4623     int64_t s6  = kBottom21Bits & (load_4(s + 15) >> 6);  in x25519_sc_reduce()  local
4699     s6  += s18 * 666643;  in x25519_sc_reduce()
4707     carry6 = (s6 + (1 << 20)) >> 21;  in x25519_sc_reduce()
4709     s6  -= carry6 * (1 << 21);  in x25519_sc_reduce()
4743     s6  += s17 * 470296;  in x25519_sc_reduce()
4752     s6  += s16 * 654183;  in x25519_sc_reduce()
4761     s6  -= s15 * 997805;  in x25519_sc_reduce()
4770     s6  += s14 * 136657;  in x25519_sc_reduce()
4779     s6  -= s13 * 683901;  in x25519_sc_reduce()
4799     carry6 = (s6 + (1 << 20)) >> 21;  in x25519_sc_reduce()
4801     s6 -= carry6 * (1 << 21);  in x25519_sc_reduce()
4816     s6  += carry5;  in x25519_sc_reduce()
4852     s6  += carry5;  in x25519_sc_reduce()
4854     carry6 = s6 >> 21;  in x25519_sc_reduce()
4856     s6  -= carry6 * (1 << 21);  in x25519_sc_reduce()
4897     s6  += carry5;  in x25519_sc_reduce()
4899     carry6 = s6 >> 21;  in x25519_sc_reduce()
4901     s6  -= carry6 * (1 << 21);  in x25519_sc_reduce()
4930     s[15] = (uint8_t)((s5  >> 15) | (s6  <<  6));  in x25519_sc_reduce()
4931     s[16] = (uint8_t) (s6  >>  2);  in x25519_sc_reduce()
4932     s[17] = (uint8_t) (s6  >> 10);  in x25519_sc_reduce()
4933     s[18] = (uint8_t)((s6  >> 18) | (s7  <<  3));  in x25519_sc_reduce()
5004     int64_t s6;  in sc_muladd()  local
5052 …s6  = c6   +   a0 * b6   +   a1 * b5   +   a2 * b4  +   a3 * b3  +   a4 * b2  +   a5 * b1 +   a6 *…  in sc_muladd()
5080     carry6 = (s6 + (1 << 20)) >> 21;  in sc_muladd()
5082     s6  -= carry6 * (1 << 21);  in sc_muladd()
5115     s6  += carry5;  in sc_muladd()
5182     s6  += s18 * 666643;  in sc_muladd()
5190     carry6 = (s6 + (1 << 20)) >> 21;  in sc_muladd()
5192     s6  -= carry6 * (1 << 21);  in sc_muladd()
5226     s6  += s17 * 470296;  in sc_muladd()
5235     s6  += s16 * 654183;  in sc_muladd()
5244     s6  -= s15 * 997805;  in sc_muladd()
5253     s6  += s14 * 136657;  in sc_muladd()
5262     s6  -= s13 * 683901;  in sc_muladd()
5282     carry6 = (s6 + (1 << 20)) >> 21;  in sc_muladd()
5284     s6  -= carry6 * (1 << 21);  in sc_muladd()
5299     s6  += carry5;  in sc_muladd()
5335     s6  += carry5;  in sc_muladd()
5337     carry6 = s6 >> 21;  in sc_muladd()
5339     s6  -= carry6 * (1 << 21);  in sc_muladd()
5380     s6  += carry5;  in sc_muladd()
5382     carry6 = s6 >> 21;  in sc_muladd()
5384     s6  -= carry6 * (1 << 21);  in sc_muladd()
5413     s[15] = (uint8_t)((s5  >> 15) | (s6 << 6));  in sc_muladd()
5414     s[16] = (uint8_t) (s6  >>  2);  in sc_muladd()
5415     s[17] = (uint8_t) (s6  >> 10);  in sc_muladd()
5416     s[18] = (uint8_t)((s6  >> 18) | (s7 << 3));  in sc_muladd()