1077   int64_t s11 = 2097151 & (load_4(s + 28) >> 7);  in x25519_sc_reduce()  local
1108   s11 += s23 * 666643;  in x25519_sc_reduce()
1117   s11 += s22 * 470296;  in x25519_sc_reduce()
1126   s11 += s21 * 654183;  in x25519_sc_reduce()
1135   s11 -= s20 * 997805;  in x25519_sc_reduce()
1144   s11 += s19 * 136657;  in x25519_sc_reduce()
1153   s11 -= s18 * 683901;  in x25519_sc_reduce()
1163   s11 += carry10;  in x25519_sc_reduce()
1181   carry11 = (s11 + (1 << 20)) >> 21;  in x25519_sc_reduce()
1183   s11 -= int64_lshift21(carry11);  in x25519_sc_reduce()
1255   s11 += carry10;  in x25519_sc_reduce()
1273   carry11 = (s11 + (1 << 20)) >> 21;  in x25519_sc_reduce()
1275   s11 -= int64_lshift21(carry11);  in x25519_sc_reduce()
1316   s11 += carry10;  in x25519_sc_reduce()
1318   carry11 = s11 >> 21;  in x25519_sc_reduce()
1320   s11 -= int64_lshift21(carry11);  in x25519_sc_reduce()
1361   s11 += carry10;  in x25519_sc_reduce()
1392   s[28] = (s10 >> 14) | (s11 << 7);  in x25519_sc_reduce()
1393   s[29] = s11 >> 1;  in x25519_sc_reduce()
1394   s[30] = s11 >> 9;  in x25519_sc_reduce()
1395   s[31] = s11 >> 17;  in x25519_sc_reduce()
1455   int64_t s11;  in sc_muladd()  local
1507   s11 = c11 + a0 * b11 + a1 * b10 + a2 * b9 + a3 * b8 + a4 * b7 + a5 * b6 +  in sc_muladd()
1542   s11 += carry10;  in sc_muladd()
1578   carry11 = (s11 + (1 << 20)) >> 21;  in sc_muladd()
1580   s11 -= int64_lshift21(carry11);  in sc_muladd()
1597   s11 += s23 * 666643;  in sc_muladd()
1606   s11 += s22 * 470296;  in sc_muladd()
1615   s11 += s21 * 654183;  in sc_muladd()
1624   s11 -= s20 * 997805;  in sc_muladd()
1633   s11 += s19 * 136657;  in sc_muladd()
1642   s11 -= s18 * 683901;  in sc_muladd()
1652   s11 += carry10;  in sc_muladd()
1670   carry11 = (s11 + (1 << 20)) >> 21;  in sc_muladd()
1672   s11 -= int64_lshift21(carry11);  in sc_muladd()
1744   s11 += carry10;  in sc_muladd()
1762   carry11 = (s11 + (1 << 20)) >> 21;  in sc_muladd()
1764   s11 -= int64_lshift21(carry11);  in sc_muladd()
1805   s11 += carry10;  in sc_muladd()
1807   carry11 = s11 >> 21;  in sc_muladd()
1809   s11 -= int64_lshift21(carry11);  in sc_muladd()
1850   s11 += carry10;  in sc_muladd()
1881   s[28] = (s10 >> 14) | (s11 << 7);  in sc_muladd()
1882   s[29] = s11 >> 1;  in sc_muladd()
1883   s[30] = s11 >> 9;  in sc_muladd()
1884   s[31] = s11 >> 17;  in sc_muladd()