AESENC X1, X0
	MOVUPS 48(AX), X1
	AESENC X1, X0
	MOVUPS 64(AX), X1
	AESENC X1, X0
	MOVUPS 80(AX), X1
	AESENC X1, X0
	MOVUPS 96(AX), X1
	AESENC X1, X0
	MOVUPS 112(AX), X1
	AESENC X1, X0
	MOVUPS 128(AX), X1
	AESENC X1, X0
	MOVUPS 144(AX), X1
	AESENCLAST X1, X0
	MOVUPS X0, 0(DX)
	RET

// func decryptBlockAsm(nr int, xk *uint32, dst, src *byte)
TEXT ·decryptBlockAsm(SB),NOSPLIT,$0
	MOVQ nr+0(FP), CX

	VL   80(P1ptr), X1        // Z1H
	VPDI $0x4, X1, X1, X1
	VL   64(P1ptr), X0        // Z1L
	VPDI $0x4, X0, X0, X0
	VLR  X0, Y0
	VLR  X1, Y1
	CALL p256SqrInternal<>(SB)

	// SUB(X<X1-T)            // T2 = X1-T1
	VL   16(P1ptr), X1H
	VPDI $0x4, X1H, X1H, X1H
	VL   0(P1ptr), X1L
	VPDI $0x4, X1L, X1L, X1L
	p256SubInternal(X1,X0,X1H,X1L,T1,T0)

	LXVD2X (R20)(P1ptr), X1 // Z1L

	XXPERMDI X0, X0, $2, X0
	XXPERMDI X1, X1, $2, X1

	VOR  X0, X0, Y0
	VOR  X1, X1, Y1
	CALL p256MulInternal<>(SB)

	// SUB(X<X1-T)            // T2 = X1-T1
	LXVD2X (R0)(P1ptr), X1L
	LXVD2X (R16)(P1ptr), X1H
	XXPERMDI X1L, X1L, $2, X1L
	XXPERMDI X1H, X1H, $2, X1H

	p256SubInternal(X1,X0,X1H,X1L,T1,T0)

	MOVD	table+8(FP), t1
	MOVD	res+0(FP), res_ptr

	EOR	x0, x0, x0
	EOR	x1, x1, x1
	EOR	x2, x2, x2
	EOR	x3, x3, x3
	EOR	y0, y0, y0
	EOR	y1, y1, y1
	EOR	y2, y2, y2
	EOR	y3, y3, y3

	MOVD	$0, t2

loop_select:
		ADD	$1, t2
		CMP	t0, t2
		LDP.P	16(t1), (acc0, acc1)
		CSEL	EQ, acc0, x0, x0
		CSEL	EQ, acc1, x1, x1
		LDP.P	16(t1), (acc2, acc3)
		CSEL	EQ, acc2, x2, x2
		CSEL	EQ, acc3, x3, x3

        itemList.add(new SynonymItem(3, new String[] { "c1" }, new String[] { "C1", "C2" }));
        itemList.add(new SynonymItem(4, new String[] { "x1", "X1" }, new String[] { "x1", "X1" }));
        itemList.add(new SynonymItem(5, new String[] { "y1", "Y1", "y2" }, new String[] { "y1", "Y1", "y2" }));
        synonymFile.synonymItemList = itemList;
    }

    public void test_selectList() {

func (curve *CurveParams) Double(x1, y1 *big.Int) (*big.Int, *big.Int) {
	// If there is a dedicated constant-time implementation for this curve operation,
	// use that instead of the generic one.
	if specific, ok := matchesSpecificCurve(curve); ok {
		return specific.Double(x1, y1)
	}
	panicIfNotOnCurve(curve, x1, y1)

	z1 := zForAffine(x1, y1)

	xd := z[2*n : 2*n+n2]
	if subVV(xd, x1, x0) != 0 { // x1-x0
		s = -s
		subVV(xd, x0, x1) // x0-x1
	}

	// compute yd (or the negative value if underflow occurs)
	yd := z[2*n+n2 : 3*n]
	if subVV(yd, y0, y1) != 0 { // y0-y1
		s = -s
		subVV(yd, y1, y0) // y1-y0
	}

	// p = (x1-x0)*(y0-y1) == x1*y0 - x1*y1 - x0*y0 + x0*y1 for s > 0
	// p = (x0-x1)*(y0-y1) == x0*y0 - x0*y1 - x1*y0 + x1*y1 for s < 0
	p := z[n*3:]

	// a page boundary, so we can load it directly.
	MOVOU	-16(AX), X1
	ADDQ	CX, CX
	MOVQ	$masks<>(SB), AX
	PAND	(AX)(CX*8), X1
final1:
	PXOR	X0, X1	// xor data with seed
	AESENC	X1, X1	// scramble combo 3 times
	AESENC	X1, X1
	AESENC	X1, X1
	MOVQ	X1, AX	// return X1
	RET

endofpage:
	// address ends in 1111xxxx. Might be up against

(BIC x0 x1:(SLLconst [c] y)) && clobberIfDead(x1) => (BICshiftLL x0 y [c])
(BIC x0 x1:(SRLconst [c] y)) && clobberIfDead(x1) => (BICshiftRL x0 y [c])
(BIC x0 x1:(SRAconst [c] y)) && clobberIfDead(x1) => (BICshiftRA x0 y [c])
(BIC x0 x1:(RORconst [c] y)) && clobberIfDead(x1) => (BICshiftRO x0 y [c])
(ORN x0 x1:(SLLconst [c] y)) && clobberIfDead(x1) => (ORNshiftLL x0 y [c])

		PAND X12, X8
		PAND X12, X9
		PAND X12, X10
		PAND X12, X11

		PXOR X4, X0
		PXOR X5, X1
		PXOR X6, X2
		PXOR X7, X3

		PXOR X8, X0
		PXOR X9, X1
		PXOR X10, X2
		PXOR X11, X3

		DECQ AX
		JNE loop_select_base

	MOVOU X0, (16*0)(DX)
	MOVOU X1, (16*1)(DX)
	MOVOU X2, (16*2)(DX)
	MOVOU X3, (16*3)(DX)

	RET
/* ---------------------------------------*/