MOVW	R18, 72(R29)
	MOVW	R19, 76(R29)
	MOVW	R20, 80(R29)
	// R21 already saved
	// R22 already saved.
	MOVW	R22, 84(R29)
	// R23 is tmp register.
	MOVW	R24, 88(R29)
	MOVW	R25, 92(R29)
	// R26 is reserved by kernel.
	// R27 is reserved by kernel.
	MOVW	R28, 96(R29)
	// R29 is SP.
	// R30 is g.
	// R31 is LR, which was saved by the prologue.

	CALL	runtime·wbBufFlush(SB)

	MOVW	4(R29), R20

#define const0 R15
#define const1 R16

#define hlp0 R17
#define hlp1 res_ptr

#define x0 R19
#define x1 R20
#define x2 R21
#define x3 R22
#define y0 R23
#define y1 R24
#define y2 R25
#define y3 R26

#define const2 t2
#define const3 t3

DATA p256const0<>+0x00(SB)/8, $0x00000000ffffffff
DATA p256const1<>+0x00(SB)/8, $0xffffffff00000001
DATA p256ordK0<>+0x00(SB)/8, $0xccd1c8aaee00bc4f

	&& s > 64 && s <= 16*64 && s%16 == 0
	&& !config.noDuffDevice && logLargeCopy(v, s) =>
	(DUFFCOPY [8 * (64 - s/16)] dst src mem)
// 8 is the number of bytes to encode:
//
// LDP.P   16(R16), (R26, R27)
// STP.P   (R26, R27), 16(R17)
//
// 64 is number of these blocks. See runtime/duff_arm64.s:duffcopy

// large move uses a loop
(Move [s] dst src mem)
	&& s%16 == 0 && (s > 16*64 || config.noDuffDevice)