	v18.16b, v18.16b, v28.16b
+	bic	x28, x6, x10
+	ushr	v5.2d, v31.2d, #36
+	bic	x30, x7, x6
+	ushr	v3.2d, v18.2d, #43
+	eor	x6, x6, x11
+	sli	v5.2d, v31.2d, #28
+	eor	x7, x7, x27
+	sli	v3.2d, v18.2d, #21
+	bic	x11, x10, x9
+	eor	v31.16b, v17.16b, v27.16b
+	eor	x9, x9, x28
+	eor	v11.16b, v11.16b, v26.16b
+	eor	x8, x8, x11
+	ushr	v18.2d, v31.2d, #49
+	eor	x10, x10, x30
+	ushr	v17.2d, v11.2d, #54
+	bic	x11, x13, x12
+	sli	v18.2d, v31.2d, #15
+	bic	x27, x14, x13
+	sli	v17.2d, v11.2d, #10
+	bic	x28, x0, x15
+	eor	v31.16b, v7.16b, v27.16b
+	bic	x30, x12, x0
+	eor	v10.16b, v10.16b, v25.16b
+	eor	x11, x0, x11
+	ushr	v11.2d, v31.2d, #58
+	eor	x12, x12, x27
+	ushr	v7.2d, v10.2d, #61
+	bic	x0, x15, x14
+	sli	v11.2d, v31.2d, #6
+	eor	x14, x14, x28
+	sli	v7.2d, v10.2d, #3
+	eor	x13, x13, x0
+	; Row Mix NEON
+	bic	v25.16b, v2.16b, v1.16b
+	eor	x15, x15, x30
+	bic	v26.16b, v3.16b, v2.16b
+	bic	x0, x19, x17
+	bic	v27.16b, v4.16b, v3.16b
+	bic	x27, x20, x19
+	bic	v28.16b, v0.16b, v4.16b
+	bic	x28, x16, x21
+	bic	v29.16b, v1.16b, v0.16b
+	bic	x30, x17, x16
+	eor	v0.16b, v0.16b, v25.16b
+	eor	x16, x16, x0
+	eor	v1.16b, v1.16b, v26.16b
+	eor	x17, x17, x27
+	eor	v2.16b, v2.16b, v27.16b
+	bic	x0, x21, x20
+	eor	v3.16b, v3.16b, v28.16b
+	eor	x20, x20, x28
+	eor	v4.16b, v4.16b, v29.16b
+	eor	x19, x19, x0
+	bic	v25.16b, v7.16b, v6.16b
+	eor	x21, x21, x30
+	bic	v26.16b, v8.16b, v7.16b
+	bic	x0, x24, x23
+	bic	v27.16b, v9.16b, v8.16b
+	bic	x27, x25, x24
+	bic	v28.16b, v5.16b, v9.16b
+	bic	x28, x22, x26
+	bic	v29.16b, v6.16b, v5.16b
+	bic	x30, x23, x22
+	eor	v5.16b, v5.16b, v25.16b
+	eor	x22, x22, x0
+	eor	v6.16b, v6.16b, v26.16b
+	eor	x23, x23, x27
+	eor	v7.16b, v7.16b, v27.16b
+	bic	x0, x26, x25
+	eor	v8.16b, v8.16b, v28.16b
+	eor	x25, x25, x28
+	eor	v9.16b, v9.16b, v29.16b
+	eor	x24, x24, x0
+	bic	v25.16b, v12.16b, v11.16b
+	eor	x26, x26, x30
+	bic	v26.16b, v13.16b, v12.16b
+	bic	v27.16b, v14.16b, v13.16b
+	bic	v28.16b, v30.16b, v14.16b
+	bic	v29.16b, v11.16b, v30.16b
+	eor	v10.16b, v30.16b, v25.16b
+	eor	v11.16b, v11.16b, v26.16b
+	eor	v12.16b, v12.16b, v27.16b
+	eor	v13.16b, v13.16b, v28.16b
+	eor	v14.16b, v14.16b, v29.16b
+	bic	v25.16b, v17.16b, v16.16b
+	bic	v26.16b, v18.16b, v17.16b
+	bic	v27.16b, v19.16b, v18.16b
+	bic	v28.16b, v15.16b, v19.16b
+	bic	v29.16b, v16.16b, v15.16b
+	eor	v15.16b, v15.16b, v25.16b
+	eor	v16.16b, v16.16b, v26.16b
+	eor	v17.16b, v17.16b, v27.16b
+	eor	v18.16b, v18.16b, v28.16b
+	eor	v19.16b, v19.16b, v29.16b
+	bic	v25.16b, v22.16b, v21.16b
+	bic	v26.16b, v23.16b, v22.16b
+	bic	v27.16b, v24.16b, v23.16b
+	bic	v28.16b, v20.16b, v24.16b
+	bic	v29.16b, v21.16b, v20.16b
+	eor	v20.16b, v20.16b, v25.16b
+	eor	v21.16b, v21.16b, v26.16b
+	eor	v22.16b, v22.16b, v27.16b
+	eor	v23.16b, v23.16b, v28.16b
+	eor	v24.16b, v24.16b, v29.16b
+	; Done transforming
+	ldp	x27, x28, [x29, #48]
+	ldr	x0, [x27], #8
+	subs	x28, x28, #1
+	mov	v30.d[0], x0
+	mov	v30.d[1], x0
+	eor	x1, x1, x0
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_SHA3_transform_blocksx3_neon_begin
+	ldr	x0, [x29, #40]
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	stp	x1, x2, [x0]
+	stp	x3, x4, [x0, #16]
+	stp	x5, x6, [x0, #32]
+	stp	x7, x8, [x0, #48]
+	stp	x9, x10, [x0, #64]
+	stp	x11, x12, [x0, #80]
+	stp	x13, x14, [x0, #96]
+	stp	x15, x16, [x0, #112]
+	stp	x17, x19, [x0, #128]
+	stp	x20, x21, [x0, #144]
+	stp	x22, x23, [x0, #160]
+	stp	x24, x25, [x0, #176]
+	str	x26, [x0, #192]
+	ldp	x17, x19, [x29, #72]
+	ldp	x20, x21, [x29, #88]
+	ldp	x22, x23, [x29, #104]
+	ldp	x24, x25, [x29, #120]
+	ldp	x26, x27, [x29, #136]
+	ldr	x28, [x29, #152]
+	ldp	d8, d9, [x29, #160]
+	ldp	d10, d11, [x29, #176]
+	ldp	d12, d13, [x29, #192]
+	ldp	d14, d15, [x29, #208]
+	ldp	x29, x30, [sp], #0xe0
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_shake128_blocksx3_seed_neon
+mlkem_shake128_blocksx3_seed_neon PROC
+	stp	x29, x30, [sp, #-224]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #72]
+	stp	x20, x21, [x29, #88]
+	stp	x22, x23, [x29, #104]
+	stp	x24, x25, [x29, #120]
+	stp	x26, x27, [x29, #136]
+	str	x28, [x29, #152]
+	stp	d8, d9, [x29, #160]
+	stp	d10, d11, [x29, #176]
+	stp	d12, d13, [x29, #192]
+	stp	d14, d15, [x29, #208]
+	adrp	x28, L_sha3_aarch64_r
+	add	x28, x28, L_sha3_aarch64_r
+	str	x0, [x29, #40]
+	add	x0, x0, #32
+	ld1	{v4.d}[0], [x0]
+	ldp	x2, x3, [x1], #16
+	add	x0, x0, #0xc8
+	ld1	{v4.d}[1], [x0]
+	ldp	x4, x5, [x1], #16
+	ldr	x6, [x0, #200]
+	eor	v5.16b, v5.16b, v5.16b
+	eor	x7, x7, x7
+	eor	v6.16b, v6.16b, v6.16b
+	eor	x8, x8, x8
+	eor	v7.16b, v7.16b, v7.16b
+	eor	x9, x9, x9
+	eor	v8.16b, v8.16b, v8.16b
+	eor	x10, x10, x10
+	eor	v9.16b, v9.16b, v9.16b
+	eor	x11, x11, x11
+	eor	v10.16b, v10.16b, v10.16b
+	eor	x12, x12, x12
+	eor	v11.16b, v11.16b, v11.16b
+	eor	x13, x13, x13
+	eor	v12.16b, v12.16b, v12.16b
+	eor	x14, x14, x14
+	eor	v13.16b, v13.16b, v13.16b
+	eor	x15, x15, x15
+	eor	v14.16b, v14.16b, v14.16b
+	eor	x16, x16, x16
+	eor	v15.16b, v15.16b, v15.16b
+	eor	x17, x17, x17
+	eor	v16.16b, v16.16b, v16.16b
+	eor	x19, x19, x19
+	eor	v17.16b, v17.16b, v17.16b
+	eor	x20, x20, x20
+	eor	v18.16b, v18.16b, v18.16b
+	eor	x21, x21, x21
+	eor	v19.16b, v19.16b, v19.16b
+	eor	x22, x22, x22
+	movz	x23, #0x8000, lsl 48
+	eor	v21.16b, v21.16b, v21.16b
+	eor	x24, x24, x24
+	eor	v22.16b, v22.16b, v22.16b
+	eor	x25, x25, x25
+	eor	v23.16b, v23.16b, v23.16b
+	eor	x26, x26, x26
+	eor	v24.16b, v24.16b, v24.16b
+	eor	x27, x27, x27
+	dup	v0.2d, x2
+	dup	v1.2d, x3
+	dup	v2.2d, x4
+	dup	v3.2d, x5
+	dup	v20.2d, x23
+	mov	x1, #24
+	; Start of 24 rounds
+L_SHA3_shake128_blocksx3_seed_neon_begin
+	stp	x28, x1, [x29, #48]
+	; Col Mix NEON
+	eor	v30.16b, v4.16b, v9.16b
+	eor	x0, x6, x11
+	eor	v27.16b, v1.16b, v6.16b
+	eor	x30, x2, x7
+	eor	v30.16b, v30.16b, v14.16b
+	eor	x28, x4, x9
+	eor	v27.16b, v27.16b, v11.16b
+	eor	x0, x0, x16
+	eor	v30.16b, v30.16b, v19.16b
+	eor	x30, x30, x12
+	eor	v27.16b, v27.16b, v16.16b
+	eor	x28, x28, x14
+	eor	v30.16b, v30.16b, v24.16b
+	eor	x0, x0, x22
+	eor	v27.16b, v27.16b, v21.16b
+	eor	x30, x30, x17
+	ushr	v25.2d, v27.2d, #63
+	eor	x28, x28, x20
+	sli	v25.2d, v27.2d, #1
+	eor	x0, x0, x27
+	eor	v25.16b, v25.16b, v30.16b
+	eor	x30, x30, x23
+	eor	v31.16b, v0.16b, v5.16b
+	eor	x28, x28, x25
+	eor	v28.16b, v2.16b, v7.16b
+	str	x0, [x29, #32]
+	eor	v31.16b, v31.16b, v10.16b
+	str	x28, [x29, #24]
+	eor	v28.16b, v28.16b, v12.16b
+	eor	x1, x3, x8
+	eor	v31.16b, v31.16b, v15.16b
+	eor	x28, x5, x10
+	eor	v28.16b, v28.16b, v17.16b
+	eor	x1, x1, x13
+	eor	v31.16b, v31.16b, v20.16b
+	eor	x28, x28, x15
+	eor	v28.16b, v28.16b, v22.16b
+	eor	x1, x1, x19
+	ushr	v29.2d, v30.2d, #63
+	eor	x28, x28, x21
+	ushr	v26.2d, v28.2d, #63
+	eor	x1, x1, x24
+	sli	v29.2d, v30.2d, #1
+	eor	x28, x28, x26
+	sli	v26.2d, v28.2d, #1
+	eor	x0, x0, x1, ror 63
+	eor	v28.16b, v28.16b, v29.16b
+	eor	x1, x1, x28, ror 63
+	eor	v29.16b, v3.16b, v8.16b
+	eor	x2, x2, x0
+	eor	v26.16b, v26.16b, v31.16b
+	eor	x7, x7, x0
+	eor	v29.16b, v29.16b, v13.16b
+	eor	x12, x12, x0
+	eor	v29.16b, v29.16b, v18.16b
+	eor	x17, x17, x0
+	eor	v29.16b, v29.16b, v23.16b
+	eor	x23, x23, x0
+	ushr	v30.2d, v29.2d, #63
+	eor	x4, x4, x1
+	sli	v30.2d, v29.2d, #1
+	eor	x9, x9, x1
+	eor	v27.16b, v27.16b, v30.16b
+	eor	x14, x14, x1
+	ushr	v30.2d, v31.2d, #63
+	eor	x20, x20, x1
+	sli	v30.2d, v31.2d, #1
+	eor	x25, x25, x1
+	eor	v29.16b, v29.16b, v30.16b
+	ldr	x0, [x29, #32]
+	; Swap Rotate NEON
+	eor	v0.16b, v0.16b, v25.16b
+	eor	v31.16b, v1.16b, v26.16b
+	ldr	x1, [x29, #24]
+	eor	v6.16b, v6.16b, v26.16b
+	eor	x28, x28, x30, ror 63
+	ushr	v30.2d, v31.2d, #63
+	eor	x30, x30, x1, ror 63
+	ushr	v1.2d, v6.2d, #20
+	eor	x1, x1, x0, ror 63
+	sli	v30.2d, v31.2d, #1
+	eor	x6, x6, x28
+	sli	v1.2d, v6.2d, #44
+	eor	x11, x11, x28
+	eor	v31.16b, v9.16b, v29.16b
+	eor	x16, x16, x28
+	eor	v22.16b, v22.16b, v27.16b
+	eor	x22, x22, x28
+	ushr	v6.2d, v31.2d, #44
+	eor	x27, x27, x28
+	ushr	v9.2d, v22.2d, #3
+	eor	x3, x3, x30
+	sli	v6.2d, v31.2d, #20
+	eor	x8, x8, x30
+	sli	v9.2d, v22.2d, #61
+	eor	x13, x13, x30
+	eor	v31.16b, v14.16b, v29.16b
+	eor	x19, x19, x30
+	eor	v20.16b, v20.16b, v25.16b
+	eor	x24, x24, x30
+	ushr	v22.2d, v31.2d, #25
+	eor	x5, x5, x1
+	ushr	v14.2d, v20.2d, #46
+	eor	x10, x10, x1
+	sli	v22.2d, v31.2d, #39
+	eor	x15, x15, x1
+	sli	v14.2d, v20.2d, #18
+	eor	x21, x21, x1
+	eor	v31.16b, v2.16b, v27.16b
+	eor	x26, x26, x1
+	; Swap Rotate Base
+	eor	v12.16b, v12.16b, v27.16b
+	ror	x0, x3, #63
+	ushr	v20.2d, v31.2d, #2
+	ror	x3, x8, #20
+	ushr	v2.2d, v12.2d, #21
+	ror	x8, x11, #44
+	sli	v20.2d, v31.2d, #62
+	ror	x11, x25, #3
+	sli	v2.2d, v12.2d, #43
+	ror	x25, x16, #25
+	eor	v31.16b, v13.16b, v28.16b
+	ror	x16, x23, #46
+	eor	v19.16b, v19.16b, v29.16b
+	ror	x23, x4, #2
+	ushr	v12.2d, v31.2d, #39
+	ror	x4, x14, #21
+	ushr	v13.2d, v19.2d, #56
+	ror	x14, x15, #39
+	sli	v12.2d, v31.2d, #25
+	ror	x15, x22, #56
+	sli	v13.2d, v19.2d, #8
+	ror	x22, x26, #8
+	eor	v31.16b, v23.16b, v28.16b
+	ror	x26, x17, #23
+	eor	v15.16b, v15.16b, v25.16b
+	ror	x17, x6, #37
+	ushr	v19.2d, v31.2d, #8
+	ror	x6, x27, #50
+	ushr	v23.2d, v15.2d, #23
+	ror	x27, x24, #62
+	sli	v19.2d, v31.2d, #56
+	ror	x24, x10, #9
+	sli	v23.2d, v15.2d, #41
+	ror	x10, x19, #19
+	eor	v31.16b, v4.16b, v29.16b
+	ror	x19, x7, #28
+	eor	v24.16b, v24.16b, v29.16b
+	ror	x7, x5, #36
+	ushr	v15.2d, v31.2d, #37
+	ror	x5, x21, #43
+	ushr	v4.2d, v24.2d, #50
+	ror	x21, x20, #49
+	sli	v15.2d, v31.2d, #27
+	ror	x20, x13, #54
+	sli	v4.2d, v24.2d, #14
+	ror	x13, x9, #58
+	eor	v31.16b, v21.16b, v26.16b
+	ror	x9, x12, #61
+	; Row Mix Base
+	eor	v8.16b, v8.16b, v28.16b
+	bic	x12, x4, x3
+	ushr	v24.2d, v31.2d, #62
+	bic	x1, x5, x4
+	ushr	v21.2d, v8.2d, #9
+	bic	x28, x2, x6
+	sli	v24.2d, v31.2d, #2
+	bic	x30, x3, x2
+	sli	v21.2d, v8.2d, #55
+	eor	x2, x2, x12
+	eor	v31.16b, v16.16b, v26.16b
+	eor	x3, x3, x1
+	eor	v5.16b, v5.16b, v25.16b
+	bic	x12, x6, x5
+	ushr	v8.2d, v31.2d, #19
+	eor	x5, x5, x28
+	ushr	v16.2d, v5.2d, #28
+	eor	x4, x4, x12
+	sli	v8.2d, v31.2d, #45
+	eor	x6, x6, x30
+	sli	v16.2d, v5.2d, #36
+	bic	x12, x9, x8
+	eor	v31.16b, v3.16b, v28.16b
+	bic	x1, x10, x9
+	eor	v18.16b, v18.16b, v28.16b
+	bic	x28, x7, x11
+	ushr	v5.2d, v31.2d, #36
+	bic	x30, x8, x7
+	ushr	v3.2d, v18.2d, #43
+	eor	x7, x7, x12
+	sli	v5.2d, v31.2d, #28
+	eor	x8, x8, x1
+	sli	v3.2d, v18.2d, #21
+	bic	x12, x11, x10
+	eor	v31.16b, v17.16b, v27.16b
+	eor	x10, x10, x28
+	eor	v11.16b, v11.16b, v26.16b
+	eor	x9, x9, x12
+	ushr	v18.2d, v31.2d, #49
+	eor	x11, x11, x30
+	ushr	v17.2d, v11.2d, #54
+	bic	x12, x14, x13
+	sli	v18.2d, v31.2d, #15
+	bic	x1, x15, x14
+	sli	v17.2d, v11.2d, #10
+	bic	x28, x0, x16
+	eor	v31.16b, v7.16b, v27.16b
+	bic	x30, x13, x0
+	eor	v10.16b, v10.16b, v25.16b
+	eor	x12, x0, x12
+	ushr	v11.2d, v31.2d, #58
+	eor	x13, x13, x1
+	ushr	v7.2d, v10.2d, #61
+	bic	x0, x16, x15
+	sli	v11.2d, v31.2d, #6
+	eor	x15, x15, x28
+	sli	v7.2d, v10.2d, #3
+	eor	x14, x14, x0
+	; Row Mix NEON
+	bic	v25.16b, v2.16b, v1.16b
+	eor	x16, x16, x30
+	bic	v26.16b, v3.16b, v2.16b
+	bic	x0, x20, x19
+	bic	v27.16b, v4.16b, v3.16b
+	bic	x1, x21, x20
+	bic	v28.16b, v0.16b, v4.16b
+	bic	x28, x17, x22
+	bic	v29.16b, v1.16b, v0.16b
+	bic	x30, x19, x17
+	eor	v0.16b, v0.16b, v25.16b
+	eor	x17, x17, x0
+	eor	v1.16b, v1.16b, v26.16b
+	eor	x19, x19, x1
+	eor	v2.16b, v2.16b, v27.16b
+	bic	x0, x22, x21
+	eor	v3.16b, v3.16b, v28.16b
+	eor	x21, x21, x28
+	eor	v4.16b, v4.16b, v29.16b
+	eor	x20, x20, x0
+	bic	v25.16b, v7.16b, v6.16b
+	eor	x22, x22, x30
+	bic	v26.16b, v8.16b, v7.16b
+	bic	x0, x25, x24
+	bic	v27.16b, v9.16b, v8.16b
+	bic	x1, x26, x25
+	bic	v28.16b, v5.16b, v9.16b
+	bic	x28, x23, x27
+	bic	v29.16b, v6.16b, v5.16b
+	bic	x30, x24, x23
+	eor	v5.16b, v5.16b, v25.16b
+	eor	x23, x23, x0
+	eor	v6.16b, v6.16b, v26.16b
+	eor	x24, x24, x1
+	eor	v7.16b, v7.16b, v27.16b
+	bic	x0, x27, x26
+	eor	v8.16b, v8.16b, v28.16b
+	eor	x26, x26, x28
+	eor	v9.16b, v9.16b, v29.16b
+	eor	x25, x25, x0
+	bic	v25.16b, v12.16b, v11.16b
+	eor	x27, x27, x30
+	bic	v26.16b, v13.16b, v12.16b
+	bic	v27.16b, v14.16b, v13.16b
+	bic	v28.16b, v30.16b, v14.16b
+	bic	v29.16b, v11.16b, v30.16b
+	eor	v10.16b, v30.16b, v25.16b
+	eor	v11.16b, v11.16b, v26.16b
+	eor	v12.16b, v12.16b, v27.16b
+	eor	v13.16b, v13.16b, v28.16b
+	eor	v14.16b, v14.16b, v29.16b
+	bic	v25.16b, v17.16b, v16.16b
+	bic	v26.16b, v18.16b, v17.16b
+	bic	v27.16b, v19.16b, v18.16b
+	bic	v28.16b, v15.16b, v19.16b
+	bic	v29.16b, v16.16b, v15.16b
+	eor	v15.16b, v15.16b, v25.16b
+	eor	v16.16b, v16.16b, v26.16b
+	eor	v17.16b, v17.16b, v27.16b
+	eor	v18.16b, v18.16b, v28.16b
+	eor	v19.16b, v19.16b, v29.16b
+	bic	v25.16b, v22.16b, v21.16b
+	bic	v26.16b, v23.16b, v22.16b
+	bic	v27.16b, v24.16b, v23.16b
+	bic	v28.16b, v20.16b, v24.16b
+	bic	v29.16b, v21.16b, v20.16b
+	eor	v20.16b, v20.16b, v25.16b
+	eor	v21.16b, v21.16b, v26.16b
+	eor	v22.16b, v22.16b, v27.16b
+	eor	v23.16b, v23.16b, v28.16b
+	eor	v24.16b, v24.16b, v29.16b
+	; Done transforming
+	ldp	x28, x1, [x29, #48]
+	ldr	x0, [x28], #8
+	subs	x1, x1, #1
+	mov	v30.d[0], x0
+	mov	v30.d[1], x0
+	eor	x2, x2, x0
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_SHA3_shake128_blocksx3_seed_neon_begin
+	ldr	x0, [x29, #40]
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	stp	x6, x7, [x0, #32]
+	stp	x8, x9, [x0, #48]
+	stp	x10, x11, [x0, #64]
+	stp	x12, x13, [x0, #80]
+	stp	x14, x15, [x0, #96]
+	stp	x16, x17, [x0, #112]
+	stp	x19, x20, [x0, #128]
+	stp	x21, x22, [x0, #144]
+	stp	x23, x24, [x0, #160]
+	stp	x25, x26, [x0, #176]
+	str	x27, [x0, #192]
+	ldp	x17, x19, [x29, #72]
+	ldp	x20, x21, [x29, #88]
+	ldp	x22, x23, [x29, #104]
+	ldp	x24, x25, [x29, #120]
+	ldp	x26, x27, [x29, #136]
+	ldr	x28, [x29, #152]
+	ldp	d8, d9, [x29, #160]
+	ldp	d10, d11, [x29, #176]
+	ldp	d12, d13, [x29, #192]
+	ldp	d14, d15, [x29, #208]
+	ldp	x29, x30, [sp], #0xe0
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	mlkem_shake256_blocksx3_seed_neon
+mlkem_shake256_blocksx3_seed_neon PROC
+	stp	x29, x30, [sp, #-224]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #72]
+	stp	x20, x21, [x29, #88]
+	stp	x22, x23, [x29, #104]
+	stp	x24, x25, [x29, #120]
+	stp	x26, x27, [x29, #136]
+	str	x28, [x29, #152]
+	stp	d8, d9, [x29, #160]
+	stp	d10, d11, [x29, #176]
+	stp	d12, d13, [x29, #192]
+	stp	d14, d15, [x29, #208]
+	adrp	x28, L_sha3_aarch64_r
+	add	x28, x28, L_sha3_aarch64_r
+	str	x0, [x29, #40]
+	add	x0, x0, #32
+	ld1	{v4.d}[0], [x0]
+	ldp	x2, x3, [x1], #16
+	add	x0, x0, #0xc8
+	ld1	{v4.d}[1], [x0]
+	ldp	x4, x5, [x1], #16
+	ldr	x6, [x0, #200]
+	eor	v5.16b, v5.16b, v5.16b
+	eor	x7, x7, x7
+	eor	v6.16b, v6.16b, v6.16b
+	eor	x8, x8, x8
+	eor	v7.16b, v7.16b, v7.16b
+	eor	x9, x9, x9
+	eor	v8.16b, v8.16b, v8.16b
+	eor	x10, x10, x10
+	eor	v9.16b, v9.16b, v9.16b
+	eor	x11, x11, x11
+	eor	v10.16b, v10.16b, v10.16b
+	eor	x12, x12, x12
+	eor	v11.16b, v11.16b, v11.16b
+	eor	x13, x13, x13
+	eor	v12.16b, v12.16b, v12.16b
+	eor	x14, x14, x14
+	eor	v13.16b, v13.16b, v13.16b
+	eor	x15, x15, x15
+	eor	v14.16b, v14.16b, v14.16b
+	eor	x16, x16, x16
+	eor	v15.16b, v15.16b, v15.16b
+	eor	x17, x17, x17
+	movz	x19, #0x8000, lsl 48
+	eor	v17.16b, v17.16b, v17.16b
+	eor	x20, x20, x20
+	eor	v18.16b, v18.16b, v18.16b
+	eor	x21, x21, x21
+	eor	v19.16b, v19.16b, v19.16b
+	eor	x22, x22, x22
+	eor	v20.16b, v20.16b, v20.16b
+	eor	x23, x23, x23
+	eor	v21.16b, v21.16b, v21.16b
+	eor	x24, x24, x24
+	eor	v22.16b, v22.16b, v22.16b
+	eor	x25, x25, x25
+	eor	v23.16b, v23.16b, v23.16b
+	eor	x26, x26, x26
+	eor	v24.16b, v24.16b, v24.16b
+	eor	x27, x27, x27
+	dup	v0.2d, x2
+	dup	v1.2d, x3
+	dup	v2.2d, x4
+	dup	v3.2d, x5
+	dup	v16.2d, x19
+	mov	x1, #24
+	; Start of 24 rounds
+L_SHA3_shake256_blocksx3_seed_neon_begin
+	stp	x28, x1, [x29, #48]
+	; Col Mix NEON
+	eor	v30.16b, v4.16b, v9.16b
+	eor	x0, x6, x11
+	eor	v27.16b, v1.16b, v6.16b
+	eor	x30, x2, x7
+	eor	v30.16b, v30.16b, v14.16b
+	eor	x28, x4, x9
+	eor	v27.16b, v27.16b, v11.16b
+	eor	x0, x0, x16
+	eor	v30.16b, v30.16b, v19.16b
+	eor	x30, x30, x12
+	eor	v27.16b, v27.16b, v16.16b
+	eor	x28, x28, x14
+	eor	v30.16b, v30.16b, v24.16b
+	eor	x0, x0, x22
+	eor	v27.16b, v27.16b, v21.16b
+	eor	x30, x30, x17
+	ushr	v25.2d, v27.2d, #63
+	eor	x28, x28, x20
+	sli	v25.2d, v27.2d, #1
+	eor	x0, x0, x27
+	eor	v25.16b, v25.16b, v30.16b
+	eor	x30, x30, x23
+	eor	v31.16b, v0.16b, v5.16b
+	eor	x28, x28, x25
+	eor	v28.16b, v2.16b, v7.16b
+	str	x0, [x29, #32]
+	eor	v31.16b, v31.16b, v10.16b
+	str	x28, [x29, #24]
+	eor	v28.16b, v28.16b, v12.16b
+	eor	x1, x3, x8
+	eor	v31.16b, v31.16b, v15.16b
+	eor	x28, x5, x10
+	eor	v28.16b, v28.16b, v17.16b
+	eor	x1, x1, x13
+	eor	v31.16b, v31.16b, v20.16b
+	eor	x28, x28, x15
+	eor	v28.16b, v28.16b, v22.16b
+	eor	x1, x1, x19
+	ushr	v29.2d, v30.2d, #63
+	eor	x28, x28, x21
+	ushr	v26.2d, v28.2d, #63
+	eor	x1, x1, x24
+	sli	v29.2d, v30.2d, #1
+	eor	x28, x28, x26
+	sli	v26.2d, v28.2d, #1
+	eor	x0, x0, x1, ror 63
+	eor	v28.16b, v28.16b, v29.16b
+	eor	x1, x1, x28, ror 63
+	eor	v29.16b, v3.16b, v8.16b
+	eor	x2, x2, x0
+	eor	v26.16b, v26.16b, v31.16b
+	eor	x7, x7, x0
+	eor	v29.16b, v29.16b, v13.16b
+	eor	x12, x12, x0
+	eor	v29.16b, v29.16b, v18.16b
+	eor	x17, x17, x0
+	eor	v29.16b, v29.16b, v23.16b
+	eor	x23, x23, x0
+	ushr	v30.2d, v29.2d, #63
+	eor	x4, x4, x1
+	sli	v30.2d, v29.2d, #1
+	eor	x9, x9, x1
+	eor	v27.16b, v27.16b, v30.16b
+	eor	x14, x14, x1
+	ushr	v30.2d, v31.2d, #63
+	eor	x20, x20, x1
+	sli	v30.2d, v31.2d, #1
+	eor	x25, x25, x1
+	eor	v29.16b, v29.16b, v30.16b
+	ldr	x0, [x29, #32]
+	; Swap Rotate NEON
+	eor	v0.16b, v0.16b, v25.16b
+	eor	v31.16b, v1.16b, v26.16b
+	ldr	x1, [x29, #24]
+	eor	v6.16b, v6.16b, v26.16b
+	eor	x28, x28, x30, ror 63
+	ushr	v30.2d, v31.2d, #63
+	eor	x30, x30, x1, ror 63
+	ushr	v1.2d, v6.2d, #20
+	eor	x1, x1, x0, ror 63
+	sli	v30.2d, v31.2d, #1
+	eor	x6, x6, x28
+	sli	v1.2d, v6.2d, #44
+	eor	x11, x11, x28
+	eor	v31.16b, v9.16b, v29.16b
+	eor	x16, x16, x28
+	eor	v22.16b, v22.16b, v27.16b
+	eor	x22, x22, x28
+	ushr	v6.2d, v31.2d, #44
+	eor	x27, x27, x28
+	ushr	v9.2d, v22.2d, #3
+	eor	x3, x3, x30
+	sli	v6.2d, v31.2d, #20
+	eor	x8, x8, x30
+	sli	v9.2d, v22.2d, #61
+	eor	x13, x13, x30
+	eor	v31.16b, v14.16b, v29.16b
+	eor	x19, x19, x30
+	eor	v20.16b, v20.16b, v25.16b
+	eor	x24, x24, x30
+	ushr	v22.2d, v31.2d, #25
+	eor	x5, x5, x1
+	ushr	v14.2d, v20.2d, #46
+	eor	x10, x10, x1
+	sli	v22.2d, v31.2d, #39
+	eor	x15, x15, x1
+	sli	v14.2d, v20.2d, #18
+	eor	x21, x21, x1
+	eor	v31.16b, v2.16b, v27.16b
+	eor	x26, x26, x1
+	; Swap Rotate Base
+	eor	v12.16b, v12.16b, v27.16b
+	ror	x0, x3, #63
+	ushr	v20.2d, v31.2d, #2
+	ror	x3, x8, #20
+	ushr	v2.2d, v12.2d, #21
+	ror	x8, x11, #44
+	sli	v20.2d, v31.2d, #62
+	ror	x11, x25, #3
+	sli	v2.2d, v12.2d, #43
+	ror	x25, x16, #25
+	eor	v31.16b, v13.16b, v28.16b
+	ror	x16, x23, #46
+	eor	v19.16b, v19.16b, v29.16b
+	ror	x23, x4, #2
+	ushr	v12.2d, v31.2d, #39
+	ror	x4, x14, #21
+	ushr	v13.2d, v19.2d, #56
+	ror	x14, x15, #39
+	sli	v12.2d, v31.2d, #25
+	ror	x15, x22, #56
+	sli	v13.2d, v19.2d, #8
+	ror	x22, x26, #8
+	eor	v31.16b, v23.16b, v28.16b
+	ror	x26, x17, #23
+	eor	v15.16b, v15.16b, v25.16b
+	ror	x17, x6, #37
+	ushr	v19.2d, v31.2d, #8
+	ror	x6, x27, #50
+	ushr	v23.2d, v15.2d, #23
+	ror	x27, x24, #62
+	sli	v19.2d, v31.2d, #56
+	ror	x24, x10, #9
+	sli	v23.2d, v15.2d, #41
+	ror	x10, x19, #19
+	eor	v31.16b, v4.16b, v29.16b
+	ror	x19, x7, #28
+	eor	v24.16b, v24.16b, v29.16b
+	ror	x7, x5, #36
+	ushr	v15.2d, v31.2d, #37
+	ror	x5, x21, #43
+	ushr	v4.2d, v24.2d, #50
+	ror	x21, x20, #49
+	sli	v15.2d, v31.2d, #27
+	ror	x20, x13, #54
+	sli	v4.2d, v24.2d, #14
+	ror	x13, x9, #58
+	eor	v31.16b, v21.16b, v26.16b
+	ror	x9, x12, #61
+	; Row Mix Base
+	eor	v8.16b, v8.16b, v28.16b
+	bic	x12, x4, x3
+	ushr	v24.2d, v31.2d, #62
+	bic	x1, x5, x4
+	ushr	v21.2d, v8.2d, #9
+	bic	x28, x2, x6
+	sli	v24.2d, v31.2d, #2
+	bic	x30, x3, x2
+	sli	v21.2d, v8.2d, #55
+	eor	x2, x2, x12
+	eor	v31.16b, v16.16b, v26.16b
+	eor	x3, x3, x1
+	eor	v5.16b, v5.16b, v25.16b
+	bic	x12, x6, x5
+	ushr	v8.2d, v31.2d, #19
+	eor	x5, x5, x28
+	ushr	v16.2d, v5.2d, #28
+	eor	x4, x4, x12
+	sli	v8.2d, v31.2d, #45
+	eor	x6, x6, x30
+	sli	v16.2d, v5.2d, #36
+	bic	x12, x9, x8
+	eor	v31.16b, v3.16b, v28.16b
+	bic	x1, x10, x9
+	eor	v18.16b, v18.16b, v28.16b
+	bic	x28, x7, x11
+	ushr	v5.2d, v31.2d, #36
+	bic	x30, x8, x7
+	ushr	v3.2d, v18.2d, #43
+	eor	x7, x7, x12
+	sli	v5.2d, v31.2d, #28
+	eor	x8, x8, x1
+	sli	v3.2d, v18.2d, #21
+	bic	x12, x11, x10
+	eor	v31.16b, v17.16b, v27.16b
+	eor	x10, x10, x28
+	eor	v11.16b, v11.16b, v26.16b
+	eor	x9, x9, x12
+	ushr	v18.2d, v31.2d, #49
+	eor	x11, x11, x30
+	ushr	v17.2d, v11.2d, #54
+	bic	x12, x14, x13
+	sli	v18.2d, v31.2d, #15
+	bic	x1, x15, x14
+	sli	v17.2d, v11.2d, #10
+	bic	x28, x0, x16
+	eor	v31.16b, v7.16b, v27.16b
+	bic	x30, x13, x0
+	eor	v10.16b, v10.16b, v25.16b
+	eor	x12, x0, x12
+	ushr	v11.2d, v31.2d, #58
+	eor	x13, x13, x1
+	ushr	v7.2d, v10.2d, #61
+	bic	x0, x16, x15
+	sli	v11.2d, v31.2d, #6
+	eor	x15, x15, x28
+	sli	v7.2d, v10.2d, #3
+	eor	x14, x14, x0
+	; Row Mix NEON
+	bic	v25.16b, v2.16b, v1.16b
+	eor	x16, x16, x30
+	bic	v26.16b, v3.16b, v2.16b
+	bic	x0, x20, x19
+	bic	v27.16b, v4.16b, v3.16b
+	bic	x1, x21, x20
+	bic	v28.16b, v0.16b, v4.16b
+	bic	x28, x17, x22
+	bic	v29.16b, v1.16b, v0.16b
+	bic	x30, x19, x17
+	eor	v0.16b, v0.16b, v25.16b
+	eor	x17, x17, x0
+	eor	v1.16b, v1.16b, v26.16b
+	eor	x19, x19, x1
+	eor	v2.16b, v2.16b, v27.16b
+	bic	x0, x22, x21
+	eor	v3.16b, v3.16b, v28.16b
+	eor	x21, x21, x28
+	eor	v4.16b, v4.16b, v29.16b
+	eor	x20, x20, x0
+	bic	v25.16b, v7.16b, v6.16b
+	eor	x22, x22, x30
+	bic	v26.16b, v8.16b, v7.16b
+	bic	x0, x25, x24
+	bic	v27.16b, v9.16b, v8.16b
+	bic	x1, x26, x25
+	bic	v28.16b, v5.16b, v9.16b
+	bic	x28, x23, x27
+	bic	v29.16b, v6.16b, v5.16b
+	bic	x30, x24, x23
+	eor	v5.16b, v5.16b, v25.16b
+	eor	x23, x23, x0
+	eor	v6.16b, v6.16b, v26.16b
+	eor	x24, x24, x1
+	eor	v7.16b, v7.16b, v27.16b
+	bic	x0, x27, x26
+	eor	v8.16b, v8.16b, v28.16b
+	eor	x26, x26, x28
+	eor	v9.16b, v9.16b, v29.16b
+	eor	x25, x25, x0
+	bic	v25.16b, v12.16b, v11.16b
+	eor	x27, x27, x30
+	bic	v26.16b, v13.16b, v12.16b
+	bic	v27.16b, v14.16b, v13.16b
+	bic	v28.16b, v30.16b, v14.16b
+	bic	v29.16b, v11.16b, v30.16b
+	eor	v10.16b, v30.16b, v25.16b
+	eor	v11.16b, v11.16b, v26.16b
+	eor	v12.16b, v12.16b, v27.16b
+	eor	v13.16b, v13.16b, v28.16b
+	eor	v14.16b, v14.16b, v29.16b
+	bic	v25.16b, v17.16b, v16.16b
+	bic	v26.16b, v18.16b, v17.16b
+	bic	v27.16b, v19.16b, v18.16b
+	bic	v28.16b, v15.16b, v19.16b
+	bic	v29.16b, v16.16b, v15.16b
+	eor	v15.16b, v15.16b, v25.16b
+	eor	v16.16b, v16.16b, v26.16b
+	eor	v17.16b, v17.16b, v27.16b
+	eor	v18.16b, v18.16b, v28.16b
+	eor	v19.16b, v19.16b, v29.16b
+	bic	v25.16b, v22.16b, v21.16b
+	bic	v26.16b, v23.16b, v22.16b
+	bic	v27.16b, v24.16b, v23.16b
+	bic	v28.16b, v20.16b, v24.16b
+	bic	v29.16b, v21.16b, v20.16b
+	eor	v20.16b, v20.16b, v25.16b
+	eor	v21.16b, v21.16b, v26.16b
+	eor	v22.16b, v22.16b, v27.16b
+	eor	v23.16b, v23.16b, v28.16b
+	eor	v24.16b, v24.16b, v29.16b
+	; Done transforming
+	ldp	x28, x1, [x29, #48]
+	ldr	x0, [x28], #8
+	subs	x1, x1, #1
+	mov	v30.d[0], x0
+	mov	v30.d[1], x0
+	eor	x2, x2, x0
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_SHA3_shake256_blocksx3_seed_neon_begin
+	ldr	x0, [x29, #40]
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.d}[0], [x0]
+	add	x0, x0, #8
+	st4	{v0.d, v1.d, v2.d, v3.d}[1], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[1], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[1], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[1], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[1], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[1], [x0], #32
+	st1	{v24.d}[1], [x0]
+	add	x0, x0, #8
+	stp	x2, x3, [x0]
+	stp	x4, x5, [x0, #16]
+	stp	x6, x7, [x0, #32]
+	stp	x8, x9, [x0, #48]
+	stp	x10, x11, [x0, #64]
+	stp	x12, x13, [x0, #80]
+	stp	x14, x15, [x0, #96]
+	stp	x16, x17, [x0, #112]
+	stp	x19, x20, [x0, #128]
+	stp	x21, x22, [x0, #144]
+	stp	x23, x24, [x0, #160]
+	stp	x25, x26, [x0, #176]
+	str	x27, [x0, #192]
+	ldp	x17, x19, [x29, #72]
+	ldp	x20, x21, [x29, #88]
+	ldp	x22, x23, [x29, #104]
+	ldp	x24, x25, [x29, #120]
+	ldp	x26, x27, [x29, #136]
+	ldr	x28, [x29, #152]
+	ldp	d8, d9, [x29, #160]
+	ldp	d10, d11, [x29, #176]
+	ldp	d12, d13, [x29, #192]
+	ldp	d14, d15, [x29, #208]
+	ldp	x29, x30, [sp], #0xe0
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-poly1305-asm.asm b/wolfcrypt/src/port/arm/armv8-poly1305-asm.asm
new file mode 100644
index 0000000000..61940944b3
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-poly1305-asm.asm
@@ -0,0 +1,645 @@
+; /* armv8-poly1305-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./poly1305/poly1305.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-poly1305-asm.asm
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	poly1305_arm64_block_16
+poly1305_arm64_block_16 PROC
+	; Load h
+	ldp	w2, w3, [x0, #96]
+	ldp	w4, w11, [x0, #104]
+	ldr	w12, [x0, #112]
+	; Load m
+	ldr	x14, [x1]
+	ldr	x15, [x1, #8]
+	; Load r
+	ldp	x5, x6, [x0]
+	; h: Base26 -> Base 64
+	add	x2, x2, x3, lsl 26
+	lsr	x3, x4, #12
+	add	x2, x2, x4, lsl 52
+	add	x3, x3, x11, lsl 14
+	lsr	x4, x12, #24
+	add	x3, x3, x12, lsl 40
+	; Add m and !finished at bit 128
+	adds	x2, x2, x14
+	adcs	x3, x3, x15
+	adc	x4, x4, xzr
+	; Multiply h by r
+	; b[0] * a[0]
+	mul	x7, x5, x2
+	umulh	x8, x5, x2
+	; b[0] * a[1]
+	mul	x10, x5, x3
+	umulh	x9, x5, x3
+	; b[1] * a[0]
+	mul	x11, x6, x2
+	umulh	x12, x6, x2
+	adds	x8, x8, x10
+	; b[1] * a[1]
+	mul	x13, x6, x3
+	umulh	x10, x6, x3
+	adc	x9, x9, x12
+	adds	x8, x8, x11
+	; b[0] * a[2]
+	mul	x11, x5, x4
+	adcs	x9, x9, x13
+	; b[1] * a[2]
+	mul	x12, x6, x4
+	adc	x10, x10, xzr
+	adds	x9, x9, x11
+	adc	x10, x10, x12
+	; Reduce mod 2^130 - 5
+	; Get high bits
+	and	x11, x9, #-4
+	; Get top two bits
+	and	x9, x9, #3
+	; Add top bits * 4
+	adds	x2, x7, x11
+	; Move down 2 bits
+	extr	x11, x10, x11, #2
+	adcs	x3, x8, x10
+	lsr	x10, x10, #2
+	adc	x4, x9, xzr
+	; Add top bits.
+	adds	x2, x2, x11
+	adcs	x3, x3, x10
+	adc	x4, x4, xzr
+	extr	x12, x4, x3, #40
+	ubfx	x4, x2, #52, #12
+	ubfx	x11, x3, #14, #26
+	bfi	x4, x3, #12, #14
+	ubfx	x3, x2, #26, #26
+	ubfx	x2, x2, #0, #26
+	stp	w2, w3, [x0, #96]
+	stp	w4, w11, [x0, #104]
+	str	w12, [x0, #112]
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	poly1305_arm64_blocks
+poly1305_arm64_blocks PROC
+	stp	x29, x30, [sp, #-96]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	stp	d8, d9, [x29, #32]
+	stp	d10, d11, [x29, #48]
+	stp	d12, d13, [x29, #64]
+	stp	d14, d15, [x29, #80]
+	cmp	x2, #0x40
+	blt	L_poly1305_arm64_blocks_done
+	; Set mask (0x3ffffff), hi bit and 5 into vector registers
+	movi	v25.16b, #0xff
+	movi	v27.4s, #1, lsl 24
+	ushr	v25.4s, v25.4s, #6
+	movi	v24.4s, #5
+	uxtl	v26.2d, v25.2s
+	add	x14, x0, #16
+	ld4	{v15.4s, v16.4s, v17.4s, v18.4s}, [x14], #0x40
+	ld1	{v19.4s}, [x14]
+	add	x14, x0, #0x60
+	movi	v0.4s, #0
+	movi	v1.4s, #0
+	movi	v2.4s, #0
+	movi	v3.4s, #0
+	movi	v4.4s, #0
+	ld4	{v0.s, v1.s, v2.s, v3.s}[0], [x14], #16
+	ld1	{v4.s}[0], [x14]
+	mul	v20.4s, v16.4s, v24.4s
+	mul	v21.4s, v17.4s, v24.4s
+	mul	v22.4s, v18.4s, v24.4s
+	mul	v23.4s, v19.4s, v24.4s
+L_poly1305_arm64_blocks_loop_64
+	; Load message of 64 bytes - setting hi bit for not finished
+	ld4	{v5.4s, v6.4s, v7.4s, v8.4s}, [x1], #0x40
+	sub	x2, x2, #0x40
+	ushr	v9.4s, v8.4s, #8
+	shl	v8.4s, v8.4s, #18
+	orr	v9.16b, v9.16b, v27.16b
+	sri	v8.4s, v7.4s, #14
+	shl	v7.4s, v7.4s, #12
+	and	v8.16b, v8.16b, v25.16b
+	sri	v7.4s, v6.4s, #20
+	shl	v6.4s, v6.4s, #6
+	and	v7.16b, v7.16b, v25.16b
+	sri	v6.4s, v5.4s, #26
+	and	v5.16b, v5.16b, v25.16b
+	and	v6.16b, v6.16b, v25.16b
+	umull2	v10.2d, v5.4s, v15.4s
+	umull2	v11.2d, v5.4s, v16.4s
+	umull2	v12.2d, v5.4s, v17.4s
+	umull2	v13.2d, v5.4s, v18.4s
+	umull2	v14.2d, v5.4s, v19.4s
+	umlal2	v10.2d, v6.4s, v23.4s
+	umlal2	v11.2d, v6.4s, v15.4s
+	umlal2	v12.2d, v6.4s, v16.4s
+	umlal2	v13.2d, v6.4s, v17.4s
+	umlal2	v14.2d, v6.4s, v18.4s
+	umlal2	v10.2d, v7.4s, v22.4s
+	umlal2	v11.2d, v7.4s, v23.4s
+	umlal2	v12.2d, v7.4s, v15.4s
+	umlal2	v13.2d, v7.4s, v16.4s
+	umlal2	v14.2d, v7.4s, v17.4s
+	umlal2	v10.2d, v8.4s, v21.4s
+	umlal2	v11.2d, v8.4s, v22.4s
+	umlal2	v12.2d, v8.4s, v23.4s
+	umlal2	v13.2d, v8.4s, v15.4s
+	umlal2	v14.2d, v8.4s, v16.4s
+	umlal2	v10.2d, v9.4s, v20.4s
+	umlal2	v11.2d, v9.4s, v21.4s
+	umlal2	v12.2d, v9.4s, v22.4s
+	umlal2	v13.2d, v9.4s, v23.4s
+	umlal2	v14.2d, v9.4s, v15.4s
+	add	v5.4s, v5.4s, v0.4s
+	add	v6.4s, v6.4s, v1.4s
+	add	v7.4s, v7.4s, v2.4s
+	add	v8.4s, v8.4s, v3.4s
+	add	v9.4s, v9.4s, v4.4s
+	umlal	v10.2d, v5.2s, v15.2s
+	umlal	v11.2d, v5.2s, v16.2s
+	umlal	v12.2d, v5.2s, v17.2s
+	umlal	v13.2d, v5.2s, v18.2s
+	umlal	v14.2d, v5.2s, v19.2s
+	umlal	v10.2d, v6.2s, v23.2s
+	umlal	v11.2d, v6.2s, v15.2s
+	umlal	v12.2d, v6.2s, v16.2s
+	umlal	v13.2d, v6.2s, v17.2s
+	umlal	v14.2d, v6.2s, v18.2s
+	umlal	v10.2d, v7.2s, v22.2s
+	umlal	v11.2d, v7.2s, v23.2s
+	umlal	v12.2d, v7.2s, v15.2s
+	umlal	v13.2d, v7.2s, v16.2s
+	umlal	v14.2d, v7.2s, v17.2s
+	umlal	v10.2d, v8.2s, v21.2s
+	umlal	v11.2d, v8.2s, v22.2s
+	umlal	v12.2d, v8.2s, v23.2s
+	umlal	v13.2d, v8.2s, v15.2s
+	umlal	v14.2d, v8.2s, v16.2s
+	umlal	v10.2d, v9.2s, v20.2s
+	umlal	v11.2d, v9.2s, v21.2s
+	umlal	v12.2d, v9.2s, v22.2s
+	umlal	v13.2d, v9.2s, v23.2s
+	umlal	v14.2d, v9.2s, v15.2s
+	addp	d10, v10.2d
+	addp	d11, v11.2d
+	addp	d12, v12.2d
+	addp	d13, v13.2d
+	addp	d14, v14.2d
+	; Redistribute and handle overflow
+	usra	v11.2d, v10.2d, #26
+	and	v10.16b, v10.16b, v26.16b
+	usra	v14.2d, v13.2d, #26
+	and	v3.16b, v13.16b, v26.16b
+	ushr	v2.2d, v14.2d, #26
+	usra	v12.2d, v11.2d, #26
+	shl	v0.2d, v2.2d, #2
+	and	v1.16b, v11.16b, v26.16b
+	add	v0.2d, v0.2d, v2.2d
+	and	v4.16b, v14.16b, v26.16b
+	add	v10.2d, v10.2d, v0.2d
+	usra	v3.2d, v12.2d, #26
+	and	v2.16b, v12.16b, v26.16b
+	usra	v1.2d, v10.2d, #26
+	and	v0.16b, v10.16b, v26.16b
+	usra	v4.2d, v3.2d, #26
+	and	v3.16b, v3.16b, v26.16b
+	cmp	x2, #0x40
+	bge	L_poly1305_arm64_blocks_loop_64
+	cmp	x2, #16
+	ble	L_poly1305_arm64_blocks_done_32
+	; Start 32
+	ld4	{v5.2s, v6.2s, v7.2s, v8.2s}, [x1], #32
+	sub	x2, x2, #32
+	mov	v15.d[0], v15.d[1]
+	mov	v16.d[0], v16.d[1]
+	mov	v17.d[0], v17.d[1]
+	mov	v18.d[0], v18.d[1]
+	mov	v19.d[0], v19.d[1]
+	mov	v20.d[0], v20.d[1]
+	mov	v21.d[0], v21.d[1]
+	mov	v22.d[0], v22.d[1]
+	mov	v23.d[0], v23.d[1]
+	ushr	v9.2s, v8.2s, #8
+	shl	v8.2s, v8.2s, #18
+	orr	v9.8b, v9.8b, v27.8b
+	sri	v8.2s, v7.2s, #14
+	shl	v7.2s, v7.2s, #12
+	and	v8.8b, v8.8b, v25.8b
+	sri	v7.2s, v6.2s, #20
+	shl	v6.2s, v6.2s, #6
+	and	v7.8b, v7.8b, v25.8b
+	sri	v6.2s, v5.2s, #26
+	and	v5.8b, v5.8b, v25.8b
+	and	v6.8b, v6.8b, v25.8b
+	add	v5.2s, v5.2s, v0.2s
+	add	v6.2s, v6.2s, v1.2s
+	add	v7.2s, v7.2s, v2.2s
+	add	v8.2s, v8.2s, v3.2s
+	add	v9.2s, v9.2s, v4.2s
+	umull	v10.2d, v5.2s, v15.2s
+	umull	v11.2d, v5.2s, v16.2s
+	umull	v12.2d, v5.2s, v17.2s
+	umull	v13.2d, v5.2s, v18.2s
+	umull	v14.2d, v5.2s, v19.2s
+	umlal	v10.2d, v6.2s, v23.2s
+	umlal	v11.2d, v6.2s, v15.2s
+	umlal	v12.2d, v6.2s, v16.2s
+	umlal	v13.2d, v6.2s, v17.2s
+	umlal	v14.2d, v6.2s, v18.2s
+	umlal	v10.2d, v7.2s, v22.2s
+	umlal	v11.2d, v7.2s, v23.2s
+	umlal	v12.2d, v7.2s, v15.2s
+	umlal	v13.2d, v7.2s, v16.2s
+	umlal	v14.2d, v7.2s, v17.2s
+	umlal	v10.2d, v8.2s, v21.2s
+	umlal	v11.2d, v8.2s, v22.2s
+	umlal	v12.2d, v8.2s, v23.2s
+	umlal	v13.2d, v8.2s, v15.2s
+	umlal	v14.2d, v8.2s, v16.2s
+	umlal	v10.2d, v9.2s, v20.2s
+	umlal	v11.2d, v9.2s, v21.2s
+	umlal	v12.2d, v9.2s, v22.2s
+	umlal	v13.2d, v9.2s, v23.2s
+	umlal	v14.2d, v9.2s, v15.2s
+	addp	d10, v10.2d
+	addp	d11, v11.2d
+	addp	d12, v12.2d
+	addp	d13, v13.2d
+	addp	d14, v14.2d
+	; Redistribute and handle overflow
+	usra	v11.2d, v10.2d, #26
+	and	v10.16b, v10.16b, v26.16b
+	usra	v14.2d, v13.2d, #26
+	and	v3.16b, v13.16b, v26.16b
+	ushr	v2.2d, v14.2d, #26
+	usra	v12.2d, v11.2d, #26
+	shl	v0.2d, v2.2d, #2
+	and	v1.16b, v11.16b, v26.16b
+	add	v0.2d, v0.2d, v2.2d
+	and	v4.16b, v14.16b, v26.16b
+	add	v10.2d, v10.2d, v0.2d
+	usra	v3.2d, v12.2d, #26
+	and	v2.16b, v12.16b, v26.16b
+	usra	v1.2d, v10.2d, #26
+	and	v0.16b, v10.16b, v26.16b
+	usra	v4.2d, v3.2d, #26
+	and	v3.16b, v3.16b, v26.16b
+L_poly1305_arm64_blocks_done_32
+	cmp	x2, #16
+	beq	L_poly1305_arm64_blocks_transfer
+	add	x14, x0, #0x60
+	st4	{v0.s, v1.s, v2.s, v3.s}[0], [x14], #16
+	st1	{v4.s}[0], [x14]
+	b	L_poly1305_arm64_blocks_done_all
+L_poly1305_arm64_blocks_transfer
+	mov	w3, v0.s[0]
+	mov	w4, v1.s[0]
+	mov	w5, v2.s[0]
+	mov	w6, v3.s[0]
+	mov	w7, v4.s[0]
+	b	L_poly1305_arm64_blocks_start
+L_poly1305_arm64_blocks_done
+	cmp	x2, #16
+	blt	L_poly1305_arm64_blocks_done_all
+	; Load h
+	ldp	w3, w4, [x0, #96]
+	ldp	w5, w6, [x0, #104]
+	ldr	w7, [x0, #112]
+L_poly1305_arm64_blocks_start
+	mov	x17, #1
+	; Load r
+	ldp	x8, x9, [x0]
+	; Base26 -> Base 64
+	add	x3, x3, x4, lsl 26
+	lsr	x4, x5, #12
+	add	x3, x3, x5, lsl 52
+	add	x4, x4, x6, lsl 14
+	lsr	x5, x7, #24
+	add	x4, x4, x7, lsl 40
+L_poly1305_arm64_blocks_loop
+	; Load m
+	ldr	x14, [x1]
+	ldr	x15, [x1, #8]
+	; Add m and !finished at bit 128
+	adds	x3, x3, x14
+	adcs	x4, x4, x15
+	adc	x5, x5, x17
+	; Multiply h by r
+	; b[0] * a[0]
+	mul	x10, x8, x3
+	umulh	x11, x8, x3
+	; b[0] * a[1]
+	mul	x13, x8, x4
+	umulh	x12, x8, x4
+	; b[1] * a[0]
+	mul	x14, x9, x3
+	umulh	x15, x9, x3
+	adds	x11, x11, x13
+	; b[1] * a[1]
+	mul	x16, x9, x4
+	umulh	x13, x9, x4
+	adc	x12, x12, x15
+	adds	x11, x11, x14
+	; b[0] * a[2]
+	mul	x14, x8, x5
+	adcs	x12, x12, x16
+	; b[1] * a[2]
+	mul	x15, x9, x5
+	adc	x13, x13, xzr
+	adds	x12, x12, x14
+	adc	x13, x13, x15
+	; Reduce mod 2^130 - 5
+	; Get high bits
+	and	x14, x12, #-4
+	; Get top two bits
+	and	x12, x12, #3
+	; Add top bits * 4
+	adds	x3, x10, x14
+	; Move down 2 bits
+	extr	x14, x13, x14, #2
+	adcs	x4, x11, x13
+	lsr	x13, x13, #2
+	adc	x5, x12, xzr
+	; Add top bits.
+	adds	x3, x3, x14
+	adcs	x4, x4, x13
+	adc	x5, x5, xzr
+	; Sub 16 from length.
+	subs	x2, x2, #16
+	add	x1, x1, #16
+	; Loop again if more message to do.
+	bgt	L_poly1305_arm64_blocks_loop
+	extr	x7, x5, x4, #40
+	ubfx	x5, x3, #52, #12
+	ubfx	x6, x4, #14, #26
+	bfi	x5, x4, #12, #14
+	ubfx	x4, x3, #26, #26
+	ubfx	x3, x3, #0, #26
+	stp	w3, w4, [x0, #96]
+	stp	w5, w6, [x0, #104]
+	str	w7, [x0, #112]
+L_poly1305_arm64_blocks_done_all
+	ldr	x17, [x29, #24]
+	ldp	d8, d9, [x29, #32]
+	ldp	d10, d11, [x29, #48]
+	ldp	d12, d13, [x29, #64]
+	ldp	d14, d15, [x29, #80]
+	ldp	x29, x30, [sp], #0x60
+	ret
+	ENDP
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_poly1305_set_key_arm64_clamp
+	DCD	0x0fffffff, 0x0ffffffc, 0x0ffffffc, 0x0ffffffc
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	poly1305_set_key
+poly1305_set_key PROC
+	stp	x29, x30, [sp, #-32]!
+	add	x29, sp, #0
+	str	x17, [x29, #24]
+	adrp	x2, L_poly1305_set_key_arm64_clamp
+	add	x2, x2, L_poly1305_set_key_arm64_clamp
+	; Load key and pad.
+	ldp	x11, x12, [x1]
+	ldp	x14, x15, [x1, #16]
+	; Load mask.
+	ldp	x16, x17, [x2]
+	; Save pad for later
+	stp	x14, x15, [x0, #120]
+	; Apply clamp.
+	; r &= 0x0ffffffc0ffffffc0ffffffc0fffffff
+	and	x11, x11, x16
+	and	x12, x12, x17
+	; Store r - 64-bit version.
+	stp	x11, x12, [x0]
+	; 128-bits: Base 64 -> Base 26
+	lsr	x7, x12, #40
+	ubfx	x5, x11, #52, #12
+	ubfx	x6, x12, #14, #26
+	bfi	x5, x12, #12, #14
+	ubfx	x4, x11, #26, #26
+	ubfx	x3, x11, #0, #26
+	stp	w3, w4, [x0, #64]
+	stp	w5, w6, [x0, #72]
+	str	w7, [x0, #92]
+	; Compute r^2
+	; a[0] * a[0]
+	mul	x3, x11, x11
+	umulh	x4, x11, x11
+	; 2 * a[0] * a[1]
+	mul	x14, x11, x12
+	umulh	x5, x11, x12
+	; a[1] * a[1]
+	mul	x15, x12, x12
+	umulh	x6, x12, x12
+	adds	x4, x4, x14, lsl 1
+	extr	x5, x5, x14, #63
+	adcs	x5, x5, x15
+	adc	x6, x6, xzr
+	; Reduce mod 2^130 - 5
+	; Get high bits
+	and	x14, x5, #-4
+	; Get top two bits
+	and	x5, x5, #3
+	; Add top bits * 4
+	adds	x8, x3, x14
+	; Move down 2 bits
+	extr	x14, x6, x14, #2
+	adcs	x9, x4, x6
+	lsr	x6, x6, #2
+	adc	x10, x5, xzr
+	; Add top bits.
+	adds	x8, x8, x14
+	adcs	x9, x9, x6
+	adc	x10, x10, xzr
+	; 130-bits: Base 64 -> Base 26
+	extr	x7, x10, x9, #40
+	ubfx	x5, x8, #52, #12
+	ubfx	x6, x9, #14, #26
+	bfi	x5, x9, #12, #14
+	ubfx	x4, x8, #26, #26
+	ubfx	x3, x8, #0, #26
+	stp	w3, w4, [x0, #48]
+	stp	w5, w6, [x0, #56]
+	str	w7, [x0, #88]
+	; Compute r^3
+	; b[0] * a[0]
+	mul	x3, x11, x8
+	umulh	x4, x11, x8
+	; b[0] * a[1]
+	mul	x6, x11, x9
+	umulh	x5, x11, x9
+	; b[1] * a[0]
+	mul	x14, x12, x8
+	umulh	x15, x12, x8
+	adds	x4, x4, x6
+	; b[1] * a[1]
+	mul	x16, x12, x9
+	umulh	x6, x12, x9
+	adc	x5, x5, x15
+	adds	x4, x4, x14
+	; b[0] * a[2]
+	mul	x14, x11, x10
+	adcs	x5, x5, x16
+	; b[1] * a[2]
+	mul	x15, x12, x10
+	adc	x6, x6, xzr
+	adds	x5, x5, x14
+	adc	x6, x6, x15
+	; Reduce mod 2^130 - 5
+	; Get high bits
+	and	x14, x5, #-4
+	; Get top two bits
+	and	x5, x5, #3
+	; Add top bits * 4
+	adds	x8, x3, x14
+	; Move down 2 bits
+	extr	x14, x6, x14, #2
+	adcs	x9, x4, x6
+	lsr	x6, x6, #2
+	adc	x10, x5, xzr
+	; Add top bits.
+	adds	x8, x8, x14
+	adcs	x9, x9, x6
+	adc	x10, x10, xzr
+	; 130-bits: Base 64 -> Base 26
+	extr	x7, x10, x9, #40
+	ubfx	x5, x8, #52, #12
+	ubfx	x6, x9, #14, #26
+	bfi	x5, x9, #12, #14
+	ubfx	x4, x8, #26, #26
+	ubfx	x3, x8, #0, #26
+	stp	w3, w4, [x0, #32]
+	stp	w5, w6, [x0, #40]
+	str	w7, [x0, #84]
+	; Compute r^4
+	; b[0] * a[0]
+	mul	x3, x11, x8
+	umulh	x4, x11, x8
+	; b[0] * a[1]
+	mul	x6, x11, x9
+	umulh	x5, x11, x9
+	; b[1] * a[0]
+	mul	x14, x12, x8
+	umulh	x15, x12, x8
+	adds	x4, x4, x6
+	; b[1] * a[1]
+	mul	x16, x12, x9
+	umulh	x6, x12, x9
+	adc	x5, x5, x15
+	adds	x4, x4, x14
+	; b[0] * a[2]
+	mul	x14, x11, x10
+	adcs	x5, x5, x16
+	; b[1] * a[2]
+	mul	x15, x12, x10
+	adc	x6, x6, xzr
+	adds	x5, x5, x14
+	adc	x6, x6, x15
+	; Reduce mod 2^130 - 5
+	; Get high bits
+	and	x14, x5, #-4
+	; Get top two bits
+	and	x5, x5, #3
+	; Add top bits * 4
+	adds	x11, x3, x14
+	; Move down 2 bits
+	extr	x14, x6, x14, #2
+	adcs	x12, x4, x6
+	lsr	x6, x6, #2
+	adc	x13, x5, xzr
+	; Add top bits.
+	adds	x11, x11, x14
+	adcs	x12, x12, x6
+	adc	x13, x13, xzr
+	; 130-bits: Base 64 -> Base 26
+	extr	x7, x13, x12, #40
+	ubfx	x5, x11, #52, #12
+	ubfx	x6, x12, #14, #26
+	bfi	x5, x12, #12, #14
+	ubfx	x4, x11, #26, #26
+	ubfx	x3, x11, #0, #26
+	stp	w3, w4, [x0, #16]
+	stp	w5, w6, [x0, #24]
+	str	w7, [x0, #80]
+	; h (accumulator) = 0
+	stp	xzr, xzr, [x0, #96]
+	str	wzr, [x0, #112]
+	; Zero leftover
+	str	xzr, [x0, #136]
+	; Zero finished
+	strb	wzr, [x0, #160]
+	ldr	x17, [x29, #24]
+	ldp	x29, x30, [sp], #32
+	ret
+	ENDP
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	poly1305_final
+poly1305_final PROC
+	ldp	x8, x9, [x0, #120]
+	ldp	w2, w3, [x0, #96]
+	ldp	w4, w5, [x0, #104]
+	ldr	w6, [x0, #112]
+	add	x2, x2, x3, lsl 26
+	lsr	x3, x4, #12
+	add	x2, x2, x4, lsl 52
+	add	x3, x3, x5, lsl 14
+	lsr	x4, x6, #24
+	add	x3, x3, x6, lsl 40
+	; Add 5 to h.
+	adds	x5, x2, #5
+	adcs	x6, x3, xzr
+	adc	x7, x4, xzr
+	; Check if h+5 s larger than p.
+	cmp	x7, #3
+	csel	x2, x5, x2, hi
+	csel	x3, x6, x3, hi
+	; Add padding
+	adds	x2, x2, x8
+	adc	x3, x3, x9
+	; Store MAC
+	stp	x2, x3, [x1]
+	; Zero out h.
+	stp	xzr, xzr, [x0, #96]
+	str	wzr, [x0, #112]
+	; Zero out r64.
+	stp	xzr, xzr, [x0]
+	; Zero out r.
+	stp	xzr, xzr, [x0, #16]
+	; Zero out r_2.
+	stp	xzr, xzr, [x0, #48]
+	str	xzr, [x0, #64]
+	; Zero out r_4.
+	stp	xzr, xzr, [x0, #16]
+	str	xzr, [x0, #32]
+	; Zero out pad.
+	stp	xzr, xzr, [x0, #120]
+	ret
+	ENDP
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-sha256-asm.asm b/wolfcrypt/src/port/arm/armv8-sha256-asm.asm
new file mode 100644
index 0000000000..877ff66414
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-sha256-asm.asm
@@ -0,0 +1,1193 @@
+; /* armv8-sha256-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./sha2/sha256.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-sha256-asm.asm
+	IF :LNOT::DEF:NO_SHA256 :LOR: :DEF:WOLFSSL_SHA224
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_SHA256_transform_neon_len_k
+	DCD	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
+	DCD	0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
+	DCD	0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
+	DCD	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174
+	DCD	0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc
+	DCD	0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da
+	DCD	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7
+	DCD	0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967
+	DCD	0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13
+	DCD	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85
+	DCD	0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3
+	DCD	0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070
+	DCD	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5
+	DCD	0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
+	DCD	0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
+	DCD	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	Transform_Sha256_Len_neon
+Transform_Sha256_Len_neon PROC
+	stp	x29, x30, [sp, #-112]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #24]
+	stp	x20, x21, [x29, #40]
+	stp	x22, x23, [x29, #56]
+	str	x24, [x29, #72]
+	stp	d8, d9, [x29, #80]
+	stp	d10, d11, [x29, #96]
+	adrp	x3, L_SHA256_transform_neon_len_k
+	add	x3, x3, L_SHA256_transform_neon_len_k
+	; Load digest into working vars
+	ldr	w4, [x0]
+	ldr	w5, [x0, #4]
+	ldr	w6, [x0, #8]
+	ldr	w7, [x0, #12]
+	ldr	w8, [x0, #16]
+	ldr	w9, [x0, #20]
+	ldr	w10, [x0, #24]
+	ldr	w11, [x0, #28]
+	; Start of loop processing a block
+L_sha256_len_neon_begin
+	; Load W
+	; Copy digest to add in at end
+	ld1	{v0.8b, v1.8b, v2.8b, v3.8b}, [x1], #32
+	mov	w15, w4
+	ld1	{v4.8b, v5.8b, v6.8b, v7.8b}, [x1], #32
+	mov	w16, w5
+	rev32	v0.8b, v0.8b
+	mov	w17, w6
+	rev32	v1.8b, v1.8b
+	mov	w19, w7
+	rev32	v2.8b, v2.8b
+	mov	w20, w8
+	rev32	v3.8b, v3.8b
+	mov	w21, w9
+	rev32	v4.8b, v4.8b
+	mov	w22, w10
+	rev32	v5.8b, v5.8b
+	mov	w23, w11
+	rev32	v6.8b, v6.8b
+	rev32	v7.8b, v7.8b
+	mov	x24, #3
+	; Start of 16 rounds
+L_sha256_len_neon_start
+	; Round 0
+	mov	w14, v0.s[0]
+	ror	w12, w8, #6
+	eor	w13, w9, w10
+	eor	w12, w12, w8, ror 11
+	and	w13, w13, w8
+	eor	w12, w12, w8, ror 25
+	eor	w13, w13, w10
+	add	w11, w11, w12
+	add	w11, w11, w13
+	ldr	w12, [x3]
+	add	w11, w11, w14
+	add	w11, w11, w12
+	add	w7, w7, w11
+	ror	w12, w4, #2
+	eor	w13, w4, w5
+	eor	w12, w12, w4, ror 13
+	eor	w14, w5, w6
+	and	w13, w13, w14
+	eor	w12, w12, w4, ror 22
+	eor	w13, w13, w5
+	add	w11, w11, w12
+	add	w11, w11, w13
+	; Round 1
+	mov	w14, v0.s[1]
+	; Calc new W[0]-W[1]
+	ext	v10.8b, v0.8b, v1.8b, #4
+	ror	w12, w7, #6
+	shl	v8.2s, v7.2s, #15
+	eor	w13, w8, w9
+	sri	v8.2s, v7.2s, #17
+	eor	w12, w12, w7, ror 11
+	shl	v9.2s, v7.2s, #13
+	and	w13, w13, w7
+	sri	v9.2s, v7.2s, #19
+	eor	w12, w12, w7, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w9
+	ushr	v8.2s, v7.2s, #10
+	add	w10, w10, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w10, w10, w13
+	add	v0.2s, v0.2s, v9.2s
+	ldr	w12, [x3, #4]
+	ext	v11.8b, v4.8b, v5.8b, #4
+	add	w10, w10, w14
+	add	v0.2s, v0.2s, v11.2s
+	add	w10, w10, w12
+	shl	v8.2s, v10.2s, #25
+	add	w6, w6, w10
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w11, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w11, w4
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w11, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w4, w5
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w11, ror 22
+	add	v0.2s, v0.2s, v9.2s
+	eor	w13, w13, w4
+	add	w10, w10, w12
+	add	w10, w10, w13
+	; Round 2
+	mov	w14, v1.s[0]
+	ror	w12, w6, #6
+	eor	w13, w7, w8
+	eor	w12, w12, w6, ror 11
+	and	w13, w13, w6
+	eor	w12, w12, w6, ror 25
+	eor	w13, w13, w8
+	add	w9, w9, w12
+	add	w9, w9, w13
+	ldr	w12, [x3, #8]
+	add	w9, w9, w14
+	add	w9, w9, w12
+	add	w5, w5, w9
+	ror	w12, w10, #2
+	eor	w13, w10, w11
+	eor	w12, w12, w10, ror 13
+	eor	w14, w11, w4
+	and	w13, w13, w14
+	eor	w12, w12, w10, ror 22
+	eor	w13, w13, w11
+	add	w9, w9, w12
+	add	w9, w9, w13
+	; Round 3
+	mov	w14, v1.s[1]
+	; Calc new W[2]-W[3]
+	ext	v10.8b, v1.8b, v2.8b, #4
+	ror	w12, w5, #6
+	shl	v8.2s, v0.2s, #15
+	eor	w13, w6, w7
+	sri	v8.2s, v0.2s, #17
+	eor	w12, w12, w5, ror 11
+	shl	v9.2s, v0.2s, #13
+	and	w13, w13, w5
+	sri	v9.2s, v0.2s, #19
+	eor	w12, w12, w5, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w7
+	ushr	v8.2s, v0.2s, #10
+	add	w8, w8, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w8, w8, w13
+	add	v1.2s, v1.2s, v9.2s
+	ldr	w12, [x3, #12]
+	ext	v11.8b, v5.8b, v6.8b, #4
+	add	w8, w8, w14
+	add	v1.2s, v1.2s, v11.2s
+	add	w8, w8, w12
+	shl	v8.2s, v10.2s, #25
+	add	w4, w4, w8
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w9, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w9, w10
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w9, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w10, w11
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w9, ror 22
+	add	v1.2s, v1.2s, v9.2s
+	eor	w13, w13, w10
+	add	w8, w8, w12
+	add	w8, w8, w13
+	; Round 4
+	mov	w14, v2.s[0]
+	ror	w12, w4, #6
+	eor	w13, w5, w6
+	eor	w12, w12, w4, ror 11
+	and	w13, w13, w4
+	eor	w12, w12, w4, ror 25
+	eor	w13, w13, w6
+	add	w7, w7, w12
+	add	w7, w7, w13
+	ldr	w12, [x3, #16]
+	add	w7, w7, w14
+	add	w7, w7, w12
+	add	w11, w11, w7
+	ror	w12, w8, #2
+	eor	w13, w8, w9
+	eor	w12, w12, w8, ror 13
+	eor	w14, w9, w10
+	and	w13, w13, w14
+	eor	w12, w12, w8, ror 22
+	eor	w13, w13, w9
+	add	w7, w7, w12
+	add	w7, w7, w13
+	; Round 5
+	mov	w14, v2.s[1]
+	; Calc new W[4]-W[5]
+	ext	v10.8b, v2.8b, v3.8b, #4
+	ror	w12, w11, #6
+	shl	v8.2s, v1.2s, #15
+	eor	w13, w4, w5
+	sri	v8.2s, v1.2s, #17
+	eor	w12, w12, w11, ror 11
+	shl	v9.2s, v1.2s, #13
+	and	w13, w13, w11
+	sri	v9.2s, v1.2s, #19
+	eor	w12, w12, w11, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w5
+	ushr	v8.2s, v1.2s, #10
+	add	w6, w6, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w6, w6, w13
+	add	v2.2s, v2.2s, v9.2s
+	ldr	w12, [x3, #20]
+	ext	v11.8b, v6.8b, v7.8b, #4
+	add	w6, w6, w14
+	add	v2.2s, v2.2s, v11.2s
+	add	w6, w6, w12
+	shl	v8.2s, v10.2s, #25
+	add	w10, w10, w6
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w7, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w7, w8
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w7, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w8, w9
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w7, ror 22
+	add	v2.2s, v2.2s, v9.2s
+	eor	w13, w13, w8
+	add	w6, w6, w12
+	add	w6, w6, w13
+	; Round 6
+	mov	w14, v3.s[0]
+	ror	w12, w10, #6
+	eor	w13, w11, w4
+	eor	w12, w12, w10, ror 11
+	and	w13, w13, w10
+	eor	w12, w12, w10, ror 25
+	eor	w13, w13, w4
+	add	w5, w5, w12
+	add	w5, w5, w13
+	ldr	w12, [x3, #24]
+	add	w5, w5, w14
+	add	w5, w5, w12
+	add	w9, w9, w5
+	ror	w12, w6, #2
+	eor	w13, w6, w7
+	eor	w12, w12, w6, ror 13
+	eor	w14, w7, w8
+	and	w13, w13, w14
+	eor	w12, w12, w6, ror 22
+	eor	w13, w13, w7
+	add	w5, w5, w12
+	add	w5, w5, w13
+	; Round 7
+	mov	w14, v3.s[1]
+	; Calc new W[6]-W[7]
+	ext	v10.8b, v3.8b, v4.8b, #4
+	ror	w12, w9, #6
+	shl	v8.2s, v2.2s, #15
+	eor	w13, w10, w11
+	sri	v8.2s, v2.2s, #17
+	eor	w12, w12, w9, ror 11
+	shl	v9.2s, v2.2s, #13
+	and	w13, w13, w9
+	sri	v9.2s, v2.2s, #19
+	eor	w12, w12, w9, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w11
+	ushr	v8.2s, v2.2s, #10
+	add	w4, w4, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w4, w4, w13
+	add	v3.2s, v3.2s, v9.2s
+	ldr	w12, [x3, #28]
+	ext	v11.8b, v7.8b, v0.8b, #4
+	add	w4, w4, w14
+	add	v3.2s, v3.2s, v11.2s
+	add	w4, w4, w12
+	shl	v8.2s, v10.2s, #25
+	add	w8, w8, w4
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w5, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w5, w6
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w5, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w6, w7
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w5, ror 22
+	add	v3.2s, v3.2s, v9.2s
+	eor	w13, w13, w6
+	add	w4, w4, w12
+	add	w4, w4, w13
+	; Round 8
+	mov	w14, v4.s[0]
+	ror	w12, w8, #6
+	eor	w13, w9, w10
+	eor	w12, w12, w8, ror 11
+	and	w13, w13, w8
+	eor	w12, w12, w8, ror 25
+	eor	w13, w13, w10
+	add	w11, w11, w12
+	add	w11, w11, w13
+	ldr	w12, [x3, #32]
+	add	w11, w11, w14
+	add	w11, w11, w12
+	add	w7, w7, w11
+	ror	w12, w4, #2
+	eor	w13, w4, w5
+	eor	w12, w12, w4, ror 13
+	eor	w14, w5, w6
+	and	w13, w13, w14
+	eor	w12, w12, w4, ror 22
+	eor	w13, w13, w5
+	add	w11, w11, w12
+	add	w11, w11, w13
+	; Round 9
+	mov	w14, v4.s[1]
+	; Calc new W[8]-W[9]
+	ext	v10.8b, v4.8b, v5.8b, #4
+	ror	w12, w7, #6
+	shl	v8.2s, v3.2s, #15
+	eor	w13, w8, w9
+	sri	v8.2s, v3.2s, #17
+	eor	w12, w12, w7, ror 11
+	shl	v9.2s, v3.2s, #13
+	and	w13, w13, w7
+	sri	v9.2s, v3.2s, #19
+	eor	w12, w12, w7, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w9
+	ushr	v8.2s, v3.2s, #10
+	add	w10, w10, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w10, w10, w13
+	add	v4.2s, v4.2s, v9.2s
+	ldr	w12, [x3, #36]
+	ext	v11.8b, v0.8b, v1.8b, #4
+	add	w10, w10, w14
+	add	v4.2s, v4.2s, v11.2s
+	add	w10, w10, w12
+	shl	v8.2s, v10.2s, #25
+	add	w6, w6, w10
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w11, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w11, w4
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w11, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w4, w5
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w11, ror 22
+	add	v4.2s, v4.2s, v9.2s
+	eor	w13, w13, w4
+	add	w10, w10, w12
+	add	w10, w10, w13
+	; Round 10
+	mov	w14, v5.s[0]
+	ror	w12, w6, #6
+	eor	w13, w7, w8
+	eor	w12, w12, w6, ror 11
+	and	w13, w13, w6
+	eor	w12, w12, w6, ror 25
+	eor	w13, w13, w8
+	add	w9, w9, w12
+	add	w9, w9, w13
+	ldr	w12, [x3, #40]
+	add	w9, w9, w14
+	add	w9, w9, w12
+	add	w5, w5, w9
+	ror	w12, w10, #2
+	eor	w13, w10, w11
+	eor	w12, w12, w10, ror 13
+	eor	w14, w11, w4
+	and	w13, w13, w14
+	eor	w12, w12, w10, ror 22
+	eor	w13, w13, w11
+	add	w9, w9, w12
+	add	w9, w9, w13
+	; Round 11
+	mov	w14, v5.s[1]
+	; Calc new W[10]-W[11]
+	ext	v10.8b, v5.8b, v6.8b, #4
+	ror	w12, w5, #6
+	shl	v8.2s, v4.2s, #15
+	eor	w13, w6, w7
+	sri	v8.2s, v4.2s, #17
+	eor	w12, w12, w5, ror 11
+	shl	v9.2s, v4.2s, #13
+	and	w13, w13, w5
+	sri	v9.2s, v4.2s, #19
+	eor	w12, w12, w5, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w7
+	ushr	v8.2s, v4.2s, #10
+	add	w8, w8, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w8, w8, w13
+	add	v5.2s, v5.2s, v9.2s
+	ldr	w12, [x3, #44]
+	ext	v11.8b, v1.8b, v2.8b, #4
+	add	w8, w8, w14
+	add	v5.2s, v5.2s, v11.2s
+	add	w8, w8, w12
+	shl	v8.2s, v10.2s, #25
+	add	w4, w4, w8
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w9, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w9, w10
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w9, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w10, w11
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w9, ror 22
+	add	v5.2s, v5.2s, v9.2s
+	eor	w13, w13, w10
+	add	w8, w8, w12
+	add	w8, w8, w13
+	; Round 12
+	mov	w14, v6.s[0]
+	ror	w12, w4, #6
+	eor	w13, w5, w6
+	eor	w12, w12, w4, ror 11
+	and	w13, w13, w4
+	eor	w12, w12, w4, ror 25
+	eor	w13, w13, w6
+	add	w7, w7, w12
+	add	w7, w7, w13
+	ldr	w12, [x3, #48]
+	add	w7, w7, w14
+	add	w7, w7, w12
+	add	w11, w11, w7
+	ror	w12, w8, #2
+	eor	w13, w8, w9
+	eor	w12, w12, w8, ror 13
+	eor	w14, w9, w10
+	and	w13, w13, w14
+	eor	w12, w12, w8, ror 22
+	eor	w13, w13, w9
+	add	w7, w7, w12
+	add	w7, w7, w13
+	; Round 13
+	mov	w14, v6.s[1]
+	; Calc new W[12]-W[13]
+	ext	v10.8b, v6.8b, v7.8b, #4
+	ror	w12, w11, #6
+	shl	v8.2s, v5.2s, #15
+	eor	w13, w4, w5
+	sri	v8.2s, v5.2s, #17
+	eor	w12, w12, w11, ror 11
+	shl	v9.2s, v5.2s, #13
+	and	w13, w13, w11
+	sri	v9.2s, v5.2s, #19
+	eor	w12, w12, w11, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w5
+	ushr	v8.2s, v5.2s, #10
+	add	w6, w6, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w6, w6, w13
+	add	v6.2s, v6.2s, v9.2s
+	ldr	w12, [x3, #52]
+	ext	v11.8b, v2.8b, v3.8b, #4
+	add	w6, w6, w14
+	add	v6.2s, v6.2s, v11.2s
+	add	w6, w6, w12
+	shl	v8.2s, v10.2s, #25
+	add	w10, w10, w6
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w7, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w7, w8
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w7, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w8, w9
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w7, ror 22
+	add	v6.2s, v6.2s, v9.2s
+	eor	w13, w13, w8
+	add	w6, w6, w12
+	add	w6, w6, w13
+	; Round 14
+	mov	w14, v7.s[0]
+	ror	w12, w10, #6
+	eor	w13, w11, w4
+	eor	w12, w12, w10, ror 11
+	and	w13, w13, w10
+	eor	w12, w12, w10, ror 25
+	eor	w13, w13, w4
+	add	w5, w5, w12
+	add	w5, w5, w13
+	ldr	w12, [x3, #56]
+	add	w5, w5, w14
+	add	w5, w5, w12
+	add	w9, w9, w5
+	ror	w12, w6, #2
+	eor	w13, w6, w7
+	eor	w12, w12, w6, ror 13
+	eor	w14, w7, w8
+	and	w13, w13, w14
+	eor	w12, w12, w6, ror 22
+	eor	w13, w13, w7
+	add	w5, w5, w12
+	add	w5, w5, w13
+	; Round 15
+	mov	w14, v7.s[1]
+	; Calc new W[14]-W[15]
+	ext	v10.8b, v7.8b, v0.8b, #4
+	ror	w12, w9, #6
+	shl	v8.2s, v6.2s, #15
+	eor	w13, w10, w11
+	sri	v8.2s, v6.2s, #17
+	eor	w12, w12, w9, ror 11
+	shl	v9.2s, v6.2s, #13
+	and	w13, w13, w9
+	sri	v9.2s, v6.2s, #19
+	eor	w12, w12, w9, ror 25
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w13, w13, w11
+	ushr	v8.2s, v6.2s, #10
+	add	w4, w4, w12
+	eor	v9.8b, v9.8b, v8.8b
+	add	w4, w4, w13
+	add	v7.2s, v7.2s, v9.2s
+	ldr	w12, [x3, #60]
+	ext	v11.8b, v3.8b, v4.8b, #4
+	add	w4, w4, w14
+	add	v7.2s, v7.2s, v11.2s
+	add	w4, w4, w12
+	shl	v8.2s, v10.2s, #25
+	add	w8, w8, w4
+	sri	v8.2s, v10.2s, #7
+	ror	w12, w5, #2
+	shl	v9.2s, v10.2s, #14
+	eor	w13, w5, w6
+	sri	v9.2s, v10.2s, #18
+	eor	w12, w12, w5, ror 13
+	eor	v9.8b, v9.8b, v8.8b
+	eor	w14, w6, w7
+	ushr	v10.2s, v10.2s, #3
+	and	w13, w13, w14
+	eor	v9.8b, v9.8b, v10.8b
+	eor	w12, w12, w5, ror 22
+	add	v7.2s, v7.2s, v9.2s
+	eor	w13, w13, w6
+	add	w4, w4, w12
+	add	w4, w4, w13
+	add	x3, x3, #0x40
+	subs	x24, x24, #1
+	bne	L_sha256_len_neon_start
+	; Round 0
+	mov	w14, v0.s[0]
+	ror	w12, w8, #6
+	eor	w13, w9, w10
+	eor	w12, w12, w8, ror 11
+	and	w13, w13, w8
+	eor	w12, w12, w8, ror 25
+	eor	w13, w13, w10
+	add	w11, w11, w12
+	add	w11, w11, w13
+	ldr	w12, [x3]
+	add	w11, w11, w14
+	add	w11, w11, w12
+	add	w7, w7, w11
+	ror	w12, w4, #2
+	eor	w13, w4, w5
+	eor	w12, w12, w4, ror 13
+	eor	w14, w5, w6
+	and	w13, w13, w14
+	eor	w12, w12, w4, ror 22
+	eor	w13, w13, w5
+	add	w11, w11, w12
+	add	w11, w11, w13
+	; Round 1
+	mov	w14, v0.s[1]
+	ror	w12, w7, #6
+	eor	w13, w8, w9
+	eor	w12, w12, w7, ror 11
+	and	w13, w13, w7
+	eor	w12, w12, w7, ror 25
+	eor	w13, w13, w9
+	add	w10, w10, w12
+	add	w10, w10, w13
+	ldr	w12, [x3, #4]
+	add	w10, w10, w14
+	add	w10, w10, w12
+	add	w6, w6, w10
+	ror	w12, w11, #2
+	eor	w13, w11, w4
+	eor	w12, w12, w11, ror 13
+	eor	w14, w4, w5
+	and	w13, w13, w14
+	eor	w12, w12, w11, ror 22
+	eor	w13, w13, w4
+	add	w10, w10, w12
+	add	w10, w10, w13
+	; Round 2
+	mov	w14, v1.s[0]
+	ror	w12, w6, #6
+	eor	w13, w7, w8
+	eor	w12, w12, w6, ror 11
+	and	w13, w13, w6
+	eor	w12, w12, w6, ror 25
+	eor	w13, w13, w8
+	add	w9, w9, w12
+	add	w9, w9, w13
+	ldr	w12, [x3, #8]
+	add	w9, w9, w14
+	add	w9, w9, w12
+	add	w5, w5, w9
+	ror	w12, w10, #2
+	eor	w13, w10, w11
+	eor	w12, w12, w10, ror 13
+	eor	w14, w11, w4
+	and	w13, w13, w14
+	eor	w12, w12, w10, ror 22
+	eor	w13, w13, w11
+	add	w9, w9, w12
+	add	w9, w9, w13
+	; Round 3
+	mov	w14, v1.s[1]
+	ror	w12, w5, #6
+	eor	w13, w6, w7
+	eor	w12, w12, w5, ror 11
+	and	w13, w13, w5
+	eor	w12, w12, w5, ror 25
+	eor	w13, w13, w7
+	add	w8, w8, w12
+	add	w8, w8, w13
+	ldr	w12, [x3, #12]
+	add	w8, w8, w14
+	add	w8, w8, w12
+	add	w4, w4, w8
+	ror	w12, w9, #2
+	eor	w13, w9, w10
+	eor	w12, w12, w9, ror 13
+	eor	w14, w10, w11
+	and	w13, w13, w14
+	eor	w12, w12, w9, ror 22
+	eor	w13, w13, w10
+	add	w8, w8, w12
+	add	w8, w8, w13
+	; Round 4
+	mov	w14, v2.s[0]
+	ror	w12, w4, #6
+	eor	w13, w5, w6
+	eor	w12, w12, w4, ror 11
+	and	w13, w13, w4
+	eor	w12, w12, w4, ror 25
+	eor	w13, w13, w6
+	add	w7, w7, w12
+	add	w7, w7, w13
+	ldr	w12, [x3, #16]
+	add	w7, w7, w14
+	add	w7, w7, w12
+	add	w11, w11, w7
+	ror	w12, w8, #2
+	eor	w13, w8, w9
+	eor	w12, w12, w8, ror 13
+	eor	w14, w9, w10
+	and	w13, w13, w14
+	eor	w12, w12, w8, ror 22
+	eor	w13, w13, w9
+	add	w7, w7, w12
+	add	w7, w7, w13
+	; Round 5
+	mov	w14, v2.s[1]
+	ror	w12, w11, #6
+	eor	w13, w4, w5
+	eor	w12, w12, w11, ror 11
+	and	w13, w13, w11
+	eor	w12, w12, w11, ror 25
+	eor	w13, w13, w5
+	add	w6, w6, w12
+	add	w6, w6, w13
+	ldr	w12, [x3, #20]
+	add	w6, w6, w14
+	add	w6, w6, w12
+	add	w10, w10, w6
+	ror	w12, w7, #2
+	eor	w13, w7, w8
+	eor	w12, w12, w7, ror 13
+	eor	w14, w8, w9
+	and	w13, w13, w14
+	eor	w12, w12, w7, ror 22
+	eor	w13, w13, w8
+	add	w6, w6, w12
+	add	w6, w6, w13
+	; Round 6
+	mov	w14, v3.s[0]
+	ror	w12, w10, #6
+	eor	w13, w11, w4
+	eor	w12, w12, w10, ror 11
+	and	w13, w13, w10
+	eor	w12, w12, w10, ror 25
+	eor	w13, w13, w4
+	add	w5, w5, w12
+	add	w5, w5, w13
+	ldr	w12, [x3, #24]
+	add	w5, w5, w14
+	add	w5, w5, w12
+	add	w9, w9, w5
+	ror	w12, w6, #2
+	eor	w13, w6, w7
+	eor	w12, w12, w6, ror 13
+	eor	w14, w7, w8
+	and	w13, w13, w14
+	eor	w12, w12, w6, ror 22
+	eor	w13, w13, w7
+	add	w5, w5, w12
+	add	w5, w5, w13
+	; Round 7
+	mov	w14, v3.s[1]
+	ror	w12, w9, #6
+	eor	w13, w10, w11
+	eor	w12, w12, w9, ror 11
+	and	w13, w13, w9
+	eor	w12, w12, w9, ror 25
+	eor	w13, w13, w11
+	add	w4, w4, w12
+	add	w4, w4, w13
+	ldr	w12, [x3, #28]
+	add	w4, w4, w14
+	add	w4, w4, w12
+	add	w8, w8, w4
+	ror	w12, w5, #2
+	eor	w13, w5, w6
+	eor	w12, w12, w5, ror 13
+	eor	w14, w6, w7
+	and	w13, w13, w14
+	eor	w12, w12, w5, ror 22
+	eor	w13, w13, w6
+	add	w4, w4, w12
+	add	w4, w4, w13
+	; Round 8
+	mov	w14, v4.s[0]
+	ror	w12, w8, #6
+	eor	w13, w9, w10
+	eor	w12, w12, w8, ror 11
+	and	w13, w13, w8
+	eor	w12, w12, w8, ror 25
+	eor	w13, w13, w10
+	add	w11, w11, w12
+	add	w11, w11, w13
+	ldr	w12, [x3, #32]
+	add	w11, w11, w14
+	add	w11, w11, w12
+	add	w7, w7, w11
+	ror	w12, w4, #2
+	eor	w13, w4, w5
+	eor	w12, w12, w4, ror 13
+	eor	w14, w5, w6
+	and	w13, w13, w14
+	eor	w12, w12, w4, ror 22
+	eor	w13, w13, w5
+	add	w11, w11, w12
+	add	w11, w11, w13
+	; Round 9
+	mov	w14, v4.s[1]
+	ror	w12, w7, #6
+	eor	w13, w8, w9
+	eor	w12, w12, w7, ror 11
+	and	w13, w13, w7
+	eor	w12, w12, w7, ror 25
+	eor	w13, w13, w9
+	add	w10, w10, w12
+	add	w10, w10, w13
+	ldr	w12, [x3, #36]
+	add	w10, w10, w14
+	add	w10, w10, w12
+	add	w6, w6, w10
+	ror	w12, w11, #2
+	eor	w13, w11, w4
+	eor	w12, w12, w11, ror 13
+	eor	w14, w4, w5
+	and	w13, w13, w14
+	eor	w12, w12, w11, ror 22
+	eor	w13, w13, w4
+	add	w10, w10, w12
+	add	w10, w10, w13
+	; Round 10
+	mov	w14, v5.s[0]
+	ror	w12, w6, #6
+	eor	w13, w7, w8
+	eor	w12, w12, w6, ror 11
+	and	w13, w13, w6
+	eor	w12, w12, w6, ror 25
+	eor	w13, w13, w8
+	add	w9, w9, w12
+	add	w9, w9, w13
+	ldr	w12, [x3, #40]
+	add	w9, w9, w14
+	add	w9, w9, w12
+	add	w5, w5, w9
+	ror	w12, w10, #2
+	eor	w13, w10, w11
+	eor	w12, w12, w10, ror 13
+	eor	w14, w11, w4
+	and	w13, w13, w14
+	eor	w12, w12, w10, ror 22
+	eor	w13, w13, w11
+	add	w9, w9, w12
+	add	w9, w9, w13
+	; Round 11
+	mov	w14, v5.s[1]
+	ror	w12, w5, #6
+	eor	w13, w6, w7
+	eor	w12, w12, w5, ror 11
+	and	w13, w13, w5
+	eor	w12, w12, w5, ror 25
+	eor	w13, w13, w7
+	add	w8, w8, w12
+	add	w8, w8, w13
+	ldr	w12, [x3, #44]
+	add	w8, w8, w14
+	add	w8, w8, w12
+	add	w4, w4, w8
+	ror	w12, w9, #2
+	eor	w13, w9, w10
+	eor	w12, w12, w9, ror 13
+	eor	w14, w10, w11
+	and	w13, w13, w14
+	eor	w12, w12, w9, ror 22
+	eor	w13, w13, w10
+	add	w8, w8, w12
+	add	w8, w8, w13
+	; Round 12
+	mov	w14, v6.s[0]
+	ror	w12, w4, #6
+	eor	w13, w5, w6
+	eor	w12, w12, w4, ror 11
+	and	w13, w13, w4
+	eor	w12, w12, w4, ror 25
+	eor	w13, w13, w6
+	add	w7, w7, w12
+	add	w7, w7, w13
+	ldr	w12, [x3, #48]
+	add	w7, w7, w14
+	add	w7, w7, w12
+	add	w11, w11, w7
+	ror	w12, w8, #2
+	eor	w13, w8, w9
+	eor	w12, w12, w8, ror 13
+	eor	w14, w9, w10
+	and	w13, w13, w14
+	eor	w12, w12, w8, ror 22
+	eor	w13, w13, w9
+	add	w7, w7, w12
+	add	w7, w7, w13
+	; Round 13
+	mov	w14, v6.s[1]
+	ror	w12, w11, #6
+	eor	w13, w4, w5
+	eor	w12, w12, w11, ror 11
+	and	w13, w13, w11
+	eor	w12, w12, w11, ror 25
+	eor	w13, w13, w5
+	add	w6, w6, w12
+	add	w6, w6, w13
+	ldr	w12, [x3, #52]
+	add	w6, w6, w14
+	add	w6, w6, w12
+	add	w10, w10, w6
+	ror	w12, w7, #2
+	eor	w13, w7, w8
+	eor	w12, w12, w7, ror 13
+	eor	w14, w8, w9
+	and	w13, w13, w14
+	eor	w12, w12, w7, ror 22
+	eor	w13, w13, w8
+	add	w6, w6, w12
+	add	w6, w6, w13
+	; Round 14
+	mov	w14, v7.s[0]
+	ror	w12, w10, #6
+	eor	w13, w11, w4
+	eor	w12, w12, w10, ror 11
+	and	w13, w13, w10
+	eor	w12, w12, w10, ror 25
+	eor	w13, w13, w4
+	add	w5, w5, w12
+	add	w5, w5, w13
+	ldr	w12, [x3, #56]
+	add	w5, w5, w14
+	add	w5, w5, w12
+	add	w9, w9, w5
+	ror	w12, w6, #2
+	eor	w13, w6, w7
+	eor	w12, w12, w6, ror 13
+	eor	w14, w7, w8
+	and	w13, w13, w14
+	eor	w12, w12, w6, ror 22
+	eor	w13, w13, w7
+	add	w5, w5, w12
+	add	w5, w5, w13
+	; Round 15
+	mov	w14, v7.s[1]
+	ror	w12, w9, #6
+	eor	w13, w10, w11
+	eor	w12, w12, w9, ror 11
+	and	w13, w13, w9
+	eor	w12, w12, w9, ror 25
+	eor	w13, w13, w11
+	add	w4, w4, w12
+	add	w4, w4, w13
+	ldr	w12, [x3, #60]
+	add	w4, w4, w14
+	add	w4, w4, w12
+	add	w8, w8, w4
+	ror	w12, w5, #2
+	eor	w13, w5, w6
+	eor	w12, w12, w5, ror 13
+	eor	w14, w6, w7
+	and	w13, w13, w14
+	eor	w12, w12, w5, ror 22
+	eor	w13, w13, w6
+	add	w4, w4, w12
+	add	w4, w4, w13
+	add	w11, w11, w23
+	add	w10, w10, w22
+	add	w9, w9, w21
+	add	w8, w8, w20
+	add	w7, w7, w19
+	add	w6, w6, w17
+	add	w5, w5, w16
+	add	w4, w4, w15
+	subs	w2, w2, #0x40
+	sub	x3, x3, #0xc0
+	bne	L_sha256_len_neon_begin
+	str	w4, [x0]
+	str	w5, [x0, #4]
+	str	w6, [x0, #8]
+	str	w7, [x0, #12]
+	str	w8, [x0, #16]
+	str	w9, [x0, #20]
+	str	w10, [x0, #24]
+	str	w11, [x0, #28]
+	ldp	x17, x19, [x29, #24]
+	ldp	x20, x21, [x29, #40]
+	ldp	x22, x23, [x29, #56]
+	ldr	x24, [x29, #72]
+	ldp	d8, d9, [x29, #80]
+	ldp	d10, d11, [x29, #96]
+	ldp	x29, x30, [sp], #0x70
+	ret
+	ENDP
+	IF :LNOT::DEF:WOLFSSL_ARMASM_NO_HW_CRYPTO
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	8
+L_SHA256_trans_crypto_len_k
+	DCD	0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5
+	DCD	0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5
+	DCD	0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3
+	DCD	0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174
+	DCD	0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc
+	DCD	0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da
+	DCD	0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7
+	DCD	0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967
+	DCD	0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13
+	DCD	0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85
+	DCD	0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3
+	DCD	0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070
+	DCD	0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5
+	DCD	0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3
+	DCD	0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208
+	DCD	0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	Transform_Sha256_Len_crypto
+Transform_Sha256_Len_crypto PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x3, L_SHA256_trans_crypto_len_k
+	add	x3, x3, L_SHA256_trans_crypto_len_k
+	; Load K into vector registers
+	ld1	{v8.4s, v9.4s, v10.4s, v11.4s}, [x3], #0x40
+	ld1	{v12.4s, v13.4s, v14.4s, v15.4s}, [x3], #0x40
+	ld1	{v16.4s, v17.4s, v18.4s, v19.4s}, [x3], #0x40
+	ld1	{v20.4s, v21.4s, v22.4s, v23.4s}, [x3], #0x40
+	; Load digest into working vars
+	ld1	{v0.4s, v1.4s}, [x0]
+	; Start of loop processing a block
+L_sha256_len_crypto_begin
+	; Load W
+	ld1	{v4.4s, v5.4s, v6.4s, v7.4s}, [x1], #0x40
+	rev32	v4.16b, v4.16b
+	rev32	v5.16b, v5.16b
+	rev32	v6.16b, v6.16b
+	rev32	v7.16b, v7.16b
+	; Copy digest to add in at end
+	mov	v2.16b, v0.16b
+	mov	v3.16b, v1.16b
+	; Start 16 rounds
+	; Round 1
+	add	v24.4s, v4.4s, v8.4s
+	mov	v25.16b, v0.16b
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 2
+	sha256su0	v4.4s, v5.4s
+	add	v24.4s, v5.4s, v9.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v4.4s, v6.4s, v7.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 3
+	sha256su0	v5.4s, v6.4s
+	add	v24.4s, v6.4s, v10.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v5.4s, v7.4s, v4.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 4
+	sha256su0	v6.4s, v7.4s
+	add	v24.4s, v7.4s, v11.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v6.4s, v4.4s, v5.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 5
+	sha256su0	v7.4s, v4.4s
+	add	v24.4s, v4.4s, v12.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v7.4s, v5.4s, v6.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 6
+	sha256su0	v4.4s, v5.4s
+	add	v24.4s, v5.4s, v13.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v4.4s, v6.4s, v7.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 7
+	sha256su0	v5.4s, v6.4s
+	add	v24.4s, v6.4s, v14.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v5.4s, v7.4s, v4.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 8
+	sha256su0	v6.4s, v7.4s
+	add	v24.4s, v7.4s, v15.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v6.4s, v4.4s, v5.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 9
+	sha256su0	v7.4s, v4.4s
+	add	v24.4s, v4.4s, v16.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v7.4s, v5.4s, v6.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 10
+	sha256su0	v4.4s, v5.4s
+	add	v24.4s, v5.4s, v17.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v4.4s, v6.4s, v7.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 11
+	sha256su0	v5.4s, v6.4s
+	add	v24.4s, v6.4s, v18.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v5.4s, v7.4s, v4.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 12
+	sha256su0	v6.4s, v7.4s
+	add	v24.4s, v7.4s, v19.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v6.4s, v4.4s, v5.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 13
+	sha256su0	v7.4s, v4.4s
+	add	v24.4s, v4.4s, v20.4s
+	mov	v25.16b, v0.16b
+	sha256su1	v7.4s, v5.4s, v6.4s
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 14
+	add	v24.4s, v5.4s, v21.4s
+	mov	v25.16b, v0.16b
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 15
+	add	v24.4s, v6.4s, v22.4s
+	mov	v25.16b, v0.16b
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Round 16
+	add	v24.4s, v7.4s, v23.4s
+	mov	v25.16b, v0.16b
+	sha256h	q0, q1, v24.4s
+	sha256h2	q1, q25, v24.4s
+	; Done 16 rounds
+	add	v0.4s, v0.4s, v2.4s
+	add	v1.4s, v1.4s, v3.4s
+	subs	w2, w2, #0x40
+	bne	L_sha256_len_crypto_begin
+	; Store digest back
+	st1	{v0.4s, v1.4s}, [x0]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-sha3-asm.asm b/wolfcrypt/src/port/arm/armv8-sha3-asm.asm
new file mode 100644
index 0000000000..fcd1929a36
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-sha3-asm.asm
@@ -0,0 +1,370 @@
+; /* armv8-sha3-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./sha3/sha3.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-sha3-asm.asm
+	IF :DEF:WOLFSSL_SHA3
+	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA3
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	16
+L_SHA3_transform_crypto_r
+	DCQ	0x0000000000000001, 0x0000000000008082
+	DCQ	0x800000000000808a, 0x8000000080008000
+	DCQ	0x000000000000808b, 0x0000000080000001
+	DCQ	0x8000000080008081, 0x8000000000008009
+	DCQ	0x000000000000008a, 0x0000000000000088
+	DCQ	0x0000000080008009, 0x000000008000000a
+	DCQ	0x000000008000808b, 0x800000000000008b
+	DCQ	0x8000000000008089, 0x8000000000008003
+	DCQ	0x8000000000008002, 0x8000000000000080
+	DCQ	0x000000000000800a, 0x800000008000000a
+	DCQ	0x8000000080008081, 0x8000000000008080
+	DCQ	0x0000000080000001, 0x8000000080008008
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	BlockSha3_crypto
+BlockSha3_crypto PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x1, L_SHA3_transform_crypto_r
+	add	x1, x1, L_SHA3_transform_crypto_r
+; .arch_extension sha3
+	ld4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	ld4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	ld4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	ld4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	ld4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	ld4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	ld1	{v24.1d}, [x0]
+	sub	x0, x0, #0xc0
+	mov	x2, #24
+	; Start of 24 rounds
+L_sha3_crypto_begin
+	; Col Mix
+	eor3	v31.16b, v0.16b, v5.16b, v10.16b
+	eor3	v27.16b, v1.16b, v6.16b, v11.16b
+	eor3	v28.16b, v2.16b, v7.16b, v12.16b
+	eor3	v29.16b, v3.16b, v8.16b, v13.16b
+	eor3	v30.16b, v4.16b, v9.16b, v14.16b
+	eor3	v31.16b, v31.16b, v15.16b, v20.16b
+	eor3	v27.16b, v27.16b, v16.16b, v21.16b
+	eor3	v28.16b, v28.16b, v17.16b, v22.16b
+	eor3	v29.16b, v29.16b, v18.16b, v23.16b
+	eor3	v30.16b, v30.16b, v19.16b, v24.16b
+	rax1	v25.2d, v30.2d, v27.2d
+	rax1	v26.2d, v31.2d, v28.2d
+	rax1	v27.2d, v27.2d, v29.2d
+	rax1	v28.2d, v28.2d, v30.2d
+	rax1	v29.2d, v29.2d, v31.2d
+	eor	v0.16b, v0.16b, v25.16b
+	xar	v30.2d, v1.2d, v26.2d, #63
+	xar	v1.2d, v6.2d, v26.2d, #20
+	xar	v6.2d, v9.2d, v29.2d, #44
+	xar	v9.2d, v22.2d, v27.2d, #3
+	xar	v22.2d, v14.2d, v29.2d, #25
+	xar	v14.2d, v20.2d, v25.2d, #46
+	xar	v20.2d, v2.2d, v27.2d, #2
+	xar	v2.2d, v12.2d, v27.2d, #21
+	xar	v12.2d, v13.2d, v28.2d, #39
+	xar	v13.2d, v19.2d, v29.2d, #56
+	xar	v19.2d, v23.2d, v28.2d, #8
+	xar	v23.2d, v15.2d, v25.2d, #23
+	xar	v15.2d, v4.2d, v29.2d, #37
+	xar	v4.2d, v24.2d, v29.2d, #50
+	xar	v24.2d, v21.2d, v26.2d, #62
+	xar	v21.2d, v8.2d, v28.2d, #9
+	xar	v8.2d, v16.2d, v26.2d, #19
+	xar	v16.2d, v5.2d, v25.2d, #28
+	xar	v5.2d, v3.2d, v28.2d, #36
+	xar	v3.2d, v18.2d, v28.2d, #43
+	xar	v18.2d, v17.2d, v27.2d, #49
+	xar	v17.2d, v11.2d, v26.2d, #54
+	xar	v11.2d, v7.2d, v27.2d, #58
+	xar	v7.2d, v10.2d, v25.2d, #61
+	; Row Mix
+	mov	v25.16b, v0.16b
+	mov	v26.16b, v1.16b
+	bcax	v0.16b, v25.16b, v2.16b, v26.16b
+	bcax	v1.16b, v26.16b, v3.16b, v2.16b
+	bcax	v2.16b, v2.16b, v4.16b, v3.16b
+	bcax	v3.16b, v3.16b, v25.16b, v4.16b
+	bcax	v4.16b, v4.16b, v26.16b, v25.16b
+	mov	v25.16b, v5.16b
+	mov	v26.16b, v6.16b
+	bcax	v5.16b, v25.16b, v7.16b, v26.16b
+	bcax	v6.16b, v26.16b, v8.16b, v7.16b
+	bcax	v7.16b, v7.16b, v9.16b, v8.16b
+	bcax	v8.16b, v8.16b, v25.16b, v9.16b
+	bcax	v9.16b, v9.16b, v26.16b, v25.16b
+	mov	v26.16b, v11.16b
+	bcax	v10.16b, v30.16b, v12.16b, v26.16b
+	bcax	v11.16b, v26.16b, v13.16b, v12.16b
+	bcax	v12.16b, v12.16b, v14.16b, v13.16b
+	bcax	v13.16b, v13.16b, v30.16b, v14.16b
+	bcax	v14.16b, v14.16b, v26.16b, v30.16b
+	mov	v25.16b, v15.16b
+	mov	v26.16b, v16.16b
+	bcax	v15.16b, v25.16b, v17.16b, v26.16b
+	bcax	v16.16b, v26.16b, v18.16b, v17.16b
+	bcax	v17.16b, v17.16b, v19.16b, v18.16b
+	bcax	v18.16b, v18.16b, v25.16b, v19.16b
+	bcax	v19.16b, v19.16b, v26.16b, v25.16b
+	mov	v25.16b, v20.16b
+	mov	v26.16b, v21.16b
+	bcax	v20.16b, v25.16b, v22.16b, v26.16b
+	bcax	v21.16b, v26.16b, v23.16b, v22.16b
+	bcax	v22.16b, v22.16b, v24.16b, v23.16b
+	bcax	v23.16b, v23.16b, v25.16b, v24.16b
+	bcax	v24.16b, v24.16b, v26.16b, v25.16b
+	ld1r	{v30.2d}, [x1], #8
+	subs	x2, x2, #1
+	eor	v0.16b, v0.16b, v30.16b
+	bne	L_sha3_crypto_begin
+	st4	{v0.d, v1.d, v2.d, v3.d}[0], [x0], #32
+	st4	{v4.d, v5.d, v6.d, v7.d}[0], [x0], #32
+	st4	{v8.d, v9.d, v10.d, v11.d}[0], [x0], #32
+	st4	{v12.d, v13.d, v14.d, v15.d}[0], [x0], #32
+	st4	{v16.d, v17.d, v18.d, v19.d}[0], [x0], #32
+	st4	{v20.d, v21.d, v22.d, v23.d}[0], [x0], #32
+	st1	{v24.1d}, [x0]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	16
+L_SHA3_transform_base_r
+	DCQ	0x0000000000000001, 0x0000000000008082
+	DCQ	0x800000000000808a, 0x8000000080008000
+	DCQ	0x000000000000808b, 0x0000000080000001
+	DCQ	0x8000000080008081, 0x8000000000008009
+	DCQ	0x000000000000008a, 0x0000000000000088
+	DCQ	0x0000000080008009, 0x000000008000000a
+	DCQ	0x000000008000808b, 0x800000000000008b
+	DCQ	0x8000000000008089, 0x8000000000008003
+	DCQ	0x8000000000008002, 0x8000000000000080
+	DCQ	0x000000000000800a, 0x800000008000000a
+	DCQ	0x8000000080008081, 0x8000000000008080
+	DCQ	0x0000000080000001, 0x8000000080008008
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	BlockSha3_base
+BlockSha3_base PROC
+	stp	x29, x30, [sp, #-160]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #72]
+	stp	x20, x21, [x29, #88]
+	stp	x22, x23, [x29, #104]
+	stp	x24, x25, [x29, #120]
+	stp	x26, x27, [x29, #136]
+	str	x28, [x29, #152]
+	adrp	x27, L_SHA3_transform_base_r
+	add	x27, x27, L_SHA3_transform_base_r
+	ldp	x1, x2, [x0]
+	ldp	x3, x4, [x0, #16]
+	ldp	x5, x6, [x0, #32]
+	ldp	x7, x8, [x0, #48]
+	ldp	x9, x10, [x0, #64]
+	ldp	x11, x12, [x0, #80]
+	ldp	x13, x14, [x0, #96]
+	ldp	x15, x16, [x0, #112]
+	ldp	x17, x19, [x0, #128]
+	ldp	x20, x21, [x0, #144]
+	ldp	x22, x23, [x0, #160]
+	ldp	x24, x25, [x0, #176]
+	ldr	x26, [x0, #192]
+	str	x0, [x29, #40]
+	mov	x28, #24
+	; Start of 24 rounds
+L_SHA3_transform_base_begin
+	stp	x27, x28, [x29, #48]
+	eor	x0, x5, x10
+	eor	x30, x1, x6
+	eor	x28, x3, x8
+	eor	x0, x0, x15
+	eor	x30, x30, x11
+	eor	x28, x28, x13
+	eor	x0, x0, x21
+	eor	x30, x30, x16
+	eor	x28, x28, x19
+	eor	x0, x0, x26
+	eor	x30, x30, x22
+	eor	x28, x28, x24
+	str	x0, [x29, #32]
+	str	x28, [x29, #24]
+	eor	x27, x2, x7
+	eor	x28, x4, x9
+	eor	x27, x27, x12
+	eor	x28, x28, x14
+	eor	x27, x27, x17
+	eor	x28, x28, x20
+	eor	x27, x27, x23
+	eor	x28, x28, x25
+	eor	x0, x0, x27, ror 63
+	eor	x27, x27, x28, ror 63
+	eor	x1, x1, x0
+	eor	x6, x6, x0
+	eor	x11, x11, x0
+	eor	x16, x16, x0
+	eor	x22, x22, x0
+	eor	x3, x3, x27
+	eor	x8, x8, x27
+	eor	x13, x13, x27
+	eor	x19, x19, x27
+	eor	x24, x24, x27
+	ldr	x0, [x29, #32]
+	ldr	x27, [x29, #24]
+	eor	x28, x28, x30, ror 63
+	eor	x30, x30, x27, ror 63
+	eor	x27, x27, x0, ror 63
+	eor	x5, x5, x28
+	eor	x10, x10, x28
+	eor	x15, x15, x28
+	eor	x21, x21, x28
+	eor	x26, x26, x28
+	eor	x2, x2, x30
+	eor	x7, x7, x30
+	eor	x12, x12, x30
+	eor	x17, x17, x30
+	eor	x23, x23, x30
+	eor	x4, x4, x27
+	eor	x9, x9, x27
+	eor	x14, x14, x27
+	eor	x20, x20, x27
+	eor	x25, x25, x27
+	; Swap Rotate
+	ror	x0, x2, #63
+	ror	x2, x7, #20
+	ror	x7, x10, #44
+	ror	x10, x24, #3
+	ror	x24, x15, #25
+	ror	x15, x22, #46
+	ror	x22, x3, #2
+	ror	x3, x13, #21
+	ror	x13, x14, #39
+	ror	x14, x21, #56
+	ror	x21, x25, #8
+	ror	x25, x16, #23
+	ror	x16, x5, #37
+	ror	x5, x26, #50
+	ror	x26, x23, #62
+	ror	x23, x9, #9
+	ror	x9, x17, #19
+	ror	x17, x6, #28
+	ror	x6, x4, #36
+	ror	x4, x20, #43
+	ror	x20, x19, #49
+	ror	x19, x12, #54
+	ror	x12, x8, #58
+	ror	x8, x11, #61
+	; Row Mix
+	bic	x11, x3, x2
+	bic	x27, x4, x3
+	bic	x28, x1, x5
+	bic	x30, x2, x1
+	eor	x1, x1, x11
+	eor	x2, x2, x27
+	bic	x11, x5, x4
+	eor	x4, x4, x28
+	eor	x3, x3, x11
+	eor	x5, x5, x30
+	bic	x11, x8, x7
+	bic	x27, x9, x8
+	bic	x28, x6, x10
+	bic	x30, x7, x6
+	eor	x6, x6, x11
+	eor	x7, x7, x27
+	bic	x11, x10, x9
+	eor	x9, x9, x28
+	eor	x8, x8, x11
+	eor	x10, x10, x30
+	bic	x11, x13, x12
+	bic	x27, x14, x13
+	bic	x28, x0, x15
+	bic	x30, x12, x0
+	eor	x11, x0, x11
+	eor	x12, x12, x27
+	bic	x0, x15, x14
+	eor	x14, x14, x28
+	eor	x13, x13, x0
+	eor	x15, x15, x30
+	bic	x0, x19, x17
+	bic	x27, x20, x19
+	bic	x28, x16, x21
+	bic	x30, x17, x16
+	eor	x16, x16, x0
+	eor	x17, x17, x27
+	bic	x0, x21, x20
+	eor	x20, x20, x28
+	eor	x19, x19, x0
+	eor	x21, x21, x30
+	bic	x0, x24, x23
+	bic	x27, x25, x24
+	bic	x28, x22, x26
+	bic	x30, x23, x22
+	eor	x22, x22, x0
+	eor	x23, x23, x27
+	bic	x0, x26, x25
+	eor	x25, x25, x28
+	eor	x24, x24, x0
+	eor	x26, x26, x30
+	; Done transforming
+	ldp	x27, x28, [x29, #48]
+	ldr	x0, [x27], #8
+	subs	x28, x28, #1
+	eor	x1, x1, x0
+	bne	L_SHA3_transform_base_begin
+	ldr	x0, [x29, #40]
+	stp	x1, x2, [x0]
+	stp	x3, x4, [x0, #16]
+	stp	x5, x6, [x0, #32]
+	stp	x7, x8, [x0, #48]
+	stp	x9, x10, [x0, #64]
+	stp	x11, x12, [x0, #80]
+	stp	x13, x14, [x0, #96]
+	stp	x15, x16, [x0, #112]
+	stp	x17, x19, [x0, #128]
+	stp	x20, x21, [x0, #144]
+	stp	x22, x23, [x0, #160]
+	stp	x24, x25, [x0, #176]
+	str	x26, [x0, #192]
+	ldp	x17, x19, [x29, #72]
+	ldp	x20, x21, [x29, #88]
+	ldp	x22, x23, [x29, #104]
+	ldp	x24, x25, [x29, #120]
+	ldp	x26, x27, [x29, #136]
+	ldr	x28, [x29, #152]
+	ldp	x29, x30, [sp], #0xa0
+	ret
+	ENDP
+	ENDIF
+	END
diff --git a/wolfcrypt/src/port/arm/armv8-sha512-asm.asm b/wolfcrypt/src/port/arm/armv8-sha512-asm.asm
new file mode 100644
index 0000000000..4c333808e6
--- /dev/null
+++ b/wolfcrypt/src/port/arm/armv8-sha512-asm.asm
@@ -0,0 +1,1571 @@
+; /* armv8-sha512-asm
+;  *
+;  * Copyright (C) 2006-2026 wolfSSL Inc.
+;  *
+;  * This file is part of wolfSSL.
+;  *
+;  * wolfSSL is free software; you can redistribute it and/or modify
+;  * it under the terms of the GNU General Public License as published by
+;  * the Free Software Foundation; either version 3 of the License, or
+;  * (at your option) any later version.
+;  *
+;  * wolfSSL is distributed in the hope that it will be useful,
+;  * but WITHOUT ANY WARRANTY; without even the implied warranty of
+;  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+;  * GNU General Public License for more details.
+;  *
+;  * You should have received a copy of the GNU General Public License
+;  * along with this program; if not, write to the Free Software
+;  * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+;  */
+
+
+; Generated using (from wolfssl):
+;   cd ../scripts
+;   ruby ./sha2/sha512.rb arm64 \
+;       ../wolfssl/wolfcrypt/src/port/arm/armv8-sha512-asm.asm
+	IF :DEF:WOLFSSL_SHA512 :LOR: :DEF:WOLFSSL_SHA384
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	16
+L_SHA512_transform_neon_len_k
+	DCQ	0x428a2f98d728ae22, 0x7137449123ef65cd
+	DCQ	0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc
+	DCQ	0x3956c25bf348b538, 0x59f111f1b605d019
+	DCQ	0x923f82a4af194f9b, 0xab1c5ed5da6d8118
+	DCQ	0xd807aa98a3030242, 0x12835b0145706fbe
+	DCQ	0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2
+	DCQ	0x72be5d74f27b896f, 0x80deb1fe3b1696b1
+	DCQ	0x9bdc06a725c71235, 0xc19bf174cf692694
+	DCQ	0xe49b69c19ef14ad2, 0xefbe4786384f25e3
+	DCQ	0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65
+	DCQ	0x2de92c6f592b0275, 0x4a7484aa6ea6e483
+	DCQ	0x5cb0a9dcbd41fbd4, 0x76f988da831153b5
+	DCQ	0x983e5152ee66dfab, 0xa831c66d2db43210
+	DCQ	0xb00327c898fb213f, 0xbf597fc7beef0ee4
+	DCQ	0xc6e00bf33da88fc2, 0xd5a79147930aa725
+	DCQ	0x06ca6351e003826f, 0x142929670a0e6e70
+	DCQ	0x27b70a8546d22ffc, 0x2e1b21385c26c926
+	DCQ	0x4d2c6dfc5ac42aed, 0x53380d139d95b3df
+	DCQ	0x650a73548baf63de, 0x766a0abb3c77b2a8
+	DCQ	0x81c2c92e47edaee6, 0x92722c851482353b
+	DCQ	0xa2bfe8a14cf10364, 0xa81a664bbc423001
+	DCQ	0xc24b8b70d0f89791, 0xc76c51a30654be30
+	DCQ	0xd192e819d6ef5218, 0xd69906245565a910
+	DCQ	0xf40e35855771202a, 0x106aa07032bbd1b8
+	DCQ	0x19a4c116b8d2d0c8, 0x1e376c085141ab53
+	DCQ	0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8
+	DCQ	0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb
+	DCQ	0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3
+	DCQ	0x748f82ee5defb2fc, 0x78a5636f43172f60
+	DCQ	0x84c87814a1f0ab72, 0x8cc702081a6439ec
+	DCQ	0x90befffa23631e28, 0xa4506cebde82bde9
+	DCQ	0xbef9a3f7b2c67915, 0xc67178f2e372532b
+	DCQ	0xca273eceea26619c, 0xd186b8c721c0c207
+	DCQ	0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178
+	DCQ	0x06f067aa72176fba, 0x0a637dc5a2c898a6
+	DCQ	0x113f9804bef90dae, 0x1b710b35131c471b
+	DCQ	0x28db77f523047d84, 0x32caab7b40c72493
+	DCQ	0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
+	DCQ	0x4cc5d4becb3e42b6, 0x597f299cfc657e2a
+	DCQ	0x5fcb6fab3ad6faec, 0x6c44198c4a475817
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	16
+L_SHA512_transform_neon_len_r8
+	DCQ	0x0007060504030201, 0x080f0e0d0c0b0a09
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	Transform_Sha512_Len_neon
+Transform_Sha512_Len_neon PROC
+	stp	x29, x30, [sp, #-128]!
+	add	x29, sp, #0
+	stp	x17, x19, [x29, #16]
+	stp	x20, x21, [x29, #32]
+	stp	x22, x23, [x29, #48]
+	stp	x24, x25, [x29, #64]
+	stp	x26, x27, [x29, #80]
+	stp	d8, d9, [x29, #96]
+	stp	d10, d11, [x29, #112]
+	adrp	x3, L_SHA512_transform_neon_len_k
+	add	x3, x3, L_SHA512_transform_neon_len_k
+	adrp	x27, L_SHA512_transform_neon_len_r8
+	add	x27, x27, L_SHA512_transform_neon_len_r8
+	ld1	{v11.16b}, [x27]
+	; Load digest into working vars
+	ldp	x4, x5, [x0]
+	ldp	x6, x7, [x0, #16]
+	ldp	x8, x9, [x0, #32]
+	ldp	x10, x11, [x0, #48]
+	; Start of loop processing a block
+L_sha512_len_neon_begin
+	; Load W
+	; Copy digest to add in at end
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	mov	x19, x4
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	mov	x20, x5
+	rev64	v0.16b, v0.16b
+	mov	x21, x6
+	rev64	v1.16b, v1.16b
+	mov	x22, x7
+	rev64	v2.16b, v2.16b
+	mov	x23, x8
+	rev64	v3.16b, v3.16b
+	mov	x24, x9
+	rev64	v4.16b, v4.16b
+	mov	x25, x10
+	rev64	v5.16b, v5.16b
+	mov	x26, x11
+	rev64	v6.16b, v6.16b
+	rev64	v7.16b, v7.16b
+	; Pre-calc: b ^ c
+	eor	x16, x5, x6
+	mov	x27, #4
+	; Start of 16 rounds
+L_sha512_len_neon_start
+	; Round 0
+	mov	x13, v0.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x8, #14
+	ror	x14, x4, #28
+	eor	x12, x12, x8, ror 18
+	eor	x14, x14, x4, ror 34
+	eor	x12, x12, x8, ror 41
+	eor	x14, x14, x4, ror 39
+	add	x11, x11, x12
+	eor	x17, x4, x5
+	eor	x12, x9, x10
+	and	x16, x17, x16
+	and	x12, x12, x8
+	add	x11, x11, x13
+	eor	x12, x12, x10
+	add	x11, x11, x15
+	eor	x16, x16, x5
+	add	x11, x11, x12
+	add	x14, x14, x16
+	add	x7, x7, x11
+	add	x11, x11, x14
+	; Round 1
+	mov	x13, v0.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v0.16b, v1.16b, #8
+	ror	x12, x7, #14
+	shl	v8.2d, v7.2d, #45
+	ror	x14, x11, #28
+	sri	v8.2d, v7.2d, #19
+	eor	x12, x12, x7, ror 18
+	shl	v9.2d, v7.2d, #3
+	eor	x14, x14, x11, ror 34
+	sri	v9.2d, v7.2d, #61
+	eor	x12, x12, x7, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x11, ror 39
+	ushr	v8.2d, v7.2d, #6
+	add	x10, x10, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x11, x4
+	add	v0.2d, v0.2d, v9.2d
+	eor	x12, x8, x9
+	ext	v9.16b, v4.16b, v5.16b, #8
+	and	x17, x16, x17
+	add	v0.2d, v0.2d, v9.2d
+	and	x12, x12, x7
+	shl	v8.2d, v10.2d, #63
+	add	x10, x10, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x9
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x10, x10, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x4
+	ushr	v10.2d, v10.2d, #7
+	add	x10, x10, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v0.2d, v0.2d, v9.2d
+	add	x6, x6, x10
+	add	x10, x10, x14
+	; Round 2
+	mov	x13, v1.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x6, #14
+	ror	x14, x10, #28
+	eor	x12, x12, x6, ror 18
+	eor	x14, x14, x10, ror 34
+	eor	x12, x12, x6, ror 41
+	eor	x14, x14, x10, ror 39
+	add	x9, x9, x12
+	eor	x17, x10, x11
+	eor	x12, x7, x8
+	and	x16, x17, x16
+	and	x12, x12, x6
+	add	x9, x9, x13
+	eor	x12, x12, x8
+	add	x9, x9, x15
+	eor	x16, x16, x11
+	add	x9, x9, x12
+	add	x14, x14, x16
+	add	x5, x5, x9
+	add	x9, x9, x14
+	; Round 3
+	mov	x13, v1.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v1.16b, v2.16b, #8
+	ror	x12, x5, #14
+	shl	v8.2d, v0.2d, #45
+	ror	x14, x9, #28
+	sri	v8.2d, v0.2d, #19
+	eor	x12, x12, x5, ror 18
+	shl	v9.2d, v0.2d, #3
+	eor	x14, x14, x9, ror 34
+	sri	v9.2d, v0.2d, #61
+	eor	x12, x12, x5, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x9, ror 39
+	ushr	v8.2d, v0.2d, #6
+	add	x8, x8, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x9, x10
+	add	v1.2d, v1.2d, v9.2d
+	eor	x12, x6, x7
+	ext	v9.16b, v5.16b, v6.16b, #8
+	and	x17, x16, x17
+	add	v1.2d, v1.2d, v9.2d
+	and	x12, x12, x5
+	shl	v8.2d, v10.2d, #63
+	add	x8, x8, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x7
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x8, x8, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x10
+	ushr	v10.2d, v10.2d, #7
+	add	x8, x8, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v1.2d, v1.2d, v9.2d
+	add	x4, x4, x8
+	add	x8, x8, x14
+	; Round 4
+	mov	x13, v2.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x4, #14
+	ror	x14, x8, #28
+	eor	x12, x12, x4, ror 18
+	eor	x14, x14, x8, ror 34
+	eor	x12, x12, x4, ror 41
+	eor	x14, x14, x8, ror 39
+	add	x7, x7, x12
+	eor	x17, x8, x9
+	eor	x12, x5, x6
+	and	x16, x17, x16
+	and	x12, x12, x4
+	add	x7, x7, x13
+	eor	x12, x12, x6
+	add	x7, x7, x15
+	eor	x16, x16, x9
+	add	x7, x7, x12
+	add	x14, x14, x16
+	add	x11, x11, x7
+	add	x7, x7, x14
+	; Round 5
+	mov	x13, v2.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v2.16b, v3.16b, #8
+	ror	x12, x11, #14
+	shl	v8.2d, v1.2d, #45
+	ror	x14, x7, #28
+	sri	v8.2d, v1.2d, #19
+	eor	x12, x12, x11, ror 18
+	shl	v9.2d, v1.2d, #3
+	eor	x14, x14, x7, ror 34
+	sri	v9.2d, v1.2d, #61
+	eor	x12, x12, x11, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x7, ror 39
+	ushr	v8.2d, v1.2d, #6
+	add	x6, x6, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x7, x8
+	add	v2.2d, v2.2d, v9.2d
+	eor	x12, x4, x5
+	ext	v9.16b, v6.16b, v7.16b, #8
+	and	x17, x16, x17
+	add	v2.2d, v2.2d, v9.2d
+	and	x12, x12, x11
+	shl	v8.2d, v10.2d, #63
+	add	x6, x6, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x5
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x6, x6, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x8
+	ushr	v10.2d, v10.2d, #7
+	add	x6, x6, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v2.2d, v2.2d, v9.2d
+	add	x10, x10, x6
+	add	x6, x6, x14
+	; Round 6
+	mov	x13, v3.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x10, #14
+	ror	x14, x6, #28
+	eor	x12, x12, x10, ror 18
+	eor	x14, x14, x6, ror 34
+	eor	x12, x12, x10, ror 41
+	eor	x14, x14, x6, ror 39
+	add	x5, x5, x12
+	eor	x17, x6, x7
+	eor	x12, x11, x4
+	and	x16, x17, x16
+	and	x12, x12, x10
+	add	x5, x5, x13
+	eor	x12, x12, x4
+	add	x5, x5, x15
+	eor	x16, x16, x7
+	add	x5, x5, x12
+	add	x14, x14, x16
+	add	x9, x9, x5
+	add	x5, x5, x14
+	; Round 7
+	mov	x13, v3.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v3.16b, v4.16b, #8
+	ror	x12, x9, #14
+	shl	v8.2d, v2.2d, #45
+	ror	x14, x5, #28
+	sri	v8.2d, v2.2d, #19
+	eor	x12, x12, x9, ror 18
+	shl	v9.2d, v2.2d, #3
+	eor	x14, x14, x5, ror 34
+	sri	v9.2d, v2.2d, #61
+	eor	x12, x12, x9, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x5, ror 39
+	ushr	v8.2d, v2.2d, #6
+	add	x4, x4, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x5, x6
+	add	v3.2d, v3.2d, v9.2d
+	eor	x12, x10, x11
+	ext	v9.16b, v7.16b, v0.16b, #8
+	and	x17, x16, x17
+	add	v3.2d, v3.2d, v9.2d
+	and	x12, x12, x9
+	shl	v8.2d, v10.2d, #63
+	add	x4, x4, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x11
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x4, x4, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x6
+	ushr	v10.2d, v10.2d, #7
+	add	x4, x4, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v3.2d, v3.2d, v9.2d
+	add	x8, x8, x4
+	add	x4, x4, x14
+	; Round 8
+	mov	x13, v4.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x8, #14
+	ror	x14, x4, #28
+	eor	x12, x12, x8, ror 18
+	eor	x14, x14, x4, ror 34
+	eor	x12, x12, x8, ror 41
+	eor	x14, x14, x4, ror 39
+	add	x11, x11, x12
+	eor	x17, x4, x5
+	eor	x12, x9, x10
+	and	x16, x17, x16
+	and	x12, x12, x8
+	add	x11, x11, x13
+	eor	x12, x12, x10
+	add	x11, x11, x15
+	eor	x16, x16, x5
+	add	x11, x11, x12
+	add	x14, x14, x16
+	add	x7, x7, x11
+	add	x11, x11, x14
+	; Round 9
+	mov	x13, v4.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v4.16b, v5.16b, #8
+	ror	x12, x7, #14
+	shl	v8.2d, v3.2d, #45
+	ror	x14, x11, #28
+	sri	v8.2d, v3.2d, #19
+	eor	x12, x12, x7, ror 18
+	shl	v9.2d, v3.2d, #3
+	eor	x14, x14, x11, ror 34
+	sri	v9.2d, v3.2d, #61
+	eor	x12, x12, x7, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x11, ror 39
+	ushr	v8.2d, v3.2d, #6
+	add	x10, x10, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x11, x4
+	add	v4.2d, v4.2d, v9.2d
+	eor	x12, x8, x9
+	ext	v9.16b, v0.16b, v1.16b, #8
+	and	x17, x16, x17
+	add	v4.2d, v4.2d, v9.2d
+	and	x12, x12, x7
+	shl	v8.2d, v10.2d, #63
+	add	x10, x10, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x9
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x10, x10, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x4
+	ushr	v10.2d, v10.2d, #7
+	add	x10, x10, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v4.2d, v4.2d, v9.2d
+	add	x6, x6, x10
+	add	x10, x10, x14
+	; Round 10
+	mov	x13, v5.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x6, #14
+	ror	x14, x10, #28
+	eor	x12, x12, x6, ror 18
+	eor	x14, x14, x10, ror 34
+	eor	x12, x12, x6, ror 41
+	eor	x14, x14, x10, ror 39
+	add	x9, x9, x12
+	eor	x17, x10, x11
+	eor	x12, x7, x8
+	and	x16, x17, x16
+	and	x12, x12, x6
+	add	x9, x9, x13
+	eor	x12, x12, x8
+	add	x9, x9, x15
+	eor	x16, x16, x11
+	add	x9, x9, x12
+	add	x14, x14, x16
+	add	x5, x5, x9
+	add	x9, x9, x14
+	; Round 11
+	mov	x13, v5.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v5.16b, v6.16b, #8
+	ror	x12, x5, #14
+	shl	v8.2d, v4.2d, #45
+	ror	x14, x9, #28
+	sri	v8.2d, v4.2d, #19
+	eor	x12, x12, x5, ror 18
+	shl	v9.2d, v4.2d, #3
+	eor	x14, x14, x9, ror 34
+	sri	v9.2d, v4.2d, #61
+	eor	x12, x12, x5, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x9, ror 39
+	ushr	v8.2d, v4.2d, #6
+	add	x8, x8, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x9, x10
+	add	v5.2d, v5.2d, v9.2d
+	eor	x12, x6, x7
+	ext	v9.16b, v1.16b, v2.16b, #8
+	and	x17, x16, x17
+	add	v5.2d, v5.2d, v9.2d
+	and	x12, x12, x5
+	shl	v8.2d, v10.2d, #63
+	add	x8, x8, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x7
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x8, x8, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x10
+	ushr	v10.2d, v10.2d, #7
+	add	x8, x8, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v5.2d, v5.2d, v9.2d
+	add	x4, x4, x8
+	add	x8, x8, x14
+	; Round 12
+	mov	x13, v6.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x4, #14
+	ror	x14, x8, #28
+	eor	x12, x12, x4, ror 18
+	eor	x14, x14, x8, ror 34
+	eor	x12, x12, x4, ror 41
+	eor	x14, x14, x8, ror 39
+	add	x7, x7, x12
+	eor	x17, x8, x9
+	eor	x12, x5, x6
+	and	x16, x17, x16
+	and	x12, x12, x4
+	add	x7, x7, x13
+	eor	x12, x12, x6
+	add	x7, x7, x15
+	eor	x16, x16, x9
+	add	x7, x7, x12
+	add	x14, x14, x16
+	add	x11, x11, x7
+	add	x7, x7, x14
+	; Round 13
+	mov	x13, v6.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v6.16b, v7.16b, #8
+	ror	x12, x11, #14
+	shl	v8.2d, v5.2d, #45
+	ror	x14, x7, #28
+	sri	v8.2d, v5.2d, #19
+	eor	x12, x12, x11, ror 18
+	shl	v9.2d, v5.2d, #3
+	eor	x14, x14, x7, ror 34
+	sri	v9.2d, v5.2d, #61
+	eor	x12, x12, x11, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x7, ror 39
+	ushr	v8.2d, v5.2d, #6
+	add	x6, x6, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x7, x8
+	add	v6.2d, v6.2d, v9.2d
+	eor	x12, x4, x5
+	ext	v9.16b, v2.16b, v3.16b, #8
+	and	x17, x16, x17
+	add	v6.2d, v6.2d, v9.2d
+	and	x12, x12, x11
+	shl	v8.2d, v10.2d, #63
+	add	x6, x6, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x5
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x6, x6, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x8
+	ushr	v10.2d, v10.2d, #7
+	add	x6, x6, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v6.2d, v6.2d, v9.2d
+	add	x10, x10, x6
+	add	x6, x6, x14
+	; Round 14
+	mov	x13, v7.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x10, #14
+	ror	x14, x6, #28
+	eor	x12, x12, x10, ror 18
+	eor	x14, x14, x6, ror 34
+	eor	x12, x12, x10, ror 41
+	eor	x14, x14, x6, ror 39
+	add	x5, x5, x12
+	eor	x17, x6, x7
+	eor	x12, x11, x4
+	and	x16, x17, x16
+	and	x12, x12, x10
+	add	x5, x5, x13
+	eor	x12, x12, x4
+	add	x5, x5, x15
+	eor	x16, x16, x7
+	add	x5, x5, x12
+	add	x14, x14, x16
+	add	x9, x9, x5
+	add	x5, x5, x14
+	; Round 15
+	mov	x13, v7.d[1]
+	ldr	x15, [x3], #8
+	ext	v10.16b, v7.16b, v0.16b, #8
+	ror	x12, x9, #14
+	shl	v8.2d, v6.2d, #45
+	ror	x14, x5, #28
+	sri	v8.2d, v6.2d, #19
+	eor	x12, x12, x9, ror 18
+	shl	v9.2d, v6.2d, #3
+	eor	x14, x14, x5, ror 34
+	sri	v9.2d, v6.2d, #61
+	eor	x12, x12, x9, ror 41
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x14, x14, x5, ror 39
+	ushr	v8.2d, v6.2d, #6
+	add	x4, x4, x12
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x16, x5, x6
+	add	v7.2d, v7.2d, v9.2d
+	eor	x12, x10, x11
+	ext	v9.16b, v3.16b, v4.16b, #8
+	and	x17, x16, x17
+	add	v7.2d, v7.2d, v9.2d
+	and	x12, x12, x9
+	shl	v8.2d, v10.2d, #63
+	add	x4, x4, x13
+	sri	v8.2d, v10.2d, #1
+	eor	x12, x12, x11
+	tbl	v9.16b, {v10.16b}, v11.16b
+	add	x4, x4, x15
+	eor	v9.16b, v9.16b, v8.16b
+	eor	x17, x17, x6
+	ushr	v10.2d, v10.2d, #7
+	add	x4, x4, x12
+	eor	v9.16b, v9.16b, v10.16b
+	add	x14, x14, x17
+	add	v7.2d, v7.2d, v9.2d
+	add	x8, x8, x4
+	add	x4, x4, x14
+	subs	x27, x27, #1
+	bne	L_sha512_len_neon_start
+	; Round 0
+	mov	x13, v0.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x8, #14
+	ror	x14, x4, #28
+	eor	x12, x12, x8, ror 18
+	eor	x14, x14, x4, ror 34
+	eor	x12, x12, x8, ror 41
+	eor	x14, x14, x4, ror 39
+	add	x11, x11, x12
+	eor	x17, x4, x5
+	eor	x12, x9, x10
+	and	x16, x17, x16
+	and	x12, x12, x8
+	add	x11, x11, x13
+	eor	x12, x12, x10
+	add	x11, x11, x15
+	eor	x16, x16, x5
+	add	x11, x11, x12
+	add	x14, x14, x16
+	add	x7, x7, x11
+	add	x11, x11, x14
+	; Round 1
+	mov	x13, v0.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x7, #14
+	ror	x14, x11, #28
+	eor	x12, x12, x7, ror 18
+	eor	x14, x14, x11, ror 34
+	eor	x12, x12, x7, ror 41
+	eor	x14, x14, x11, ror 39
+	add	x10, x10, x12
+	eor	x16, x11, x4
+	eor	x12, x8, x9
+	and	x17, x16, x17
+	and	x12, x12, x7
+	add	x10, x10, x13
+	eor	x12, x12, x9
+	add	x10, x10, x15
+	eor	x17, x17, x4
+	add	x10, x10, x12
+	add	x14, x14, x17
+	add	x6, x6, x10
+	add	x10, x10, x14
+	; Round 2
+	mov	x13, v1.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x6, #14
+	ror	x14, x10, #28
+	eor	x12, x12, x6, ror 18
+	eor	x14, x14, x10, ror 34
+	eor	x12, x12, x6, ror 41
+	eor	x14, x14, x10, ror 39
+	add	x9, x9, x12
+	eor	x17, x10, x11
+	eor	x12, x7, x8
+	and	x16, x17, x16
+	and	x12, x12, x6
+	add	x9, x9, x13
+	eor	x12, x12, x8
+	add	x9, x9, x15
+	eor	x16, x16, x11
+	add	x9, x9, x12
+	add	x14, x14, x16
+	add	x5, x5, x9
+	add	x9, x9, x14
+	; Round 3
+	mov	x13, v1.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x5, #14
+	ror	x14, x9, #28
+	eor	x12, x12, x5, ror 18
+	eor	x14, x14, x9, ror 34
+	eor	x12, x12, x5, ror 41
+	eor	x14, x14, x9, ror 39
+	add	x8, x8, x12
+	eor	x16, x9, x10
+	eor	x12, x6, x7
+	and	x17, x16, x17
+	and	x12, x12, x5
+	add	x8, x8, x13
+	eor	x12, x12, x7
+	add	x8, x8, x15
+	eor	x17, x17, x10
+	add	x8, x8, x12
+	add	x14, x14, x17
+	add	x4, x4, x8
+	add	x8, x8, x14
+	; Round 4
+	mov	x13, v2.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x4, #14
+	ror	x14, x8, #28
+	eor	x12, x12, x4, ror 18
+	eor	x14, x14, x8, ror 34
+	eor	x12, x12, x4, ror 41
+	eor	x14, x14, x8, ror 39
+	add	x7, x7, x12
+	eor	x17, x8, x9
+	eor	x12, x5, x6
+	and	x16, x17, x16
+	and	x12, x12, x4
+	add	x7, x7, x13
+	eor	x12, x12, x6
+	add	x7, x7, x15
+	eor	x16, x16, x9
+	add	x7, x7, x12
+	add	x14, x14, x16
+	add	x11, x11, x7
+	add	x7, x7, x14
+	; Round 5
+	mov	x13, v2.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x11, #14
+	ror	x14, x7, #28
+	eor	x12, x12, x11, ror 18
+	eor	x14, x14, x7, ror 34
+	eor	x12, x12, x11, ror 41
+	eor	x14, x14, x7, ror 39
+	add	x6, x6, x12
+	eor	x16, x7, x8
+	eor	x12, x4, x5
+	and	x17, x16, x17
+	and	x12, x12, x11
+	add	x6, x6, x13
+	eor	x12, x12, x5
+	add	x6, x6, x15
+	eor	x17, x17, x8
+	add	x6, x6, x12
+	add	x14, x14, x17
+	add	x10, x10, x6
+	add	x6, x6, x14
+	; Round 6
+	mov	x13, v3.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x10, #14
+	ror	x14, x6, #28
+	eor	x12, x12, x10, ror 18
+	eor	x14, x14, x6, ror 34
+	eor	x12, x12, x10, ror 41
+	eor	x14, x14, x6, ror 39
+	add	x5, x5, x12
+	eor	x17, x6, x7
+	eor	x12, x11, x4
+	and	x16, x17, x16
+	and	x12, x12, x10
+	add	x5, x5, x13
+	eor	x12, x12, x4
+	add	x5, x5, x15
+	eor	x16, x16, x7
+	add	x5, x5, x12
+	add	x14, x14, x16
+	add	x9, x9, x5
+	add	x5, x5, x14
+	; Round 7
+	mov	x13, v3.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x9, #14
+	ror	x14, x5, #28
+	eor	x12, x12, x9, ror 18
+	eor	x14, x14, x5, ror 34
+	eor	x12, x12, x9, ror 41
+	eor	x14, x14, x5, ror 39
+	add	x4, x4, x12
+	eor	x16, x5, x6
+	eor	x12, x10, x11
+	and	x17, x16, x17
+	and	x12, x12, x9
+	add	x4, x4, x13
+	eor	x12, x12, x11
+	add	x4, x4, x15
+	eor	x17, x17, x6
+	add	x4, x4, x12
+	add	x14, x14, x17
+	add	x8, x8, x4
+	add	x4, x4, x14
+	; Round 8
+	mov	x13, v4.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x8, #14
+	ror	x14, x4, #28
+	eor	x12, x12, x8, ror 18
+	eor	x14, x14, x4, ror 34
+	eor	x12, x12, x8, ror 41
+	eor	x14, x14, x4, ror 39
+	add	x11, x11, x12
+	eor	x17, x4, x5
+	eor	x12, x9, x10
+	and	x16, x17, x16
+	and	x12, x12, x8
+	add	x11, x11, x13
+	eor	x12, x12, x10
+	add	x11, x11, x15
+	eor	x16, x16, x5
+	add	x11, x11, x12
+	add	x14, x14, x16
+	add	x7, x7, x11
+	add	x11, x11, x14
+	; Round 9
+	mov	x13, v4.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x7, #14
+	ror	x14, x11, #28
+	eor	x12, x12, x7, ror 18
+	eor	x14, x14, x11, ror 34
+	eor	x12, x12, x7, ror 41
+	eor	x14, x14, x11, ror 39
+	add	x10, x10, x12
+	eor	x16, x11, x4
+	eor	x12, x8, x9
+	and	x17, x16, x17
+	and	x12, x12, x7
+	add	x10, x10, x13
+	eor	x12, x12, x9
+	add	x10, x10, x15
+	eor	x17, x17, x4
+	add	x10, x10, x12
+	add	x14, x14, x17
+	add	x6, x6, x10
+	add	x10, x10, x14
+	; Round 10
+	mov	x13, v5.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x6, #14
+	ror	x14, x10, #28
+	eor	x12, x12, x6, ror 18
+	eor	x14, x14, x10, ror 34
+	eor	x12, x12, x6, ror 41
+	eor	x14, x14, x10, ror 39
+	add	x9, x9, x12
+	eor	x17, x10, x11
+	eor	x12, x7, x8
+	and	x16, x17, x16
+	and	x12, x12, x6
+	add	x9, x9, x13
+	eor	x12, x12, x8
+	add	x9, x9, x15
+	eor	x16, x16, x11
+	add	x9, x9, x12
+	add	x14, x14, x16
+	add	x5, x5, x9
+	add	x9, x9, x14
+	; Round 11
+	mov	x13, v5.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x5, #14
+	ror	x14, x9, #28
+	eor	x12, x12, x5, ror 18
+	eor	x14, x14, x9, ror 34
+	eor	x12, x12, x5, ror 41
+	eor	x14, x14, x9, ror 39
+	add	x8, x8, x12
+	eor	x16, x9, x10
+	eor	x12, x6, x7
+	and	x17, x16, x17
+	and	x12, x12, x5
+	add	x8, x8, x13
+	eor	x12, x12, x7
+	add	x8, x8, x15
+	eor	x17, x17, x10
+	add	x8, x8, x12
+	add	x14, x14, x17
+	add	x4, x4, x8
+	add	x8, x8, x14
+	; Round 12
+	mov	x13, v6.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x4, #14
+	ror	x14, x8, #28
+	eor	x12, x12, x4, ror 18
+	eor	x14, x14, x8, ror 34
+	eor	x12, x12, x4, ror 41
+	eor	x14, x14, x8, ror 39
+	add	x7, x7, x12
+	eor	x17, x8, x9
+	eor	x12, x5, x6
+	and	x16, x17, x16
+	and	x12, x12, x4
+	add	x7, x7, x13
+	eor	x12, x12, x6
+	add	x7, x7, x15
+	eor	x16, x16, x9
+	add	x7, x7, x12
+	add	x14, x14, x16
+	add	x11, x11, x7
+	add	x7, x7, x14
+	; Round 13
+	mov	x13, v6.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x11, #14
+	ror	x14, x7, #28
+	eor	x12, x12, x11, ror 18
+	eor	x14, x14, x7, ror 34
+	eor	x12, x12, x11, ror 41
+	eor	x14, x14, x7, ror 39
+	add	x6, x6, x12
+	eor	x16, x7, x8
+	eor	x12, x4, x5
+	and	x17, x16, x17
+	and	x12, x12, x11
+	add	x6, x6, x13
+	eor	x12, x12, x5
+	add	x6, x6, x15
+	eor	x17, x17, x8
+	add	x6, x6, x12
+	add	x14, x14, x17
+	add	x10, x10, x6
+	add	x6, x6, x14
+	; Round 14
+	mov	x13, v7.d[0]
+	ldr	x15, [x3], #8
+	ror	x12, x10, #14
+	ror	x14, x6, #28
+	eor	x12, x12, x10, ror 18
+	eor	x14, x14, x6, ror 34
+	eor	x12, x12, x10, ror 41
+	eor	x14, x14, x6, ror 39
+	add	x5, x5, x12
+	eor	x17, x6, x7
+	eor	x12, x11, x4
+	and	x16, x17, x16
+	and	x12, x12, x10
+	add	x5, x5, x13
+	eor	x12, x12, x4
+	add	x5, x5, x15
+	eor	x16, x16, x7
+	add	x5, x5, x12
+	add	x14, x14, x16
+	add	x9, x9, x5
+	add	x5, x5, x14
+	; Round 15
+	mov	x13, v7.d[1]
+	ldr	x15, [x3], #8
+	ror	x12, x9, #14
+	ror	x14, x5, #28
+	eor	x12, x12, x9, ror 18
+	eor	x14, x14, x5, ror 34
+	eor	x12, x12, x9, ror 41
+	eor	x14, x14, x5, ror 39
+	add	x4, x4, x12
+	eor	x16, x5, x6
+	eor	x12, x10, x11
+	and	x17, x16, x17
+	and	x12, x12, x9
+	add	x4, x4, x13
+	eor	x12, x12, x11
+	add	x4, x4, x15
+	eor	x17, x17, x6
+	add	x4, x4, x12
+	add	x14, x14, x17
+	add	x8, x8, x4
+	add	x4, x4, x14
+	add	x11, x11, x26
+	add	x10, x10, x25
+	add	x9, x9, x24
+	add	x8, x8, x23
+	add	x7, x7, x22
+	add	x6, x6, x21
+	add	x5, x5, x20
+	add	x4, x4, x19
+	subs	w2, w2, #0x80
+	sub	x3, x3, #0x280
+	bne	L_sha512_len_neon_begin
+	stp	x4, x5, [x0]
+	stp	x6, x7, [x0, #16]
+	stp	x8, x9, [x0, #32]
+	stp	x10, x11, [x0, #48]
+	ldp	x17, x19, [x29, #16]
+	ldp	x20, x21, [x29, #32]
+	ldp	x22, x23, [x29, #48]
+	ldp	x24, x25, [x29, #64]
+	ldp	x26, x27, [x29, #80]
+	ldp	d8, d9, [x29, #96]
+	ldp	d10, d11, [x29, #112]
+	ldp	x29, x30, [sp], #0x80
+	ret
+	ENDP
+	IF :DEF:WOLFSSL_ARMASM_CRYPTO_SHA512
+	AREA	|.rodata|, DATA, READONLY
+	ALIGN	16
+L_SHA512_trans_crypto_len_k
+	DCQ	0x428a2f98d728ae22, 0x7137449123ef65cd
+	DCQ	0xb5c0fbcfec4d3b2f, 0xe9b5dba58189dbbc
+	DCQ	0x3956c25bf348b538, 0x59f111f1b605d019
+	DCQ	0x923f82a4af194f9b, 0xab1c5ed5da6d8118
+	DCQ	0xd807aa98a3030242, 0x12835b0145706fbe
+	DCQ	0x243185be4ee4b28c, 0x550c7dc3d5ffb4e2
+	DCQ	0x72be5d74f27b896f, 0x80deb1fe3b1696b1
+	DCQ	0x9bdc06a725c71235, 0xc19bf174cf692694
+	DCQ	0xe49b69c19ef14ad2, 0xefbe4786384f25e3
+	DCQ	0x0fc19dc68b8cd5b5, 0x240ca1cc77ac9c65
+	DCQ	0x2de92c6f592b0275, 0x4a7484aa6ea6e483
+	DCQ	0x5cb0a9dcbd41fbd4, 0x76f988da831153b5
+	DCQ	0x983e5152ee66dfab, 0xa831c66d2db43210
+	DCQ	0xb00327c898fb213f, 0xbf597fc7beef0ee4
+	DCQ	0xc6e00bf33da88fc2, 0xd5a79147930aa725
+	DCQ	0x06ca6351e003826f, 0x142929670a0e6e70
+	DCQ	0x27b70a8546d22ffc, 0x2e1b21385c26c926
+	DCQ	0x4d2c6dfc5ac42aed, 0x53380d139d95b3df
+	DCQ	0x650a73548baf63de, 0x766a0abb3c77b2a8
+	DCQ	0x81c2c92e47edaee6, 0x92722c851482353b
+	DCQ	0xa2bfe8a14cf10364, 0xa81a664bbc423001
+	DCQ	0xc24b8b70d0f89791, 0xc76c51a30654be30
+	DCQ	0xd192e819d6ef5218, 0xd69906245565a910
+	DCQ	0xf40e35855771202a, 0x106aa07032bbd1b8
+	DCQ	0x19a4c116b8d2d0c8, 0x1e376c085141ab53
+	DCQ	0x2748774cdf8eeb99, 0x34b0bcb5e19b48a8
+	DCQ	0x391c0cb3c5c95a63, 0x4ed8aa4ae3418acb
+	DCQ	0x5b9cca4f7763e373, 0x682e6ff3d6b2b8a3
+	DCQ	0x748f82ee5defb2fc, 0x78a5636f43172f60
+	DCQ	0x84c87814a1f0ab72, 0x8cc702081a6439ec
+	DCQ	0x90befffa23631e28, 0xa4506cebde82bde9
+	DCQ	0xbef9a3f7b2c67915, 0xc67178f2e372532b
+	DCQ	0xca273eceea26619c, 0xd186b8c721c0c207
+	DCQ	0xeada7dd6cde0eb1e, 0xf57d4f7fee6ed178
+	DCQ	0x06f067aa72176fba, 0x0a637dc5a2c898a6
+	DCQ	0x113f9804bef90dae, 0x1b710b35131c471b
+	DCQ	0x28db77f523047d84, 0x32caab7b40c72493
+	DCQ	0x3c9ebe0a15c9bebc, 0x431d67c49c100d4c
+	DCQ	0x4cc5d4becb3e42b6, 0x597f299cfc657e2a
+	DCQ	0x5fcb6fab3ad6faec, 0x6c44198c4a475817
+	AREA	|.text|, CODE, READONLY
+	ALIGN	4
+	EXPORT	Transform_Sha512_Len_crypto
+Transform_Sha512_Len_crypto PROC
+	stp	x29, x30, [sp, #-80]!
+	add	x29, sp, #0
+	stp	d8, d9, [x29, #16]
+	stp	d10, d11, [x29, #32]
+	stp	d12, d13, [x29, #48]
+	stp	d14, d15, [x29, #64]
+	adrp	x4, L_SHA512_trans_crypto_len_k
+	add	x4, x4, L_SHA512_trans_crypto_len_k
+; .arch_extension sha3
+	; Load K into vector registers
+	ld1	{v8.2d, v9.2d, v10.2d, v11.2d}, [x4], #0x40
+	ld1	{v12.2d, v13.2d, v14.2d, v15.2d}, [x4], #0x40
+	; Load digest into working vars
+	ld1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x0]
+	; Start of loop processing a block
+L_sha512_len_crypto_begin
+	mov	x3, x4
+	; Load W
+	ld1	{v0.16b, v1.16b, v2.16b, v3.16b}, [x1], #0x40
+	ld1	{v4.16b, v5.16b, v6.16b, v7.16b}, [x1], #0x40
+	rev64	v0.16b, v0.16b
+	rev64	v1.16b, v1.16b
+	rev64	v2.16b, v2.16b
+	rev64	v3.16b, v3.16b
+	rev64	v4.16b, v4.16b
+	rev64	v5.16b, v5.16b
+	rev64	v6.16b, v6.16b
+	rev64	v7.16b, v7.16b
+	; Copy digest to add in at end
+	mov	v28.16b, v24.16b
+	mov	v29.16b, v25.16b
+	mov	v30.16b, v26.16b
+	mov	v31.16b, v27.16b
+	; Start of 16 rounds
+	; Round 0
+	add	v20.2d, v0.2d, v8.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Round 1
+	add	v20.2d, v1.2d, v9.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Round 2
+	add	v20.2d, v2.2d, v10.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Round 3
+	add	v20.2d, v3.2d, v11.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Round 4
+	add	v20.2d, v4.2d, v12.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	; Round 5
+	add	v20.2d, v5.2d, v13.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Round 6
+	add	v20.2d, v6.2d, v14.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Round 7
+	add	v20.2d, v7.2d, v15.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 8
+	sha512su0	v0.2d, v1.2d
+	ext	v21.16b, v4.16b, v5.16b, #8
+	sha512su1	v0.2d, v7.2d, v21.2d
+	add	v20.2d, v0.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Round 9
+	sha512su0	v1.2d, v2.2d
+	ext	v21.16b, v5.16b, v6.16b, #8
+	sha512su1	v1.2d, v0.2d, v21.2d
+	add	v20.2d, v1.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	; Round 10
+	sha512su0	v2.2d, v3.2d
+	ext	v21.16b, v6.16b, v7.16b, #8
+	sha512su1	v2.2d, v1.2d, v21.2d
+	add	v20.2d, v2.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Round 11
+	sha512su0	v3.2d, v4.2d
+	ext	v21.16b, v7.16b, v0.16b, #8
+	sha512su1	v3.2d, v2.2d, v21.2d
+	add	v20.2d, v3.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 12
+	sha512su0	v4.2d, v5.2d
+	ext	v21.16b, v0.16b, v1.16b, #8
+	sha512su1	v4.2d, v3.2d, v21.2d
+	add	v20.2d, v4.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Round 13
+	sha512su0	v5.2d, v6.2d
+	ext	v21.16b, v1.16b, v2.16b, #8
+	sha512su1	v5.2d, v4.2d, v21.2d
+	add	v20.2d, v5.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Round 14
+	sha512su0	v6.2d, v7.2d
+	ext	v21.16b, v2.16b, v3.16b, #8
+	sha512su1	v6.2d, v5.2d, v21.2d
+	add	v20.2d, v6.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	; Round 15
+	sha512su0	v7.2d, v0.2d
+	ext	v21.16b, v3.16b, v4.16b, #8
+	sha512su1	v7.2d, v6.2d, v21.2d
+	add	v20.2d, v7.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 16
+	sha512su0	v0.2d, v1.2d
+	ext	v21.16b, v4.16b, v5.16b, #8
+	sha512su1	v0.2d, v7.2d, v21.2d
+	add	v20.2d, v0.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Round 17
+	sha512su0	v1.2d, v2.2d
+	ext	v21.16b, v5.16b, v6.16b, #8
+	sha512su1	v1.2d, v0.2d, v21.2d
+	add	v20.2d, v1.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Round 18
+	sha512su0	v2.2d, v3.2d
+	ext	v21.16b, v6.16b, v7.16b, #8
+	sha512su1	v2.2d, v1.2d, v21.2d
+	add	v20.2d, v2.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Round 19
+	sha512su0	v3.2d, v4.2d
+	ext	v21.16b, v7.16b, v0.16b, #8
+	sha512su1	v3.2d, v2.2d, v21.2d
+	add	v20.2d, v3.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 20
+	sha512su0	v4.2d, v5.2d
+	ext	v21.16b, v0.16b, v1.16b, #8
+	sha512su1	v4.2d, v3.2d, v21.2d
+	add	v20.2d, v4.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Round 21
+	sha512su0	v5.2d, v6.2d
+	ext	v21.16b, v1.16b, v2.16b, #8
+	sha512su1	v5.2d, v4.2d, v21.2d
+	add	v20.2d, v5.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Round 22
+	sha512su0	v6.2d, v7.2d
+	ext	v21.16b, v2.16b, v3.16b, #8
+	sha512su1	v6.2d, v5.2d, v21.2d
+	add	v20.2d, v6.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Round 23
+	sha512su0	v7.2d, v0.2d
+	ext	v21.16b, v3.16b, v4.16b, #8
+	sha512su1	v7.2d, v6.2d, v21.2d
+	add	v20.2d, v7.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 24
+	sha512su0	v0.2d, v1.2d
+	ext	v21.16b, v4.16b, v5.16b, #8
+	sha512su1	v0.2d, v7.2d, v21.2d
+	add	v20.2d, v0.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	; Round 25
+	sha512su0	v1.2d, v2.2d
+	ext	v21.16b, v5.16b, v6.16b, #8
+	sha512su1	v1.2d, v0.2d, v21.2d
+	add	v20.2d, v1.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Round 26
+	sha512su0	v2.2d, v3.2d
+	ext	v21.16b, v6.16b, v7.16b, #8
+	sha512su1	v2.2d, v1.2d, v21.2d
+	add	v20.2d, v2.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Round 27
+	sha512su0	v3.2d, v4.2d
+	ext	v21.16b, v7.16b, v0.16b, #8
+	sha512su1	v3.2d, v2.2d, v21.2d
+	add	v20.2d, v3.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 28
+	sha512su0	v4.2d, v5.2d
+	ext	v21.16b, v0.16b, v1.16b, #8
+	sha512su1	v4.2d, v3.2d, v21.2d
+	add	v20.2d, v4.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Round 29
+	sha512su0	v5.2d, v6.2d
+	ext	v21.16b, v1.16b, v2.16b, #8
+	sha512su1	v5.2d, v4.2d, v21.2d
+	add	v20.2d, v5.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	; Round 30
+	sha512su0	v6.2d, v7.2d
+	ext	v21.16b, v2.16b, v3.16b, #8
+	sha512su1	v6.2d, v5.2d, v21.2d
+	add	v20.2d, v6.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Round 31
+	sha512su0	v7.2d, v0.2d
+	ext	v21.16b, v3.16b, v4.16b, #8
+	sha512su1	v7.2d, v6.2d, v21.2d
+	add	v20.2d, v7.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 32
+	sha512su0	v0.2d, v1.2d
+	ext	v21.16b, v4.16b, v5.16b, #8
+	sha512su1	v0.2d, v7.2d, v21.2d
+	add	v20.2d, v0.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Round 33
+	sha512su0	v1.2d, v2.2d
+	ext	v21.16b, v5.16b, v6.16b, #8
+	sha512su1	v1.2d, v0.2d, v21.2d
+	add	v20.2d, v1.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Round 34
+	sha512su0	v2.2d, v3.2d
+	ext	v21.16b, v6.16b, v7.16b, #8
+	sha512su1	v2.2d, v1.2d, v21.2d
+	add	v20.2d, v2.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	; Round 35
+	sha512su0	v3.2d, v4.2d
+	ext	v21.16b, v7.16b, v0.16b, #8
+	sha512su1	v3.2d, v2.2d, v21.2d
+	add	v20.2d, v3.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v26.16b, v27.16b, #8
+	ext	v22.16b, v25.16b, v26.16b, #8
+	add	v27.2d, v27.2d, v20.2d
+	sha512h	q27, q21, v22.2d
+	add	v23.2d, v25.2d, v27.2d
+	sha512h2	q27, q25, v24.2d
+	; Load next 8 64-bit words of K
+	ld1	{v16.2d, v17.2d, v18.2d, v19.2d}, [x3], #0x40
+	; Round 36
+	sha512su0	v4.2d, v5.2d
+	ext	v21.16b, v0.16b, v1.16b, #8
+	sha512su1	v4.2d, v3.2d, v21.2d
+	add	v20.2d, v4.2d, v16.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v23.16b, v26.16b, #8
+	ext	v22.16b, v24.16b, v23.16b, #8
+	add	v26.2d, v26.2d, v20.2d
+	sha512h	q26, q21, v22.2d
+	add	v25.2d, v24.2d, v26.2d
+	sha512h2	q26, q24, v27.2d
+	; Round 37
+	sha512su0	v5.2d, v6.2d
+	ext	v21.16b, v1.16b, v2.16b, #8
+	sha512su1	v5.2d, v4.2d, v21.2d
+	add	v20.2d, v5.2d, v17.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v25.16b, v23.16b, #8
+	ext	v22.16b, v27.16b, v25.16b, #8
+	add	v23.2d, v23.2d, v20.2d
+	sha512h	q23, q21, v22.2d
+	add	v24.2d, v27.2d, v23.2d
+	sha512h2	q23, q27, v26.2d
+	; Round 38
+	sha512su0	v6.2d, v7.2d
+	ext	v21.16b, v2.16b, v3.16b, #8
+	sha512su1	v6.2d, v5.2d, v21.2d
+	add	v20.2d, v6.2d, v18.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v24.16b, v25.16b, #8
+	ext	v22.16b, v26.16b, v24.16b, #8
+	add	v25.2d, v25.2d, v20.2d
+	sha512h	q25, q21, v22.2d
+	add	v27.2d, v26.2d, v25.2d
+	sha512h2	q25, q26, v23.2d
+	; Round 39
+	sha512su0	v7.2d, v0.2d
+	ext	v21.16b, v3.16b, v4.16b, #8
+	sha512su1	v7.2d, v6.2d, v21.2d
+	add	v20.2d, v7.2d, v19.2d
+	ext	v20.16b, v20.16b, v20.16b, #8
+	ext	v21.16b, v27.16b, v24.16b, #8
+	ext	v22.16b, v23.16b, v27.16b, #8
+	add	v24.2d, v24.2d, v20.2d
+	sha512h	q24, q21, v22.2d
+	add	v26.2d, v23.2d, v24.2d
+	sha512h2	q24, q23, v25.2d
+	add	v27.2d, v27.2d, v31.2d
+	add	v26.2d, v26.2d, v30.2d
+	add	v25.2d, v25.2d, v29.2d
+	add	v24.2d, v24.2d, v28.2d
+	subs	w2, w2, #0x80
+	bne	L_sha512_len_crypto_begin
+	; Store digest back
+	st1	{v24.2d, v25.2d, v26.2d, v27.2d}, [x0]
+	ldp	d8, d9, [x29, #16]
+	ldp	d10, d11, [x29, #32]
+	ldp	d12, d13, [x29, #48]
+	ldp	d14, d15, [x29, #64]
+	ldp	x29, x30, [sp], #0x50
+	ret
+	ENDP
+	ENDIF
+	ENDIF
+	END
diff --git a/wolfssl-VS2022.vcxproj b/wolfssl-VS2022.vcxproj
index f15f6e9a59..71cc6bbda2 100644
--- a/wolfssl-VS2022.vcxproj
+++ b/wolfssl-VS2022.vcxproj
@@ -64,6 +64,20 @@
              msbuild /p:WolfSSLIntelAsm=true -->
     <WolfSSLIntelAsm Condition="'$(WolfSSLIntelAsm)'==''">false</WolfSSLIntelAsm>
   </PropertyGroup>
+  <PropertyGroup Label="WolfSSLAarch64Asm">
+    <!-- Build the ARMv8 (AArch64) crypto assembly (AES / SHA-2 / SHA-3 /
+         Curve25519 / Ed25519 / Poly1305 / ChaCha / ML-KEM) with armasm64 and
+         enable the matching WOLFSSL_ARMASM code paths.  Off by default (pure
+         C).  Enable on an ARM64 build with:
+             msbuild /p:WolfSSLAarch64Asm=true -->
+    <WolfSSLAarch64Asm Condition="'$(WolfSSLAarch64Asm)'==''">false</WolfSSLAarch64Asm>
+    <!-- Feature macros the .asm files are guarded by.  These must mirror the
+         feature set enabled for the C compile (see IDE/WIN/user_settings.h and
+         the WOLFSSL_ARMASM* defines below); a symbol that is left undefined
+         here simply drops the matching assembly (safe - the C caller then uses
+         a C fallback), while a symbol enabled here but not in C is dead code. -->
+    <WolfSSLArmAsmDefs>--predefine "HAVE_AES_CBC SETL {TRUE}" --predefine "HAVE_AESCCM SETL {TRUE}" --predefine "HAVE_AESGCM SETL {TRUE}" --predefine "HAVE_AES_ECB SETL {TRUE}" --predefine "HAVE_AES_DECRYPT SETL {TRUE}" --predefine "WOLFSSL_AES_COUNTER SETL {TRUE}" --predefine "WOLFSSL_AES_DIRECT SETL {TRUE}" --predefine "WOLFSSL_AES_XTS SETL {TRUE}" --predefine "WOLFSSL_AESGCM_STREAM SETL {TRUE}" --predefine "WOLFSSL_SHA224 SETL {TRUE}" --predefine "WOLFSSL_SHA3 SETL {TRUE}" --predefine "WOLFSSL_ARMASM_CRYPTO_SHA3 SETL {TRUE}" --predefine "WOLFSSL_SHA384 SETL {TRUE}" --predefine "WOLFSSL_SHA512 SETL {TRUE}" --predefine "WOLFSSL_ARMASM_CRYPTO_SHA512 SETL {TRUE}" --predefine "HAVE_CHACHA SETL {TRUE}" --predefine "HAVE_CURVE25519 SETL {TRUE}" --predefine "HAVE_ED25519 SETL {TRUE}" --predefine "WOLFSSL_HAVE_MLKEM SETL {TRUE}"</WolfSSLArmAsmDefs>
+  </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <PlatformToolset>v143</PlatformToolset>
@@ -638,6 +652,54 @@
       <Command Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">ml64.exe /c /Zi /DWOLFSSL_X86_64_BUILD /DWOLFSSL_HAVE_MLKEM /DWOLFSSL_HAVE_MLDSA /DWOLFSSL_HAVE_SLHDSA /DHAVE_ED25519 /Fo"$(IntDir)%(Filename).obj" %(Identity)</Command>
       <Outputs Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">$(IntDir)%(Filename).obj</Outputs>
     </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-aes-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-chacha-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-curve25519.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-mlkem-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-poly1305-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-sha256-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-sha3-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-sha512-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
     <ClInclude Include="IDE\WIN\user_settings.h" />
   </ItemGroup>
   <ItemGroup>
@@ -655,6 +717,11 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/wolfssl.vcxproj b/wolfssl.vcxproj
index e00b6e6122..f565549501 100644
--- a/wolfssl.vcxproj
+++ b/wolfssl.vcxproj
@@ -63,6 +63,20 @@
              msbuild /p:WolfSSLIntelAsm=true -->
     <WolfSSLIntelAsm Condition="'$(WolfSSLIntelAsm)'==''">false</WolfSSLIntelAsm>
   </PropertyGroup>
+  <PropertyGroup Label="WolfSSLAarch64Asm">
+    <!-- Build the ARMv8 (AArch64) crypto assembly (AES / SHA-2 / SHA-3 /
+         Curve25519 / Ed25519 / Poly1305 / ChaCha / ML-KEM) with armasm64 and
+         enable the matching WOLFSSL_ARMASM code paths.  Off by default (pure
+         C).  Enable on an ARM64 build with:
+             msbuild /p:WolfSSLAarch64Asm=true -->
+    <WolfSSLAarch64Asm Condition="'$(WolfSSLAarch64Asm)'==''">false</WolfSSLAarch64Asm>
+    <!-- Feature macros the .asm files are guarded by.  These must mirror the
+         feature set enabled for the C compile (see IDE/WIN/user_settings.h and
+         the WOLFSSL_ARMASM* defines below); a symbol that is left undefined
+         here simply drops the matching assembly (safe - the C caller then uses
+         a C fallback), while a symbol enabled here but not in C is dead code. -->
+    <WolfSSLArmAsmDefs>--predefine "HAVE_AES_CBC SETL {TRUE}" --predefine "HAVE_AESCCM SETL {TRUE}" --predefine "HAVE_AESGCM SETL {TRUE}" --predefine "HAVE_AES_ECB SETL {TRUE}" --predefine "HAVE_AES_DECRYPT SETL {TRUE}" --predefine "WOLFSSL_AES_COUNTER SETL {TRUE}" --predefine "WOLFSSL_AES_DIRECT SETL {TRUE}" --predefine "WOLFSSL_AES_XTS SETL {TRUE}" --predefine "WOLFSSL_AESGCM_STREAM SETL {TRUE}" --predefine "WOLFSSL_SHA224 SETL {TRUE}" --predefine "WOLFSSL_SHA3 SETL {TRUE}" --predefine "WOLFSSL_ARMASM_CRYPTO_SHA3 SETL {TRUE}" --predefine "WOLFSSL_SHA384 SETL {TRUE}" --predefine "WOLFSSL_SHA512 SETL {TRUE}" --predefine "WOLFSSL_ARMASM_CRYPTO_SHA512 SETL {TRUE}" --predefine "HAVE_CHACHA SETL {TRUE}" --predefine "HAVE_CURVE25519 SETL {TRUE}" --predefine "HAVE_ED25519 SETL {TRUE}" --predefine "WOLFSSL_HAVE_MLKEM SETL {TRUE}"</WolfSSLArmAsmDefs>
+  </PropertyGroup>
   <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
     <ConfigurationType>StaticLibrary</ConfigurationType>
     <PlatformToolset>v110</PlatformToolset>
@@ -638,6 +652,54 @@
       <Command Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">ml64.exe /c /Zi /DWOLFSSL_X86_64_BUILD /DWOLFSSL_HAVE_MLKEM /DWOLFSSL_HAVE_MLDSA /DWOLFSSL_HAVE_SLHDSA /DHAVE_ED25519 /Fo"$(IntDir)%(Filename).obj" %(Identity)</Command>
       <Outputs Condition="'$(WolfSSLIntelAsm)'=='true' And '$(Platform)'=='x64'">$(IntDir)%(Filename).obj</Outputs>
     </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-aes-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-chacha-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-curve25519.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-mlkem-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-poly1305-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-sha256-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-sha3-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
+    <CustomBuild Include="wolfcrypt\src\port\arm\armv8-sha512-asm.asm">
+      <ExcludedFromBuild>true</ExcludedFromBuild>
+      <ExcludedFromBuild Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">false</ExcludedFromBuild>
+      <Command Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">armasm64.exe -o "$(IntDir)%(Filename).obj" $(WolfSSLArmAsmDefs) %(Identity)</Command>
+      <Outputs Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">$(IntDir)%(Filename).obj</Outputs>
+    </CustomBuild>
     <ClInclude Include="IDE\WIN\user_settings.h" />
   </ItemGroup>
   <ItemGroup>
@@ -655,6 +717,11 @@
       <PreprocessorDefinitions>USE_INTEL_SPEEDUP;WOLFSSL_X86_64_BUILD;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(WolfSSLAarch64Asm)'=='true' And '$(Platform)'=='ARM64'">
+    <ClCompile>
+      <PreprocessorDefinitions>WOLFSSL_ARMASM;WOLFSSL_ARMASM_CRYPTO_SHA3;WOLFSSL_ARMASM_CRYPTO_SHA512;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">
   </ImportGroup>
diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index aeb81cc35e..028e3f438b 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -380,6 +380,15 @@
     #endif
 #endif
 
+/* Microsoft's ARM64 compiler defines _M_ARM64 but not __aarch64__.  The wolfSSL
+ * ARMv8 assembly (WOLFSSL_ARMASM) and all of its C callers are gated on
+ * __aarch64__, so map _M_ARM64 across when building that assembly with MSVC and
+ * armasm64.  Scoped to WOLFSSL_ARMASM so a plain MSVC ARM64 (pure C) build is
+ * left untouched. */
+#if defined(_M_ARM64) && defined(WOLFSSL_ARMASM) && !defined(__aarch64__)
+    #define __aarch64__ 1
+#endif
+
 /* Forward propagation of the legacy parent gate to the canonical name
  * (HAVE_DILITHIUM -> WOLFSSL_HAVE_MLDSA). Always active: required so that
  * a user_settings.h or build flag using only the legacy spelling still