LDP	16(R2), (R12, R13)
	LSR	R4, R13, R23
	ORR	R8, R23		// z[i] = (x[i] << s) | (x[i-1] >> (64 - s))
	LSL	R3, R13
	LSR	R4, R12, R22
	ORR	R13, R22
	LSL	R3, R12
	LSR	R4, R11, R21
	ORR	R12, R21
	LSL	R3, R11
	LSR	R4, R10, R20
	ORR	R11, R20
	LSL	R3, R10, R8
	STP.W	(R20, R21), -32(R0)
	STP	(R22, R23), 16(R0)
	SUB	$4, R1
	B	loop
done:
	MOVD.W	R8, -8(R0)	// the first element x[0]

	// arm64:`MOVHU\t\(R[0-9]+\)`,-`ORR`,-`MOVB`
	// 386:`MOVWLZX\s\([A-Z]+\)`,-`MOVB`,-`OR`
	// amd64:`MOVWLZX\s\([A-Z]+\)`,-`MOVB`,-`OR`
	// ppc64le:`MOVHZ\t\(R[0-9]+\)`,-`MOVBZ`
	// ppc64:`MOVHBR`,-`MOVBZ`
	return uint16(s[0]) | uint16(s[1])<<8
}

func load_le_byte2_uint16_inv(s []byte) uint16 {
	// arm64:`MOVHU\t\(R[0-9]+\)`,-`ORR`,-`MOVB`
	// 386:`MOVWLZX\s\([A-Z]+\)`,-`MOVB`,-`OR`

	// s390x:"MOVWBR"
	// arm64:"REVW"
	// ppc64x/power10: "BRW"
	return bits.ReverseBytes32(n)
}

func ReverseBytes16(n uint16) uint16 {
	// amd64:"ROLW"
	// arm64:"REV16W",-"UBFX",-"ORR"
	// arm/5:"SLL","SRL","ORR"
	// arm/6:"REV16"
	// arm/7:"REV16"
	// ppc64x/power10: "BRH"
	return bits.ReverseBytes16(n)
}

// --------------------- //
//    bits.RotateLeft    //
// --------------------- //

	CALL	p256SubInternal<>(SB)    // r = s2 - s1
	STx(r)

	MOVD	$1, t2
	ORR	x0, x1, t0             // Check if zero mod p256
	ORR	x2, x3, t1
	ORR	t1, t0, t0
	CMP	$0, t0
	CSEL	EQ, t2, ZR, hlp1

	EOR	$-1, x0, t0
	EOR	const0, x1, t1
	EOR	const1, x3, t3

	ORR	t0, t1, t0
	ORR	x2, t3, t1
	ORR	t1, t0, t0
	CMP	$0, t0
	CSEL	EQ, t2, hlp1, hlp1

	LDx(z2sqr)
	LDy(x1in)

		{name: "ORshiftLL", argLength: 2, reg: gp21, asm: "ORR", aux: "Int32"},  // arg0 | arg1<<auxInt
		{name: "ORshiftRL", argLength: 2, reg: gp21, asm: "ORR", aux: "Int32"},  // arg0 | arg1>>auxInt, unsigned shift
		{name: "ORshiftRA", argLength: 2, reg: gp21, asm: "ORR", aux: "Int32"},  // arg0 | arg1>>auxInt, signed shift

	XTAH	R0<<16, R5, R2     // ERROR "illegal shift"
	XTABU	R0->24, R5, R2     // ERROR "illegal shift"
	XTAHU	R0@>1, R5, R2      // ERROR "illegal shift"
	AND.W	R0, R1             // ERROR "invalid .W suffix"
	ORR.P	R2, R3, R4         // ERROR "invalid .P suffix"
	CMP.S	R1, R2	           // ERROR "invalid .S suffix"
	BIC.P	$124, R1, R2       // ERROR "invalid .P suffix"
	MOVW.S	$124, R1           // ERROR "invalid .S suffix"

	ORNW R4@>11, R16, R3                       // 032ee42a
	ORN R22@>19, R3, R3                        // 634cf6aa
	ORRW $4294443071, R15, R24                 // f8490d32
	ORR $-3458764513820540929, R12, R22        // 96f542b2
	ORRW R13<<4, R8, R26                       // 1a110d2a
	ORR R3<<22, R5, R6                         // a65803aa
	PRFM (R8), $25                             // 190180f9
	PRFM (R2), PLDL1KEEP                       // 400080f9

00000330  c3 fb 96 05 bf b5 bd bf  e2 28 07 7e 51 a6 84 90  |.........(.~Q...|
00000340  bf 9e 2e f6 b5 04 8e 06  7a 63 c8 00 84 a1 a3 2c  |........zc.....,|
00000350  f3 6f 52 52 c4 ce 4a 59  31 1f d4 ab 2e f4 75 90  |.oRR..JY1.....u.|
00000360  a5 3b ff ab 20 be 51 92  c5 f4 4d 8b f2 2a a7 ff  |.;.. .Q...M..*..|
00000370  90 07 40 3e d6 9c cf 23  54 d1 65 d3 74 79 af 51  |..@>...#T.e.ty.Q|

	case lex.LSH:
		op = 0
	case lex.RSH:
		op = 1
	case lex.ARR:
		op = 2
	case lex.ROT:
		// following instructions on ARM64 support rotate right
		// AND, ANDS, TST, BIC, BICS, EON, EOR, ORR, MVN, ORN
		op = 3
	}
	tok := p.next()
	str := tok.String()
	var count int16
	switch tok.ScanToken {
	case scanner.Ident:
		if p.arch.Family == sys.ARM64 {