n	1	/*	n	1	/*
	2	// references:		2	// references:
	3	// https://blog.cloudflare.com/go-crypto-bridging-the-performance-gap/		3	// https://blog.cloudflare.com/go-crypto-bridging-the-performance-gap/
	4	// https://github.com/vkrasnov/openssl/blob/vlad/inv_ord/crypto/ec/asm/ecp_nistz256-x86_64.pl		4	// https://github.com/vkrasnov/openssl/blob/vlad/inv_ord/crypto/ec/asm/ecp_nistz256-x86_64.pl
	5	// https://go-review.googlesource.com/#/c/8968/		5	// https://go-review.googlesource.com/#/c/8968/
	6	// https://groups.google.com/forum/#!msg/golang-codereviews/m5QTnSUZU6c/Q5RUAdefWUwJ		6	// https://groups.google.com/forum/#!msg/golang-codereviews/m5QTnSUZU6c/Q5RUAdefWUwJ
	7	// https://github.com/openssl/openssl/pull/263/files		7	// https://github.com/openssl/openssl/pull/263/files
	8	//		8	//
	9	//		9	//
	10	Portions Copyright 2015 The Go Authors. All rights reserved.		10	Portions Copyright 2015 The Go Authors. All rights reserved.
	11	Use of this source code is governed by the following		11	Use of this source code is governed by the following
	12	BSD-style license (from the go distributions LICENSE file):		12	BSD-style license (from the go distributions LICENSE file):
	13			13
	14	Redistribution and use in source and binary forms, with or without		14	Redistribution and use in source and binary forms, with or without
	15	modification, are permitted provided that the following conditions are		15	modification, are permitted provided that the following conditions are
	16	met:		16	met:
	17			17
n	18	* Redistributions of source code must retain the above copyright	n	18	* Redistributions of source code must retain the above copyright
	19	notice, this list of conditions and the following disclaimer.		19	notice, this list of conditions and the following disclaimer.
n	20	* Redistributions in binary form must reproduce the above	n	20	* Redistributions in binary form must reproduce the above
	21	copyright notice, this list of conditions and the following disclaimer		21	copyright notice, this list of conditions and the following disclaimer
	22	in the documentation and/or other materials provided with the		22	in the documentation and/or other materials provided with the
	23	distribution.		23	distribution.
n	24	* Neither the name of Google Inc. nor the names of its	n	24	* Neither the name of Google Inc. nor the names of its
	25	contributors may be used to endorse or promote products derived from		25	contributors may be used to endorse or promote products derived from
	26	this software without specific prior written permission.		26	this software without specific prior written permission.
	27			27
	28	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS		28	THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
	29	"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT		29	"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
	30	LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR		30	LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
	31	A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT		31	A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
	32	OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,		32	OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
	33	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT		33	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
	34	LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,		34	LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	35	DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY		35	DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	36	THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT		36	THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	37	(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE		37	(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
	38	OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.		38	OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	39			39
	40	##############################################################################		40	##############################################################################
	41	# #		41	# #
	42	# Portions Copyright (c) 2015 Intel Corporation #		42	# Portions Copyright (c) 2015 Intel Corporation #
	43	# Portions Copyright (c) 2015 CloudFlare, Inc. #		43	# Portions Copyright (c) 2015 CloudFlare, Inc. #
	44	# All rights reserved. #		44	# All rights reserved. #
	45	# #		45	# #
	46	# This software is made available to you under your choice of the #		46	# This software is made available to you under your choice of the #
	47	# Apache V.2.0 and/or BSD license below: #		47	# Apache V.2.0 and/or BSD license below: #
	48	# #		48	# #
	49	##############################################################################		49	##############################################################################
	50	# #		50	# #
	51	# Licensed under the Apache License, Version 2.0 (the "License"); #		51	# Licensed under the Apache License, Version 2.0 (the "License"); #
	52	# you may not use this file except in compliance with the License. #		52	# you may not use this file except in compliance with the License. #
	53	# You may obtain a copy of the License at #		53	# You may obtain a copy of the License at #
	54	# #		54	# #
	55	# http://www.apache.org/licenses/LICENSE-2.0 #		55	# http://www.apache.org/licenses/LICENSE-2.0 #
	56	# #		56	# #
	57	# Unless required by applicable law or agreed to in writing, software #		57	# Unless required by applicable law or agreed to in writing, software #
	58	# distributed under the License is distributed on an "AS IS" BASIS, #		58	# distributed under the License is distributed on an "AS IS" BASIS, #
	59	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. #		59	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. #
	60	# See the License for the specific language governing permissions and #		60	# See the License for the specific language governing permissions and #
	61	# limitations under the License. #		61	# limitations under the License. #
	62	# #		62	# #
	63	##############################################################################		63	##############################################################################
	64	# #		64	# #
	65	# Copyright (c) 2015 Intel Corporation #		65	# Copyright (c) 2015 Intel Corporation #
	66	# Copyright (c) 2015 CloudFlare, Inc. #		66	# Copyright (c) 2015 CloudFlare, Inc. #
	67	# All rights reserved. #		67	# All rights reserved. #
	68	# #		68	# #
	69	# This software is made available to you under your choice of the #		69	# This software is made available to you under your choice of the #
	70	# Apache V.2.0 and/or BSD license below: #		70	# Apache V.2.0 and/or BSD license below: #
	71	# #		71	# #
	72	##############################################################################		72	##############################################################################
	73	# #		73	# #
	74	# Licensed under the Apache License, Version 2.0 (the "License"); #		74	# Licensed under the Apache License, Version 2.0 (the "License"); #
	75	# you may not use this file except in compliance with the License. #		75	# you may not use this file except in compliance with the License. #
	76	# You may obtain a copy of the License at #		76	# You may obtain a copy of the License at #
	77	# #		77	# #
	78	# http://www.apache.org/licenses/LICENSE-2.0 #		78	# http://www.apache.org/licenses/LICENSE-2.0 #
	79	# #		79	# #
	80	# Unless required by applicable law or agreed to in writing, software #		80	# Unless required by applicable law or agreed to in writing, software #
	81	# distributed under the License is distributed on an "AS IS" BASIS, #		81	# distributed under the License is distributed on an "AS IS" BASIS, #
	82	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. #		82	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. #
	83	# See the License for the specific language governing permissions and #		83	# See the License for the specific language governing permissions and #
	84	# limitations under the License. #		84	# limitations under the License. #
	85	# #		85	# #
	86	##############################################################################		86	##############################################################################
	87	# #		87	# #
	88	# Redistribution and use in source and binary forms, with or without #		88	# Redistribution and use in source and binary forms, with or without #
	89	# modification, are permitted provided that the following conditions are #		89	# modification, are permitted provided that the following conditions are #
	90	# met: #		90	# met: #
	91	# #		91	# #
	92	# # Redistributions of source code must retain the above copyright #		92	# # Redistributions of source code must retain the above copyright #
	93	# notice, this list of conditions and the following disclaimer. #		93	# notice, this list of conditions and the following disclaimer. #
	94	# #		94	# #
	95	# # Redistributions in binary form must reproduce the above copyright #		95	# # Redistributions in binary form must reproduce the above copyright #
	96	# notice, this list of conditions and the following disclaimer in the #		96	# notice, this list of conditions and the following disclaimer in the #
	97	# documentation and/or other materials provided with the #		97	# documentation and/or other materials provided with the #
	98	# distribution. #		98	# distribution. #
	99	# #		99	# #
	100	# # Neither the name of the copyright holders nor the names of its #		100	# # Neither the name of the copyright holders nor the names of its #
	101	# contributors may be used to endorse or promote products derived from #		101	# contributors may be used to endorse or promote products derived from #
	102	# this software without specific prior written permission. #		102	# this software without specific prior written permission. #
	103	# #		103	# #
	104	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS #		104	# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS #
	105	# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED #		105	# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED #
	106	# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR#		106	# TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR#
	107	# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR #		107	# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR #
	108	# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, #		108	# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, #
	109	# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, #		109	# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, #
	110	# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR #		110	# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR #
	111	# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF #		111	# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF #
	112	# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING #		112	# LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING #
	113	# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS #		113	# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS #
	114	# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #		114	# SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. #
	115	# #		115	# #
	116	##############################################################################		116	##############################################################################
	117	# #		117	# #
	118	# Developers and authors: #		118	# Developers and authors: #
	119	# Shay Gueron (1, 2), and Vlad Krasnov (1, 3) #		119	# Shay Gueron (1, 2), and Vlad Krasnov (1, 3) #
	120	# (1) Intel Corporation, Israel Development Center #		120	# (1) Intel Corporation, Israel Development Center #
	121	# (2) University of Haifa #		121	# (2) University of Haifa #
	122	# (3) CloudFlare, Inc. #		122	# (3) CloudFlare, Inc. #
	123	# Reference: #		123	# Reference: #
	124	# S.Gueron and V.Krasnov, "Fast Prime Field Elliptic Curve Cryptography with#		124	# S.Gueron and V.Krasnov, "Fast Prime Field Elliptic Curve Cryptography with#
	125	# 256 Bit Primes" #		125	# 256 Bit Primes" #
	126	# https://eprint.iacr.org/2013/816.pdf #		126	# https://eprint.iacr.org/2013/816.pdf #
	127	##############################################################################		127	##############################################################################
	128			128
	129	# Further optimization by <appro@openssl.org>:		129	# Further optimization by <appro@openssl.org>:
	130	#		130	#
	131	# this/original with/without -DECP_NISTZ256_ASM(*)		131	# this/original with/without -DECP_NISTZ256_ASM(*)
	132	# Opteron +12-49% +110-150%		132	# Opteron +12-49% +110-150%
	133	# Bulldozer +14-45% +175-210%		133	# Bulldozer +14-45% +175-210%
	134	# P4 +18-46% n/a :-(		134	# P4 +18-46% n/a :-(
	135	# Westmere +12-34% +80-87%		135	# Westmere +12-34% +80-87%
	136	# Sandy Bridge +9-35% +110-120%		136	# Sandy Bridge +9-35% +110-120%
	137	# Ivy Bridge +9-35% +110-125%		137	# Ivy Bridge +9-35% +110-125%
	138	# Haswell +8-37% +140-160%		138	# Haswell +8-37% +140-160%
	139	# Broadwell +18-58% +145-210%		139	# Broadwell +18-58% +145-210%
	140	# Atom +15-50% +130-180%		140	# Atom +15-50% +130-180%
	141	# VIA Nano +43-160% +300-480%		141	# VIA Nano +43-160% +300-480%
	142	#		142	#
	143	# (*) "without -DECP_NISTZ256_ASM" refers to build with		143	# (*) "without -DECP_NISTZ256_ASM" refers to build with
	144	# "enable-ec_nistp_64_gcc_128";		144	# "enable-ec_nistp_64_gcc_128";
	145	#		145	#
	146	# Ranges denote minimum and maximum improvement coefficients depending		146	# Ranges denote minimum and maximum improvement coefficients depending
	147	# on benchmark. Lower coefficients are for ECDSA sign, relatively fastest		147	# on benchmark. Lower coefficients are for ECDSA sign, relatively fastest
	148	# server-side operation. Keep in mind that +100% means 2x improvement.		148	# server-side operation. Keep in mind that +100% means 2x improvement.
	149	*/		149	*/
n	150		n
	151
	152	// This file contains constant-time, 64-bit assembly implementation of		150	// This file contains constant-time, 64-bit assembly implementation of
	153	// P256. The optimizations performed here are described in detail in:		151	// P256. The optimizations performed here are described in detail in:
	154	// S.Gueron and V.Krasnov, "Fast prime field elliptic-curve cryptography with		152	// S.Gueron and V.Krasnov, "Fast prime field elliptic-curve cryptography with
	155	// 256-bit primes"		153	// 256-bit primes"
	156			154
	157	#include "textflag.h"		155	#include "textflag.h"
	158			156
	159	#define res_ptr DI		157	#define res_ptr DI
	160	#define x_ptr SI		158	#define x_ptr SI
	161	#define y_ptr CX		159	#define y_ptr CX
	162			160
	163	#define acc0 R8		161	#define acc0 R8
	164	#define acc1 R9		162	#define acc1 R9
	165	#define acc2 R10		163	#define acc2 R10
	166	#define acc3 R11		164	#define acc3 R11
	167	#define acc4 R12		165	#define acc4 R12
	168	#define acc5 R13		166	#define acc5 R13
	169	#define t0 R14		167	#define t0 R14
	170	#define t1 R15		168	#define t1 R15
	171			169
	172	DATA p256const0<>+0x00(SB)/8, $0x00000000ffffffff		170	DATA p256const0<>+0x00(SB)/8, $0x00000000ffffffff
	173	DATA p256const1<>+0x00(SB)/8, $0xffffffff00000001		171	DATA p256const1<>+0x00(SB)/8, $0xffffffff00000001
	174	DATA p256ordK0<>+0x00(SB)/8, $0xccd1c8aaee00bc4f		172	DATA p256ordK0<>+0x00(SB)/8, $0xccd1c8aaee00bc4f
	175	DATA p256ord<>+0x00(SB)/8, $0xf3b9cac2fc632551		173	DATA p256ord<>+0x00(SB)/8, $0xf3b9cac2fc632551
	176	DATA p256ord<>+0x08(SB)/8, $0xbce6faada7179e84		174	DATA p256ord<>+0x08(SB)/8, $0xbce6faada7179e84
	177	DATA p256ord<>+0x10(SB)/8, $0xffffffffffffffff		175	DATA p256ord<>+0x10(SB)/8, $0xffffffffffffffff
	178	DATA p256ord<>+0x18(SB)/8, $0xffffffff00000000		176	DATA p256ord<>+0x18(SB)/8, $0xffffffff00000000
	179	DATA p256one<>+0x00(SB)/8, $0x0000000000000001		177	DATA p256one<>+0x00(SB)/8, $0x0000000000000001
	180	DATA p256one<>+0x08(SB)/8, $0xffffffff00000000		178	DATA p256one<>+0x08(SB)/8, $0xffffffff00000000
	181	DATA p256one<>+0x10(SB)/8, $0xffffffffffffffff		179	DATA p256one<>+0x10(SB)/8, $0xffffffffffffffff
	182	DATA p256one<>+0x18(SB)/8, $0x00000000fffffffe		180	DATA p256one<>+0x18(SB)/8, $0x00000000fffffffe
	183	GLOBL p256const0<>(SB), 8, $8		181	GLOBL p256const0<>(SB), 8, $8
	184	GLOBL p256const1<>(SB), 8, $8		182	GLOBL p256const1<>(SB), 8, $8
	185	GLOBL p256ordK0<>(SB), 8, $8		183	GLOBL p256ordK0<>(SB), 8, $8
	186	GLOBL p256ord<>(SB), 8, $32		184	GLOBL p256ord<>(SB), 8, $32
	187	GLOBL p256one<>(SB), 8, $32		185	GLOBL p256one<>(SB), 8, $32
	188			186
n	189	/* ---------------------------------------*/	n	187	// ---------------------------------------
	190	// func p256LittleToBig(res []byte, in []uint64)		188	// func p256LittleToBig(res []byte, in []uint64)
n	191	TEXT ·p256LittleToBig(SB),NOSPLIT,$0	n	189	TEXT ·p256LittleToBig(SB), NOSPLIT, $0
	192	JMP ·p256BigToLittle(SB)		190	JMP ·p256BigToLittle(SB)
n			n	191
	193	/* ---------------------------------------*/		192	// ---------------------------------------
	194	// func p256BigToLittle(res []uint64, in []byte)		193	// func p256BigToLittle(res []uint64, in []byte)
n	195	TEXT ·p256BigToLittle(SB),NOSPLIT,$0	n	194	TEXT ·p256BigToLittle(SB), NOSPLIT, $0
	196	MOVQ z+0(FP), res_ptr		195	MOVQ z+0(FP), res_ptr
	197	MOVQ x+24(FP), x_ptr		196	MOVQ x+24(FP), x_ptr
	198			197
	199	MOVQ (8*0)(x_ptr), acc0		198	MOVQ (8*0)(x_ptr), acc0
	200	MOVQ (8*1)(x_ptr), acc1		199	MOVQ (8*1)(x_ptr), acc1
	201	MOVQ (8*2)(x_ptr), acc2		200	MOVQ (8*2)(x_ptr), acc2
	202	MOVQ (8*3)(x_ptr), acc3		201	MOVQ (8*3)(x_ptr), acc3
	203			202
	204	BSWAPQ acc0		203	BSWAPQ acc0
	205	BSWAPQ acc1		204	BSWAPQ acc1
	206	BSWAPQ acc2		205	BSWAPQ acc2
	207	BSWAPQ acc3		206	BSWAPQ acc3
	208			207
	209	MOVQ acc3, (8*0)(res_ptr)		208	MOVQ acc3, (8*0)(res_ptr)
	210	MOVQ acc2, (8*1)(res_ptr)		209	MOVQ acc2, (8*1)(res_ptr)
	211	MOVQ acc1, (8*2)(res_ptr)		210	MOVQ acc1, (8*2)(res_ptr)
	212	MOVQ acc0, (8*3)(res_ptr)		211	MOVQ acc0, (8*3)(res_ptr)
	213			212
	214	RET		213	RET
n			n	214
	215	/* ---------------------------------------*/		215	// ---------------------------------------
	216	// func p256MovCond(res, a, b []uint64, cond int)		216	// func p256MovCond(res, a, b []uint64, cond int)
	217	// If cond == 0 res=b, else res=a		217	// If cond == 0 res=b, else res=a
n	218	TEXT ·p256MovCond(SB),NOSPLIT,$0	n	218	TEXT ·p256MovCond(SB), NOSPLIT, $0
	219	MOVQ res+0(FP), res_ptr		219	MOVQ res+0(FP), res_ptr
	220	MOVQ a+24(FP), x_ptr		220	MOVQ a+24(FP), x_ptr
	221	MOVQ b+48(FP), y_ptr		221	MOVQ b+48(FP), y_ptr
	222	MOVL cond+72(FP), t0		222	MOVL cond+72(FP), t0
	223			223
n	224	MOVL t0, X12	n	224	MOVL t0, X12
	225	PXOR X13, X13		225	PXOR X13, X13
	226	PSHUFB X13, X12		226	PSHUFB X13, X12
	227	PCMPEQB X13, X12		227	PCMPEQB X13, X12
	228			228
	229	MOVOU X12, X0		229	MOVOU X12, X0
	230	PANDN (16*0)(x_ptr), X0		230	PANDN (16*0)(x_ptr), X0
	231	MOVOU X12, X1		231	MOVOU X12, X1
	232	PANDN (16*1)(x_ptr), X1		232	PANDN (16*1)(x_ptr), X1
	233	MOVOU X12, X2		233	MOVOU X12, X2
	234	PANDN (16*2)(x_ptr), X2		234	PANDN (16*2)(x_ptr), X2
	235	MOVOU X12, X3		235	MOVOU X12, X3
	236	PANDN (16*3)(x_ptr), X3		236	PANDN (16*3)(x_ptr), X3
	237	MOVOU X12, X4		237	MOVOU X12, X4
	238	PANDN (16*4)(x_ptr), X4		238	PANDN (16*4)(x_ptr), X4
	239	MOVOU X12, X5		239	MOVOU X12, X5
	240	PANDN (16*5)(x_ptr), X5		240	PANDN (16*5)(x_ptr), X5
	241			241
	242	MOVOU (16*0)(y_ptr), X6		242	MOVOU (16*0)(y_ptr), X6
	243	MOVOU (16*1)(y_ptr), X7		243	MOVOU (16*1)(y_ptr), X7
	244	MOVOU (16*2)(y_ptr), X8		244	MOVOU (16*2)(y_ptr), X8
	245	MOVOU (16*3)(y_ptr), X9		245	MOVOU (16*3)(y_ptr), X9
	246	MOVOU (16*4)(y_ptr), X10		246	MOVOU (16*4)(y_ptr), X10
	247	MOVOU (16*5)(y_ptr), X11		247	MOVOU (16*5)(y_ptr), X11
	248			248
	249	PAND X12, X6		249	PAND X12, X6
	250	PAND X12, X7		250	PAND X12, X7
	251	PAND X12, X8		251	PAND X12, X8
	252	PAND X12, X9		252	PAND X12, X9
	253	PAND X12, X10		253	PAND X12, X10
	254	PAND X12, X11		254	PAND X12, X11
	255			255
	256	PXOR X6, X0		256	PXOR X6, X0
	257	PXOR X7, X1		257	PXOR X7, X1
	258	PXOR X8, X2		258	PXOR X8, X2
	259	PXOR X9, X3		259	PXOR X9, X3
	260	PXOR X10, X4		260	PXOR X10, X4
	261	PXOR X11, X5		261	PXOR X11, X5
	262			262
	263	MOVOU X0, (16*0)(res_ptr)		263	MOVOU X0, (16*0)(res_ptr)
	264	MOVOU X1, (16*1)(res_ptr)		264	MOVOU X1, (16*1)(res_ptr)
	265	MOVOU X2, (16*2)(res_ptr)		265	MOVOU X2, (16*2)(res_ptr)
	266	MOVOU X3, (16*3)(res_ptr)		266	MOVOU X3, (16*3)(res_ptr)
	267	MOVOU X4, (16*4)(res_ptr)		267	MOVOU X4, (16*4)(res_ptr)
	268	MOVOU X5, (16*5)(res_ptr)		268	MOVOU X5, (16*5)(res_ptr)
	269			269
	270	RET		270	RET
n			n	271
	271	/* ---------------------------------------*/		272	// ---------------------------------------
	272	// func p256NegCond(val []uint64, cond int)		273	// func p256NegCond(val []uint64, cond int)
n	273	TEXT ·p256NegCond(SB),NOSPLIT,$0	n	274	TEXT ·p256NegCond(SB), NOSPLIT, $0
	274	MOVQ val+0(FP), res_ptr		275	MOVQ val+0(FP), res_ptr
	275	MOVL cond+24(FP), t0		276	MOVL cond+24(FP), t0
n			n	277
	276	// acc = poly		278	// acc = poly
	277	MOVQ $-1, acc0		279	MOVQ $-1, acc0
	278	MOVQ p256const0<>(SB), acc1		280	MOVQ p256const0<>(SB), acc1
	279	MOVQ $0, acc2		281	MOVQ $0, acc2
	280	MOVQ p256const1<>(SB), acc3		282	MOVQ p256const1<>(SB), acc3
n			n	283
	281	// Load the original value		284	// Load the original value
	282	MOVQ (8*0)(res_ptr), acc5		285	MOVQ (8*0)(res_ptr), acc5
	283	MOVQ (8*1)(res_ptr), x_ptr		286	MOVQ (8*1)(res_ptr), x_ptr
	284	MOVQ (8*2)(res_ptr), y_ptr		287	MOVQ (8*2)(res_ptr), y_ptr
	285	MOVQ (8*3)(res_ptr), t1		288	MOVQ (8*3)(res_ptr), t1
n			n	289
	286	// Speculatively subtract		290	// Speculatively subtract
	287	SUBQ acc5, acc0		291	SUBQ acc5, acc0
	288	SBBQ x_ptr, acc1		292	SBBQ x_ptr, acc1
	289	SBBQ y_ptr, acc2		293	SBBQ y_ptr, acc2
	290	SBBQ t1, acc3		294	SBBQ t1, acc3
n			n	295
	291	// If condition is 0, keep original value		296	// If condition is 0, keep original value
n	292	TESTQ t0, t0	n	297	TESTQ t0, t0
	293	CMOVQEQ acc5, acc0		298	CMOVQEQ acc5, acc0
	294	CMOVQEQ x_ptr, acc1		299	CMOVQEQ x_ptr, acc1
	295	CMOVQEQ y_ptr, acc2		300	CMOVQEQ y_ptr, acc2
	296	CMOVQEQ t1, acc3		301	CMOVQEQ t1, acc3
n			n	302
	297	// Store result		303	// Store result
	298	MOVQ acc0, (8*0)(res_ptr)		304	MOVQ acc0, (8*0)(res_ptr)
	299	MOVQ acc1, (8*1)(res_ptr)		305	MOVQ acc1, (8*1)(res_ptr)
	300	MOVQ acc2, (8*2)(res_ptr)		306	MOVQ acc2, (8*2)(res_ptr)
	301	MOVQ acc3, (8*3)(res_ptr)		307	MOVQ acc3, (8*3)(res_ptr)
	302			308
	303	RET		309	RET
n			n	310
	304	/* ---------------------------------------*/		311	// ---------------------------------------
	305	// func p256Sqr(res, in []uint64)		312	// func p256Sqr(res, in []uint64)
n	306	TEXT ·p256Sqr(SB),NOSPLIT,$0	n	313	TEXT ·p256Sqr(SB), NOSPLIT, $0
	307	MOVQ res+0(FP), res_ptr		314	MOVQ res+0(FP), res_ptr
	308	MOVQ in+24(FP), x_ptr		315	MOVQ in+24(FP), x_ptr
n			n	316
	309	// y[1:] * y[0]		317	// y[1:] * y[0]
	310	MOVQ (8*0)(x_ptr), t0		318	MOVQ (8*0)(x_ptr), t0
	311			319
	312	MOVQ (8*1)(x_ptr), AX		320	MOVQ (8*1)(x_ptr), AX
	313	MULQ t0		321	MULQ t0
	314	MOVQ AX, acc1		322	MOVQ AX, acc1
	315	MOVQ DX, acc2		323	MOVQ DX, acc2
	316			324
	317	MOVQ (8*2)(x_ptr), AX		325	MOVQ (8*2)(x_ptr), AX
	318	MULQ t0		326	MULQ t0
	319	ADDQ AX, acc2		327	ADDQ AX, acc2
	320	ADCQ $0, DX		328	ADCQ $0, DX
	321	MOVQ DX, acc3		329	MOVQ DX, acc3
	322			330
	323	MOVQ (8*3)(x_ptr), AX		331	MOVQ (8*3)(x_ptr), AX
	324	MULQ t0		332	MULQ t0
	325	ADDQ AX, acc3		333	ADDQ AX, acc3
	326	ADCQ $0, DX		334	ADCQ $0, DX
	327	MOVQ DX, acc4		335	MOVQ DX, acc4
n			n	336
	328	// y[2:] * y[1]		337	// y[2:] * y[1]
	329	MOVQ (8*1)(x_ptr), t0		338	MOVQ (8*1)(x_ptr), t0
	330			339
	331	MOVQ (8*2)(x_ptr), AX		340	MOVQ (8*2)(x_ptr), AX
	332	MULQ t0		341	MULQ t0
	333	ADDQ AX, acc3		342	ADDQ AX, acc3
	334	ADCQ $0, DX		343	ADCQ $0, DX
	335	MOVQ DX, t1		344	MOVQ DX, t1
	336			345
	337	MOVQ (8*3)(x_ptr), AX		346	MOVQ (8*3)(x_ptr), AX
	338	MULQ t0		347	MULQ t0
	339	ADDQ t1, acc4		348	ADDQ t1, acc4
	340	ADCQ $0, DX		349	ADCQ $0, DX
	341	ADDQ AX, acc4		350	ADDQ AX, acc4
	342	ADCQ $0, DX		351	ADCQ $0, DX
	343	MOVQ DX, acc5		352	MOVQ DX, acc5
n			n	353
	344	// y[3] * y[2]		354	// y[3] * y[2]
	345	MOVQ (8*2)(x_ptr), t0		355	MOVQ (8*2)(x_ptr), t0
	346			356
	347	MOVQ (8*3)(x_ptr), AX		357	MOVQ (8*3)(x_ptr), AX
	348	MULQ t0		358	MULQ t0
	349	ADDQ AX, acc5		359	ADDQ AX, acc5
	350	ADCQ $0, DX		360	ADCQ $0, DX
	351	MOVQ DX, y_ptr		361	MOVQ DX, y_ptr
	352	XORQ t1, t1		362	XORQ t1, t1
n			n	363
	353	// *2		364	// *2
	354	ADDQ acc1, acc1		365	ADDQ acc1, acc1
	355	ADCQ acc2, acc2		366	ADCQ acc2, acc2
	356	ADCQ acc3, acc3		367	ADCQ acc3, acc3
	357	ADCQ acc4, acc4		368	ADCQ acc4, acc4
	358	ADCQ acc5, acc5		369	ADCQ acc5, acc5
	359	ADCQ y_ptr, y_ptr		370	ADCQ y_ptr, y_ptr
	360	ADCQ $0, t1		371	ADCQ $0, t1
n			n	372
	361	// Missing products		373	// Missing products
	362	MOVQ (8*0)(x_ptr), AX		374	MOVQ (8*0)(x_ptr), AX
	363	MULQ AX		375	MULQ AX
	364	MOVQ AX, acc0		376	MOVQ AX, acc0
	365	MOVQ DX, t0		377	MOVQ DX, t0
	366			378
	367	MOVQ (8*1)(x_ptr), AX		379	MOVQ (8*1)(x_ptr), AX
	368	MULQ AX		380	MULQ AX
	369	ADDQ t0, acc1		381	ADDQ t0, acc1
	370	ADCQ AX, acc2		382	ADCQ AX, acc2
	371	ADCQ $0, DX		383	ADCQ $0, DX
	372	MOVQ DX, t0		384	MOVQ DX, t0
	373			385
	374	MOVQ (8*2)(x_ptr), AX		386	MOVQ (8*2)(x_ptr), AX
	375	MULQ AX		387	MULQ AX
	376	ADDQ t0, acc3		388	ADDQ t0, acc3
	377	ADCQ AX, acc4		389	ADCQ AX, acc4
	378	ADCQ $0, DX		390	ADCQ $0, DX
	379	MOVQ DX, t0		391	MOVQ DX, t0
	380			392
	381	MOVQ (8*3)(x_ptr), AX		393	MOVQ (8*3)(x_ptr), AX
	382	MULQ AX		394	MULQ AX
	383	ADDQ t0, acc5		395	ADDQ t0, acc5
	384	ADCQ AX, y_ptr		396	ADCQ AX, y_ptr
	385	ADCQ DX, t1		397	ADCQ DX, t1
	386	MOVQ t1, x_ptr		398	MOVQ t1, x_ptr
n			n	399
	387	// First reduction step		400	// First reduction step
	388	MOVQ acc0, AX		401	MOVQ acc0, AX
	389	MOVQ acc0, t1		402	MOVQ acc0, t1
	390	SHLQ $32, acc0		403	SHLQ $32, acc0
	391	MULQ p256const1<>(SB)		404	MULQ p256const1<>(SB)
	392	SHRQ $32, t1		405	SHRQ $32, t1
	393	ADDQ acc0, acc1		406	ADDQ acc0, acc1
	394	ADCQ t1, acc2		407	ADCQ t1, acc2
	395	ADCQ AX, acc3		408	ADCQ AX, acc3
	396	ADCQ $0, DX		409	ADCQ $0, DX
	397	MOVQ DX, acc0		410	MOVQ DX, acc0
n			n	411
	398	// Second reduction step		412	// Second reduction step
	399	MOVQ acc1, AX		413	MOVQ acc1, AX
	400	MOVQ acc1, t1		414	MOVQ acc1, t1
	401	SHLQ $32, acc1		415	SHLQ $32, acc1
	402	MULQ p256const1<>(SB)		416	MULQ p256const1<>(SB)
	403	SHRQ $32, t1		417	SHRQ $32, t1
	404	ADDQ acc1, acc2		418	ADDQ acc1, acc2
	405	ADCQ t1, acc3		419	ADCQ t1, acc3
	406	ADCQ AX, acc0		420	ADCQ AX, acc0
	407	ADCQ $0, DX		421	ADCQ $0, DX
	408	MOVQ DX, acc1		422	MOVQ DX, acc1
n			n	423
	409	// Third reduction step		424	// Third reduction step
	410	MOVQ acc2, AX		425	MOVQ acc2, AX
	411	MOVQ acc2, t1		426	MOVQ acc2, t1
	412	SHLQ $32, acc2		427	SHLQ $32, acc2
	413	MULQ p256const1<>(SB)		428	MULQ p256const1<>(SB)
	414	SHRQ $32, t1		429	SHRQ $32, t1
	415	ADDQ acc2, acc3		430	ADDQ acc2, acc3
	416	ADCQ t1, acc0		431	ADCQ t1, acc0
	417	ADCQ AX, acc1		432	ADCQ AX, acc1
	418	ADCQ $0, DX		433	ADCQ $0, DX
	419	MOVQ DX, acc2		434	MOVQ DX, acc2
n			n	435
	420	// Last reduction step		436	// Last reduction step
	421	XORQ t0, t0		437	XORQ t0, t0
	422	MOVQ acc3, AX		438	MOVQ acc3, AX
	423	MOVQ acc3, t1		439	MOVQ acc3, t1
	424	SHLQ $32, acc3		440	SHLQ $32, acc3
	425	MULQ p256const1<>(SB)		441	MULQ p256const1<>(SB)
	426	SHRQ $32, t1		442	SHRQ $32, t1
	427	ADDQ acc3, acc0		443	ADDQ acc3, acc0
	428	ADCQ t1, acc1		444	ADCQ t1, acc1
	429	ADCQ AX, acc2		445	ADCQ AX, acc2
	430	ADCQ $0, DX		446	ADCQ $0, DX
	431	MOVQ DX, acc3		447	MOVQ DX, acc3
n			n	448
	432	// Add bits [511:256] of the sqr result		449	// Add bits [511:256] of the sqr result
	433	ADCQ acc4, acc0		450	ADCQ acc4, acc0
	434	ADCQ acc5, acc1		451	ADCQ acc5, acc1
	435	ADCQ y_ptr, acc2		452	ADCQ y_ptr, acc2
	436	ADCQ x_ptr, acc3		453	ADCQ x_ptr, acc3
	437	ADCQ $0, t0		454	ADCQ $0, t0
	438			455
	439	MOVQ acc0, acc4		456	MOVQ acc0, acc4
	440	MOVQ acc1, acc5		457	MOVQ acc1, acc5
	441	MOVQ acc2, y_ptr		458	MOVQ acc2, y_ptr
	442	MOVQ acc3, t1		459	MOVQ acc3, t1
n			n	460
	443	// Subtract p256		461	// Subtract p256
	444	SUBQ $-1, acc0		462	SUBQ $-1, acc0
n	445	SBBQ p256const0<>(SB) ,acc1	n	463	SBBQ p256const0<>(SB), acc1
	446	SBBQ $0, acc2		464	SBBQ $0, acc2
	447	SBBQ p256const1<>(SB), acc3		465	SBBQ p256const1<>(SB), acc3
	448	SBBQ $0, t0		466	SBBQ $0, t0
	449			467
	450	CMOVQCS acc4, acc0		468	CMOVQCS acc4, acc0
	451	CMOVQCS acc5, acc1		469	CMOVQCS acc5, acc1
	452	CMOVQCS y_ptr, acc2		470	CMOVQCS y_ptr, acc2
	453	CMOVQCS t1, acc3		471	CMOVQCS t1, acc3
	454			472
	455	MOVQ acc0, (8*0)(res_ptr)		473	MOVQ acc0, (8*0)(res_ptr)
	456	MOVQ acc1, (8*1)(res_ptr)		474	MOVQ acc1, (8*1)(res_ptr)
	457	MOVQ acc2, (8*2)(res_ptr)		475	MOVQ acc2, (8*2)(res_ptr)
	458	MOVQ acc3, (8*3)(res_ptr)		476	MOVQ acc3, (8*3)(res_ptr)
	459			477
	460	RET		478	RET
n			n	479
	461	/* ---------------------------------------*/		480	// ---------------------------------------
	462	// func p256Mul(res, in1, in2 []uint64)		481	// func p256Mul(res, in1, in2 []uint64)
n	463	TEXT ·p256Mul(SB),NOSPLIT,$0	n	482	TEXT ·p256Mul(SB), NOSPLIT, $0
	464	MOVQ res+0(FP), res_ptr		483	MOVQ res+0(FP), res_ptr
	465	MOVQ in1+24(FP), x_ptr		484	MOVQ in1+24(FP), x_ptr
	466	MOVQ in2+48(FP), y_ptr		485	MOVQ in2+48(FP), y_ptr
n			n	486
	467	// x * y[0]		487	// x * y[0]
	468	MOVQ (8*0)(y_ptr), t0		488	MOVQ (8*0)(y_ptr), t0
	469			489
	470	MOVQ (8*0)(x_ptr), AX		490	MOVQ (8*0)(x_ptr), AX
	471	MULQ t0		491	MULQ t0
	472	MOVQ AX, acc0		492	MOVQ AX, acc0
	473	MOVQ DX, acc1		493	MOVQ DX, acc1
	474			494
	475	MOVQ (8*1)(x_ptr), AX		495	MOVQ (8*1)(x_ptr), AX
	476	MULQ t0		496	MULQ t0
	477	ADDQ AX, acc1		497	ADDQ AX, acc1
	478	ADCQ $0, DX		498	ADCQ $0, DX
	479	MOVQ DX, acc2		499	MOVQ DX, acc2
	480			500
	481	MOVQ (8*2)(x_ptr), AX		501	MOVQ (8*2)(x_ptr), AX
	482	MULQ t0		502	MULQ t0
	483	ADDQ AX, acc2		503	ADDQ AX, acc2
	484	ADCQ $0, DX		504	ADCQ $0, DX
	485	MOVQ DX, acc3		505	MOVQ DX, acc3
	486			506
	487	MOVQ (8*3)(x_ptr), AX		507	MOVQ (8*3)(x_ptr), AX
	488	MULQ t0		508	MULQ t0
	489	ADDQ AX, acc3		509	ADDQ AX, acc3
	490	ADCQ $0, DX		510	ADCQ $0, DX
	491	MOVQ DX, acc4		511	MOVQ DX, acc4
	492	XORQ acc5, acc5		512	XORQ acc5, acc5
n			n	513
	493	// First reduction step		514	// First reduction step
	494	MOVQ acc0, AX		515	MOVQ acc0, AX
	495	MOVQ acc0, t1		516	MOVQ acc0, t1
	496	SHLQ $32, acc0		517	SHLQ $32, acc0
	497	MULQ p256const1<>(SB)		518	MULQ p256const1<>(SB)
	498	SHRQ $32, t1		519	SHRQ $32, t1
	499	ADDQ acc0, acc1		520	ADDQ acc0, acc1
	500	ADCQ t1, acc2		521	ADCQ t1, acc2
	501	ADCQ AX, acc3		522	ADCQ AX, acc3
	502	ADCQ DX, acc4		523	ADCQ DX, acc4
	503	ADCQ $0, acc5		524	ADCQ $0, acc5
	504	XORQ acc0, acc0		525	XORQ acc0, acc0
n			n	526
	505	// x * y[1]		527	// x * y[1]
	506	MOVQ (8*1)(y_ptr), t0		528	MOVQ (8*1)(y_ptr), t0
	507			529
	508	MOVQ (8*0)(x_ptr), AX		530	MOVQ (8*0)(x_ptr), AX
	509	MULQ t0		531	MULQ t0
	510	ADDQ AX, acc1		532	ADDQ AX, acc1
	511	ADCQ $0, DX		533	ADCQ $0, DX
	512	MOVQ DX, t1		534	MOVQ DX, t1
	513			535
	514	MOVQ (8*1)(x_ptr), AX		536	MOVQ (8*1)(x_ptr), AX
	515	MULQ t0		537	MULQ t0
	516	ADDQ t1, acc2		538	ADDQ t1, acc2
	517	ADCQ $0, DX		539	ADCQ $0, DX
	518	ADDQ AX, acc2		540	ADDQ AX, acc2
	519	ADCQ $0, DX		541	ADCQ $0, DX
	520	MOVQ DX, t1		542	MOVQ DX, t1
	521			543
	522	MOVQ (8*2)(x_ptr), AX		544	MOVQ (8*2)(x_ptr), AX
	523	MULQ t0		545	MULQ t0
	524	ADDQ t1, acc3		546	ADDQ t1, acc3
	525	ADCQ $0, DX		547	ADCQ $0, DX
	526	ADDQ AX, acc3		548	ADDQ AX, acc3
	527	ADCQ $0, DX		549	ADCQ $0, DX
	528	MOVQ DX, t1		550	MOVQ DX, t1
	529			551
	530	MOVQ (8*3)(x_ptr), AX		552	MOVQ (8*3)(x_ptr), AX
	531	MULQ t0		553	MULQ t0
	532	ADDQ t1, acc4		554	ADDQ t1, acc4
	533	ADCQ $0, DX		555	ADCQ $0, DX
	534	ADDQ AX, acc4		556	ADDQ AX, acc4
	535	ADCQ DX, acc5		557	ADCQ DX, acc5
	536	ADCQ $0, acc0		558	ADCQ $0, acc0
n			n	559
	537	// Second reduction step		560	// Second reduction step
	538	MOVQ acc1, AX		561	MOVQ acc1, AX
	539	MOVQ acc1, t1		562	MOVQ acc1, t1
	540	SHLQ $32, acc1		563	SHLQ $32, acc1
	541	MULQ p256const1<>(SB)		564	MULQ p256const1<>(SB)
	542	SHRQ $32, t1		565	SHRQ $32, t1
	543	ADDQ acc1, acc2		566	ADDQ acc1, acc2
	544	ADCQ t1, acc3		567	ADCQ t1, acc3
	545	ADCQ AX, acc4		568	ADCQ AX, acc4
	546	ADCQ DX, acc5		569	ADCQ DX, acc5
	547	ADCQ $0, acc0		570	ADCQ $0, acc0
	548	XORQ acc1, acc1		571	XORQ acc1, acc1
n			n	572
	549	// x * y[2]		573	// x * y[2]
	550	MOVQ (8*2)(y_ptr), t0		574	MOVQ (8*2)(y_ptr), t0
	551			575
	552	MOVQ (8*0)(x_ptr), AX		576	MOVQ (8*0)(x_ptr), AX
	553	MULQ t0		577	MULQ t0
	554	ADDQ AX, acc2		578	ADDQ AX, acc2
	555	ADCQ $0, DX		579	ADCQ $0, DX
	556	MOVQ DX, t1		580	MOVQ DX, t1
	557			581
	558	MOVQ (8*1)(x_ptr), AX		582	MOVQ (8*1)(x_ptr), AX
	559	MULQ t0		583	MULQ t0
	560	ADDQ t1, acc3		584	ADDQ t1, acc3
	561	ADCQ $0, DX		585	ADCQ $0, DX
	562	ADDQ AX, acc3		586	ADDQ AX, acc3
	563	ADCQ $0, DX		587	ADCQ $0, DX
	564	MOVQ DX, t1		588	MOVQ DX, t1
	565			589
	566	MOVQ (8*2)(x_ptr), AX		590	MOVQ (8*2)(x_ptr), AX
	567	MULQ t0		591	MULQ t0
	568	ADDQ t1, acc4		592	ADDQ t1, acc4
	569	ADCQ $0, DX		593	ADCQ $0, DX
	570	ADDQ AX, acc4		594	ADDQ AX, acc4
	571	ADCQ $0, DX		595	ADCQ $0, DX
	572	MOVQ DX, t1		596	MOVQ DX, t1
	573			597
	574	MOVQ (8*3)(x_ptr), AX		598	MOVQ (8*3)(x_ptr), AX
	575	MULQ t0		599	MULQ t0
	576	ADDQ t1, acc5		600	ADDQ t1, acc5
	577	ADCQ $0, DX		601	ADCQ $0, DX
	578	ADDQ AX, acc5		602	ADDQ AX, acc5
	579	ADCQ DX, acc0		603	ADCQ DX, acc0
	580	ADCQ $0, acc1		604	ADCQ $0, acc1
n			n	605
	581	// Third reduction step		606	// Third reduction step
	582	MOVQ acc2, AX		607	MOVQ acc2, AX
	583	MOVQ acc2, t1		608	MOVQ acc2, t1
	584	SHLQ $32, acc2		609	SHLQ $32, acc2
	585	MULQ p256const1<>(SB)		610	MULQ p256const1<>(SB)
	586	SHRQ $32, t1		611	SHRQ $32, t1
	587	ADDQ acc2, acc3		612	ADDQ acc2, acc3
	588	ADCQ t1, acc4		613	ADCQ t1, acc4
	589	ADCQ AX, acc5		614	ADCQ AX, acc5
	590	ADCQ DX, acc0		615	ADCQ DX, acc0
	591	ADCQ $0, acc1		616	ADCQ $0, acc1
	592	XORQ acc2, acc2		617	XORQ acc2, acc2
n			n	618
	593	// x * y[3]		619	// x * y[3]
	594	MOVQ (8*3)(y_ptr), t0		620	MOVQ (8*3)(y_ptr), t0
	595			621
	596	MOVQ (8*0)(x_ptr), AX		622	MOVQ (8*0)(x_ptr), AX
	597	MULQ t0		623	MULQ t0
	598	ADDQ AX, acc3		624	ADDQ AX, acc3
	599	ADCQ $0, DX		625	ADCQ $0, DX
	600	MOVQ DX, t1		626	MOVQ DX, t1
	601			627
	602	MOVQ (8*1)(x_ptr), AX		628	MOVQ (8*1)(x_ptr), AX
	603	MULQ t0		629	MULQ t0
	604	ADDQ t1, acc4		630	ADDQ t1, acc4
	605	ADCQ $0, DX		631	ADCQ $0, DX
	606	ADDQ AX, acc4		632	ADDQ AX, acc4
	607	ADCQ $0, DX		633	ADCQ $0, DX
	608	MOVQ DX, t1		634	MOVQ DX, t1
	609			635
	610	MOVQ (8*2)(x_ptr), AX		636	MOVQ (8*2)(x_ptr), AX
	611	MULQ t0		637	MULQ t0
	612	ADDQ t1, acc5		638	ADDQ t1, acc5
	613	ADCQ $0, DX		639	ADCQ $0, DX
	614	ADDQ AX, acc5		640	ADDQ AX, acc5
	615	ADCQ $0, DX		641	ADCQ $0, DX
	616	MOVQ DX, t1		642	MOVQ DX, t1
	617			643
	618	MOVQ (8*3)(x_ptr), AX		644	MOVQ (8*3)(x_ptr), AX
	619	MULQ t0		645	MULQ t0
	620	ADDQ t1, acc0		646	ADDQ t1, acc0
	621	ADCQ $0, DX		647	ADCQ $0, DX
	622	ADDQ AX, acc0		648	ADDQ AX, acc0
	623	ADCQ DX, acc1		649	ADCQ DX, acc1
	624	ADCQ $0, acc2		650	ADCQ $0, acc2
n			n	651
	625	// Last reduction step		652	// Last reduction step
	626	MOVQ acc3, AX		653	MOVQ acc3, AX
	627	MOVQ acc3, t1		654	MOVQ acc3, t1
	628	SHLQ $32, acc3		655	SHLQ $32, acc3
	629	MULQ p256const1<>(SB)		656	MULQ p256const1<>(SB)
	630	SHRQ $32, t1		657	SHRQ $32, t1
	631	ADDQ acc3, acc4		658	ADDQ acc3, acc4
	632	ADCQ t1, acc5		659	ADCQ t1, acc5
	633	ADCQ AX, acc0		660	ADCQ AX, acc0
	634	ADCQ DX, acc1		661	ADCQ DX, acc1
	635	ADCQ $0, acc2		662	ADCQ $0, acc2
n			n	663
	636	// Copy result [255:0]		664	// Copy result [255:0]
	637	MOVQ acc4, x_ptr		665	MOVQ acc4, x_ptr
	638	MOVQ acc5, acc3		666	MOVQ acc5, acc3
	639	MOVQ acc0, t0		667	MOVQ acc0, t0
	640	MOVQ acc1, t1		668	MOVQ acc1, t1
n			n	669
	641	// Subtract p256		670	// Subtract p256
	642	SUBQ $-1, acc4		671	SUBQ $-1, acc4
n	643	SBBQ p256const0<>(SB) ,acc5	n	672	SBBQ p256const0<>(SB), acc5
	644	SBBQ $0, acc0		673	SBBQ $0, acc0
	645	SBBQ p256const1<>(SB), acc1		674	SBBQ p256const1<>(SB), acc1
	646	SBBQ $0, acc2		675	SBBQ $0, acc2
	647			676
	648	CMOVQCS x_ptr, acc4		677	CMOVQCS x_ptr, acc4
	649	CMOVQCS acc3, acc5		678	CMOVQCS acc3, acc5
	650	CMOVQCS t0, acc0		679	CMOVQCS t0, acc0
	651	CMOVQCS t1, acc1		680	CMOVQCS t1, acc1
	652			681
	653	MOVQ acc4, (8*0)(res_ptr)		682	MOVQ acc4, (8*0)(res_ptr)
	654	MOVQ acc5, (8*1)(res_ptr)		683	MOVQ acc5, (8*1)(res_ptr)
	655	MOVQ acc0, (8*2)(res_ptr)		684	MOVQ acc0, (8*2)(res_ptr)
	656	MOVQ acc1, (8*3)(res_ptr)		685	MOVQ acc1, (8*3)(res_ptr)
	657			686
	658	RET		687	RET
n			n	688
	659	/* ---------------------------------------*/		689	// ---------------------------------------
	660	// func p256FromMont(res, in []uint64)		690	// func p256FromMont(res, in []uint64)
n	661	TEXT ·p256FromMont(SB),NOSPLIT,$0	n	691	TEXT ·p256FromMont(SB), NOSPLIT, $0
	662	MOVQ res+0(FP), res_ptr		692	MOVQ res+0(FP), res_ptr
	663	MOVQ in+24(FP), x_ptr		693	MOVQ in+24(FP), x_ptr
	664			694
	665	MOVQ (8*0)(x_ptr), acc0		695	MOVQ (8*0)(x_ptr), acc0
	666	MOVQ (8*1)(x_ptr), acc1		696	MOVQ (8*1)(x_ptr), acc1
	667	MOVQ (8*2)(x_ptr), acc2		697	MOVQ (8*2)(x_ptr), acc2
	668	MOVQ (8*3)(x_ptr), acc3		698	MOVQ (8*3)(x_ptr), acc3
	669	XORQ acc4, acc4		699	XORQ acc4, acc4
	670			700
	671	// Only reduce, no multiplications are needed		701	// Only reduce, no multiplications are needed
	672	// First stage		702	// First stage
	673	MOVQ acc0, AX		703	MOVQ acc0, AX
	674	MOVQ acc0, t1		704	MOVQ acc0, t1
	675	SHLQ $32, acc0		705	SHLQ $32, acc0
	676	MULQ p256const1<>(SB)		706	MULQ p256const1<>(SB)
	677	SHRQ $32, t1		707	SHRQ $32, t1
	678	ADDQ acc0, acc1		708	ADDQ acc0, acc1
	679	ADCQ t1, acc2		709	ADCQ t1, acc2
	680	ADCQ AX, acc3		710	ADCQ AX, acc3
	681	ADCQ DX, acc4		711	ADCQ DX, acc4
	682	XORQ acc5, acc5		712	XORQ acc5, acc5
n			n	713
	683	// Second stage		714	// Second stage
	684	MOVQ acc1, AX		715	MOVQ acc1, AX
	685	MOVQ acc1, t1		716	MOVQ acc1, t1
	686	SHLQ $32, acc1		717	SHLQ $32, acc1
	687	MULQ p256const1<>(SB)		718	MULQ p256const1<>(SB)
	688	SHRQ $32, t1		719	SHRQ $32, t1
	689	ADDQ acc1, acc2		720	ADDQ acc1, acc2
	690	ADCQ t1, acc3		721	ADCQ t1, acc3
	691	ADCQ AX, acc4		722	ADCQ AX, acc4
	692	ADCQ DX, acc5		723	ADCQ DX, acc5
	693	XORQ acc0, acc0		724	XORQ acc0, acc0
n			n	725
	694	// Third stage		726	// Third stage
	695	MOVQ acc2, AX		727	MOVQ acc2, AX
	696	MOVQ acc2, t1		728	MOVQ acc2, t1
	697	SHLQ $32, acc2		729	SHLQ $32, acc2
	698	MULQ p256const1<>(SB)		730	MULQ p256const1<>(SB)
	699	SHRQ $32, t1		731	SHRQ $32, t1
	700	ADDQ acc2, acc3		732	ADDQ acc2, acc3
	701	ADCQ t1, acc4		733	ADCQ t1, acc4
	702	ADCQ AX, acc5		734	ADCQ AX, acc5
	703	ADCQ DX, acc0		735	ADCQ DX, acc0
	704	XORQ acc1, acc1		736	XORQ acc1, acc1
n			n	737
	705	// Last stage		738	// Last stage
	706	MOVQ acc3, AX		739	MOVQ acc3, AX
	707	MOVQ acc3, t1		740	MOVQ acc3, t1
	708	SHLQ $32, acc3		741	SHLQ $32, acc3
	709	MULQ p256const1<>(SB)		742	MULQ p256const1<>(SB)
	710	SHRQ $32, t1		743	SHRQ $32, t1
	711	ADDQ acc3, acc4		744	ADDQ acc3, acc4
	712	ADCQ t1, acc5		745	ADCQ t1, acc5
	713	ADCQ AX, acc0		746	ADCQ AX, acc0
	714	ADCQ DX, acc1		747	ADCQ DX, acc1
	715			748
	716	MOVQ acc4, x_ptr		749	MOVQ acc4, x_ptr
	717	MOVQ acc5, acc3		750	MOVQ acc5, acc3
	718	MOVQ acc0, t0		751	MOVQ acc0, t0
	719	MOVQ acc1, t1		752	MOVQ acc1, t1
	720			753
	721	SUBQ $-1, acc4		754	SUBQ $-1, acc4
	722	SBBQ p256const0<>(SB), acc5		755	SBBQ p256const0<>(SB), acc5
	723	SBBQ $0, acc0		756	SBBQ $0, acc0
	724	SBBQ p256const1<>(SB), acc1		757	SBBQ p256const1<>(SB), acc1
	725			758
	726	CMOVQCS x_ptr, acc4		759	CMOVQCS x_ptr, acc4
	727	CMOVQCS acc3, acc5		760	CMOVQCS acc3, acc5
	728	CMOVQCS t0, acc0		761	CMOVQCS t0, acc0
	729	CMOVQCS t1, acc1		762	CMOVQCS t1, acc1
	730			763
	731	MOVQ acc4, (8*0)(res_ptr)		764	MOVQ acc4, (8*0)(res_ptr)
	732	MOVQ acc5, (8*1)(res_ptr)		765	MOVQ acc5, (8*1)(res_ptr)
	733	MOVQ acc0, (8*2)(res_ptr)		766	MOVQ acc0, (8*2)(res_ptr)
	734	MOVQ acc1, (8*3)(res_ptr)		767	MOVQ acc1, (8*3)(res_ptr)
	735			768
	736	RET		769	RET
n			n	770
	737	/* ---------------------------------------*/		771	// ---------------------------------------
	738	// Constant time point access to arbitrary point table.		772	// Constant time point access to arbitrary point table.
	739	// Indexed from 1 to 15, with -1 offset		773	// Indexed from 1 to 15, with -1 offset
	740	// (index 0 is implicitly point at infinity)		774	// (index 0 is implicitly point at infinity)
	741	// func p256Select(p, r []uint64, idx int)		775	// func p256Select(p, r []uint64, idx int)
n	742	TEXT ·p256Select(SB),NOSPLIT,$0	n	776	TEXT ·p256Select(SB), NOSPLIT, $0
	743	MOVL idx+48(FP),AX		777	MOVL idx+48(FP), AX
	744	MOVQ r+24(FP),DI		778	MOVQ r+24(FP), DI
	745	MOVQ p+0(FP),DX		779	MOVQ p+0(FP), DX
	746			780
n	747	PXOR X15, X15 // X15 = 0	n	781	PXOR X15, X15 // X15 = 0
	748	PCMPEQL X14, X14 // X14 = -1		782	PCMPEQL X14, X14 // X14 = -1
	749	PSUBL X14, X15 // X15 = 1		783	PSUBL X14, X15 // X15 = 1
	750	MOVL AX, X14		784	MOVL AX, X14
	751	PSHUFD $0, X14, X14		785	PSHUFD $0, X14, X14
	752			786
	753	PXOR X0, X0		787	PXOR X0, X0
	754	PXOR X1, X1		788	PXOR X1, X1
	755	PXOR X2, X2		789	PXOR X2, X2
	756	PXOR X3, X3		790	PXOR X3, X3
	757	PXOR X4, X4		791	PXOR X4, X4
	758	PXOR X5, X5		792	PXOR X5, X5
	759	MOVQ $16, AX		793	MOVQ $16, AX
	760			794
	761	MOVOU X15, X13		795	MOVOU X15, X13
	762			796
	763	loop_select:		797	loop_select:
	764			798
n	765	MOVOU X13, X12	n	799	MOVOU X13, X12
	766	PADDL X15, X13		800	PADDL X15, X13
	767	PCMPEQL X14, X12		801	PCMPEQL X14, X12
	768			802
n	769	MOVOU (16*0)(DI), X6	n	803	MOVOU (16*0)(DI), X6
	770	MOVOU (16*1)(DI), X7		804	MOVOU (16*1)(DI), X7
	771	MOVOU (16*2)(DI), X8		805	MOVOU (16*2)(DI), X8
	772	MOVOU (16*3)(DI), X9		806	MOVOU (16*3)(DI), X9
	773	MOVOU (16*4)(DI), X10		807	MOVOU (16*4)(DI), X10
	774	MOVOU (16*5)(DI), X11		808	MOVOU (16*5)(DI), X11
	775	ADDQ $(16*6), DI		809	ADDQ $(16*6), DI
	776			810
n	777	PAND X12, X6	n	811	PAND X12, X6
	778	PAND X12, X7		812	PAND X12, X7
	779	PAND X12, X8		813	PAND X12, X8
	780	PAND X12, X9		814	PAND X12, X9
	781	PAND X12, X10		815	PAND X12, X10
	782	PAND X12, X11		816	PAND X12, X11
	783			817
n	784	PXOR X6, X0	n	818	PXOR X6, X0
	785	PXOR X7, X1		819	PXOR X7, X1
	786	PXOR X8, X2		820	PXOR X8, X2
	787	PXOR X9, X3		821	PXOR X9, X3
	788	PXOR X10, X4		822	PXOR X10, X4
	789	PXOR X11, X5		823	PXOR X11, X5
	790			824
n	791	DECQ AX	n	825	DECQ AX
	792	JNE loop_select		826	JNE loop_select
	793			827
	794	MOVOU X0, (16*0)(DX)		828	MOVOU X0, (16*0)(DX)
	795	MOVOU X1, (16*1)(DX)		829	MOVOU X1, (16*1)(DX)
	796	MOVOU X2, (16*2)(DX)		830	MOVOU X2, (16*2)(DX)
	797	MOVOU X3, (16*3)(DX)		831	MOVOU X3, (16*3)(DX)
	798	MOVOU X4, (16*4)(DX)		832	MOVOU X4, (16*4)(DX)
	799	MOVOU X5, (16*5)(DX)		833	MOVOU X5, (16*5)(DX)
	800			834
	801	RET		835	RET
n			n	836
	802	/* ---------------------------------------*/		837	// ---------------------------------------
	803	// Constant time point access to base point table.		838	// Constant time point access to base point table.
	804	// func p256SelectBase(p, r []uint64, idx int)		839	// func p256SelectBase(p, r []uint64, idx int)
n	805	TEXT ·p256SelectBase(SB),NOSPLIT,$0	n	840	TEXT ·p256SelectBase(SB), NOSPLIT, $0
	806	MOVL idx+48(FP),AX		841	MOVL idx+48(FP), AX
	807	MOVQ r+24(FP),DI		842	MOVQ r+24(FP), DI
	808	MOVQ p+0(FP),DX		843	MOVQ p+0(FP), DX
	809			844
n	810	PXOR X15, X15 // X15 = 0	n	845	PXOR X15, X15 // X15 = 0
	811	PCMPEQL X14, X14 // X14 = -1		846	PCMPEQL X14, X14 // X14 = -1
	812	PSUBL X14, X15 // X15 = 1		847	PSUBL X14, X15 // X15 = 1
	813	MOVL AX, X14		848	MOVL AX, X14
	814	PSHUFD $0, X14, X14		849	PSHUFD $0, X14, X14
	815			850
	816	PXOR X0, X0		851	PXOR X0, X0
	817	PXOR X1, X1		852	PXOR X1, X1
	818	PXOR X2, X2		853	PXOR X2, X2
	819	PXOR X3, X3		854	PXOR X3, X3
	820	MOVQ $32, AX		855	MOVQ $32, AX
	821			856
	822	MOVOU X15, X13		857	MOVOU X15, X13
	823			858
	824	loop_select_base:		859	loop_select_base:
	825			860
n	826	MOVOU X13, X12	n	861	MOVOU X13, X12
	827	PADDL X15, X13		862	PADDL X15, X13
	828	PCMPEQL X14, X12		863	PCMPEQL X14, X12
	829			864
n	830	MOVOU (16*0)(DI), X4	n	865	MOVOU (16*0)(DI), X4
	831	MOVOU (16*1)(DI), X5		866	MOVOU (16*1)(DI), X5
	832	MOVOU (16*2)(DI), X6		867	MOVOU (16*2)(DI), X6
	833	MOVOU (16*3)(DI), X7		868	MOVOU (16*3)(DI), X7
	834			869
n	835	MOVOU (16*4)(DI), X8	n	870	MOVOU (16*4)(DI), X8
	836	MOVOU (16*5)(DI), X9		871	MOVOU (16*5)(DI), X9
	837	MOVOU (16*6)(DI), X10		872	MOVOU (16*6)(DI), X10
	838	MOVOU (16*7)(DI), X11		873	MOVOU (16*7)(DI), X11
	839			874
n	840	ADDQ $(16*8), DI	n	875	ADDQ $(16*8), DI
	841			876
n	842	PAND X12, X4	n	877	PAND X12, X4
	843	PAND X12, X5		878	PAND X12, X5
	844	PAND X12, X6		879	PAND X12, X6
	845	PAND X12, X7		880	PAND X12, X7
	846			881
n	847	MOVOU X13, X12	n	882	MOVOU X13, X12
	848	PADDL X15, X13		883	PADDL X15, X13
	849	PCMPEQL X14, X12		884	PCMPEQL X14, X12
	850			885
n	851	PAND X12, X8	n	886	PAND X12, X8
	852	PAND X12, X9		887	PAND X12, X9
	853	PAND X12, X10		888	PAND X12, X10
	854	PAND X12, X11		889	PAND X12, X11
	855			890
n	856	PXOR X4, X0	n	891	PXOR X4, X0
	857	PXOR X5, X1		892	PXOR X5, X1
	858	PXOR X6, X2		893	PXOR X6, X2
	859	PXOR X7, X3		894	PXOR X7, X3
	860			895
n	861	PXOR X8, X0	n	896	PXOR X8, X0
	862	PXOR X9, X1		897	PXOR X9, X1
	863	PXOR X10, X2		898	PXOR X10, X2
	864	PXOR X11, X3		899	PXOR X11, X3
	865			900
n	866	DECQ AX	n	901	DECQ AX
	867	JNE loop_select_base		902	JNE loop_select_base
	868			903
	869	MOVOU X0, (16*0)(DX)		904	MOVOU X0, (16*0)(DX)
	870	MOVOU X1, (16*1)(DX)		905	MOVOU X1, (16*1)(DX)
	871	MOVOU X2, (16*2)(DX)		906	MOVOU X2, (16*2)(DX)
	872	MOVOU X3, (16*3)(DX)		907	MOVOU X3, (16*3)(DX)
	873			908
	874	RET		909	RET
n			n	910
	875	/* ---------------------------------------*/		911	// ---------------------------------------
	876	// func p256OrdMul(res, in1, in2 []uint64)		912	// func p256OrdMul(res, in1, in2 []uint64)
n	877	TEXT ·p256OrdMul(SB),NOSPLIT,$0	n	913	TEXT ·p256OrdMul(SB), NOSPLIT, $0
	878	MOVQ res+0(FP), res_ptr		914	MOVQ res+0(FP), res_ptr
	879	MOVQ in1+24(FP), x_ptr		915	MOVQ in1+24(FP), x_ptr
	880	MOVQ in2+48(FP), y_ptr		916	MOVQ in2+48(FP), y_ptr
n			n	917
	881	// x * y[0]		918	// x * y[0]
	882	MOVQ (8*0)(y_ptr), t0		919	MOVQ (8*0)(y_ptr), t0
	883			920
	884	MOVQ (8*0)(x_ptr), AX		921	MOVQ (8*0)(x_ptr), AX
	885	MULQ t0		922	MULQ t0
	886	MOVQ AX, acc0		923	MOVQ AX, acc0
	887	MOVQ DX, acc1		924	MOVQ DX, acc1
	888			925
	889	MOVQ (8*1)(x_ptr), AX		926	MOVQ (8*1)(x_ptr), AX
	890	MULQ t0		927	MULQ t0
	891	ADDQ AX, acc1		928	ADDQ AX, acc1
	892	ADCQ $0, DX		929	ADCQ $0, DX
	893	MOVQ DX, acc2		930	MOVQ DX, acc2
	894			931
	895	MOVQ (8*2)(x_ptr), AX		932	MOVQ (8*2)(x_ptr), AX
	896	MULQ t0		933	MULQ t0
	897	ADDQ AX, acc2		934	ADDQ AX, acc2
	898	ADCQ $0, DX		935	ADCQ $0, DX
	899	MOVQ DX, acc3		936	MOVQ DX, acc3
	900			937
	901	MOVQ (8*3)(x_ptr), AX		938	MOVQ (8*3)(x_ptr), AX
	902	MULQ t0		939	MULQ t0
	903	ADDQ AX, acc3		940	ADDQ AX, acc3
	904	ADCQ $0, DX		941	ADCQ $0, DX
	905	MOVQ DX, acc4		942	MOVQ DX, acc4
	906	XORQ acc5, acc5		943	XORQ acc5, acc5
n			n	944
	907	// First reduction step		945	// First reduction step
	908	MOVQ acc0, AX		946	MOVQ acc0, AX
	909	MULQ p256ordK0<>(SB)		947	MULQ p256ordK0<>(SB)
	910	MOVQ AX, t0		948	MOVQ AX, t0
	911			949
	912	MOVQ p256ord<>+0x00(SB), AX		950	MOVQ p256ord<>+0x00(SB), AX
	913	MULQ t0		951	MULQ t0
	914	ADDQ AX, acc0		952	ADDQ AX, acc0
	915	ADCQ $0, DX		953	ADCQ $0, DX
	916	MOVQ DX, t1		954	MOVQ DX, t1
	917			955
	918	MOVQ p256ord<>+0x08(SB), AX		956	MOVQ p256ord<>+0x08(SB), AX
	919	MULQ t0		957	MULQ t0
	920	ADDQ t1, acc1		958	ADDQ t1, acc1
	921	ADCQ $0, DX		959	ADCQ $0, DX
	922	ADDQ AX, acc1		960	ADDQ AX, acc1
	923	ADCQ $0, DX		961	ADCQ $0, DX
	924	MOVQ DX, t1		962	MOVQ DX, t1
	925			963
	926	MOVQ p256ord<>+0x10(SB), AX		964	MOVQ p256ord<>+0x10(SB), AX
	927	MULQ t0		965	MULQ t0
	928	ADDQ t1, acc2		966	ADDQ t1, acc2
	929	ADCQ $0, DX		967	ADCQ $0, DX
	930	ADDQ AX, acc2		968	ADDQ AX, acc2
	931	ADCQ $0, DX		969	ADCQ $0, DX
	932	MOVQ DX, t1		970	MOVQ DX, t1
	933			971
	934	MOVQ p256ord<>+0x18(SB), AX		972	MOVQ p256ord<>+0x18(SB), AX
	935	MULQ t0		973	MULQ t0
	936	ADDQ t1, acc3		974	ADDQ t1, acc3
	937	ADCQ $0, DX		975	ADCQ $0, DX
	938	ADDQ AX, acc3		976	ADDQ AX, acc3
	939	ADCQ DX, acc4		977	ADCQ DX, acc4
	940	ADCQ $0, acc5		978	ADCQ $0, acc5
n			n	979
	941	// x * y[1]		980	// x * y[1]
	942	MOVQ (8*1)(y_ptr), t0		981	MOVQ (8*1)(y_ptr), t0
	943			982
	944	MOVQ (8*0)(x_ptr), AX		983	MOVQ (8*0)(x_ptr), AX
	945	MULQ t0		984	MULQ t0
	946	ADDQ AX, acc1		985	ADDQ AX, acc1
	947	ADCQ $0, DX		986	ADCQ $0, DX
	948	MOVQ DX, t1		987	MOVQ DX, t1
	949			988
	950	MOVQ (8*1)(x_ptr), AX		989	MOVQ (8*1)(x_ptr), AX
	951	MULQ t0		990	MULQ t0
	952	ADDQ t1, acc2		991	ADDQ t1, acc2
	953	ADCQ $0, DX		992	ADCQ $0, DX
	954	ADDQ AX, acc2		993	ADDQ AX, acc2
	955	ADCQ $0, DX		994	ADCQ $0, DX
	956	MOVQ DX, t1		995	MOVQ DX, t1
	957			996
	958	MOVQ (8*2)(x_ptr), AX		997	MOVQ (8*2)(x_ptr), AX
	959	MULQ t0		998	MULQ t0
	960	ADDQ t1, acc3		999	ADDQ t1, acc3
	961	ADCQ $0, DX		1000	ADCQ $0, DX
	962	ADDQ AX, acc3		1001	ADDQ AX, acc3
	963	ADCQ $0, DX		1002	ADCQ $0, DX
	964	MOVQ DX, t1		1003	MOVQ DX, t1
	965			1004
	966	MOVQ (8*3)(x_ptr), AX		1005	MOVQ (8*3)(x_ptr), AX
	967	MULQ t0		1006	MULQ t0
	968	ADDQ t1, acc4		1007	ADDQ t1, acc4
	969	ADCQ $0, DX		1008	ADCQ $0, DX
	970	ADDQ AX, acc4		1009	ADDQ AX, acc4
	971	ADCQ DX, acc5		1010	ADCQ DX, acc5
	972	ADCQ $0, acc0		1011	ADCQ $0, acc0
n			n	1012
	973	// Second reduction step		1013	// Second reduction step
	974	MOVQ acc1, AX		1014	MOVQ acc1, AX
	975	MULQ p256ordK0<>(SB)		1015	MULQ p256ordK0<>(SB)
	976	MOVQ AX, t0		1016	MOVQ AX, t0
	977			1017
	978	MOVQ p256ord<>+0x00(SB), AX		1018	MOVQ p256ord<>+0x00(SB), AX
	979	MULQ t0		1019	MULQ t0
	980	ADDQ AX, acc1		1020	ADDQ AX, acc1
	981	ADCQ $0, DX		1021	ADCQ $0, DX
	982	MOVQ DX, t1		1022	MOVQ DX, t1
	983			1023
	984	MOVQ p256ord<>+0x08(SB), AX		1024	MOVQ p256ord<>+0x08(SB), AX
	985	MULQ t0		1025	MULQ t0
	986	ADDQ t1, acc2		1026	ADDQ t1, acc2
	987	ADCQ $0, DX		1027	ADCQ $0, DX
	988	ADDQ AX, acc2		1028	ADDQ AX, acc2
	989	ADCQ $0, DX		1029	ADCQ $0, DX
	990	MOVQ DX, t1		1030	MOVQ DX, t1
	991			1031
	992	MOVQ p256ord<>+0x10(SB), AX		1032	MOVQ p256ord<>+0x10(SB), AX
	993	MULQ t0		1033	MULQ t0
	994	ADDQ t1, acc3		1034	ADDQ t1, acc3
	995	ADCQ $0, DX		1035	ADCQ $0, DX
	996	ADDQ AX, acc3		1036	ADDQ AX, acc3
	997	ADCQ $0, DX		1037	ADCQ $0, DX
	998	MOVQ DX, t1		1038	MOVQ DX, t1
	999			1039
	1000	MOVQ p256ord<>+0x18(SB), AX		1040	MOVQ p256ord<>+0x18(SB), AX
	1001	MULQ t0		1041	MULQ t0
	1002	ADDQ t1, acc4		1042	ADDQ t1, acc4
	1003	ADCQ $0, DX		1043	ADCQ $0, DX
	1004	ADDQ AX, acc4		1044	ADDQ AX, acc4
	1005	ADCQ DX, acc5		1045	ADCQ DX, acc5
	1006	ADCQ $0, acc0		1046	ADCQ $0, acc0
n			n	1047
	1007	// x * y[2]		1048	// x * y[2]
	1008	MOVQ (8*2)(y_ptr), t0		1049	MOVQ (8*2)(y_ptr), t0
	1009			1050
	1010	MOVQ (8*0)(x_ptr), AX		1051	MOVQ (8*0)(x_ptr), AX
	1011	MULQ t0		1052	MULQ t0
	1012	ADDQ AX, acc2		1053	ADDQ AX, acc2
	1013	ADCQ $0, DX		1054	ADCQ $0, DX
	1014	MOVQ DX, t1		1055	MOVQ DX, t1
	1015			1056
	1016	MOVQ (8*1)(x_ptr), AX		1057	MOVQ (8*1)(x_ptr), AX
	1017	MULQ t0		1058	MULQ t0
	1018	ADDQ t1, acc3		1059	ADDQ t1, acc3
	1019	ADCQ $0, DX		1060	ADCQ $0, DX
	1020	ADDQ AX, acc3		1061	ADDQ AX, acc3
	1021	ADCQ $0, DX		1062	ADCQ $0, DX
	1022	MOVQ DX, t1		1063	MOVQ DX, t1
	1023			1064
	1024	MOVQ (8*2)(x_ptr), AX		1065	MOVQ (8*2)(x_ptr), AX
	1025	MULQ t0		1066	MULQ t0
	1026	ADDQ t1, acc4		1067	ADDQ t1, acc4
	1027	ADCQ $0, DX		1068	ADCQ $0, DX
	1028	ADDQ AX, acc4		1069	ADDQ AX, acc4
	1029	ADCQ $0, DX		1070	ADCQ $0, DX
	1030	MOVQ DX, t1		1071	MOVQ DX, t1
	1031			1072
	1032	MOVQ (8*3)(x_ptr), AX		1073	MOVQ (8*3)(x_ptr), AX
	1033	MULQ t0		1074	MULQ t0
	1034	ADDQ t1, acc5		1075	ADDQ t1, acc5
	1035	ADCQ $0, DX		1076	ADCQ $0, DX
	1036	ADDQ AX, acc5		1077	ADDQ AX, acc5
	1037	ADCQ DX, acc0		1078	ADCQ DX, acc0
	1038	ADCQ $0, acc1		1079	ADCQ $0, acc1
n			n	1080
	1039	// Third reduction step		1081	// Third reduction step
	1040	MOVQ acc2, AX		1082	MOVQ acc2, AX
	1041	MULQ p256ordK0<>(SB)		1083	MULQ p256ordK0<>(SB)
	1042	MOVQ AX, t0		1084	MOVQ AX, t0
	1043			1085
	1044	MOVQ p256ord<>+0x00(SB), AX		1086	MOVQ p256ord<>+0x00(SB), AX
	1045	MULQ t0		1087	MULQ t0
	1046	ADDQ AX, acc2		1088	ADDQ AX, acc2
	1047	ADCQ $0, DX		1089	ADCQ $0, DX
	1048	MOVQ DX, t1		1090	MOVQ DX, t1
	1049			1091
	1050	MOVQ p256ord<>+0x08(SB), AX		1092	MOVQ p256ord<>+0x08(SB), AX
	1051	MULQ t0		1093	MULQ t0
	1052	ADDQ t1, acc3		1094	ADDQ t1, acc3
	1053	ADCQ $0, DX		1095	ADCQ $0, DX
	1054	ADDQ AX, acc3		1096	ADDQ AX, acc3
	1055	ADCQ $0, DX		1097	ADCQ $0, DX
	1056	MOVQ DX, t1		1098	MOVQ DX, t1
	1057			1099
	1058	MOVQ p256ord<>+0x10(SB), AX		1100	MOVQ p256ord<>+0x10(SB), AX
	1059	MULQ t0		1101	MULQ t0
	1060	ADDQ t1, acc4		1102	ADDQ t1, acc4
	1061	ADCQ $0, DX		1103	ADCQ $0, DX
	1062	ADDQ AX, acc4		1104	ADDQ AX, acc4
	1063	ADCQ $0, DX		1105	ADCQ $0, DX
	1064	MOVQ DX, t1		1106	MOVQ DX, t1
	1065			1107
	1066	MOVQ p256ord<>+0x18(SB), AX		1108	MOVQ p256ord<>+0x18(SB), AX
	1067	MULQ t0		1109	MULQ t0
	1068	ADDQ t1, acc5		1110	ADDQ t1, acc5
	1069	ADCQ $0, DX		1111	ADCQ $0, DX
	1070	ADDQ AX, acc5		1112	ADDQ AX, acc5
	1071	ADCQ DX, acc0		1113	ADCQ DX, acc0
	1072	ADCQ $0, acc1		1114	ADCQ $0, acc1
n			n	1115
	1073	// x * y[3]		1116	// x * y[3]
	1074	MOVQ (8*3)(y_ptr), t0		1117	MOVQ (8*3)(y_ptr), t0
	1075			1118
	1076	MOVQ (8*0)(x_ptr), AX		1119	MOVQ (8*0)(x_ptr), AX
	1077	MULQ t0		1120	MULQ t0
	1078	ADDQ AX, acc3		1121	ADDQ AX, acc3
	1079	ADCQ $0, DX		1122	ADCQ $0, DX
	1080	MOVQ DX, t1		1123	MOVQ DX, t1
	1081			1124
	1082	MOVQ (8*1)(x_ptr), AX		1125	MOVQ (8*1)(x_ptr), AX
	1083	MULQ t0		1126	MULQ t0
	1084	ADDQ t1, acc4		1127	ADDQ t1, acc4
	1085	ADCQ $0, DX		1128	ADCQ $0, DX
	1086	ADDQ AX, acc4		1129	ADDQ AX, acc4
	1087	ADCQ $0, DX		1130	ADCQ $0, DX
	1088	MOVQ DX, t1		1131	MOVQ DX, t1
	1089			1132
	1090	MOVQ (8*2)(x_ptr), AX		1133	MOVQ (8*2)(x_ptr), AX
	1091	MULQ t0		1134	MULQ t0
	1092	ADDQ t1, acc5		1135	ADDQ t1, acc5
	1093	ADCQ $0, DX		1136	ADCQ $0, DX
	1094	ADDQ AX, acc5		1137	ADDQ AX, acc5
	1095	ADCQ $0, DX		1138	ADCQ $0, DX
	1096	MOVQ DX, t1		1139	MOVQ DX, t1
	1097			1140
	1098	MOVQ (8*3)(x_ptr), AX		1141	MOVQ (8*3)(x_ptr), AX
	1099	MULQ t0		1142	MULQ t0
	1100	ADDQ t1, acc0		1143	ADDQ t1, acc0
	1101	ADCQ $0, DX		1144	ADCQ $0, DX
	1102	ADDQ AX, acc0		1145	ADDQ AX, acc0
	1103	ADCQ DX, acc1		1146	ADCQ DX, acc1
	1104	ADCQ $0, acc2		1147	ADCQ $0, acc2
n			n	1148
	1105	// Last reduction step		1149	// Last reduction step
	1106	MOVQ acc3, AX		1150	MOVQ acc3, AX
	1107	MULQ p256ordK0<>(SB)		1151	MULQ p256ordK0<>(SB)
	1108	MOVQ AX, t0		1152	MOVQ AX, t0
	1109			1153
	1110	MOVQ p256ord<>+0x00(SB), AX		1154	MOVQ p256ord<>+0x00(SB), AX
	1111	MULQ t0		1155	MULQ t0
	1112	ADDQ AX, acc3		1156	ADDQ AX, acc3
	1113	ADCQ $0, DX		1157	ADCQ $0, DX
	1114	MOVQ DX, t1		1158	MOVQ DX, t1
	1115			1159
	1116	MOVQ p256ord<>+0x08(SB), AX		1160	MOVQ p256ord<>+0x08(SB), AX
	1117	MULQ t0		1161	MULQ t0
	1118	ADDQ t1, acc4		1162	ADDQ t1, acc4
	1119	ADCQ $0, DX		1163	ADCQ $0, DX
	1120	ADDQ AX, acc4		1164	ADDQ AX, acc4
	1121	ADCQ $0, DX		1165	ADCQ $0, DX
	1122	MOVQ DX, t1		1166	MOVQ DX, t1
	1123			1167
	1124	MOVQ p256ord<>+0x10(SB), AX		1168	MOVQ p256ord<>+0x10(SB), AX
	1125	MULQ t0		1169	MULQ t0
	1126	ADDQ t1, acc5		1170	ADDQ t1, acc5
	1127	ADCQ $0, DX		1171	ADCQ $0, DX
	1128	ADDQ AX, acc5		1172	ADDQ AX, acc5
	1129	ADCQ $0, DX		1173	ADCQ $0, DX
	1130	MOVQ DX, t1		1174	MOVQ DX, t1
	1131			1175
	1132	MOVQ p256ord<>+0x18(SB), AX		1176	MOVQ p256ord<>+0x18(SB), AX
	1133	MULQ t0		1177	MULQ t0
	1134	ADDQ t1, acc0		1178	ADDQ t1, acc0
	1135	ADCQ $0, DX		1179	ADCQ $0, DX
	1136	ADDQ AX, acc0		1180	ADDQ AX, acc0
	1137	ADCQ DX, acc1		1181	ADCQ DX, acc1
	1138	ADCQ $0, acc2		1182	ADCQ $0, acc2
n			n	1183
	1139	// Copy result [255:0]		1184	// Copy result [255:0]
	1140	MOVQ acc4, x_ptr		1185	MOVQ acc4, x_ptr
	1141	MOVQ acc5, acc3		1186	MOVQ acc5, acc3
	1142	MOVQ acc0, t0		1187	MOVQ acc0, t0
	1143	MOVQ acc1, t1		1188	MOVQ acc1, t1
n			n	1189
	1144	// Subtract p256		1190	// Subtract p256
	1145	SUBQ p256ord<>+0x00(SB), acc4		1191	SUBQ p256ord<>+0x00(SB), acc4
n	1146	SBBQ p256ord<>+0x08(SB) ,acc5	n	1192	SBBQ p256ord<>+0x08(SB), acc5
	1147	SBBQ p256ord<>+0x10(SB), acc0		1193	SBBQ p256ord<>+0x10(SB), acc0
	1148	SBBQ p256ord<>+0x18(SB), acc1		1194	SBBQ p256ord<>+0x18(SB), acc1
	1149	SBBQ $0, acc2		1195	SBBQ $0, acc2
	1150			1196
	1151	CMOVQCS x_ptr, acc4		1197	CMOVQCS x_ptr, acc4
	1152	CMOVQCS acc3, acc5		1198	CMOVQCS acc3, acc5
	1153	CMOVQCS t0, acc0		1199	CMOVQCS t0, acc0
	1154	CMOVQCS t1, acc1		1200	CMOVQCS t1, acc1
	1155			1201
	1156	MOVQ acc4, (8*0)(res_ptr)		1202	MOVQ acc4, (8*0)(res_ptr)
	1157	MOVQ acc5, (8*1)(res_ptr)		1203	MOVQ acc5, (8*1)(res_ptr)
	1158	MOVQ acc0, (8*2)(res_ptr)		1204	MOVQ acc0, (8*2)(res_ptr)
	1159	MOVQ acc1, (8*3)(res_ptr)		1205	MOVQ acc1, (8*3)(res_ptr)
	1160			1206
	1161	RET		1207	RET
n			n	1208
	1162	/* ---------------------------------------*/		1209	// ---------------------------------------
	1163	// func p256OrdSqr(res, in []uint64, n int)		1210	// func p256OrdSqr(res, in []uint64, n int)
n	1164	TEXT ·p256OrdSqr(SB),NOSPLIT,$0	n	1211	TEXT ·p256OrdSqr(SB), NOSPLIT, $0
	1165	MOVQ z+0(FP), res_ptr		1212	MOVQ z+0(FP), res_ptr
	1166	MOVQ x+24(FP), x_ptr		1213	MOVQ x+24(FP), x_ptr
	1167	MOVL n+48(FP), BX		1214	MOVL n+48(FP), BX
	1168			1215
	1169	ordSqrLoop:		1216	ordSqrLoop:
	1170			1217
	1171	// y[1:] * y[0]		1218	// y[1:] * y[0]
	1172	MOVQ (8*0)(x_ptr), t0		1219	MOVQ (8*0)(x_ptr), t0
	1173			1220
	1174	MOVQ (8*1)(x_ptr), AX		1221	MOVQ (8*1)(x_ptr), AX
	1175	MULQ t0		1222	MULQ t0
	1176	MOVQ AX, acc1		1223	MOVQ AX, acc1
	1177	MOVQ DX, acc2		1224	MOVQ DX, acc2
	1178			1225
	1179	MOVQ (8*2)(x_ptr), AX		1226	MOVQ (8*2)(x_ptr), AX
	1180	MULQ t0		1227	MULQ t0
	1181	ADDQ AX, acc2		1228	ADDQ AX, acc2
	1182	ADCQ $0, DX		1229	ADCQ $0, DX
	1183	MOVQ DX, acc3		1230	MOVQ DX, acc3
	1184			1231
	1185	MOVQ (8*3)(x_ptr), AX		1232	MOVQ (8*3)(x_ptr), AX
	1186	MULQ t0		1233	MULQ t0
	1187	ADDQ AX, acc3		1234	ADDQ AX, acc3
	1188	ADCQ $0, DX		1235	ADCQ $0, DX
	1189	MOVQ DX, acc4		1236	MOVQ DX, acc4
n			n	1237
	1190	// y[2:] * y[1]		1238	// y[2:] * y[1]
	1191	MOVQ (8*1)(x_ptr), t0		1239	MOVQ (8*1)(x_ptr), t0
	1192			1240
	1193	MOVQ (8*2)(x_ptr), AX		1241	MOVQ (8*2)(x_ptr), AX
	1194	MULQ t0		1242	MULQ t0
	1195	ADDQ AX, acc3		1243	ADDQ AX, acc3
	1196	ADCQ $0, DX		1244	ADCQ $0, DX
	1197	MOVQ DX, t1		1245	MOVQ DX, t1
	1198			1246
	1199	MOVQ (8*3)(x_ptr), AX		1247	MOVQ (8*3)(x_ptr), AX
	1200	MULQ t0		1248	MULQ t0
	1201	ADDQ t1, acc4		1249	ADDQ t1, acc4
	1202	ADCQ $0, DX		1250	ADCQ $0, DX
	1203	ADDQ AX, acc4		1251	ADDQ AX, acc4
	1204	ADCQ $0, DX		1252	ADCQ $0, DX
	1205	MOVQ DX, acc5		1253	MOVQ DX, acc5
n			n	1254
	1206	// y[3] * y[2]		1255	// y[3] * y[2]
	1207	MOVQ (8*2)(x_ptr), t0		1256	MOVQ (8*2)(x_ptr), t0
	1208			1257
	1209	MOVQ (8*3)(x_ptr), AX		1258	MOVQ (8*3)(x_ptr), AX
	1210	MULQ t0		1259	MULQ t0
	1211	ADDQ AX, acc5		1260	ADDQ AX, acc5
	1212	ADCQ $0, DX		1261	ADCQ $0, DX
	1213	MOVQ DX, y_ptr		1262	MOVQ DX, y_ptr
	1214	XORQ t1, t1		1263	XORQ t1, t1
n			n	1264
	1215	// *2		1265	// *2
	1216	ADDQ acc1, acc1		1266	ADDQ acc1, acc1
	1217	ADCQ acc2, acc2		1267	ADCQ acc2, acc2
	1218	ADCQ acc3, acc3		1268	ADCQ acc3, acc3
	1219	ADCQ acc4, acc4		1269	ADCQ acc4, acc4
	1220	ADCQ acc5, acc5		1270	ADCQ acc5, acc5
	1221	ADCQ y_ptr, y_ptr		1271	ADCQ y_ptr, y_ptr
	1222	ADCQ $0, t1		1272	ADCQ $0, t1
n			n	1273
	1223	// Missing products		1274	// Missing products
	1224	MOVQ (8*0)(x_ptr), AX		1275	MOVQ (8*0)(x_ptr), AX
	1225	MULQ AX		1276	MULQ AX
	1226	MOVQ AX, acc0		1277	MOVQ AX, acc0
	1227	MOVQ DX, t0		1278	MOVQ DX, t0
	1228			1279
	1229	MOVQ (8*1)(x_ptr), AX		1280	MOVQ (8*1)(x_ptr), AX
	1230	MULQ AX		1281	MULQ AX
	1231	ADDQ t0, acc1		1282	ADDQ t0, acc1
	1232	ADCQ AX, acc2		1283	ADCQ AX, acc2
	1233	ADCQ $0, DX		1284	ADCQ $0, DX
	1234	MOVQ DX, t0		1285	MOVQ DX, t0
	1235			1286
	1236	MOVQ (8*2)(x_ptr), AX		1287	MOVQ (8*2)(x_ptr), AX
	1237	MULQ AX		1288	MULQ AX
	1238	ADDQ t0, acc3		1289	ADDQ t0, acc3
	1239	ADCQ AX, acc4		1290	ADCQ AX, acc4
	1240	ADCQ $0, DX		1291	ADCQ $0, DX
	1241	MOVQ DX, t0		1292	MOVQ DX, t0
	1242			1293
	1243	MOVQ (8*3)(x_ptr), AX		1294	MOVQ (8*3)(x_ptr), AX
	1244	MULQ AX		1295	MULQ AX
	1245	ADDQ t0, acc5		1296	ADDQ t0, acc5
	1246	ADCQ AX, y_ptr		1297	ADCQ AX, y_ptr
	1247	ADCQ DX, t1		1298	ADCQ DX, t1
	1248	MOVQ t1, x_ptr		1299	MOVQ t1, x_ptr
n			n	1300
	1249	// First reduction step		1301	// First reduction step
	1250	MOVQ acc0, AX		1302	MOVQ acc0, AX
	1251	MULQ p256ordK0<>(SB)		1303	MULQ p256ordK0<>(SB)
	1252	MOVQ AX, t0		1304	MOVQ AX, t0
	1253			1305
	1254	MOVQ p256ord<>+0x00(SB), AX		1306	MOVQ p256ord<>+0x00(SB), AX
	1255	MULQ t0		1307	MULQ t0
	1256	ADDQ AX, acc0		1308	ADDQ AX, acc0
	1257	ADCQ $0, DX		1309	ADCQ $0, DX
	1258	MOVQ DX, t1		1310	MOVQ DX, t1
	1259			1311
	1260	MOVQ p256ord<>+0x08(SB), AX		1312	MOVQ p256ord<>+0x08(SB), AX
	1261	MULQ t0		1313	MULQ t0
	1262	ADDQ t1, acc1		1314	ADDQ t1, acc1
	1263	ADCQ $0, DX		1315	ADCQ $0, DX
	1264	ADDQ AX, acc1		1316	ADDQ AX, acc1
	1265			1317
	1266	MOVQ t0, t1		1318	MOVQ t0, t1
	1267	ADCQ DX, acc2		1319	ADCQ DX, acc2
	1268	ADCQ $0, t1		1320	ADCQ $0, t1
	1269	SUBQ t0, acc2		1321	SUBQ t0, acc2
	1270	SBBQ $0, t1		1322	SBBQ $0, t1
	1271			1323
	1272	MOVQ t0, AX		1324	MOVQ t0, AX
	1273	MOVQ t0, DX		1325	MOVQ t0, DX
	1274	MOVQ t0, acc0		1326	MOVQ t0, acc0
	1275	SHLQ $32, AX		1327	SHLQ $32, AX
	1276	SHRQ $32, DX		1328	SHRQ $32, DX
	1277			1329
	1278	ADDQ t1, acc3		1330	ADDQ t1, acc3
	1279	ADCQ $0, acc0		1331	ADCQ $0, acc0
	1280	SUBQ AX, acc3		1332	SUBQ AX, acc3
	1281	SBBQ DX, acc0		1333	SBBQ DX, acc0
n			n	1334
	1282	// Second reduction step		1335	// Second reduction step
	1283	MOVQ acc1, AX		1336	MOVQ acc1, AX
	1284	MULQ p256ordK0<>(SB)		1337	MULQ p256ordK0<>(SB)
	1285	MOVQ AX, t0		1338	MOVQ AX, t0
	1286			1339
	1287	MOVQ p256ord<>+0x00(SB), AX		1340	MOVQ p256ord<>+0x00(SB), AX
	1288	MULQ t0		1341	MULQ t0
	1289	ADDQ AX, acc1		1342	ADDQ AX, acc1
	1290	ADCQ $0, DX		1343	ADCQ $0, DX
	1291	MOVQ DX, t1		1344	MOVQ DX, t1
	1292			1345
	1293	MOVQ p256ord<>+0x08(SB), AX		1346	MOVQ p256ord<>+0x08(SB), AX
	1294	MULQ t0		1347	MULQ t0
	1295	ADDQ t1, acc2		1348	ADDQ t1, acc2
	1296	ADCQ $0, DX		1349	ADCQ $0, DX
	1297	ADDQ AX, acc2		1350	ADDQ AX, acc2
	1298			1351
	1299	MOVQ t0, t1		1352	MOVQ t0, t1
	1300	ADCQ DX, acc3		1353	ADCQ DX, acc3
	1301	ADCQ $0, t1		1354	ADCQ $0, t1
	1302	SUBQ t0, acc3		1355	SUBQ t0, acc3
	1303	SBBQ $0, t1		1356	SBBQ $0, t1
	1304			1357
	1305	MOVQ t0, AX		1358	MOVQ t0, AX
	1306	MOVQ t0, DX		1359	MOVQ t0, DX
	1307	MOVQ t0, acc1		1360	MOVQ t0, acc1
	1308	SHLQ $32, AX		1361	SHLQ $32, AX
	1309	SHRQ $32, DX		1362	SHRQ $32, DX
	1310			1363
	1311	ADDQ t1, acc0		1364	ADDQ t1, acc0
	1312	ADCQ $0, acc1		1365	ADCQ $0, acc1
	1313	SUBQ AX, acc0		1366	SUBQ AX, acc0
	1314	SBBQ DX, acc1		1367	SBBQ DX, acc1
n			n	1368
	1315	// Third reduction step		1369	// Third reduction step
	1316	MOVQ acc2, AX		1370	MOVQ acc2, AX
	1317	MULQ p256ordK0<>(SB)		1371	MULQ p256ordK0<>(SB)
	1318	MOVQ AX, t0		1372	MOVQ AX, t0
	1319			1373
	1320	MOVQ p256ord<>+0x00(SB), AX		1374	MOVQ p256ord<>+0x00(SB), AX
	1321	MULQ t0		1375	MULQ t0
	1322	ADDQ AX, acc2		1376	ADDQ AX, acc2
	1323	ADCQ $0, DX		1377	ADCQ $0, DX
	1324	MOVQ DX, t1		1378	MOVQ DX, t1
	1325			1379
	1326	MOVQ p256ord<>+0x08(SB), AX		1380	MOVQ p256ord<>+0x08(SB), AX
	1327	MULQ t0		1381	MULQ t0
	1328	ADDQ t1, acc3		1382	ADDQ t1, acc3
	1329	ADCQ $0, DX		1383	ADCQ $0, DX
	1330	ADDQ AX, acc3		1384	ADDQ AX, acc3
	1331			1385
	1332	MOVQ t0, t1		1386	MOVQ t0, t1
	1333	ADCQ DX, acc0		1387	ADCQ DX, acc0
	1334	ADCQ $0, t1		1388	ADCQ $0, t1
	1335	SUBQ t0, acc0		1389	SUBQ t0, acc0
	1336	SBBQ $0, t1		1390	SBBQ $0, t1
	1337			1391
	1338	MOVQ t0, AX		1392	MOVQ t0, AX
	1339	MOVQ t0, DX		1393	MOVQ t0, DX
	1340	MOVQ t0, acc2		1394	MOVQ t0, acc2
	1341	SHLQ $32, AX		1395	SHLQ $32, AX
	1342	SHRQ $32, DX		1396	SHRQ $32, DX
	1343			1397
	1344	ADDQ t1, acc1		1398	ADDQ t1, acc1
	1345	ADCQ $0, acc2		1399	ADCQ $0, acc2
	1346	SUBQ AX, acc1		1400	SUBQ AX, acc1
	1347	SBBQ DX, acc2		1401	SBBQ DX, acc2
n			n	1402
	1348	// Last reduction step		1403	// Last reduction step
	1349	MOVQ acc3, AX		1404	MOVQ acc3, AX
	1350	MULQ p256ordK0<>(SB)		1405	MULQ p256ordK0<>(SB)
	1351	MOVQ AX, t0		1406	MOVQ AX, t0
	1352			1407
	1353	MOVQ p256ord<>+0x00(SB), AX		1408	MOVQ p256ord<>+0x00(SB), AX
	1354	MULQ t0		1409	MULQ t0
	1355	ADDQ AX, acc3		1410	ADDQ AX, acc3
	1356	ADCQ $0, DX		1411	ADCQ $0, DX
	1357	MOVQ DX, t1		1412	MOVQ DX, t1
	1358			1413
	1359	MOVQ p256ord<>+0x08(SB), AX		1414	MOVQ p256ord<>+0x08(SB), AX
	1360	MULQ t0		1415	MULQ t0
	1361	ADDQ t1, acc0		1416	ADDQ t1, acc0
	1362	ADCQ $0, DX		1417	ADCQ $0, DX
	1363	ADDQ AX, acc0		1418	ADDQ AX, acc0
	1364	ADCQ $0, DX		1419	ADCQ $0, DX
	1365	MOVQ DX, t1		1420	MOVQ DX, t1
	1366			1421
	1367	MOVQ t0, t1		1422	MOVQ t0, t1
	1368	ADCQ DX, acc1		1423	ADCQ DX, acc1
	1369	ADCQ $0, t1		1424	ADCQ $0, t1
	1370	SUBQ t0, acc1		1425	SUBQ t0, acc1
	1371	SBBQ $0, t1		1426	SBBQ $0, t1
	1372			1427
	1373	MOVQ t0, AX		1428	MOVQ t0, AX
	1374	MOVQ t0, DX		1429	MOVQ t0, DX
	1375	MOVQ t0, acc3		1430	MOVQ t0, acc3
	1376	SHLQ $32, AX		1431	SHLQ $32, AX
	1377	SHRQ $32, DX		1432	SHRQ $32, DX
	1378			1433
	1379	ADDQ t1, acc2		1434	ADDQ t1, acc2
	1380	ADCQ $0, acc3		1435	ADCQ $0, acc3
	1381	SUBQ AX, acc2		1436	SUBQ AX, acc2
	1382	SBBQ DX, acc3		1437	SBBQ DX, acc3
	1383	XORQ t0, t0		1438	XORQ t0, t0
n			n	1439
	1384	// Add bits [511:256] of the sqr result		1440	// Add bits [511:256] of the sqr result
	1385	ADCQ acc4, acc0		1441	ADCQ acc4, acc0
	1386	ADCQ acc5, acc1		1442	ADCQ acc5, acc1
	1387	ADCQ y_ptr, acc2		1443	ADCQ y_ptr, acc2
	1388	ADCQ x_ptr, acc3		1444	ADCQ x_ptr, acc3
	1389	ADCQ $0, t0		1445	ADCQ $0, t0
	1390			1446
	1391	MOVQ acc0, acc4		1447	MOVQ acc0, acc4
	1392	MOVQ acc1, acc5		1448	MOVQ acc1, acc5
	1393	MOVQ acc2, y_ptr		1449	MOVQ acc2, y_ptr
	1394	MOVQ acc3, t1		1450	MOVQ acc3, t1
n			n	1451
	1395	// Subtract p256		1452	// Subtract p256
	1396	SUBQ p256ord<>+0x00(SB), acc0		1453	SUBQ p256ord<>+0x00(SB), acc0
n	1397	SBBQ p256ord<>+0x08(SB) ,acc1	n	1454	SBBQ p256ord<>+0x08(SB), acc1
	1398	SBBQ p256ord<>+0x10(SB), acc2		1455	SBBQ p256ord<>+0x10(SB), acc2
	1399	SBBQ p256ord<>+0x18(SB), acc3		1456	SBBQ p256ord<>+0x18(SB), acc3
	1400	SBBQ $0, t0		1457	SBBQ $0, t0
	1401			1458
	1402	CMOVQCS acc4, acc0		1459	CMOVQCS acc4, acc0
	1403	CMOVQCS acc5, acc1		1460	CMOVQCS acc5, acc1
	1404	CMOVQCS y_ptr, acc2		1461	CMOVQCS y_ptr, acc2
	1405	CMOVQCS t1, acc3		1462	CMOVQCS t1, acc3
	1406			1463
	1407	MOVQ acc0, (8*0)(res_ptr)		1464	MOVQ acc0, (8*0)(res_ptr)
	1408	MOVQ acc1, (8*1)(res_ptr)		1465	MOVQ acc1, (8*1)(res_ptr)
	1409	MOVQ acc2, (8*2)(res_ptr)		1466	MOVQ acc2, (8*2)(res_ptr)
	1410	MOVQ acc3, (8*3)(res_ptr)		1467	MOVQ acc3, (8*3)(res_ptr)
	1411	MOVQ res_ptr, x_ptr		1468	MOVQ res_ptr, x_ptr
	1412	DECQ BX		1469	DECQ BX
n	1413	JNE ordSqrLoop	n	1470	JNE ordSqrLoop
	1414			1471
	1415	RET		1472	RET
n			n	1473
	1416	/* ---------------------------------------*/		1474	// ---------------------------------------
	1417	#undef res_ptr		1475	#undef res_ptr
	1418	#undef x_ptr		1476	#undef x_ptr
	1419	#undef y_ptr		1477	#undef y_ptr
	1420			1478
	1421	#undef acc0		1479	#undef acc0
	1422	#undef acc1		1480	#undef acc1
	1423	#undef acc2		1481	#undef acc2
	1424	#undef acc3		1482	#undef acc3
	1425	#undef acc4		1483	#undef acc4
	1426	#undef acc5		1484	#undef acc5
	1427	#undef t0		1485	#undef t0
	1428	#undef t1		1486	#undef t1
n	1429	/* ---------------------------------------*/	n	1487	// ---------------------------------------
	1430	#define mul0 AX		1488	#define mul0 AX
	1431	#define mul1 DX		1489	#define mul1 DX
	1432	#define acc0 BX		1490	#define acc0 BX
	1433	#define acc1 CX		1491	#define acc1 CX
	1434	#define acc2 R8		1492	#define acc2 R8
	1435	#define acc3 R9		1493	#define acc3 R9
	1436	#define acc4 R10		1494	#define acc4 R10
	1437	#define acc5 R11		1495	#define acc5 R11
	1438	#define acc6 R12		1496	#define acc6 R12
	1439	#define acc7 R13		1497	#define acc7 R13
	1440	#define t0 R14		1498	#define t0 R14
	1441	#define t1 R15		1499	#define t1 R15
	1442	#define t2 DI		1500	#define t2 DI
	1443	#define t3 SI		1501	#define t3 SI
	1444	#define hlp BP		1502	#define hlp BP
n	1445	/* ---------------------------------------*/	n	1503	// ---------------------------------------
	1446	TEXT p256SubInternal(SB),NOSPLIT,$0		1504	TEXT p256SubInternal(SB), NOSPLIT, $0
	1447	XORQ mul0, mul0		1505	XORQ mul0, mul0
	1448	SUBQ t0, acc4		1506	SUBQ t0, acc4
	1449	SBBQ t1, acc5		1507	SBBQ t1, acc5
	1450	SBBQ t2, acc6		1508	SBBQ t2, acc6
	1451	SBBQ t3, acc7		1509	SBBQ t3, acc7
	1452	SBBQ $0, mul0		1510	SBBQ $0, mul0
	1453			1511
	1454	MOVQ acc4, acc0		1512	MOVQ acc4, acc0
	1455	MOVQ acc5, acc1		1513	MOVQ acc5, acc1
	1456	MOVQ acc6, acc2		1514	MOVQ acc6, acc2
	1457	MOVQ acc7, acc3		1515	MOVQ acc7, acc3
	1458			1516
	1459	ADDQ $-1, acc4		1517	ADDQ $-1, acc4
	1460	ADCQ p256const0<>(SB), acc5		1518	ADCQ p256const0<>(SB), acc5
	1461	ADCQ $0, acc6		1519	ADCQ $0, acc6
	1462	ADCQ p256const1<>(SB), acc7		1520	ADCQ p256const1<>(SB), acc7
	1463	ADCQ $0, mul0		1521	ADCQ $0, mul0
	1464			1522
	1465	CMOVQNE acc0, acc4		1523	CMOVQNE acc0, acc4
	1466	CMOVQNE acc1, acc5		1524	CMOVQNE acc1, acc5
	1467	CMOVQNE acc2, acc6		1525	CMOVQNE acc2, acc6
	1468	CMOVQNE acc3, acc7		1526	CMOVQNE acc3, acc7
	1469			1527
	1470	RET		1528	RET
n			n	1529
	1471	/* ---------------------------------------*/		1530	// ---------------------------------------
	1472	TEXT p256MulInternal(SB),NOSPLIT,$0		1531	TEXT p256MulInternal(SB), NOSPLIT, $0
	1473	MOVQ acc4, mul0		1532	MOVQ acc4, mul0
	1474	MULQ t0		1533	MULQ t0
	1475	MOVQ mul0, acc0		1534	MOVQ mul0, acc0
	1476	MOVQ mul1, acc1		1535	MOVQ mul1, acc1
	1477			1536
	1478	MOVQ acc4, mul0		1537	MOVQ acc4, mul0
	1479	MULQ t1		1538	MULQ t1
	1480	ADDQ mul0, acc1		1539	ADDQ mul0, acc1
	1481	ADCQ $0, mul1		1540	ADCQ $0, mul1
	1482	MOVQ mul1, acc2		1541	MOVQ mul1, acc2
	1483			1542
	1484	MOVQ acc4, mul0		1543	MOVQ acc4, mul0
	1485	MULQ t2		1544	MULQ t2
	1486	ADDQ mul0, acc2		1545	ADDQ mul0, acc2
	1487	ADCQ $0, mul1		1546	ADCQ $0, mul1
	1488	MOVQ mul1, acc3		1547	MOVQ mul1, acc3
	1489			1548
	1490	MOVQ acc4, mul0		1549	MOVQ acc4, mul0
	1491	MULQ t3		1550	MULQ t3
	1492	ADDQ mul0, acc3		1551	ADDQ mul0, acc3
	1493	ADCQ $0, mul1		1552	ADCQ $0, mul1
	1494	MOVQ mul1, acc4		1553	MOVQ mul1, acc4
	1495			1554
	1496	MOVQ acc5, mul0		1555	MOVQ acc5, mul0
	1497	MULQ t0		1556	MULQ t0
	1498	ADDQ mul0, acc1		1557	ADDQ mul0, acc1
	1499	ADCQ $0, mul1		1558	ADCQ $0, mul1
	1500	MOVQ mul1, hlp		1559	MOVQ mul1, hlp
	1501			1560
	1502	MOVQ acc5, mul0		1561	MOVQ acc5, mul0
	1503	MULQ t1		1562	MULQ t1
	1504	ADDQ hlp, acc2		1563	ADDQ hlp, acc2
	1505	ADCQ $0, mul1		1564	ADCQ $0, mul1
	1506	ADDQ mul0, acc2		1565	ADDQ mul0, acc2
	1507	ADCQ $0, mul1		1566	ADCQ $0, mul1
	1508	MOVQ mul1, hlp		1567	MOVQ mul1, hlp
	1509			1568
	1510	MOVQ acc5, mul0		1569	MOVQ acc5, mul0
	1511	MULQ t2		1570	MULQ t2
	1512	ADDQ hlp, acc3		1571	ADDQ hlp, acc3
	1513	ADCQ $0, mul1		1572	ADCQ $0, mul1
	1514	ADDQ mul0, acc3		1573	ADDQ mul0, acc3
	1515	ADCQ $0, mul1		1574	ADCQ $0, mul1
	1516	MOVQ mul1, hlp		1575	MOVQ mul1, hlp
	1517			1576
	1518	MOVQ acc5, mul0		1577	MOVQ acc5, mul0
	1519	MULQ t3		1578	MULQ t3
	1520	ADDQ hlp, acc4		1579	ADDQ hlp, acc4
	1521	ADCQ $0, mul1		1580	ADCQ $0, mul1
	1522	ADDQ mul0, acc4		1581	ADDQ mul0, acc4
	1523	ADCQ $0, mul1		1582	ADCQ $0, mul1
	1524	MOVQ mul1, acc5		1583	MOVQ mul1, acc5
	1525			1584
	1526	MOVQ acc6, mul0		1585	MOVQ acc6, mul0
	1527	MULQ t0		1586	MULQ t0
	1528	ADDQ mul0, acc2		1587	ADDQ mul0, acc2
	1529	ADCQ $0, mul1		1588	ADCQ $0, mul1
	1530	MOVQ mul1, hlp		1589	MOVQ mul1, hlp
	1531			1590
	1532	MOVQ acc6, mul0		1591	MOVQ acc6, mul0
	1533	MULQ t1		1592	MULQ t1
	1534	ADDQ hlp, acc3		1593	ADDQ hlp, acc3
	1535	ADCQ $0, mul1		1594	ADCQ $0, mul1
	1536	ADDQ mul0, acc3		1595	ADDQ mul0, acc3
	1537	ADCQ $0, mul1		1596	ADCQ $0, mul1
	1538	MOVQ mul1, hlp		1597	MOVQ mul1, hlp
	1539			1598
	1540	MOVQ acc6, mul0		1599	MOVQ acc6, mul0
	1541	MULQ t2		1600	MULQ t2
	1542	ADDQ hlp, acc4		1601	ADDQ hlp, acc4
	1543	ADCQ $0, mul1		1602	ADCQ $0, mul1
	1544	ADDQ mul0, acc4		1603	ADDQ mul0, acc4
	1545	ADCQ $0, mul1		1604	ADCQ $0, mul1
	1546	MOVQ mul1, hlp		1605	MOVQ mul1, hlp
	1547			1606
	1548	MOVQ acc6, mul0		1607	MOVQ acc6, mul0
	1549	MULQ t3		1608	MULQ t3
	1550	ADDQ hlp, acc5		1609	ADDQ hlp, acc5
	1551	ADCQ $0, mul1		1610	ADCQ $0, mul1
	1552	ADDQ mul0, acc5		1611	ADDQ mul0, acc5
	1553	ADCQ $0, mul1		1612	ADCQ $0, mul1
	1554	MOVQ mul1, acc6		1613	MOVQ mul1, acc6
	1555			1614
	1556	MOVQ acc7, mul0		1615	MOVQ acc7, mul0
	1557	MULQ t0		1616	MULQ t0
	1558	ADDQ mul0, acc3		1617	ADDQ mul0, acc3
	1559	ADCQ $0, mul1		1618	ADCQ $0, mul1
	1560	MOVQ mul1, hlp		1619	MOVQ mul1, hlp
	1561			1620
	1562	MOVQ acc7, mul0		1621	MOVQ acc7, mul0
	1563	MULQ t1		1622	MULQ t1
	1564	ADDQ hlp, acc4		1623	ADDQ hlp, acc4
	1565	ADCQ $0, mul1		1624	ADCQ $0, mul1
	1566	ADDQ mul0, acc4		1625	ADDQ mul0, acc4
	1567	ADCQ $0, mul1		1626	ADCQ $0, mul1
	1568	MOVQ mul1, hlp		1627	MOVQ mul1, hlp
	1569			1628
	1570	MOVQ acc7, mul0		1629	MOVQ acc7, mul0
	1571	MULQ t2		1630	MULQ t2
	1572	ADDQ hlp, acc5		1631	ADDQ hlp, acc5
	1573	ADCQ $0, mul1		1632	ADCQ $0, mul1
	1574	ADDQ mul0, acc5		1633	ADDQ mul0, acc5
	1575	ADCQ $0, mul1		1634	ADCQ $0, mul1
	1576	MOVQ mul1, hlp		1635	MOVQ mul1, hlp
	1577			1636
	1578	MOVQ acc7, mul0		1637	MOVQ acc7, mul0
	1579	MULQ t3		1638	MULQ t3
	1580	ADDQ hlp, acc6		1639	ADDQ hlp, acc6
	1581	ADCQ $0, mul1		1640	ADCQ $0, mul1
	1582	ADDQ mul0, acc6		1641	ADDQ mul0, acc6
	1583	ADCQ $0, mul1		1642	ADCQ $0, mul1
	1584	MOVQ mul1, acc7		1643	MOVQ mul1, acc7
n			n	1644
	1585	// First reduction step		1645	// First reduction step
	1586	MOVQ acc0, mul0		1646	MOVQ acc0, mul0
	1587	MOVQ acc0, hlp		1647	MOVQ acc0, hlp
	1588	SHLQ $32, acc0		1648	SHLQ $32, acc0
	1589	MULQ p256const1<>(SB)		1649	MULQ p256const1<>(SB)
	1590	SHRQ $32, hlp		1650	SHRQ $32, hlp
	1591	ADDQ acc0, acc1		1651	ADDQ acc0, acc1
	1592	ADCQ hlp, acc2		1652	ADCQ hlp, acc2
	1593	ADCQ mul0, acc3		1653	ADCQ mul0, acc3
	1594	ADCQ $0, mul1		1654	ADCQ $0, mul1
	1595	MOVQ mul1, acc0		1655	MOVQ mul1, acc0
n			n	1656
	1596	// Second reduction step		1657	// Second reduction step
	1597	MOVQ acc1, mul0		1658	MOVQ acc1, mul0
	1598	MOVQ acc1, hlp		1659	MOVQ acc1, hlp
	1599	SHLQ $32, acc1		1660	SHLQ $32, acc1
	1600	MULQ p256const1<>(SB)		1661	MULQ p256const1<>(SB)
	1601	SHRQ $32, hlp		1662	SHRQ $32, hlp
	1602	ADDQ acc1, acc2		1663	ADDQ acc1, acc2
	1603	ADCQ hlp, acc3		1664	ADCQ hlp, acc3
	1604	ADCQ mul0, acc0		1665	ADCQ mul0, acc0
	1605	ADCQ $0, mul1		1666	ADCQ $0, mul1
	1606	MOVQ mul1, acc1		1667	MOVQ mul1, acc1
n			n	1668
	1607	// Third reduction step		1669	// Third reduction step
	1608	MOVQ acc2, mul0		1670	MOVQ acc2, mul0
	1609	MOVQ acc2, hlp		1671	MOVQ acc2, hlp
	1610	SHLQ $32, acc2		1672	SHLQ $32, acc2
	1611	MULQ p256const1<>(SB)		1673	MULQ p256const1<>(SB)
	1612	SHRQ $32, hlp		1674	SHRQ $32, hlp
	1613	ADDQ acc2, acc3		1675	ADDQ acc2, acc3
	1614	ADCQ hlp, acc0		1676	ADCQ hlp, acc0
	1615	ADCQ mul0, acc1		1677	ADCQ mul0, acc1
	1616	ADCQ $0, mul1		1678	ADCQ $0, mul1
	1617	MOVQ mul1, acc2		1679	MOVQ mul1, acc2
n			n	1680
	1618	// Last reduction step		1681	// Last reduction step
	1619	MOVQ acc3, mul0		1682	MOVQ acc3, mul0
	1620	MOVQ acc3, hlp		1683	MOVQ acc3, hlp
	1621	SHLQ $32, acc3		1684	SHLQ $32, acc3
	1622	MULQ p256const1<>(SB)		1685	MULQ p256const1<>(SB)
	1623	SHRQ $32, hlp		1686	SHRQ $32, hlp
	1624	ADDQ acc3, acc0		1687	ADDQ acc3, acc0
	1625	ADCQ hlp, acc1		1688	ADCQ hlp, acc1
	1626	ADCQ mul0, acc2		1689	ADCQ mul0, acc2
	1627	ADCQ $0, mul1		1690	ADCQ $0, mul1
	1628	MOVQ mul1, acc3		1691	MOVQ mul1, acc3
n	1629	BYTE $0x48; BYTE $0xc7; BYTE $0xc5; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x00 // MOVQ $0, BP	n	1692	BYTE $0x48; BYTE $0xc7; BYTE $0xc5; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x00 // MOVQ $0, BP
				1693
	1630	// Add bits [511:256] of the result		1694	// Add bits [511:256] of the result
	1631	ADCQ acc0, acc4		1695	ADCQ acc0, acc4
	1632	ADCQ acc1, acc5		1696	ADCQ acc1, acc5
	1633	ADCQ acc2, acc6		1697	ADCQ acc2, acc6
	1634	ADCQ acc3, acc7		1698	ADCQ acc3, acc7
	1635	ADCQ $0, hlp		1699	ADCQ $0, hlp
n			n	1700
	1636	// Copy result		1701	// Copy result
	1637	MOVQ acc4, acc0		1702	MOVQ acc4, acc0
	1638	MOVQ acc5, acc1		1703	MOVQ acc5, acc1
	1639	MOVQ acc6, acc2		1704	MOVQ acc6, acc2
	1640	MOVQ acc7, acc3		1705	MOVQ acc7, acc3
n			n	1706
	1641	// Subtract p256		1707	// Subtract p256
	1642	SUBQ $-1, acc4		1708	SUBQ $-1, acc4
n	1643	SBBQ p256const0<>(SB) ,acc5	n	1709	SBBQ p256const0<>(SB), acc5
	1644	SBBQ $0, acc6		1710	SBBQ $0, acc6
	1645	SBBQ p256const1<>(SB), acc7		1711	SBBQ p256const1<>(SB), acc7
	1646	SBBQ $0, hlp		1712	SBBQ $0, hlp
n			n	1713
	1647	// If the result of the subtraction is negative, restore the previous result		1714	// If the result of the subtraction is negative, restore the previous result
	1648	CMOVQCS acc0, acc4		1715	CMOVQCS acc0, acc4
	1649	CMOVQCS acc1, acc5		1716	CMOVQCS acc1, acc5
	1650	CMOVQCS acc2, acc6		1717	CMOVQCS acc2, acc6
	1651	CMOVQCS acc3, acc7		1718	CMOVQCS acc3, acc7
	1652			1719
	1653	RET		1720	RET
n			n	1721
	1654	/* ---------------------------------------*/		1722	// ---------------------------------------
	1655	TEXT p256SqrInternal(SB),NOSPLIT,$0		1723	TEXT p256SqrInternal(SB), NOSPLIT, $0
	1656			1724
	1657	MOVQ acc4, mul0		1725	MOVQ acc4, mul0
	1658	MULQ acc5		1726	MULQ acc5
	1659	MOVQ mul0, acc1		1727	MOVQ mul0, acc1
	1660	MOVQ mul1, acc2		1728	MOVQ mul1, acc2
	1661			1729
	1662	MOVQ acc4, mul0		1730	MOVQ acc4, mul0
	1663	MULQ acc6		1731	MULQ acc6
	1664	ADDQ mul0, acc2		1732	ADDQ mul0, acc2
	1665	ADCQ $0, mul1		1733	ADCQ $0, mul1
	1666	MOVQ mul1, acc3		1734	MOVQ mul1, acc3
	1667			1735
	1668	MOVQ acc4, mul0		1736	MOVQ acc4, mul0
	1669	MULQ acc7		1737	MULQ acc7
	1670	ADDQ mul0, acc3		1738	ADDQ mul0, acc3
	1671	ADCQ $0, mul1		1739	ADCQ $0, mul1
	1672	MOVQ mul1, t0		1740	MOVQ mul1, t0
	1673			1741
	1674	MOVQ acc5, mul0		1742	MOVQ acc5, mul0
	1675	MULQ acc6		1743	MULQ acc6
	1676	ADDQ mul0, acc3		1744	ADDQ mul0, acc3
	1677	ADCQ $0, mul1		1745	ADCQ $0, mul1
	1678	MOVQ mul1, hlp		1746	MOVQ mul1, hlp
	1679			1747
	1680	MOVQ acc5, mul0		1748	MOVQ acc5, mul0
	1681	MULQ acc7		1749	MULQ acc7
	1682	ADDQ hlp, t0		1750	ADDQ hlp, t0
	1683	ADCQ $0, mul1		1751	ADCQ $0, mul1
	1684	ADDQ mul0, t0		1752	ADDQ mul0, t0
	1685	ADCQ $0, mul1		1753	ADCQ $0, mul1
	1686	MOVQ mul1, t1		1754	MOVQ mul1, t1
	1687			1755
	1688	MOVQ acc6, mul0		1756	MOVQ acc6, mul0
	1689	MULQ acc7		1757	MULQ acc7
	1690	ADDQ mul0, t1		1758	ADDQ mul0, t1
	1691	ADCQ $0, mul1		1759	ADCQ $0, mul1
	1692	MOVQ mul1, t2		1760	MOVQ mul1, t2
	1693	XORQ t3, t3		1761	XORQ t3, t3
n			n	1762
	1694	// *2		1763	// *2
	1695	ADDQ acc1, acc1		1764	ADDQ acc1, acc1
	1696	ADCQ acc2, acc2		1765	ADCQ acc2, acc2
	1697	ADCQ acc3, acc3		1766	ADCQ acc3, acc3
	1698	ADCQ t0, t0		1767	ADCQ t0, t0
	1699	ADCQ t1, t1		1768	ADCQ t1, t1
	1700	ADCQ t2, t2		1769	ADCQ t2, t2
	1701	ADCQ $0, t3		1770	ADCQ $0, t3
n			n	1771
	1702	// Missing products		1772	// Missing products
	1703	MOVQ acc4, mul0		1773	MOVQ acc4, mul0
	1704	MULQ mul0		1774	MULQ mul0
	1705	MOVQ mul0, acc0		1775	MOVQ mul0, acc0
	1706	MOVQ DX, acc4		1776	MOVQ DX, acc4
	1707			1777
	1708	MOVQ acc5, mul0		1778	MOVQ acc5, mul0
	1709	MULQ mul0		1779	MULQ mul0
	1710	ADDQ acc4, acc1		1780	ADDQ acc4, acc1
	1711	ADCQ mul0, acc2		1781	ADCQ mul0, acc2
	1712	ADCQ $0, DX		1782	ADCQ $0, DX
	1713	MOVQ DX, acc4		1783	MOVQ DX, acc4
	1714			1784
	1715	MOVQ acc6, mul0		1785	MOVQ acc6, mul0
	1716	MULQ mul0		1786	MULQ mul0
	1717	ADDQ acc4, acc3		1787	ADDQ acc4, acc3
	1718	ADCQ mul0, t0		1788	ADCQ mul0, t0
	1719	ADCQ $0, DX		1789	ADCQ $0, DX
	1720	MOVQ DX, acc4		1790	MOVQ DX, acc4
	1721			1791
	1722	MOVQ acc7, mul0		1792	MOVQ acc7, mul0
	1723	MULQ mul0		1793	MULQ mul0
	1724	ADDQ acc4, t1		1794	ADDQ acc4, t1
	1725	ADCQ mul0, t2		1795	ADCQ mul0, t2
	1726	ADCQ DX, t3		1796	ADCQ DX, t3
n			n	1797
	1727	// First reduction step		1798	// First reduction step
	1728	MOVQ acc0, mul0		1799	MOVQ acc0, mul0
	1729	MOVQ acc0, hlp		1800	MOVQ acc0, hlp
	1730	SHLQ $32, acc0		1801	SHLQ $32, acc0
	1731	MULQ p256const1<>(SB)		1802	MULQ p256const1<>(SB)
	1732	SHRQ $32, hlp		1803	SHRQ $32, hlp
	1733	ADDQ acc0, acc1		1804	ADDQ acc0, acc1
	1734	ADCQ hlp, acc2		1805	ADCQ hlp, acc2
	1735	ADCQ mul0, acc3		1806	ADCQ mul0, acc3
	1736	ADCQ $0, mul1		1807	ADCQ $0, mul1
	1737	MOVQ mul1, acc0		1808	MOVQ mul1, acc0
n			n	1809
	1738	// Second reduction step		1810	// Second reduction step
	1739	MOVQ acc1, mul0		1811	MOVQ acc1, mul0
	1740	MOVQ acc1, hlp		1812	MOVQ acc1, hlp
	1741	SHLQ $32, acc1		1813	SHLQ $32, acc1
	1742	MULQ p256const1<>(SB)		1814	MULQ p256const1<>(SB)
	1743	SHRQ $32, hlp		1815	SHRQ $32, hlp
	1744	ADDQ acc1, acc2		1816	ADDQ acc1, acc2
	1745	ADCQ hlp, acc3		1817	ADCQ hlp, acc3
	1746	ADCQ mul0, acc0		1818	ADCQ mul0, acc0
	1747	ADCQ $0, mul1		1819	ADCQ $0, mul1
	1748	MOVQ mul1, acc1		1820	MOVQ mul1, acc1
n			n	1821
	1749	// Third reduction step		1822	// Third reduction step
	1750	MOVQ acc2, mul0		1823	MOVQ acc2, mul0
	1751	MOVQ acc2, hlp		1824	MOVQ acc2, hlp
	1752	SHLQ $32, acc2		1825	SHLQ $32, acc2
	1753	MULQ p256const1<>(SB)		1826	MULQ p256const1<>(SB)
	1754	SHRQ $32, hlp		1827	SHRQ $32, hlp
	1755	ADDQ acc2, acc3		1828	ADDQ acc2, acc3
	1756	ADCQ hlp, acc0		1829	ADCQ hlp, acc0
	1757	ADCQ mul0, acc1		1830	ADCQ mul0, acc1
	1758	ADCQ $0, mul1		1831	ADCQ $0, mul1
	1759	MOVQ mul1, acc2		1832	MOVQ mul1, acc2
n			n	1833
	1760	// Last reduction step		1834	// Last reduction step
	1761	MOVQ acc3, mul0		1835	MOVQ acc3, mul0
	1762	MOVQ acc3, hlp		1836	MOVQ acc3, hlp
	1763	SHLQ $32, acc3		1837	SHLQ $32, acc3
	1764	MULQ p256const1<>(SB)		1838	MULQ p256const1<>(SB)
	1765	SHRQ $32, hlp		1839	SHRQ $32, hlp
	1766	ADDQ acc3, acc0		1840	ADDQ acc3, acc0
	1767	ADCQ hlp, acc1		1841	ADCQ hlp, acc1
	1768	ADCQ mul0, acc2		1842	ADCQ mul0, acc2
	1769	ADCQ $0, mul1		1843	ADCQ $0, mul1
	1770	MOVQ mul1, acc3		1844	MOVQ mul1, acc3
n	1771	BYTE $0x48; BYTE $0xc7; BYTE $0xc5; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x00 // MOVQ $0, BP	n	1845	BYTE $0x48; BYTE $0xc7; BYTE $0xc5; BYTE $0x00; BYTE $0x00; BYTE $0x00; BYTE $0x00 // MOVQ $0, BP
				1846
	1772	// Add bits [511:256] of the result		1847	// Add bits [511:256] of the result
	1773	ADCQ acc0, t0		1848	ADCQ acc0, t0
	1774	ADCQ acc1, t1		1849	ADCQ acc1, t1
	1775	ADCQ acc2, t2		1850	ADCQ acc2, t2
	1776	ADCQ acc3, t3		1851	ADCQ acc3, t3
	1777	ADCQ $0, hlp		1852	ADCQ $0, hlp
n			n	1853
	1778	// Copy result		1854	// Copy result
	1779	MOVQ t0, acc4		1855	MOVQ t0, acc4
	1780	MOVQ t1, acc5		1856	MOVQ t1, acc5
	1781	MOVQ t2, acc6		1857	MOVQ t2, acc6
	1782	MOVQ t3, acc7		1858	MOVQ t3, acc7
n			n	1859
	1783	// Subtract p256		1860	// Subtract p256
	1784	SUBQ $-1, acc4		1861	SUBQ $-1, acc4
n	1785	SBBQ p256const0<>(SB) ,acc5	n	1862	SBBQ p256const0<>(SB), acc5
	1786	SBBQ $0, acc6		1863	SBBQ $0, acc6
	1787	SBBQ p256const1<>(SB), acc7		1864	SBBQ p256const1<>(SB), acc7
	1788	SBBQ $0, hlp		1865	SBBQ $0, hlp
n			n	1866
	1789	// If the result of the subtraction is negative, restore the previous result		1867	// If the result of the subtraction is negative, restore the previous result
	1790	CMOVQCS t0, acc4		1868	CMOVQCS t0, acc4
	1791	CMOVQCS t1, acc5		1869	CMOVQCS t1, acc5
	1792	CMOVQCS t2, acc6		1870	CMOVQCS t2, acc6
	1793	CMOVQCS t3, acc7		1871	CMOVQCS t3, acc7
	1794			1872
	1795	RET		1873	RET
n			n	1874
	1796	/* ---------------------------------------*/		1875	// ---------------------------------------
	1797	#define p256MulBy2Inline\		1876	#define p256MulBy2Inline \
	1798	XORQ mul0, mul0;\		1877	XORQ mul0, mul0; \
	1799	ADDQ acc4, acc4;\		1878	ADDQ acc4, acc4; \
	1800	ADCQ acc5, acc5;\		1879	ADCQ acc5, acc5; \
	1801	ADCQ acc6, acc6;\		1880	ADCQ acc6, acc6; \
	1802	ADCQ acc7, acc7;\		1881	ADCQ acc7, acc7; \
	1803	ADCQ $0, mul0;\		1882	ADCQ $0, mul0; \
	1804	MOVQ acc4, t0;\		1883	MOVQ acc4, t0; \
	1805	MOVQ acc5, t1;\		1884	MOVQ acc5, t1; \
	1806	MOVQ acc6, t2;\		1885	MOVQ acc6, t2; \
	1807	MOVQ acc7, t3;\		1886	MOVQ acc7, t3; \
	1808	SUBQ $-1, t0;\		1887	SUBQ $-1, t0; \
	1809	SBBQ p256const0<>(SB), t1;\		1888	SBBQ p256const0<>(SB), t1; \
	1810	SBBQ $0, t2;\		1889	SBBQ $0, t2; \
	1811	SBBQ p256const1<>(SB), t3;\		1890	SBBQ p256const1<>(SB), t3; \
	1812	SBBQ $0, mul0;\		1891	SBBQ $0, mul0; \
	1813	CMOVQCS acc4, t0;\		1892	CMOVQCS acc4, t0; \
	1814	CMOVQCS acc5, t1;\		1893	CMOVQCS acc5, t1; \
	1815	CMOVQCS acc6, t2;\		1894	CMOVQCS acc6, t2; \
	1816	CMOVQCS acc7, t3;		1895	CMOVQCS acc7, t3
				1896
	1817	/* ---------------------------------------*/		1897	// ---------------------------------------
	1818	#define p256AddInline \		1898	#define p256AddInline \
n	1819	XORQ mul0, mul0;\	n	1899	XORQ mul0, mul0; \
	1820	ADDQ t0, acc4;\		1900	ADDQ t0, acc4; \
	1821	ADCQ t1, acc5;\		1901	ADCQ t1, acc5; \
	1822	ADCQ t2, acc6;\		1902	ADCQ t2, acc6; \
	1823	ADCQ t3, acc7;\		1903	ADCQ t3, acc7; \
	1824	ADCQ $0, mul0;\		1904	ADCQ $0, mul0; \
	1825	MOVQ acc4, t0;\		1905	MOVQ acc4, t0; \
	1826	MOVQ acc5, t1;\		1906	MOVQ acc5, t1; \
	1827	MOVQ acc6, t2;\		1907	MOVQ acc6, t2; \
	1828	MOVQ acc7, t3;\		1908	MOVQ acc7, t3; \
	1829	SUBQ $-1, t0;\		1909	SUBQ $-1, t0; \
	1830	SBBQ p256const0<>(SB), t1;\		1910	SBBQ p256const0<>(SB), t1; \
	1831	SBBQ $0, t2;\		1911	SBBQ $0, t2; \
	1832	SBBQ p256const1<>(SB), t3;\		1912	SBBQ p256const1<>(SB), t3; \
	1833	SBBQ $0, mul0;\		1913	SBBQ $0, mul0; \
	1834	CMOVQCS acc4, t0;\		1914	CMOVQCS acc4, t0; \
	1835	CMOVQCS acc5, t1;\		1915	CMOVQCS acc5, t1; \
	1836	CMOVQCS acc6, t2;\		1916	CMOVQCS acc6, t2; \
	1837	CMOVQCS acc7, t3;		1917	CMOVQCS acc7, t3
				1918
	1838	/* ---------------------------------------*/		1919	// ---------------------------------------
	1839	#define LDacc(src) MOVQ src(80), acc4; MOVQ src(81), acc5; MOVQ src(82), acc6; MOVQ src(83), acc7		1920	#define LDacc(src) MOVQ src(80), acc4; MOVQ src(81), acc5; MOVQ src(82), acc6; MOVQ src(83), acc7
	1840	#define LDt(src) MOVQ src(80), t0; MOVQ src(81), t1; MOVQ src(82), t2; MOVQ src(83), t3		1921	#define LDt(src) MOVQ src(80), t0; MOVQ src(81), t1; MOVQ src(82), t2; MOVQ src(83), t3
	1841	#define ST(dst) MOVQ acc4, dst(80); MOVQ acc5, dst(81); MOVQ acc6, dst(82); MOVQ acc7, dst(83)		1922	#define ST(dst) MOVQ acc4, dst(80); MOVQ acc5, dst(81); MOVQ acc6, dst(82); MOVQ acc7, dst(83)
	1842	#define STt(dst) MOVQ t0, dst(80); MOVQ t1, dst(81); MOVQ t2, dst(82); MOVQ t3, dst(83)		1923	#define STt(dst) MOVQ t0, dst(80); MOVQ t1, dst(81); MOVQ t2, dst(82); MOVQ t3, dst(83)
	1843	#define acc2t MOVQ acc4, t0; MOVQ acc5, t1; MOVQ acc6, t2; MOVQ acc7, t3		1924	#define acc2t MOVQ acc4, t0; MOVQ acc5, t1; MOVQ acc6, t2; MOVQ acc7, t3
	1844	#define t2acc MOVQ t0, acc4; MOVQ t1, acc5; MOVQ t2, acc6; MOVQ t3, acc7		1925	#define t2acc MOVQ t0, acc4; MOVQ t1, acc5; MOVQ t2, acc6; MOVQ t3, acc7
n	1845	/* ---------------------------------------*/	n	1926	// ---------------------------------------
	1846	#define x1in(off) (32*0 + off)(SP)		1927	#define x1in(off) (32*0 + off)(SP)
	1847	#define y1in(off) (32*1 + off)(SP)		1928	#define y1in(off) (32*1 + off)(SP)
	1848	#define z1in(off) (32*2 + off)(SP)		1929	#define z1in(off) (32*2 + off)(SP)
	1849	#define x2in(off) (32*3 + off)(SP)		1930	#define x2in(off) (32*3 + off)(SP)
	1850	#define y2in(off) (32*4 + off)(SP)		1931	#define y2in(off) (32*4 + off)(SP)
	1851	#define xout(off) (32*5 + off)(SP)		1932	#define xout(off) (32*5 + off)(SP)
	1852	#define yout(off) (32*6 + off)(SP)		1933	#define yout(off) (32*6 + off)(SP)
	1853	#define zout(off) (32*7 + off)(SP)		1934	#define zout(off) (32*7 + off)(SP)
	1854	#define s2(off) (32*8 + off)(SP)		1935	#define s2(off) (32*8 + off)(SP)
	1855	#define z1sqr(off) (32*9 + off)(SP)		1936	#define z1sqr(off) (32*9 + off)(SP)
	1856	#define h(off) (32*10 + off)(SP)		1937	#define h(off) (32*10 + off)(SP)
	1857	#define r(off) (32*11 + off)(SP)		1938	#define r(off) (32*11 + off)(SP)
	1858	#define hsqr(off) (32*12 + off)(SP)		1939	#define hsqr(off) (32*12 + off)(SP)
	1859	#define rsqr(off) (32*13 + off)(SP)		1940	#define rsqr(off) (32*13 + off)(SP)
	1860	#define hcub(off) (32*14 + off)(SP)		1941	#define hcub(off) (32*14 + off)(SP)
	1861	#define rptr (32*15)(SP)		1942	#define rptr (32*15)(SP)
	1862	#define sel_save (32*15 + 8)(SP)		1943	#define sel_save (32*15 + 8)(SP)
	1863	#define zero_save (32*15 + 8 + 4)(SP)		1944	#define zero_save (32*15 + 8 + 4)(SP)
	1864			1945
	1865	// func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)		1946	// func p256PointAddAffineAsm(res, in1, in2 []uint64, sign, sel, zero int)
n	1866	TEXT ·p256PointAddAffineAsm(SB),0,$512-96	n	1947	TEXT ·p256PointAddAffineAsm(SB), 0, $512-96
	1867	// Move input to stack in order to free registers		1948	// Move input to stack in order to free registers
	1868	MOVQ res+0(FP), AX		1949	MOVQ res+0(FP), AX
	1869	MOVQ in1+24(FP), BX		1950	MOVQ in1+24(FP), BX
	1870	MOVQ in2+48(FP), CX		1951	MOVQ in2+48(FP), CX
	1871	MOVQ sign+72(FP), DX		1952	MOVQ sign+72(FP), DX
	1872	MOVQ sel+80(FP), t1		1953	MOVQ sel+80(FP), t1
	1873	MOVQ zero+88(FP), t2		1954	MOVQ zero+88(FP), t2
	1874			1955
	1875	MOVOU (16*0)(BX), X0		1956	MOVOU (16*0)(BX), X0
	1876	MOVOU (16*1)(BX), X1		1957	MOVOU (16*1)(BX), X1
	1877	MOVOU (16*2)(BX), X2		1958	MOVOU (16*2)(BX), X2
	1878	MOVOU (16*3)(BX), X3		1959	MOVOU (16*3)(BX), X3
	1879	MOVOU (16*4)(BX), X4		1960	MOVOU (16*4)(BX), X4
	1880	MOVOU (16*5)(BX), X5		1961	MOVOU (16*5)(BX), X5
	1881			1962
	1882	MOVOU X0, x1in(16*0)		1963	MOVOU X0, x1in(16*0)
	1883	MOVOU X1, x1in(16*1)		1964	MOVOU X1, x1in(16*1)
	1884	MOVOU X2, y1in(16*0)		1965	MOVOU X2, y1in(16*0)
	1885	MOVOU X3, y1in(16*1)		1966	MOVOU X3, y1in(16*1)
	1886	MOVOU X4, z1in(16*0)		1967	MOVOU X4, z1in(16*0)
	1887	MOVOU X5, z1in(16*1)		1968	MOVOU X5, z1in(16*1)
	1888			1969
	1889	MOVOU (16*0)(CX), X0		1970	MOVOU (16*0)(CX), X0
	1890	MOVOU (16*1)(CX), X1		1971	MOVOU (16*1)(CX), X1
	1891			1972
	1892	MOVOU X0, x2in(16*0)		1973	MOVOU X0, x2in(16*0)
	1893	MOVOU X1, x2in(16*1)		1974	MOVOU X1, x2in(16*1)
n			n	1975
	1894	// Store pointer to result		1976	// Store pointer to result
	1895	MOVQ mul0, rptr		1977	MOVQ mul0, rptr
	1896	MOVL t1, sel_save		1978	MOVL t1, sel_save
	1897	MOVL t2, zero_save		1979	MOVL t2, zero_save
n			n	1980
	1898	// Negate y2in based on sign		1981	// Negate y2in based on sign
	1899	MOVQ (162 + 80)(CX), acc4		1982	MOVQ (162 + 80)(CX), acc4
	1900	MOVQ (162 + 81)(CX), acc5		1983	MOVQ (162 + 81)(CX), acc5
	1901	MOVQ (162 + 82)(CX), acc6		1984	MOVQ (162 + 82)(CX), acc6
	1902	MOVQ (162 + 83)(CX), acc7		1985	MOVQ (162 + 83)(CX), acc7
	1903	MOVQ $-1, acc0		1986	MOVQ $-1, acc0
	1904	MOVQ p256const0<>(SB), acc1		1987	MOVQ p256const0<>(SB), acc1
	1905	MOVQ $0, acc2		1988	MOVQ $0, acc2
	1906	MOVQ p256const1<>(SB), acc3		1989	MOVQ p256const1<>(SB), acc3
	1907	XORQ mul0, mul0		1990	XORQ mul0, mul0
n			n	1991
	1908	// Speculatively subtract		1992	// Speculatively subtract
	1909	SUBQ acc4, acc0		1993	SUBQ acc4, acc0
	1910	SBBQ acc5, acc1		1994	SBBQ acc5, acc1
	1911	SBBQ acc6, acc2		1995	SBBQ acc6, acc2
	1912	SBBQ acc7, acc3		1996	SBBQ acc7, acc3
	1913	SBBQ $0, mul0		1997	SBBQ $0, mul0
	1914	MOVQ acc0, t0		1998	MOVQ acc0, t0
	1915	MOVQ acc1, t1		1999	MOVQ acc1, t1
	1916	MOVQ acc2, t2		2000	MOVQ acc2, t2
	1917	MOVQ acc3, t3		2001	MOVQ acc3, t3
n			n	2002
	1918	// Add in case the operand was > p256		2003	// Add in case the operand was > p256
n	1919	ADDQ $-1, acc0	n	2004	ADDQ $-1, acc0
	1920	ADCQ p256const0<>(SB), acc1		2005	ADCQ p256const0<>(SB), acc1
	1921	ADCQ $0, acc2		2006	ADCQ $0, acc2
	1922	ADCQ p256const1<>(SB), acc3		2007	ADCQ p256const1<>(SB), acc3
	1923	ADCQ $0, mul0		2008	ADCQ $0, mul0
	1924	CMOVQNE t0, acc0		2009	CMOVQNE t0, acc0
	1925	CMOVQNE t1, acc1		2010	CMOVQNE t1, acc1
	1926	CMOVQNE t2, acc2		2011	CMOVQNE t2, acc2
	1927	CMOVQNE t3, acc3		2012	CMOVQNE t3, acc3
n			n	2013
	1928	// If condition is 0, keep original value		2014	// If condition is 0, keep original value
n	1929	TESTQ DX, DX	n	2015	TESTQ DX, DX
	1930	CMOVQEQ acc4, acc0		2016	CMOVQEQ acc4, acc0
	1931	CMOVQEQ acc5, acc1		2017	CMOVQEQ acc5, acc1
	1932	CMOVQEQ acc6, acc2		2018	CMOVQEQ acc6, acc2
	1933	CMOVQEQ acc7, acc3		2019	CMOVQEQ acc7, acc3
n			n	2020
	1934	// Store result		2021	// Store result
	1935	MOVQ acc0, y2in(8*0)		2022	MOVQ acc0, y2in(8*0)
	1936	MOVQ acc1, y2in(8*1)		2023	MOVQ acc1, y2in(8*1)
	1937	MOVQ acc2, y2in(8*2)		2024	MOVQ acc2, y2in(8*2)
	1938	MOVQ acc3, y2in(8*3)		2025	MOVQ acc3, y2in(8*3)
n			n	2026
	1939	// Begin point add		2027	// Begin point add
	1940	LDacc (z1in)		2028	LDacc (z1in)
n	1941	CALL p256SqrInternal(SB) // z1ˆ2	n	2029	CALL p256SqrInternal(SB) // z1ˆ2
	1942	ST (z1sqr)		2030	ST (z1sqr)
	1943			2031
	1944	LDt (x2in)		2032	LDt (x2in)
n	1945	CALL p256MulInternal(SB) // x2 * z1ˆ2	n	2033	CALL p256MulInternal(SB) // x2 * z1ˆ2
	1946			2034
	1947	LDt (x1in)		2035	LDt (x1in)
n	1948	CALL p256SubInternal(SB) // h = u2 - u1	n	2036	CALL p256SubInternal(SB) // h = u2 - u1
	1949	ST (h)		2037	ST (h)
	1950			2038
	1951	LDt (z1in)		2039	LDt (z1in)
n	1952	CALL p256MulInternal(SB) // z3 = h * z1	n	2040	CALL p256MulInternal(SB) // z3 = h * z1
	1953	ST (zout)		2041	ST (zout)
	1954			2042
	1955	LDacc (z1sqr)		2043	LDacc (z1sqr)
n	1956	CALL p256MulInternal(SB) // z1ˆ3	n	2044	CALL p256MulInternal(SB) // z1ˆ3
	1957			2045
	1958	LDt (y2in)		2046	LDt (y2in)
n	1959	CALL p256MulInternal(SB) // s2 = y2 * z1ˆ3	n	2047	CALL p256MulInternal(SB) // s2 = y2 * z1ˆ3
	1960	ST (s2)		2048	ST (s2)
	1961			2049
	1962	LDt (y1in)		2050	LDt (y1in)
n	1963	CALL p256SubInternal(SB) // r = s2 - s1	n	2051	CALL p256SubInternal(SB) // r = s2 - s1
	1964	ST (r)		2052	ST (r)
	1965			2053
n	1966	CALL p256SqrInternal(SB) // rsqr = rˆ2	n	2054	CALL p256SqrInternal(SB) // rsqr = rˆ2
	1967	ST (rsqr)		2055	ST (rsqr)
	1968			2056
	1969	LDacc (h)		2057	LDacc (h)
n	1970	CALL p256SqrInternal(SB) // hsqr = hˆ2	n	2058	CALL p256SqrInternal(SB) // hsqr = hˆ2
	1971	ST (hsqr)		2059	ST (hsqr)
	1972			2060
	1973	LDt (h)		2061	LDt (h)
n	1974	CALL p256MulInternal(SB) // hcub = hˆ3	n	2062	CALL p256MulInternal(SB) // hcub = hˆ3
	1975	ST (hcub)		2063	ST (hcub)
	1976			2064
	1977	LDt (y1in)		2065	LDt (y1in)
n	1978	CALL p256MulInternal(SB) // y1 * hˆ3	n	2066	CALL p256MulInternal(SB) // y1 * hˆ3
	1979	ST (s2)		2067	ST (s2)
	1980			2068
	1981	LDacc (x1in)		2069	LDacc (x1in)
	1982	LDt (hsqr)		2070	LDt (hsqr)
n	1983	CALL p256MulInternal(SB) // u1 * hˆ2	n	2071	CALL p256MulInternal(SB) // u1 * hˆ2
	1984	ST (h)		2072	ST (h)
	1985			2073
n	1986	p256MulBy2Inline // u1 * hˆ2 * 2, inline	n	2074	p256MulBy2Inline // u1 * hˆ2 * 2, inline
	1987	LDacc (rsqr)		2075	LDacc (rsqr)
n	1988	CALL p256SubInternal(SB) // rˆ2 - u1 * hˆ2 * 2	n	2076	CALL p256SubInternal(SB) // rˆ2 - u1 * hˆ2 * 2
	1989			2077
	1990	LDt (hcub)		2078	LDt (hcub)
	1991	CALL p256SubInternal(SB)		2079	CALL p256SubInternal(SB)
	1992	ST (xout)		2080	ST (xout)
	1993			2081
	1994	MOVQ acc4, t0		2082	MOVQ acc4, t0
	1995	MOVQ acc5, t1		2083	MOVQ acc5, t1
	1996	MOVQ acc6, t2		2084	MOVQ acc6, t2
	1997	MOVQ acc7, t3		2085	MOVQ acc7, t3
	1998	LDacc (h)		2086	LDacc (h)
	1999	CALL p256SubInternal(SB)		2087	CALL p256SubInternal(SB)
	2000			2088
	2001	LDt (r)		2089	LDt (r)
	2002	CALL p256MulInternal(SB)		2090	CALL p256MulInternal(SB)
	2003			2091
	2004	LDt (s2)		2092	LDt (s2)
	2005	CALL p256SubInternal(SB)		2093	CALL p256SubInternal(SB)
	2006	ST (yout)		2094	ST (yout)
n			n	2095
	2007	// Load stored values from stack		2096	// Load stored values from stack
	2008	MOVQ rptr, AX		2097	MOVQ rptr, AX
	2009	MOVL sel_save, BX		2098	MOVL sel_save, BX
	2010	MOVL zero_save, CX		2099	MOVL zero_save, CX
n			n	2100
	2011	// The result is not valid if (sel == 0), conditional choose		2101	// The result is not valid if (sel == 0), conditional choose
	2012	MOVOU xout(16*0), X0		2102	MOVOU xout(16*0), X0
	2013	MOVOU xout(16*1), X1		2103	MOVOU xout(16*1), X1
	2014	MOVOU yout(16*0), X2		2104	MOVOU yout(16*0), X2
	2015	MOVOU yout(16*1), X3		2105	MOVOU yout(16*1), X3
	2016	MOVOU zout(16*0), X4		2106	MOVOU zout(16*0), X4
	2017	MOVOU zout(16*1), X5		2107	MOVOU zout(16*1), X5
	2018			2108
	2019	MOVL BX, X6		2109	MOVL BX, X6
	2020	MOVL CX, X7		2110	MOVL CX, X7
	2021			2111
n	2022	PXOR X8, X8	n	2112	PXOR X8, X8
	2023	PCMPEQL X9, X9		2113	PCMPEQL X9, X9
	2024			2114
	2025	PSHUFD $0, X6, X6		2115	PSHUFD $0, X6, X6
	2026	PSHUFD $0, X7, X7		2116	PSHUFD $0, X7, X7
	2027			2117
	2028	PCMPEQL X8, X6		2118	PCMPEQL X8, X6
	2029	PCMPEQL X8, X7		2119	PCMPEQL X8, X7
	2030			2120
	2031	MOVOU X6, X15		2121	MOVOU X6, X15
	2032	PANDN X9, X15		2122	PANDN X9, X15
	2033			2123
	2034	MOVOU x1in(16*0), X9		2124	MOVOU x1in(16*0), X9
	2035	MOVOU x1in(16*1), X10		2125	MOVOU x1in(16*1), X10
	2036	MOVOU y1in(16*0), X11		2126	MOVOU y1in(16*0), X11
	2037	MOVOU y1in(16*1), X12		2127	MOVOU y1in(16*1), X12
	2038	MOVOU z1in(16*0), X13		2128	MOVOU z1in(16*0), X13
	2039	MOVOU z1in(16*1), X14		2129	MOVOU z1in(16*1), X14
	2040			2130
	2041	PAND X15, X0		2131	PAND X15, X0
	2042	PAND X15, X1		2132	PAND X15, X1
	2043	PAND X15, X2		2133	PAND X15, X2
	2044	PAND X15, X3		2134	PAND X15, X3
	2045	PAND X15, X4		2135	PAND X15, X4
	2046	PAND X15, X5		2136	PAND X15, X5
	2047			2137
	2048	PAND X6, X9		2138	PAND X6, X9
	2049	PAND X6, X10		2139	PAND X6, X10
	2050	PAND X6, X11		2140	PAND X6, X11
	2051	PAND X6, X12		2141	PAND X6, X12
	2052	PAND X6, X13		2142	PAND X6, X13
	2053	PAND X6, X14		2143	PAND X6, X14
	2054			2144
	2055	PXOR X9, X0		2145	PXOR X9, X0
	2056	PXOR X10, X1		2146	PXOR X10, X1
	2057	PXOR X11, X2		2147	PXOR X11, X2
	2058	PXOR X12, X3		2148	PXOR X12, X3
	2059	PXOR X13, X4		2149	PXOR X13, X4
	2060	PXOR X14, X5		2150	PXOR X14, X5
n			n	2151
	2061	// Similarly if zero == 0		2152	// Similarly if zero == 0
	2062	PCMPEQL X9, X9		2153	PCMPEQL X9, X9
n	2063	MOVOU X7, X15	n	2154	MOVOU X7, X15
	2064	PANDN X9, X15		2155	PANDN X9, X15
	2065			2156
	2066	MOVOU x2in(16*0), X9		2157	MOVOU x2in(16*0), X9
	2067	MOVOU x2in(16*1), X10		2158	MOVOU x2in(16*1), X10
	2068	MOVOU y2in(16*0), X11		2159	MOVOU y2in(16*0), X11
	2069	MOVOU y2in(16*1), X12		2160	MOVOU y2in(16*1), X12
	2070	MOVOU p256one<>+0x00(SB), X13		2161	MOVOU p256one<>+0x00(SB), X13
	2071	MOVOU p256one<>+0x10(SB), X14		2162	MOVOU p256one<>+0x10(SB), X14
	2072			2163
	2073	PAND X15, X0		2164	PAND X15, X0
	2074	PAND X15, X1		2165	PAND X15, X1
	2075	PAND X15, X2		2166	PAND X15, X2
	2076	PAND X15, X3		2167	PAND X15, X3
	2077	PAND X15, X4		2168	PAND X15, X4
	2078	PAND X15, X5		2169	PAND X15, X5
	2079			2170
	2080	PAND X7, X9		2171	PAND X7, X9
	2081	PAND X7, X10		2172	PAND X7, X10
	2082	PAND X7, X11		2173	PAND X7, X11
	2083	PAND X7, X12		2174	PAND X7, X12
	2084	PAND X7, X13		2175	PAND X7, X13
	2085	PAND X7, X14		2176	PAND X7, X14
	2086			2177
	2087	PXOR X9, X0		2178	PXOR X9, X0
	2088	PXOR X10, X1		2179	PXOR X10, X1
	2089	PXOR X11, X2		2180	PXOR X11, X2
	2090	PXOR X12, X3		2181	PXOR X12, X3
	2091	PXOR X13, X4		2182	PXOR X13, X4
	2092	PXOR X14, X5		2183	PXOR X14, X5
n			n	2184
	2093	// Finally output the result		2185	// Finally output the result
	2094	MOVOU X0, (16*0)(AX)		2186	MOVOU X0, (16*0)(AX)
	2095	MOVOU X1, (16*1)(AX)		2187	MOVOU X1, (16*1)(AX)
	2096	MOVOU X2, (16*2)(AX)		2188	MOVOU X2, (16*2)(AX)
	2097	MOVOU X3, (16*3)(AX)		2189	MOVOU X3, (16*3)(AX)
	2098	MOVOU X4, (16*4)(AX)		2190	MOVOU X4, (16*4)(AX)
	2099	MOVOU X5, (16*5)(AX)		2191	MOVOU X5, (16*5)(AX)
n	2100	MOVQ $0, rptr	n	2192	MOVQ $0, rptr
	2101			2193
	2102	RET		2194	RET
n			n	2195
	2103	#undef x1in		2196	#undef x1in
	2104	#undef y1in		2197	#undef y1in
	2105	#undef z1in		2198	#undef z1in
	2106	#undef x2in		2199	#undef x2in
	2107	#undef y2in		2200	#undef y2in
	2108	#undef xout		2201	#undef xout
	2109	#undef yout		2202	#undef yout
	2110	#undef zout		2203	#undef zout
	2111	#undef s2		2204	#undef s2
	2112	#undef z1sqr		2205	#undef z1sqr
	2113	#undef h		2206	#undef h
	2114	#undef r		2207	#undef r
	2115	#undef hsqr		2208	#undef hsqr
	2116	#undef rsqr		2209	#undef rsqr
	2117	#undef hcub		2210	#undef hcub
	2118	#undef rptr		2211	#undef rptr
	2119	#undef sel_save		2212	#undef sel_save
	2120	#undef zero_save		2213	#undef zero_save
n	2121	/* ---------------------------------------*/	n	2214	// ---------------------------------------
	2122	#define x1in(off) (32*0 + off)(SP)		2215	#define x1in(off) (32*0 + off)(SP)
	2123	#define y1in(off) (32*1 + off)(SP)		2216	#define y1in(off) (32*1 + off)(SP)
	2124	#define z1in(off) (32*2 + off)(SP)		2217	#define z1in(off) (32*2 + off)(SP)
	2125	#define x2in(off) (32*3 + off)(SP)		2218	#define x2in(off) (32*3 + off)(SP)
	2126	#define y2in(off) (32*4 + off)(SP)		2219	#define y2in(off) (32*4 + off)(SP)
	2127	#define z2in(off) (32*5 + off)(SP)		2220	#define z2in(off) (32*5 + off)(SP)
	2128			2221
	2129	#define xout(off) (32*6 + off)(SP)		2222	#define xout(off) (32*6 + off)(SP)
	2130	#define yout(off) (32*7 + off)(SP)		2223	#define yout(off) (32*7 + off)(SP)
	2131	#define zout(off) (32*8 + off)(SP)		2224	#define zout(off) (32*8 + off)(SP)
	2132			2225
	2133	#define u1(off) (32*9 + off)(SP)		2226	#define u1(off) (32*9 + off)(SP)
	2134	#define u2(off) (32*10 + off)(SP)		2227	#define u2(off) (32*10 + off)(SP)
	2135	#define s1(off) (32*11 + off)(SP)		2228	#define s1(off) (32*11 + off)(SP)
	2136	#define s2(off) (32*12 + off)(SP)		2229	#define s2(off) (32*12 + off)(SP)
	2137	#define z1sqr(off) (32*13 + off)(SP)		2230	#define z1sqr(off) (32*13 + off)(SP)
	2138	#define z2sqr(off) (32*14 + off)(SP)		2231	#define z2sqr(off) (32*14 + off)(SP)
	2139	#define h(off) (32*15 + off)(SP)		2232	#define h(off) (32*15 + off)(SP)
	2140	#define r(off) (32*16 + off)(SP)		2233	#define r(off) (32*16 + off)(SP)
	2141	#define hsqr(off) (32*17 + off)(SP)		2234	#define hsqr(off) (32*17 + off)(SP)
	2142	#define rsqr(off) (32*18 + off)(SP)		2235	#define rsqr(off) (32*18 + off)(SP)
	2143	#define hcub(off) (32*19 + off)(SP)		2236	#define hcub(off) (32*19 + off)(SP)
	2144	#define rptr (32*20)(SP)		2237	#define rptr (32*20)(SP)
	2145			2238
n	2146	//func p256PointAddAsm(res, in1, in2 []uint64)	n	2239	// func p256PointAddAsm(res, in1, in2 []uint64)
	2147	TEXT ·p256PointAddAsm(SB),0,$672-76		2240	TEXT ·p256PointAddAsm(SB), 0, $672-76
	2148	// Move input to stack in order to free registers		2241	// Move input to stack in order to free registers
	2149	MOVQ res+0(FP), AX		2242	MOVQ res+0(FP), AX
	2150	MOVQ in1+24(FP), BX		2243	MOVQ in1+24(FP), BX
	2151	MOVQ in2+48(FP), CX		2244	MOVQ in2+48(FP), CX
	2152			2245
	2153	MOVOU (16*0)(BX), X0		2246	MOVOU (16*0)(BX), X0
	2154	MOVOU (16*1)(BX), X1		2247	MOVOU (16*1)(BX), X1
	2155	MOVOU (16*2)(BX), X2		2248	MOVOU (16*2)(BX), X2
	2156	MOVOU (16*3)(BX), X3		2249	MOVOU (16*3)(BX), X3
	2157	MOVOU (16*4)(BX), X4		2250	MOVOU (16*4)(BX), X4
	2158	MOVOU (16*5)(BX), X5		2251	MOVOU (16*5)(BX), X5
	2159			2252
	2160	MOVOU X0, x1in(16*0)		2253	MOVOU X0, x1in(16*0)
	2161	MOVOU X1, x1in(16*1)		2254	MOVOU X1, x1in(16*1)
	2162	MOVOU X2, y1in(16*0)		2255	MOVOU X2, y1in(16*0)
	2163	MOVOU X3, y1in(16*1)		2256	MOVOU X3, y1in(16*1)
	2164	MOVOU X4, z1in(16*0)		2257	MOVOU X4, z1in(16*0)
	2165	MOVOU X5, z1in(16*1)		2258	MOVOU X5, z1in(16*1)
	2166			2259
	2167	MOVOU (16*0)(CX), X0		2260	MOVOU (16*0)(CX), X0
	2168	MOVOU (16*1)(CX), X1		2261	MOVOU (16*1)(CX), X1
	2169	MOVOU (16*2)(CX), X2		2262	MOVOU (16*2)(CX), X2
	2170	MOVOU (16*3)(CX), X3		2263	MOVOU (16*3)(CX), X3
	2171	MOVOU (16*4)(CX), X4		2264	MOVOU (16*4)(CX), X4
	2172	MOVOU (16*5)(CX), X5		2265	MOVOU (16*5)(CX), X5
	2173			2266
	2174	MOVOU X0, x2in(16*0)		2267	MOVOU X0, x2in(16*0)
	2175	MOVOU X1, x2in(16*1)		2268	MOVOU X1, x2in(16*1)
	2176	MOVOU X2, y2in(16*0)		2269	MOVOU X2, y2in(16*0)
	2177	MOVOU X3, y2in(16*1)		2270	MOVOU X3, y2in(16*1)
	2178	MOVOU X4, z2in(16*0)		2271	MOVOU X4, z2in(16*0)
	2179	MOVOU X5, z2in(16*1)		2272	MOVOU X5, z2in(16*1)
n			n	2273
	2180	// Store pointer to result		2274	// Store pointer to result
	2181	MOVQ AX, rptr		2275	MOVQ AX, rptr
n			n	2276
	2182	// Begin point add		2277	// Begin point add
	2183	LDacc (z2in)		2278	LDacc (z2in)
n	2184	CALL p256SqrInternal(SB) // z2ˆ2	n	2279	CALL p256SqrInternal(SB) // z2ˆ2
	2185	ST (z2sqr)		2280	ST (z2sqr)
	2186	LDt (z2in)		2281	LDt (z2in)
n	2187	CALL p256MulInternal(SB) // z2ˆ3	n	2282	CALL p256MulInternal(SB) // z2ˆ3
	2188	LDt (y1in)		2283	LDt (y1in)
n	2189	CALL p256MulInternal(SB) // s1 = z2ˆ3*y1	n	2284	CALL p256MulInternal(SB) // s1 = z2ˆ3*y1
	2190	ST (s1)		2285	ST (s1)
	2191			2286
	2192	LDacc (z1in)		2287	LDacc (z1in)
n	2193	CALL p256SqrInternal(SB) // z1ˆ2	n	2288	CALL p256SqrInternal(SB) // z1ˆ2
	2194	ST (z1sqr)		2289	ST (z1sqr)
	2195	LDt (z1in)		2290	LDt (z1in)
n	2196	CALL p256MulInternal(SB) // z1ˆ3	n	2291	CALL p256MulInternal(SB) // z1ˆ3
	2197	LDt (y2in)		2292	LDt (y2in)
n	2198	CALL p256MulInternal(SB) // s2 = z1ˆ3*y2	n	2293	CALL p256MulInternal(SB) // s2 = z1ˆ3*y2
	2199	ST (s2)		2294	ST (s2)
	2200			2295
	2201	LDt (s1)		2296	LDt (s1)
n	2202	CALL p256SubInternal(SB) // r = s2 - s1	n	2297	CALL p256SubInternal(SB) // r = s2 - s1
	2203	ST (r)		2298	ST (r)
	2204			2299
	2205	LDacc (z2sqr)		2300	LDacc (z2sqr)
	2206	LDt (x1in)		2301	LDt (x1in)
n	2207	CALL p256MulInternal(SB) // u1 = x1 * z2ˆ2	n	2302	CALL p256MulInternal(SB) // u1 = x1 * z2ˆ2
	2208	ST (u1)		2303	ST (u1)
	2209	LDacc (z1sqr)		2304	LDacc (z1sqr)
	2210	LDt (x2in)		2305	LDt (x2in)
n	2211	CALL p256MulInternal(SB) // u2 = x2 * z1ˆ2	n	2306	CALL p256MulInternal(SB) // u2 = x2 * z1ˆ2
	2212	ST (u2)		2307	ST (u2)
	2213			2308
	2214	LDt (u1)		2309	LDt (u1)
n	2215	CALL p256SubInternal(SB) // h = u2 - u1	n	2310	CALL p256SubInternal(SB) // h = u2 - u1
	2216	ST (h)		2311	ST (h)
	2217			2312
	2218	LDacc (r)		2313	LDacc (r)
n	2219	CALL p256SqrInternal(SB) // rsqr = rˆ2	n	2314	CALL p256SqrInternal(SB) // rsqr = rˆ2
	2220	ST (rsqr)		2315	ST (rsqr)
	2221			2316
	2222	LDacc (h)		2317	LDacc (h)
n	2223	CALL p256SqrInternal(SB) // hsqr = hˆ2	n	2318	CALL p256SqrInternal(SB) // hsqr = hˆ2
	2224	ST (hsqr)		2319	ST (hsqr)
	2225			2320
	2226	LDt (h)		2321	LDt (h)
n	2227	CALL p256MulInternal(SB) // hcub = hˆ3	n	2322	CALL p256MulInternal(SB) // hcub = hˆ3
	2228	ST (hcub)		2323	ST (hcub)
	2229			2324
	2230	LDt (s1)		2325	LDt (s1)
	2231	CALL p256MulInternal(SB)		2326	CALL p256MulInternal(SB)
	2232	ST (s2)		2327	ST (s2)
	2233			2328
	2234	LDacc (z1in)		2329	LDacc (z1in)
	2235	LDt (z2in)		2330	LDt (z2in)
n	2236	CALL p256MulInternal(SB) // z1 * z2	n	2331	CALL p256MulInternal(SB) // z1 * z2
	2237	LDt (h)		2332	LDt (h)
n	2238	CALL p256MulInternal(SB) // z1 * z2 * h	n	2333	CALL p256MulInternal(SB) // z1 * z2 * h
	2239	ST (zout)		2334	ST (zout)
	2240			2335
	2241	LDacc (hsqr)		2336	LDacc (hsqr)
	2242	LDt (u1)		2337	LDt (u1)
n	2243	CALL p256MulInternal(SB) // hˆ2 * u1	n	2338	CALL p256MulInternal(SB) // hˆ2 * u1
	2244	ST (u2)		2339	ST (u2)
	2245			2340
n	2246	p256MulBy2Inline // u1 * hˆ2 * 2, inline	n	2341	p256MulBy2Inline // u1 * hˆ2 * 2, inline
	2247	LDacc (rsqr)		2342	LDacc (rsqr)
n	2248	CALL p256SubInternal(SB) // rˆ2 - u1 * hˆ2 * 2	n	2343	CALL p256SubInternal(SB) // rˆ2 - u1 * hˆ2 * 2
	2249			2344
	2250	LDt (hcub)		2345	LDt (hcub)
	2251	CALL p256SubInternal(SB)		2346	CALL p256SubInternal(SB)
	2252	ST (xout)		2347	ST (xout)
	2253			2348
	2254	MOVQ acc4, t0		2349	MOVQ acc4, t0
	2255	MOVQ acc5, t1		2350	MOVQ acc5, t1
	2256	MOVQ acc6, t2		2351	MOVQ acc6, t2
	2257	MOVQ acc7, t3		2352	MOVQ acc7, t3
	2258	LDacc (u2)		2353	LDacc (u2)
	2259	CALL p256SubInternal(SB)		2354	CALL p256SubInternal(SB)
	2260			2355
	2261	LDt (r)		2356	LDt (r)
	2262	CALL p256MulInternal(SB)		2357	CALL p256MulInternal(SB)
	2263			2358
	2264	LDt (s2)		2359	LDt (s2)
	2265	CALL p256SubInternal(SB)		2360	CALL p256SubInternal(SB)
	2266	ST (yout)		2361	ST (yout)
	2267			2362
	2268	MOVOU xout(16*0), X0		2363	MOVOU xout(16*0), X0
	2269	MOVOU xout(16*1), X1		2364	MOVOU xout(16*1), X1
	2270	MOVOU yout(16*0), X2		2365	MOVOU yout(16*0), X2
	2271	MOVOU yout(16*1), X3		2366	MOVOU yout(16*1), X3
	2272	MOVOU zout(16*0), X4		2367	MOVOU zout(16*0), X4
	2273	MOVOU zout(16*1), X5		2368	MOVOU zout(16*1), X5
n			n	2369
	2274	// Finally output the result		2370	// Finally output the result
n	2275	MOVQ rptr, AX	n	2371	MOVQ rptr, AX
	2276	MOVQ $0, rptr		2372	MOVQ $0, rptr
	2277	MOVOU X0, (16*0)(AX)		2373	MOVOU X0, (16*0)(AX)
	2278	MOVOU X1, (16*1)(AX)		2374	MOVOU X1, (16*1)(AX)
	2279	MOVOU X2, (16*2)(AX)		2375	MOVOU X2, (16*2)(AX)
	2280	MOVOU X3, (16*3)(AX)		2376	MOVOU X3, (16*3)(AX)
	2281	MOVOU X4, (16*4)(AX)		2377	MOVOU X4, (16*4)(AX)
	2282	MOVOU X5, (16*5)(AX)		2378	MOVOU X5, (16*5)(AX)
	2283			2379
	2284	RET		2380	RET
n			n	2381
	2285	#undef x1in		2382	#undef x1in
	2286	#undef y1in		2383	#undef y1in
	2287	#undef z1in		2384	#undef z1in
	2288	#undef x2in		2385	#undef x2in
	2289	#undef y2in		2386	#undef y2in
	2290	#undef z2in		2387	#undef z2in
	2291	#undef xout		2388	#undef xout
	2292	#undef yout		2389	#undef yout
	2293	#undef zout		2390	#undef zout
	2294	#undef s1		2391	#undef s1
	2295	#undef s2		2392	#undef s2
	2296	#undef u1		2393	#undef u1
	2297	#undef u2		2394	#undef u2
	2298	#undef z1sqr		2395	#undef z1sqr
	2299	#undef z2sqr		2396	#undef z2sqr
	2300	#undef h		2397	#undef h
	2301	#undef r		2398	#undef r
	2302	#undef hsqr		2399	#undef hsqr
	2303	#undef rsqr		2400	#undef rsqr
	2304	#undef hcub		2401	#undef hcub
	2305	#undef rptr		2402	#undef rptr
n	2306	/* ---------------------------------------*/	n	2403	// ---------------------------------------
	2307	#define x(off) (32*0 + off)(SP)		2404	#define x(off) (32*0 + off)(SP)
	2308	#define y(off) (32*1 + off)(SP)		2405	#define y(off) (32*1 + off)(SP)
	2309	#define z(off) (32*2 + off)(SP)		2406	#define z(off) (32*2 + off)(SP)
	2310			2407
	2311	#define s(off) (32*3 + off)(SP)		2408	#define s(off) (32*3 + off)(SP)
	2312	#define m(off) (32*4 + off)(SP)		2409	#define m(off) (32*4 + off)(SP)
	2313	#define zsqr(off) (32*5 + off)(SP)		2410	#define zsqr(off) (32*5 + off)(SP)
	2314	#define tmp(off) (32*6 + off)(SP)		2411	#define tmp(off) (32*6 + off)(SP)
	2315	#define rptr (32*7)(SP)		2412	#define rptr (32*7)(SP)
	2316			2413
n	2317	//func p256PointDoubleAsm(res, in []uint64)	n	2414	// func p256PointDoubleAsm(res, in []uint64)
	2318	TEXT ·p256PointDoubleAsm(SB),NOSPLIT,$256-48		2415	TEXT ·p256PointDoubleAsm(SB), NOSPLIT, $256-48
	2319	// Move input to stack in order to free registers		2416	// Move input to stack in order to free registers
	2320	MOVQ res+0(FP), AX		2417	MOVQ res+0(FP), AX
	2321	MOVQ in+24(FP), BX		2418	MOVQ in+24(FP), BX
	2322			2419
	2323	MOVOU (16*0)(BX), X0		2420	MOVOU (16*0)(BX), X0
	2324	MOVOU (16*1)(BX), X1		2421	MOVOU (16*1)(BX), X1
	2325	MOVOU (16*2)(BX), X2		2422	MOVOU (16*2)(BX), X2
	2326	MOVOU (16*3)(BX), X3		2423	MOVOU (16*3)(BX), X3
	2327	MOVOU (16*4)(BX), X4		2424	MOVOU (16*4)(BX), X4
	2328	MOVOU (16*5)(BX), X5		2425	MOVOU (16*5)(BX), X5
	2329			2426
	2330	MOVOU X0, x(16*0)		2427	MOVOU X0, x(16*0)
	2331	MOVOU X1, x(16*1)		2428	MOVOU X1, x(16*1)
	2332	MOVOU X2, y(16*0)		2429	MOVOU X2, y(16*0)
	2333	MOVOU X3, y(16*1)		2430	MOVOU X3, y(16*1)
	2334	MOVOU X4, z(16*0)		2431	MOVOU X4, z(16*0)
	2335	MOVOU X5, z(16*1)		2432	MOVOU X5, z(16*1)
n			n	2433
	2336	// Store pointer to result		2434	// Store pointer to result
	2337	MOVQ AX, rptr		2435	MOVQ AX, rptr
n			n	2436
	2338	// Begin point double		2437	// Begin point double
	2339	LDacc (z)		2438	LDacc (z)
	2340	CALL p256SqrInternal(SB)		2439	CALL p256SqrInternal(SB)
	2341	ST (zsqr)		2440	ST (zsqr)
	2342			2441
	2343	LDt (x)		2442	LDt (x)
	2344	p256AddInline		2443	p256AddInline
	2345	STt (m)		2444	STt (m)
	2346			2445
	2347	LDacc (z)		2446	LDacc (z)
	2348	LDt (y)		2447	LDt (y)
	2349	CALL p256MulInternal(SB)		2448	CALL p256MulInternal(SB)
	2350	p256MulBy2Inline		2449	p256MulBy2Inline
	2351	MOVQ rptr, AX		2450	MOVQ rptr, AX
n			n	2451
	2352	// Store z		2452	// Store z
	2353	MOVQ t0, (164 + 80)(AX)		2453	MOVQ t0, (164 + 80)(AX)
	2354	MOVQ t1, (164 + 81)(AX)		2454	MOVQ t1, (164 + 81)(AX)
	2355	MOVQ t2, (164 + 82)(AX)		2455	MOVQ t2, (164 + 82)(AX)
	2356	MOVQ t3, (164 + 83)(AX)		2456	MOVQ t3, (164 + 83)(AX)
	2357			2457
	2358	LDacc (x)		2458	LDacc (x)
	2359	LDt (zsqr)		2459	LDt (zsqr)
	2360	CALL p256SubInternal(SB)		2460	CALL p256SubInternal(SB)
	2361	LDt (m)		2461	LDt (m)
	2362	CALL p256MulInternal(SB)		2462	CALL p256MulInternal(SB)
	2363	ST (m)		2463	ST (m)
n			n	2464
	2364	// Multiply by 3		2465	// Multiply by 3
	2365	p256MulBy2Inline		2466	p256MulBy2Inline
	2366	LDacc (m)		2467	LDacc (m)
	2367	p256AddInline		2468	p256AddInline
	2368	STt (m)		2469	STt (m)
n			n	2470
	2369	////////////////////////		2471	////////////////////////
	2370	LDacc (y)		2472	LDacc (y)
	2371	p256MulBy2Inline		2473	p256MulBy2Inline
	2372	t2acc		2474	t2acc
n	2373	CALL p256SqrInternal(SB)	n	2475	CALL p256SqrInternal(SB)
	2374	ST (s)		2476	ST (s)
n	2375	CALL p256SqrInternal(SB)	n	2477	CALL p256SqrInternal(SB)
				2478
	2376	// Divide by 2		2479	// Divide by 2
	2377	XORQ mul0, mul0		2480	XORQ mul0, mul0
	2378	MOVQ acc4, t0		2481	MOVQ acc4, t0
	2379	MOVQ acc5, t1		2482	MOVQ acc5, t1
	2380	MOVQ acc6, t2		2483	MOVQ acc6, t2
	2381	MOVQ acc7, t3		2484	MOVQ acc7, t3
	2382			2485
n	2383	ADDQ $-1, acc4	n	2486	ADDQ $-1, acc4
	2384	ADCQ p256const0<>(SB), acc5		2487	ADCQ p256const0<>(SB), acc5
	2385	ADCQ $0, acc6		2488	ADCQ $0, acc6
	2386	ADCQ p256const1<>(SB), acc7		2489	ADCQ p256const1<>(SB), acc7
	2387	ADCQ $0, mul0		2490	ADCQ $0, mul0
	2388	TESTQ $1, t0		2491	TESTQ $1, t0
	2389			2492
	2390	CMOVQEQ t0, acc4		2493	CMOVQEQ t0, acc4
	2391	CMOVQEQ t1, acc5		2494	CMOVQEQ t1, acc5
	2392	CMOVQEQ t2, acc6		2495	CMOVQEQ t2, acc6
	2393	CMOVQEQ t3, acc7		2496	CMOVQEQ t3, acc7
n	2394	ANDQ t0, mul0	n	2497	ANDQ t0, mul0
	2395			2498
	2396	SHRQ $1, acc4:acc5		2499	SHRQ $1, acc4:acc5
	2397	SHRQ $1, acc5:acc6		2500	SHRQ $1, acc5:acc6
	2398	SHRQ $1, acc6:acc7		2501	SHRQ $1, acc6:acc7
	2399	SHRQ $1, acc7:mul0		2502	SHRQ $1, acc7:mul0
	2400	ST (y)		2503	ST (y)
n			n	2504
	2401	/////////////////////////		2505	/////////////////////////
	2402	LDacc (x)		2506	LDacc (x)
	2403	LDt (s)		2507	LDt (s)
	2404	CALL p256MulInternal(SB)		2508	CALL p256MulInternal(SB)
	2405	ST (s)		2509	ST (s)
	2406	p256MulBy2Inline		2510	p256MulBy2Inline
	2407	STt (tmp)		2511	STt (tmp)
	2408			2512
	2409	LDacc (m)		2513	LDacc (m)
	2410	CALL p256SqrInternal(SB)		2514	CALL p256SqrInternal(SB)
	2411	LDt (tmp)		2515	LDt (tmp)
	2412	CALL p256SubInternal(SB)		2516	CALL p256SubInternal(SB)
	2413			2517
	2414	MOVQ rptr, AX		2518	MOVQ rptr, AX
n			n	2519
	2415	// Store x		2520	// Store x
	2416	MOVQ acc4, (160 + 80)(AX)		2521	MOVQ acc4, (160 + 80)(AX)
	2417	MOVQ acc5, (160 + 81)(AX)		2522	MOVQ acc5, (160 + 81)(AX)
	2418	MOVQ acc6, (160 + 82)(AX)		2523	MOVQ acc6, (160 + 82)(AX)
	2419	MOVQ acc7, (160 + 83)(AX)		2524	MOVQ acc7, (160 + 83)(AX)
	2420			2525
	2421	acc2t		2526	acc2t
	2422	LDacc (s)		2527	LDacc (s)
n	2423	CALL p256SubInternal(SB)	n	2528	CALL p256SubInternal(SB)
	2424			2529
	2425	LDt (m)		2530	LDt (m)
	2426	CALL p256MulInternal(SB)		2531	CALL p256MulInternal(SB)
	2427			2532
	2428	LDt (y)		2533	LDt (y)
	2429	CALL p256SubInternal(SB)		2534	CALL p256SubInternal(SB)
	2430	MOVQ rptr, AX		2535	MOVQ rptr, AX
n			n	2536
	2431	// Store y		2537	// Store y
	2432	MOVQ acc4, (162 + 80)(AX)		2538	MOVQ acc4, (162 + 80)(AX)
	2433	MOVQ acc5, (162 + 81)(AX)		2539	MOVQ acc5, (162 + 81)(AX)
	2434	MOVQ acc6, (162 + 82)(AX)		2540	MOVQ acc6, (162 + 82)(AX)
	2435	MOVQ acc7, (162 + 83)(AX)		2541	MOVQ acc7, (162 + 83)(AX)
n			n	2542
	2436	///////////////////////		2543	///////////////////////
	2437	MOVQ $0, rptr		2544	MOVQ $0, rptr
	2438			2545
	2439	RET		2546	RET
t			t	2547
	2440	/* ---------------------------------------*/		2548	// ---------------------------------------
	2441			2549