MOVL	$0, 0x68(DI)

	SUBQ	$(const_maxArgs*8), SP	// room for args

	// Fast version, do not store args on the stack.
	CMPL	CX, $0;	JE	_0args
	CMPL	CX, $1;	JE	_1args
	CMPL	CX, $2;	JE	_2args
	CMPL	CX, $3;	JE	_3args
	CMPL	CX, $4;	JE	_4args

	// Check we have enough room for args.
	CMPL	CX, $const_maxArgs
	JLE	2(PC)
	INT	$3			// not enough room -> crash

	// Copy args to the stack.
	MOVQ	SP, DI
	CLD

TEXT ·Syscall6(SB),NOSPLIT,$0-40
	MOVL	num+0(FP), AX	// syscall entry
	MOVL	a1+4(FP), BX
	MOVL	a2+8(FP), CX
	MOVL	a3+12(FP), DX
	MOVL	a4+16(FP), SI
	MOVL	a5+20(FP), DI
	MOVL	a6+24(FP), BP
	INVOKE_SYSCALL
	CMPL	AX, $0xfffff001
	JLS	ok
	MOVL	$-1, r1+28(FP)
	MOVL	$0, r2+32(FP)
	NEGL	AX
	MOVL	AX, errno+36(FP)
	RET
ok:
	MOVL	AX, r1+28(FP)
	MOVL	DX, r2+32(FP)
	MOVL	$0, errno+36(FP)

	MOVL	dig+0(FP),	BP
	MOVL	p+4(FP),	SI
	MOVL	p_len+8(FP), DX
	SHRL	$6,		DX
	SHLL	$6,		DX

	LEAL	(SI)(DX*1),	DI
	MOVL	(0*4)(BP),	AX
	MOVL	(1*4)(BP),	BX
	MOVL	(2*4)(BP),	CX
	MOVL	(3*4)(BP),	DX

	CMPL	SI,		DI
	JEQ	end

	MOVL	DI,		16(SP)

loop:
	MOVL	AX,		0(SP)
	MOVL	BX,		4(SP)
	MOVL	CX,		8(SP)
	MOVL	DX,		12(SP)

	MOVL	(0*4)(SI),	DI
	MOVL	DX,		BP

	ROUND1(AX,BX,CX,DX, 1,0xd76aa478, 7);

	MOVL	p_len+8(FP),	DX
	SHRL	$6,		DX
	SHLL	$6,		DX

	LEAL	(SI)(DX*1),	DI
	MOVL	(0*4)(BP),	AX
	MOVL	(1*4)(BP),	BX
	MOVL	(2*4)(BP),	CX
	MOVL	(3*4)(BP),	DX
	MOVL	(4*4)(BP),	BP

	CMPL	SI,		DI
	JEQ	end

	MOVL	DI,	84(SP)

loop:
	MOVL	SI,	88(SP)

	MOVL	AX,	64(SP)
	MOVL	BX,	68(SP)
	MOVL	CX,	72(SP)
	MOVL	DX,	76(SP)
	MOVL	BP,	80(SP)

	ROUND1(AX, BX, CX, DX, BP, 0)

	SHA256ROUND(index, const, a, b, c, d, e, f, g, h)

TEXT ·block(SB),0,$296-16
	MOVL	p_base+4(FP), SI
	MOVL	p_len+8(FP), DX
	SHRL	$6, DX
	SHLL	$6, DX

	LEAL	(SI)(DX*1), DI
	MOVL	DI, 288(SP)
	CMPL	SI, DI
	JEQ	end

	LEAL	256(SP), DI		// variables

	MOVL	dig+0(FP), BP
	MOVL	(0*4)(BP), AX		// a = H0
	MOVL	AX, (0*4)(DI)
	MOVL	(1*4)(BP), BX		// b = H1
	MOVL	BX, (1*4)(DI)

	MOVQ nr+0(FP), CX
	MOVQ key+8(FP), AX
	MOVQ enc+16(FP), BX
	MOVQ dec+24(FP), DX
	MOVUPS (AX), X0
	// enc
	MOVUPS X0, (BX)
	ADDQ $16, BX
	PXOR X4, X4 // _expand_key_* expect X4 to be zero
	CMPL CX, $12
	JE Lexp_enc192
	JB Lexp_enc128
Lexp_enc256:
	MOVUPS 16(AX), X2
	MOVUPS X2, (BX)
	ADDQ $16, BX
	AESKEYGENASSIST $0x01, X2, X1
	CALL _expand_key_256a<>(SB)
	AESKEYGENASSIST $0x01, X0, X1