ORR	R0->28, R1           // 401e81e1
	ORR	R0@>28, R1           // 601e81e1
	ORR.S	R0<<28, R1           // 001e91e1
	ORR.S	R0>>28, R1           // 201e91e1
	ORR.S	R0->28, R1           // 401e91e1
	ORR.S	R0@>28, R1           // 601e91e1
	ORR	R0<<R1, R2, R3       // 103182e1
	ORR	R0>>R1, R2, R3       // 303182e1
	ORR	R0->R1, R2, R3       // 503182e1
	ORR	R0@>R1, R2, R3       // 703182e1

	LDP	16(R2), (R12, R13)
	LSR	R4, R13, R23
	ORR	R8, R23		// z[i] = (x[i] << s) | (x[i-1] >> (64 - s))
	LSL	R3, R13
	LSR	R4, R12, R22
	ORR	R13, R22
	LSL	R3, R12
	LSR	R4, R11, R21
	ORR	R12, R21
	LSL	R3, R11
	LSR	R4, R10, R20
	ORR	R11, R20
	LSL	R3, R10, R8
	STP.W	(R20, R21), -32(R0)
	STP	(R22, R23), 16(R0)
	SUB	$4, R1
	B	loop
done:
	MOVD.W	R8, -8(R0)	// the first element x[0]

	// arm64:`MOVHU\t\(R[0-9]+\)`,-`ORR`,-`MOVB`
	// 386:`MOVWLZX\s\([A-Z]+\)`,-`MOVB`,-`OR`
	// amd64:`MOVWLZX\s\([A-Z]+\)`,-`MOVB`,-`OR`
	// ppc64le:`MOVHZ\t\(R[0-9]+\)`,-`MOVBZ`
	// ppc64:`MOVHBR`,-`MOVBZ`
	return uint16(s[0]) | uint16(s[1])<<8
}

func load_le_byte2_uint16_inv(s []byte) uint16 {
	// arm64:`MOVHU\t\(R[0-9]+\)`,-`ORR`,-`MOVB`
	// 386:`MOVWLZX\s\([A-Z]+\)`,-`MOVB`,-`OR`

	// w[i] = p[j]<<24 | p[j+1]<<16 | p[j+2]<<8 | p[j+3]
	// e += w[i]
#define LOAD(Re) \
	MOVBU	2(Rdata), Rt0 ; \
	MOVBU	3(Rdata), Rt1 ; \
	MOVBU	1(Rdata), Rt2 ; \
	ORR	Rt0<<8, Rt1, Rt0	    ; \
	MOVBU.P	4(Rdata), Rt1 ; \
	ORR	Rt2<<16, Rt0, Rt0	    ; \
	ORR	Rt1<<24, Rt0, Rt0	    ; \
	MOVW.P	Rt0, 4(Rw)		    ; \
	ADD	Rt0, Re, Re

	// tmp := w[(i-3)&0xf] ^ w[(i-8)&0xf] ^ w[(i-14)&0xf] ^ w[(i)&0xf]
	// w[i&0xf] = tmp<<1 | tmp>>(32-1)

	// s390x:"MOVWBR"
	// arm64:"REVW"
	// ppc64x/power10: "BRW"
	return bits.ReverseBytes32(n)
}

func ReverseBytes16(n uint16) uint16 {
	// amd64:"ROLW"
	// arm64:"REV16W",-"UBFX",-"ORR"
	// arm/5:"SLL","SRL","ORR"
	// arm/6:"REV16"
	// arm/7:"REV16"
	// ppc64x/power10: "BRH"
	return bits.ReverseBytes16(n)
}

// --------------------- //
//    bits.RotateLeft    //
// --------------------- //

#ifndef GOARM64_LSE
	MOVBU	internal∕cpu·ARM64+const_offsetARM64HasATOMICS(SB), R4
	CBZ 	R4, load_store_loop
#endif
	LDORALB	R1, (R0), R2
	RET
#ifndef GOARM64_LSE
load_store_loop:
	LDAXRB	(R0), R2
	ORR	R1, R2
	STLXRB	R2, (R0), R3
	CBNZ	R3, load_store_loop
	RET
#endif

// func And(addr *uint32, v uint32)
TEXT ·And(SB), NOSPLIT, $0-12
	MOVD	ptr+0(FP), R0
	MOVW	val+8(FP), R1
#ifndef GOARM64_LSE

	CALL	p256SubInternal<>(SB)    // r = s2 - s1
	STx(r)

	MOVD	$1, t2
	ORR	x0, x1, t0             // Check if zero mod p256
	ORR	x2, x3, t1
	ORR	t1, t0, t0
	CMP	$0, t0
	CSEL	EQ, t2, ZR, hlp1

	EOR	$-1, x0, t0
	EOR	const0, x1, t1
	EOR	const1, x3, t3

	ORR	t0, t1, t0
	ORR	x2, t3, t1
	ORR	t1, t0, t0
	CMP	$0, t0
	CSEL	EQ, t2, hlp1, hlp1

	LDx(z2sqr)
	LDy(x1in)

	ADD	$4, R1	// stop one word early
	MOVW	$32, R4
	SUB	R3, R4
	MOVW	$0, R7

	MOVW.W	-4(R2), R6
	MOVW	R6<<R3, R7
	MOVW	R6>>R4, R6
	MOVW	R6, c+28(FP)
	B E7

L7:
	MOVW.W	-4(R2), R6
	ORR	R6>>R4, R7
	MOVW.W	R7, -4(R5)
	MOVW	R6<<R3, R7
E7:
	TEQ	R1, R5
	BNE	L7

	MOVW	R7, -4(R5)
	RET

Y7:	// copy loop, because shift 0 == shift 32
	MOVW.W	-4(R2), R6
	MOVW.W	R6, -4(R5)

	MULLU	R1,R3,(R6,R5)		// R7:R6:R5 = R2:R1 * R3
	MOVW	$0,R7
	MULALU	R2,R3,(R7,R6)

	// unscale by discarding low 32 bits, shifting the rest by 29
	MOVW	R6>>29,R6		// R7:R6 = (R7:R6:R5 >> 61)
	ORR	R7<<3,R6
	MOVW	R7>>29,R7

	// subtract (10**9 * sec) from nsec to get nanosecond remainder
	MOVW	$1000000000, R5	// 10**9
	MULLU	R6,R5,(R9,R8)   // R9:R8 = R7:R6 * R5
	MULA	R7,R5,R9,R9
	SUB.S	R8,R1		// R2:R1 -= R9:R8

		{name: "ORshiftLL", argLength: 2, reg: gp21, asm: "ORR", aux: "Int64"},                    // arg0 | arg1<<auxInt, auxInt should be in the range 0 to 63.
		{name: "ORshiftRL", argLength: 2, reg: gp21, asm: "ORR", aux: "Int64"},                    // arg0 | arg1>>auxInt, unsigned shift, auxInt should be in the range 0 to 63.