4640     int64_t s13 = kBottom21Bits & (load_3(s + 34) >> 1);  in x25519_sc_reduce()  local
4671     s13 += s23 * 654183;  in x25519_sc_reduce()
4680     s13 -= s22 * 997805;  in x25519_sc_reduce()
4689     s13 += s21 * 136657;  in x25519_sc_reduce()
4698     s13 -= s20 * 683901;  in x25519_sc_reduce()
4727     s13 += carry12;  in x25519_sc_reduce()
4745     carry13 = (s13 + (1 << 20)) >> 21;  in x25519_sc_reduce()
4747     s13 -= carry13 * (1 << 21);  in x25519_sc_reduce()
4784     s1  += s13 * 666643;  in x25519_sc_reduce()
4785     s2  += s13 * 470296;  in x25519_sc_reduce()
4786     s3  += s13 * 654183;  in x25519_sc_reduce()
4787     s4  -= s13 * 997805;  in x25519_sc_reduce()
4788     s5  += s13 * 136657;  in x25519_sc_reduce()
4789     s6  -= s13 * 683901;  in x25519_sc_reduce()
4790     s13  = 0;  in x25519_sc_reduce()
5021     int64_t s13;  in sc_muladd()  local
5069 …s13 =          a2 * b11  +   a3 * b10  +   a4 * b9  +   a5 * b8  +   a6 * b7  +   a7 * b6 +   a8 *…  in sc_muladd()
5100     s13 += carry12;  in sc_muladd()
5136     carry13 = (s13 + (1 << 20)) >> 21;  in sc_muladd()
5138     s13 -= carry13 * (1 << 21);  in sc_muladd()
5154     s13 += s23 * 654183;  in sc_muladd()
5163     s13 -= s22 * 997805;  in sc_muladd()
5172     s13 += s21 * 136657;  in sc_muladd()
5181     s13 -= s20 * 683901;  in sc_muladd()
5210     s13 += carry12;  in sc_muladd()
5228     carry13 = (s13 + (1 << 20)) >> 21;  in sc_muladd()
5230     s13 -= carry13 * (1 << 21);  in sc_muladd()
5267     s1  += s13 * 666643;  in sc_muladd()
5268     s2  += s13 * 470296;  in sc_muladd()
5269     s3  += s13 * 654183;  in sc_muladd()
5270     s4  -= s13 * 997805;  in sc_muladd()
5271     s5  += s13 * 136657;  in sc_muladd()
5272     s6  -= s13 * 683901;  in sc_muladd()
5273     s13  = 0;  in sc_muladd()