VXOR	V12, V12, V12 \
	VXOR	V13, V13, V13 \
	VXOR	V14, V14, V14 \
	VXOR	V15, V15, V15 \
	VXOR	V16, V16, V16 \
	VXOR	V17, V17, V17 \
	VXOR	V18, V18, V18 \
	VXOR	V19, V19, V19 \
	VXOR	V20, V20, V20

//func cryptBlocksChain(src, dst *byte, length int, key *uint32, iv *byte, enc int, nr int)
TEXT ·cryptBlocksChain(SB), NOSPLIT|NOFRAME, $0
	MOVD	src+0(FP), INP
	MOVD	dst+8(FP), OUTP
	MOVD	length+16(FP), LEN

	AESIMC	V0.B16, V15.B16
	AESIMC	V1.B16, V14.B16
	AESIMC	V2.B16, V13.B16
	AESIMC	V3.B16, V12.B16
	VLD1	(R10), [V0.B16, V1.B16, V2.B16]
	AESIMC	V0.B16, V18.B16
	AESIMC	V1.B16, V17.B16
	VMOV	V2.B16, V16.B16
	VST1.P	[V16.B16, V17.B16, V18.B16], 48(R11)
	VST1.P	[V12.B16, V13.B16, V14.B16, V15.B16], 64(R11)
	VST1.P	[V8.B16, V9.B16, V10.B16, V11.B16], 64(R11)
	VST1	[V4.B16, V5.B16, V6.B16, V7.B16], (R11)
ksDone:

#define Y1L    V2
#define Y1H    V3
#define Z1L    V4
#define Z1H    V5
#define X2L    V6
#define X2H    V7
#define Y2L    V8
#define Y2H    V9
#define Z2L    V10
#define Z2H    V11

#define ZER   V18
#define SEL1  V19
TEXT ·p256MovCond(SB), NOSPLIT, $0
	MOVD   res+0(FP), P3ptr
	MOVD   a+8(FP), P1ptr
	MOVD   b+16(FP), P2ptr
	VLREPG cond+24(FP), SEL1
	VZERO  ZER
	VCEQG  SEL1, ZER, SEL1

#define Y1L    V2
#define Y1H    V3
#define Z1L    V4
#define Z1H    V5
#define X2L    V6
#define X2H    V7
#define Y2L    V8
#define Y2H    V9
#define Z2L    V10
#define Z2H    V11

#define ONE   V18
#define IDX   V19
#define SEL1  V20
#define SEL2  V21
// func p256Select(point *p256Point, table *p256Table, idx int)
TEXT ·p256Select(SB), NOSPLIT, $0-24
	MOVD res+0(FP), P3ptr
	MOVD table+8(FP), P1ptr

#define B7 V7

#define ACC0 V8
#define ACC1 V9
#define ACCM V10

#define T0 V11
#define T1 V12
#define T2 V13
#define T3 V14

#define POLY V15
#define ZERO V16
#define INC V17
#define CTR V18

#define K0 V19
#define K1 V20
#define K2 V21
#define K3 V22
#define K4 V23
#define K5 V24
#define K6 V25
#define K7 V26
#define K8 V27
#define K9 V28
#define K10 V29
#define K11 V30

  // CHECK-DAG: %[[V18:.*]] = mhlo.subtract %[[V11]], %[[V2]] : tensor<1x22x128xi32>
  // CHECK-DAG: %[[V19:.*]] = mhlo.negate %[[V18]] : tensor<1x22x128xi32>
  // CHECK-DAG: %[[V20:.*]] = mhlo.minimum %[[V18]], %[[V5]] : tensor<1x22x128xi32>
  // CHECK-DAG: %[[V21:.*]] = mhlo.add %[[V13]], %[[V20]] : tensor<1x22x128xi32>
  // CHECK-DAG: %[[V22:.*]] = mhlo.maximum %[[V18]], %[[V5]] : tensor<1x22x128xi32>

		v17 := b.NewValue0(v.Pos, OpDiv32u, typ.UInt32)
		v18 := b.NewValue0(v.Pos, OpAdd32, typ.UInt32)
		v19 := b.NewValue0(v.Pos, OpMod32u, typ.UInt32)
		v19.AddArg2(v11, v8)
		v20 := b.NewValue0(v.Pos, OpMul32, typ.UInt32)
		v21 := b.NewValue0(v.Pos, OpConst32, typ.UInt32)
		v21.AuxInt = int32ToAuxInt(int32((1 << 32) % c))
		v20.AddArg2(v14, v21)
		v18.AddArg2(v19, v20)
		v17.AddArg2(v18, v8)
		v16.AddArg(v17)
		v.AddArg2(v0, v16)