JMP	main(SB)

// When building with -buildmode=c-shared, this symbol is called when the shared
// library is loaded.
TEXT _rt0_riscv64_freebsd_lib(SB),NOSPLIT,$224
	// Preserve callee-save registers, along with X1 (LR).
	MOV	X1, (8*3)(X2)
	MOV	X8, (8*4)(X2)
	MOV	X9, (8*5)(X2)
	MOV	X18, (8*6)(X2)
	MOV	X19, (8*7)(X2)
	MOV	X20, (8*8)(X2)
	MOV	X21, (8*9)(X2)
	MOV	X22, (8*10)(X2)
	MOV	X23, (8*11)(X2)
	MOV	X24, (8*12)(X2)

	MOVD $(NUM_ROUNDS/2), R1

loop:
	ROUND4(X0, X4, X12,  X8, X1, X5, X13,  X9, X2, X6, X14, X10, X3, X7, X15, X11)
	ROUND4(X0, X5, X15, X10, X1, X6, X12, X11, X2, X7, X13, X8,  X3, X4, X14, X9)

	ADD $-1, R1
	BNE loop

	// decrement length
	ADD $-256, R4

	// rearrange vectors
	SHUFFLE(X0, X1, X2, X3, M0, M1, M2, M3)
	ADDV(J0, X0, X1, X2, X3)
	SHUFFLE(X4, X5, X6, X7, M0, M1, M2, M3)

func Mul64(x, y uint64) (hi, lo uint64) {
	const mask32 = 1<<32 - 1
	x0 := x & mask32
	x1 := x >> 32
	y0 := y & mask32
	y1 := y >> 32
	w0 := x0 * y0
	t := x1*y0 + w0>>32
	w1 := t & mask32
	w2 := t >> 32
	w1 += x0 * y1
	hi = x1*y1 + w2 + w1>>32
	lo = x * y
	return
}

// Add64 returns the sum with carry of x, y and carry: sum = x + y + carry.

		for x := x0; x != x1; x, yi, ci = x+4, yi+1, ci+1 {
	`,
	"422": `
		ciBase := (sy-src.Rect.Min.Y)*src.CStride - src.Rect.Min.X/2
		for x, sx := x0, sp.X; x != x1; x, sx, yi = x+4, sx+1, yi+1 {
			ci := ciBase + sx/2
	`,
	"420": `
		ciBase := (sy/2-src.Rect.Min.Y/2)*src.CStride - src.Rect.Min.X/2
		for x, sx := x0, sp.X; x != x1; x, sx, yi = x+4, sx+1, yi+1 {
			ci := ciBase + sx/2
	`,

	y0 = x0

	a0 = b0
	b0 /* ERROR "initialization cycle for b0" */ = c0
	c0 = d0
	d0 = b0
)

var (
	s1 /* ERROR "initialization cycle: s1 refers to itself" */ = s1

	x1 /* ERROR "initialization cycle for x1" */ = y1
	y1 = x1

	a1 = b1
	b1 /* ERROR "initialization cycle for b1" */ = c1
	c1 = d1
	d1 = b1
)

// initialization cycles (we know the types)
const (

	xd := z[2*n : 2*n+n2]
	if subVV(xd, x1, x0) != 0 { // x1-x0
		s = -s
		subVV(xd, x0, x1) // x0-x1
	}

	// compute yd (or the negative value if underflow occurs)
	yd := z[2*n+n2 : 3*n]
	if subVV(yd, y0, y1) != 0 { // y0-y1
		s = -s
		subVV(yd, y1, y0) // y1-y0
	}

	// p = (x1-x0)*(y0-y1) == x1*y0 - x1*y1 - x0*y0 + x0*y1 for s > 0
	// p = (x0-x1)*(y0-y1) == x0*y0 - x0*y1 - x1*y0 + x1*y1 for s < 0
	p := z[n*3:]

func _[
	TP0 Interface,
	TP1 ~_Chan,
	TP2 ~chan int | ~chan byte,
](X0 TP0, X1 TP1, X2 TP2) {
	i = X0
	I = X0
	c = X1
	C = X1 // ERRORx `cannot use X1 .* as Chan value`
	c = X2 // ERRORx `.* cannot assign chan byte \(in TP2\) to (chan int|_Chan.*)`
}

//              j1(x) = sqrt(2/(pi*x))*(p1(x)*cos(x1)-q1(x)*sin(x1))
//              y1(x) = sqrt(2/(pi*x))*(p1(x)*sin(x1)+q1(x)*cos(x1))
//         where x1 = x-3*pi/4. It is better to compute sin(x1),cos(x1)
//         as follow:
//              cos(x1) =  cos(x)cos(3pi/4)+sin(x)sin(3pi/4)
//                      =  1/sqrt(2) * (sin(x) - cos(x))
//              sin(x1) =  sin(x)cos(3pi/4)-cos(x)sin(3pi/4)

func (T0) m() int { return y0 }

var x0 = T0{}

var y0 /* ERROR "initialization cycle" */ = x0.m()

type T1 struct{}

func (T1) m() int { return y1 }

var x1 interface {
	m() int
} = T1{}

var y1 = x1.m() // no cycle reported, x1 is of interface type

// issue 6703 (modified)

var x2 /* ERROR "initialization cycle" */ = T2.m

var y2 = x2

type T2 struct{}

func (T2) m() int {
	_ = y2

}

func x25519ScalarMult(dst, scalar, point []byte) {
	var e [32]byte

	copy(e[:], scalar[:])
	e[0] &= 248
	e[31] &= 127
	e[31] |= 64

	var x1, x2, z2, x3, z3, tmp0, tmp1 field.Element
	x1.SetBytes(point[:])
	x2.One()
	x3.Set(&x1)
	z3.One()

	swap := 0
	for pos := 254; pos >= 0; pos-- {
		b := e[pos/8] >> uint(pos&7)
		b &= 1
		swap ^= int(b)
		x2.Swap(&x3, swap)