51   fe25519 t;  in fe25519_pack()  local
52   t = *x;  in fe25519_pack()
53   x25519_x86_64_freeze(&t);  in fe25519_pack()
55   r[0] = (uint8_t)(t.v[0] & 0xff);  in fe25519_pack()
56   r[1] = (uint8_t)((t.v[0] >> 8) & 0xff);  in fe25519_pack()
57   r[2] = (uint8_t)((t.v[0] >> 16) & 0xff);  in fe25519_pack()
58   r[3] = (uint8_t)((t.v[0] >> 24) & 0xff);  in fe25519_pack()
59   r[4] = (uint8_t)((t.v[0] >> 32) & 0xff);  in fe25519_pack()
60   r[5] = (uint8_t)((t.v[0] >> 40) & 0xff);  in fe25519_pack()
61   r[6] = (uint8_t)((t.v[0] >> 48));  in fe25519_pack()
63   r[6] ^= (uint8_t)((t.v[1] << 3) & 0xf8);  in fe25519_pack()
64   r[7] = (uint8_t)((t.v[1] >> 5) & 0xff);  in fe25519_pack()
65   r[8] = (uint8_t)((t.v[1] >> 13) & 0xff);  in fe25519_pack()
66   r[9] = (uint8_t)((t.v[1] >> 21) & 0xff);  in fe25519_pack()
67   r[10] = (uint8_t)((t.v[1] >> 29) & 0xff);  in fe25519_pack()
68   r[11] = (uint8_t)((t.v[1] >> 37) & 0xff);  in fe25519_pack()
69   r[12] = (uint8_t)((t.v[1] >> 45));  in fe25519_pack()
71   r[12] ^= (uint8_t)((t.v[2] << 6) & 0xc0);  in fe25519_pack()
72   r[13] = (uint8_t)((t.v[2] >> 2) & 0xff);  in fe25519_pack()
73   r[14] = (uint8_t)((t.v[2] >> 10) & 0xff);  in fe25519_pack()
74   r[15] = (uint8_t)((t.v[2] >> 18) & 0xff);  in fe25519_pack()
75   r[16] = (uint8_t)((t.v[2] >> 26) & 0xff);  in fe25519_pack()
76   r[17] = (uint8_t)((t.v[2] >> 34) & 0xff);  in fe25519_pack()
77   r[18] = (uint8_t)((t.v[2] >> 42) & 0xff);  in fe25519_pack()
78   r[19] = (uint8_t)((t.v[2] >> 50));  in fe25519_pack()
80   r[19] ^= (uint8_t)((t.v[3] << 1) & 0xfe);  in fe25519_pack()
81   r[20] = (uint8_t)((t.v[3] >> 7) & 0xff);  in fe25519_pack()
82   r[21] = (uint8_t)((t.v[3] >> 15) & 0xff);  in fe25519_pack()
83   r[22] = (uint8_t)((t.v[3] >> 23) & 0xff);  in fe25519_pack()
84   r[23] = (uint8_t)((t.v[3] >> 31) & 0xff);  in fe25519_pack()
85   r[24] = (uint8_t)((t.v[3] >> 39) & 0xff);  in fe25519_pack()
86   r[25] = (uint8_t)((t.v[3] >> 47));  in fe25519_pack()
88   r[25] ^= (uint8_t)((t.v[4] << 4) & 0xf0);  in fe25519_pack()
89   r[26] = (uint8_t)((t.v[4] >> 4) & 0xff);  in fe25519_pack()
90   r[27] = (uint8_t)((t.v[4] >> 12) & 0xff);  in fe25519_pack()
91   r[28] = (uint8_t)((t.v[4] >> 20) & 0xff);  in fe25519_pack()
92   r[29] = (uint8_t)((t.v[4] >> 28) & 0xff);  in fe25519_pack()
93   r[30] = (uint8_t)((t.v[4] >> 36) & 0xff);  in fe25519_pack()
94   r[31] = (uint8_t)((t.v[4] >> 44));  in fe25519_pack()
149   fe25519 t;  in fe25519_invert()  local
153   /* 4 */ x25519_x86_64_square(&t, &z2);  in fe25519_invert()
154   /* 8 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
155   /* 9 */ x25519_x86_64_mul(&z9, &t, x);  in fe25519_invert()
157   /* 22 */ x25519_x86_64_square(&t, &z11);  in fe25519_invert()
158   /* 2^5 - 2^0 = 31 */ x25519_x86_64_mul(&z2_5_0, &t, &z9);  in fe25519_invert()
160   /* 2^6 - 2^1 */ x25519_x86_64_square(&t, &z2_5_0);  in fe25519_invert()
161   /* 2^20 - 2^10 */ for (i = 1; i < 5; i++) { x25519_x86_64_square(&t, &t); }  in fe25519_invert()
162   /* 2^10 - 2^0 */ x25519_x86_64_mul(&z2_10_0, &t, &z2_5_0);  in fe25519_invert()
164   /* 2^11 - 2^1 */ x25519_x86_64_square(&t, &z2_10_0);  in fe25519_invert()
165   /* 2^20 - 2^10 */ for (i = 1; i < 10; i++) { x25519_x86_64_square(&t, &t); }  in fe25519_invert()
166   /* 2^20 - 2^0 */ x25519_x86_64_mul(&z2_20_0, &t, &z2_10_0);  in fe25519_invert()
168   /* 2^21 - 2^1 */ x25519_x86_64_square(&t, &z2_20_0);  in fe25519_invert()
169   /* 2^40 - 2^20 */ for (i = 1; i < 20; i++) { x25519_x86_64_square(&t, &t); }  in fe25519_invert()
170   /* 2^40 - 2^0 */ x25519_x86_64_mul(&t, &t, &z2_20_0);  in fe25519_invert()
172   /* 2^41 - 2^1 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
173   /* 2^50 - 2^10 */ for (i = 1; i < 10; i++) { x25519_x86_64_square(&t, &t); }  in fe25519_invert()
174   /* 2^50 - 2^0 */ x25519_x86_64_mul(&z2_50_0, &t, &z2_10_0);  in fe25519_invert()
176   /* 2^51 - 2^1 */ x25519_x86_64_square(&t, &z2_50_0);  in fe25519_invert()
177   /* 2^100 - 2^50 */ for (i = 1; i < 50; i++) { x25519_x86_64_square(&t, &t); }  in fe25519_invert()
178   /* 2^100 - 2^0 */ x25519_x86_64_mul(&z2_100_0, &t, &z2_50_0);  in fe25519_invert()
180   /* 2^101 - 2^1 */ x25519_x86_64_square(&t, &z2_100_0);  in fe25519_invert()
182     x25519_x86_64_square(&t, &t);  in fe25519_invert()
184   /* 2^200 - 2^0 */ x25519_x86_64_mul(&t, &t, &z2_100_0);  in fe25519_invert()
186   /* 2^201 - 2^1 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
187   /* 2^250 - 2^50 */ for (i = 1; i < 50; i++) { x25519_x86_64_square(&t, &t); }  in fe25519_invert()
188   /* 2^250 - 2^0 */ x25519_x86_64_mul(&t, &t, &z2_50_0);  in fe25519_invert()
190   /* 2^251 - 2^1 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
191   /* 2^252 - 2^2 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
192   /* 2^253 - 2^3 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
194   /* 2^254 - 2^4 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
196   /* 2^255 - 2^5 */ x25519_x86_64_square(&t, &t);  in fe25519_invert()
197   /* 2^255 - 21 */ x25519_x86_64_mul(r, &t, &z11);  in fe25519_invert()
238   fe25519 t;  in x25519_x86_64()  local
240   fe25519_unpack(&t, point);  in x25519_x86_64()
241   mladder(&t, &z, e);  in x25519_x86_64()
243   x25519_x86_64_mul(&t, &t, &z);  in x25519_x86_64()
244   fe25519_pack(out, &t);  in x25519_x86_64()