//     Maj(x, y, z) = (x AND y) XOR (x AND z) XOR (y AND z)
#define SHA512T2(a, b, c) \
	ROR	$28, a, X6; \
	ROR	$34, a, X7; \
	XOR	X7, X6; \
	ROR	$39, a, X8; \
	XOR	X8, X6; \
	AND	a, b, X7; \
	AND	a, c, X8; \
	XOR	X8, X7; \
	AND	b, c, X9; \
	XOR	X9, X7; \
	ADD	X7, X6

// Calculate T1 and T2, then e = d + T1 and a = T1 + T2.
// The values for e and a are stored in d and h, ready for rotation.

	AND	$7, X10, X7
	AND	$7, X12, X8
	BNE	X7, X8, check8_unaligned
	BEQZ	X7, compare32

	// Check one byte at a time until we reach 8 byte alignment.
	SUB	X7, X0, X7
	ADD	$8, X7, X7
	SUB	X7, X5, X5
align:
	SUB	$1, X7
	MOVBU	0(X10), X8
	MOVBU	0(X12), X9
	BNE	X8, X9, cmp
	ADD	$1, X10
	ADD	$1, X12
	BNEZ	X7, align

check32:
	// X6 contains $32

TEXT addMulVVWx(SB),NOFRAME|NOSPLIT,$0
	MOV	z+0(FP), X5
	MOV	x+8(FP), X7
	MOV	y+16(FP), X6
	MOV	$0, X29

	BEQZ	X30, done
loop:
	MOV	0*8(X5), X10	// z[0]
	MOV	1*8(X5), X13	// z[1]
	MOV	2*8(X5), X16	// z[2]
	MOV	3*8(X5), X19	// z[3]

	MOV	0*8(X7), X8	// x[0]
	MOV	1*8(X7), X11	// x[1]
	MOV	2*8(X7), X14	// x[2]
	MOV	3*8(X7), X17	// x[3]

	MULHU	X8, X6, X9	// z_hi[0] = x[0] * y

	VREPF $1, KEY0, X5
	VREPF $2, KEY0, X6
	VREPF $3, KEY0, X7
	VREPF $0, KEY1, X8
	VREPF $1, KEY1, X9
	VREPF $2, KEY1, X10
	VREPF $3, KEY1, X11
	VLR   CTR, X12
	VREPF $1, NONCE, X13
	VREPF $2, NONCE, X14
	VREPF $3, NONCE, X15

	MOVD $(NUM_ROUNDS/2), R1

loop:
	ROUND4(X0, X4, X12,  X8, X1, X5, X13,  X9, X2, X6, X14, X10, X3, X7, X15, X11)

	_ = x1
	var x2 C.jclass = 0
	_ = x2
	var x3 C.jthrowable = 0
	_ = x3
	var x4 C.jstring = 0
	_ = x4
	var x5 C.jarray = 0
	_ = x5
	var x6 C.jbooleanArray = 0
	_ = x6
	var x7 C.jbyteArray = 0
	_ = x7
	var x8 C.jcharArray = 0
	_ = x8
	var x9 C.jshortArray = 0
	_ = x9
	var x10 C.jintArray = 0
	_ = x10
	var x11 C.jlongArray = 0
	_ = x11
	var x12 C.jfloatArray = 0
	_ = x12

	VPGATHERQQ Y2, (BP)(X7*2), Y2   // ERROR "mask, index, and destination registers should be distinct"
	VPGATHERQQ Y7, (BP)(X2*2), Y2   // ERROR "mask, index, and destination registers should be distinct"
	VPGATHERDQ X2, 664(X2*8), X2    // ERROR "mask, index, and destination registers should be distinct"
	VPGATHERDQ X2, 664(X2*8), X7    // ERROR "mask, index, and destination registers should be distinct"

	QR(X1, X5, X9, X13, X15)
	MOVOU (15*16)(BX), X15 // reload X15; temp now X4
	QR(X2, X6, X10, X14, X4)
	QR(X3, X7, X11, X15, X4)

	QR(X0, X5, X10, X15, X4)
	MOVOU X15, (15*16)(BX) // save X15
	QR(X1, X6, X11, X12, X4)
	MOVOU (4*16)(BX), X4  // reload X4; temp now X15
	QR(X2, X7, X8, X13, X15)
	QR(X3, X4, X9, X14, X15)

	DECL DX
	JNZ loop

	// Store interlaced blocks back to output buffer,

// cycles via functions

var x4 = x5
var x5 /* ERROR "initialization cycle for x5" */ = f1()
func f1() int { return x5*10 }

var x6, x7 /* ERROR "initialization cycle" */ = f2()
var x8 = x7
func f2() (int, int) { return f3() + f3(), 0 }
func f3() int { return x8 }

// cycles via function literals

		x2 := byteorder.LeUint32(q[4*0x2:])
		x3 := byteorder.LeUint32(q[4*0x3:])
		x4 := byteorder.LeUint32(q[4*0x4:])
		x5 := byteorder.LeUint32(q[4*0x5:])
		x6 := byteorder.LeUint32(q[4*0x6:])
		x7 := byteorder.LeUint32(q[4*0x7:])
		x8 := byteorder.LeUint32(q[4*0x8:])
		x9 := byteorder.LeUint32(q[4*0x9:])
		xa := byteorder.LeUint32(q[4*0xa:])
		xb := byteorder.LeUint32(q[4*0xb:])
		xc := byteorder.LeUint32(q[4*0xc:])

	JE 2(PC)
	#endif
	VZEROUPPER
	#endif
	MOVUPS X0, 112(SP)
	MOVUPS X1, 128(SP)
	MOVUPS X2, 144(SP)
	MOVUPS X3, 160(SP)
	MOVUPS X4, 176(SP)
	MOVUPS X5, 192(SP)
	MOVUPS X6, 208(SP)
	MOVUPS X7, 224(SP)
	MOVUPS X8, 240(SP)
	MOVUPS X9, 256(SP)
	MOVUPS X10, 272(SP)
	MOVUPS X11, 288(SP)
	MOVUPS X12, 304(SP)
	MOVUPS X13, 320(SP)
	MOVUPS X14, 336(SP)
	MOVUPS X15, 352(SP)
	CALL ·asyncPreempt2(SB)