x3 = x1 + w2mw6*x3
		x1 = x4 + x6
		x4 -= x6
		x6 = x5 + x7
		x5 -= x7

		// Stage 3.
		x7 = x8 + x3
		x8 -= x3
		x3 = x0 + x2
		x0 -= x2
		x2 = (r2*(x4+x5) + 128) >> 8
		x4 = (r2*(x4-x5) + 128) >> 8

		// Stage 4.
		s[0] = (x7 + x1) >> 8
		s[1] = (x3 + x2) >> 8
		s[2] = (x0 + x4) >> 8
		s[3] = (x8 + x6) >> 8
		s[4] = (x8 - x6) >> 8
		s[5] = (x0 - x4) >> 8

	for _, length := range []int{64, 1350, 8 * 1024} {
		b.Run("Open-128-"+strconv.Itoa(length), func(b *testing.B) {
			benchmarkAESGCMOpen(b, make([]byte, length), 128/8)
		})
		b.Run("Seal-128-"+strconv.Itoa(length), func(b *testing.B) {
			benchmarkAESGCMSeal(b, make([]byte, length), 128/8)
		})

		b.Run("Open-256-"+strconv.Itoa(length), func(b *testing.B) {
			benchmarkAESGCMOpen(b, make([]byte, length), 256/8)
		})

/**
 * This annotation is a marker and guarantees all integration tests are tagged.
 *
 * When we use JUnit Platform `includeTags('SomeTag')`, all spock tests are excluded:
 * https://github.com/spockframework/spock/issues/1288 . As a workaround,
 * we tag all non-spock integration tests and use `includeTags(none() | SomeTag)` to make
 * sure spock engine tests are executed.
 */
@Retention(RetentionPolicy.RUNTIME)

	eq(I1.Sum(t2, a, 12), 22)

	f3 := I1.Sum
	eq(f3(t1, a, 13), 23)
	eq(f3(t2, a, 14), 24)

	eq(I2.Sum(t1, a, 15), 25)
	eq(I2.Sum(t2, a, 16), 26)

	f4 := I2.Sum
	eq(f4(t1, a, 17), 27)
	eq(f4(t2, a, 18), 28)

	// issue 6723
	f5 := (interface {
		I2
	}).Sum
	eq(f5(t1, a, 19), 29)
	eq(f5(t2, a, 20), 30)

	mt1 := method4a.T1(4)
	mt2 := &method4a.T2{4}

	eq(mt1.Sum(a, 30), 40)
	eq(mt2.Sum(a, 31), 41)

	// This avoids an unnecessary allocation of the aesCipher struct.
	c := aesCipherGCM{aesCipherAsm{aesCipher{l: uint8(len(key) + 28)}}}
	var rounds int
	switch len(key) {
	case 128 / 8:
		rounds = 10
	case 192 / 8:
		rounds = 12
	case 256 / 8:
		rounds = 14
	default:
		return nil, KeySizeError(len(key))
	}

	expandKeyAsm(rounds, &key[0], &c.enc[0], &c.dec[0])

	if !(cpu.S390X.HasAES && cpu.S390X.HasAESCBC && cpu.S390X.HasAESCTR && (cpu.S390X.HasGHASH || cpu.S390X.HasAESGCM)) {
		return newCipherGeneric(key)
	}

	var function code
	switch len(key) {
	case 128 / 8:
		function = aes128
	case 192 / 8:
		function = aes192
	case 256 / 8:
		function = aes256
	default:
		return nil, KeySizeError(len(key))
	}

	var c aesCipherAsm
	c.function = function

	LEAQ	·emptystring(SB), SI

copyresult3:
	LEAQ	err+48(FP), DI

	CLD
	MOVSQ
	MOVSQ

	RET

TEXT	·Syscall6(SB),NOSPLIT,$168-88
	NO_LOCAL_POINTERS
	CALL	runtime·entersyscall<ABIInternal>(SB)
	MOVQ	trap+0(FP), BP	// syscall entry
	// copy args down
	LEAQ	a1+8(FP), SI
	LEAQ	sysargs-160(SP), DI
	CLD
	MOVSQ
	MOVSQ
	MOVSQ
	MOVSQ

	// level shift. Scaling reduces the rounding errors in the conversion from
	// floats to ints.
	for i, b := range blocks {
		got, want := b, b
		for j := range got {
			got[j] = (got[j] - 128) * 8
		}
		slowFDCT(&got)
		slowIDCT(&got)
		for j := range got {
			got[j] = got[j]/8 + 128
		}
		if differ(&got, &want) {
			t.Errorf("i=%d: IDCT(FDCT)\nsrc\n%s\ngot\n%s\nwant\n%s\n", i, &b, &got, &want)
		}

	{"testdata/video-001.png", "testdata/video-001.gif", 64 << 8},
	{"testdata/video-001.png", "testdata/video-001.interlaced.gif", 64 << 8},
	{"testdata/video-001.png", "testdata/video-001.5bpp.gif", 128 << 8},
	// JPEG is a lossy format and hence needs a non-zero tolerance.
	{"testdata/video-001.png", "testdata/video-001.jpeg", 8 << 8},
	{"testdata/video-001.png", "testdata/video-001.progressive.jpeg", 8 << 8},

00000010  0b b8 f3 69 ba 4f 49 93  05 0f b1 f1 d7 6b 6c 0c  |...i.OI......kl.|
00000020  98 d0 22 78 0c ad 15 6b  24 5b 14 03 03 00 01 01  |.."x...k$[......|
00000030  16 03 03 00 20 9d aa 3f  17 b3 16 88 d5 44 3d 03  |.... ..?.....D=.|
00000040  3c 3c 8d 92 f1 2f e4 38  cc 42 20 2f ef 6a 29 c6  |<<.../.8.B /.j).|
00000050  5c ca 44 81 f6                                    |\.D..|
>>> Flow 4 (server to client)