72  * A field element is encoded as four 64-bit integers, in basis 2^63.
77 #define MASK63   (((uint64_t)1 << 63) - (uint64_t)1)
87 	m = -(uint64_t)ctl;  in f255_cswap()
168 	 * We compute t = 2^256 - 38 + a - b, which is necessarily  in f255_sub()
177 	z = (unsigned __int128)a[0] - (unsigned __int128)b[0] - 38;  in f255_sub()
179 	cc = -(uint64_t)(z >> 64);  in f255_sub()
180 	z = (unsigned __int128)a[1] - (unsigned __int128)b[1]  in f255_sub()
181 		- (unsigned __int128)cc;  in f255_sub()
183 	cc = -(uint64_t)(z >> 64);  in f255_sub()
184 	z = (unsigned __int128)a[2] - (unsigned __int128)b[2]  in f255_sub()
185 		- (unsigned __int128)cc;  in f255_sub()
187 	cc = -(uint64_t)(z >> 64);  in f255_sub()
188 	z = (unsigned __int128)a[3] - (unsigned __int128)b[3]  in f255_sub()
189 		- (unsigned __int128)cc;  in f255_sub()
194 	 * We have a 257-bit result. The two top bits can be 00, 01 or 10,  in f255_sub()
195 	 * but not 11 (value t <= 2^256 - 38 + 2^255 + 37 = 2^256 + 2^255 - 1).  in f255_sub()
199 	cc = (38 & -t4) + (19 & -(t3 >> 63));  in f255_sub()
212 	 * We compute t = 2^256 - 38 + a - b, which is necessarily  in f255_sub()
234 	 * We have a 257-bit result. The two top bits can be 00, 01 or 10,  in f255_sub()
235 	 * but not 11 (value t <= 2^256 - 38 + 2^255 + 37 = 2^256 + 2^255 - 1).  in f255_sub()
239 	t4 = (38 & -t4) + (19 & -(t3 >> 63));  in f255_sub()
261 	 * Compute the product a*b over plain integers.  in f255_mul()
346 	th = (361 & -th) + (19 * (uint64_t)(z >> 63));  in f255_mul()
386 	 * Compute the product a*b over plain integers.  in f255_mul()
457 	th = (361 & -th) + (19 * ((h3 << 1) + (t7 >> 63)));  in f255_mul()
522 	z = (unsigned __int128)t0 + (19 & -(t3 >> 63));  in f255_mul_a24()
551 	t4 = 19 & -(t3 >> 63);  in f255_mul_a24()
574 	 * is already less than 2^255-19, thus already reduced.  in f255_final_reduce()
576 	 * have t = a - (2^255-19), and that's our result.  in f255_final_reduce()
586 	m = -(t3 >> 63);  in f255_final_reduce()
600 	 * is already less than 2^255-19, thus already reduced.  in f255_final_reduce()
602 	 * have t = a - (2^255-19), and that's our result.  in f255_final_reduce()
609 	m = -(t3 >> 63);  in f255_final_reduce()
648 	 * We can use memset() to clear values, because exact-width types  in api_mul()
659 	 * The multiplier is provided in big-endian notation, and  in api_mul()
662 	memset(k, 0, (sizeof k) - kblen);  in api_mul()
663 	memcpy(k + (sizeof k) - kblen, kb, kblen);  in api_mul()
670 	for (i = 254; i >= 0; i --) {  in api_mul()
672 		uint64_t c[4], d[4], da[4], cb[4];  in api_mul()  local
675 		kt = (k[31 - (i >> 3)] >> (i & 7)) & 1;  in api_mul()
687 		/* B = x_2 - z_2 */  in api_mul()
693 		/* E = AA - BB */  in api_mul()
699 		/* D = x_3 - z_3 */  in api_mul()
705 		/* CB = C * B */  in api_mul()
706 		f255_mul(cb, c, b);  in api_mul()
708 		/* x_3 = (DA + CB)^2 */  in api_mul()
709 		f255_add(x3, da, cb);  in api_mul()
712 		/* z_3 = x_1 * (DA - CB)^2 */  in api_mul()
713 		f255_sub(z3, da, cb);  in api_mul()
730 	 * Compute 1/z2 = z2^(p-2). Since p = 2^255-19, we can mutualize  in api_mul()
731 	 * most non-squarings. We use x1 and x3, now useless, as temporaries.  in api_mul()
747 	for (i = 14; i >= 0; i --) {  in api_mul()
755 	 * Compute x2/z2. We have 1/z2 in x3.  in api_mul()
761 	 * Encode the final x2 value in little-endian.  in api_mul()