MOVD	x+24(FP), R2
	MOVD	s+48(FP), R3
	ADD	R1<<3, R0	// R0 = &z[n]
	ADD	R1<<3, R2	// R2 = &x[n]
	CBZ	R1, len0
	CBZ	R3, copy	// if the number of shift is 0, just copy x to z
	MOVD	$64, R4
	SUB	R3, R4
	// handling the most significant element x[n-1]
	MOVD.W	-8(R2), R6
	LSR	R4, R6, R5	// return value
	LSL	R3, R6, R8	// x[i] << s
	SUB	$1, R1
one:	TBZ	$0, R1, two
	MOVD.W	-8(R2), R6

	MOVD   $-4(R5), R5
	CMPBGE R5, $4, mediumLoopBody
	BR     smallLoop

returnC:
	MOVD R7, c+56(FP)
	RET

// func shlVU(z, x []Word, s uint) (c Word)
TEXT ·shlVU(SB), NOSPLIT, $0
	BR ·shlVU_g(SB)

// func shrVU(z, x []Word, s uint) (c Word)
TEXT ·shrVU(SB), NOSPLIT, $0
	BR ·shrVU_g(SB)

	MOVV	R25, R3

	MOVW	$CLOCK_REALTIME, R4
	MOVV	$0(R3), R5

	MOVV	runtime·vdsoClockgettimeSym(SB), R20
	BEQ	R20, fallback

	// Store g on gsignal's stack, see sys_linux_arm64.s for detail
	MOVBU	runtime·iscgo(SB), R25
	BNE	R25, nosaveg

	MOVV	m_gsignal(R24), R25	// g.m.gsignal
	BEQ	R25, nosaveg
	BEQ	g, R25, nosaveg

	MOVV	(g_stack+stack_lo)(R25), R25	// g.m.gsignal.stack.lo

	MOVV	R0, gobuf_sp(R3)
	MOVV	R0, gobuf_ret(R3)
	MOVV	R0, gobuf_lr(R3)
	MOVV	R0, gobuf_ctxt(R3)
	MOVV	gobuf_pc(R3), R4
	JMP	(R4)

// void mcall(fn func(*g))
// Switch to m->g0's stack, call fn(g).
// Fn must never return. It should gogo(&g->sched)
// to keep running g.
TEXT runtime·mcall(SB), NOSPLIT|NOFRAME, $0-8
	// Save caller state in g->sched
	MOVV	R29, (g_sched+gobuf_sp)(g)

	MOVL	$0, gobuf_sp(BX)	// clear to help garbage collector
	MOVL	$0, gobuf_ret(BX)
	MOVL	$0, gobuf_ctxt(BX)
	MOVL	gobuf_pc(BX), BX
	JMP	BX

// func mcall(fn func(*g))
// Switch to m->g0's stack, call fn(g).
// Fn must never return. It should gogo(&g->sched)
// to keep running g.
TEXT runtime·mcall(SB), NOSPLIT, $0-4
	MOVL	fn+0(FP), DI

	get_tls(DX)
	MOVL	g(DX), AX	// save state in g->sched

	// Called from f.
	// Set m->morebuf to f's caller.
	MOV	RA, (m_morebuf+gobuf_pc)(A0)	// f's caller's PC
	MOV	X2, (m_morebuf+gobuf_sp)(A0)	// f's caller's SP
	MOV	g, (m_morebuf+gobuf_g)(A0)

	// Call newstack on m->g0's stack.
	MOV	m_g0(A0), g
	CALL	runtime·save_g(SB)
	MOV	(g_sched+gobuf_sp)(g), X2
	// Create a stack frame on g0 to call newstack.
	MOV	ZERO, -8(X2)	// Zero saved LR in frame
	SUB	$8, X2
	CALL	runtime·newstack(SB)

	MOVD	$0, gobuf_lr(R5)
	MOVD	$0, gobuf_ctxt(R5)
	CMP	R0, R0 // set condition codes for == test, needed by stack split
	MOVD	gobuf_pc(R5), R6
	BR	(R6)

// void mcall(fn func(*g))
// Switch to m->g0's stack, call fn(g).
// Fn must never return.  It should gogo(&g->sched)
// to keep running g.
TEXT runtime·mcall(SB), NOSPLIT, $-8-8
	// Save caller state in g->sched
	MOVD	R15, (g_sched+gobuf_sp)(g)

	MOVH.S	0xaaaa(R2), R3     // ERROR "invalid .S suffix"
	MOVW.S	0xaaaa(R2), R3     // ERROR "invalid .S suffix"
	MOVW.S	CPSR, R1           // ERROR "invalid .S suffix"
	MOVW.S	R3, CPSR           // ERROR "invalid .S suffix"
	MOVW.S	$0, CPSR           // ERROR "invalid .S suffix"
	MOVM.S	(R0), [R2-R4]      // ERROR "invalid .S suffix"
	MOVM.S	[R1-R6], (R9)      // ERROR "invalid .S suffix"
	SWPW.S	R1, (R2), R3       // ERROR "invalid .S suffix"

//go:build !purego

// This is an optimized implementation of AES-GCM using AES-NI and CLMUL-NI
// The implementation uses some optimization as described in:
// [1] Gueron, S., Kounavis, M.E.: Intel® Carry-Less Multiplication
//     Instruction and its Usage for Computing the GCM Mode rev. 2.02
// [2] Gueron, S., Krasnov, V.: Speeding up Counter Mode in Software and
//     Hardware

#include "textflag.h"

#define B0 X0
#define B1 X1
#define B2 X2

	//TODO VFMINV V11.S4, F9                   // 69f9b06e
	//TODO VFMLA V6.S[0], F2, F14              // 4e10865f
	//TODO VFMLA V28.S[2], V2.S2, V30.S2       // 5e189c0f
	VFMLA V29.S2, V20.S2, V14.S2               // 8ece3d0e
	//TODO VFMLS V24.D[1], F3, F17             // 7158d85f
	//TODO VFMLS V10.S[0], V11.S2, V10.S2      // 6a518a0f
	VFMLS V29.S2, V27.S2, V17.S2               // 71cfbd0e