1075   int64_t s9 = 2097151 & (load_4(s + 23) >> 5);  in x25519_sc_reduce()  local
1124   s9 += s21 * 666643;  in x25519_sc_reduce()
1133   s9 += s20 * 470296;  in x25519_sc_reduce()
1142   s9 += s19 * 654183;  in x25519_sc_reduce()
1151   s9 -= s18 * 997805;  in x25519_sc_reduce()
1160   s9 += carry8;  in x25519_sc_reduce()
1178   carry9 = (s9 + (1 << 20)) >> 21;  in x25519_sc_reduce()
1180   s9 -= int64_lshift21(carry9);  in x25519_sc_reduce()
1195   s9 += s17 * 136657;  in x25519_sc_reduce()
1204   s9 -= s16 * 683901;  in x25519_sc_reduce()
1252   s9 += carry8;  in x25519_sc_reduce()
1270   carry9 = (s9 + (1 << 20)) >> 21;  in x25519_sc_reduce()
1272   s9 -= int64_lshift21(carry9);  in x25519_sc_reduce()
1310   s9 += carry8;  in x25519_sc_reduce()
1312   carry9 = s9 >> 21;  in x25519_sc_reduce()
1314   s9 -= int64_lshift21(carry9);  in x25519_sc_reduce()
1355   s9 += carry8;  in x25519_sc_reduce()
1357   carry9 = s9 >> 21;  in x25519_sc_reduce()
1359   s9 -= int64_lshift21(carry9);  in x25519_sc_reduce()
1387   s[23] = (s8 >> 16) | (s9 << 5);  in x25519_sc_reduce()
1388   s[24] = s9 >> 3;  in x25519_sc_reduce()
1389   s[25] = s9 >> 11;  in x25519_sc_reduce()
1390   s[26] = (s9 >> 19) | (s10 << 2);  in x25519_sc_reduce()
1453   int64_t s9;  in sc_muladd()  local
1503   s9 = c9 + a0 * b9 + a1 * b8 + a2 * b7 + a3 * b6 + a4 * b5 + a5 * b4 +  in sc_muladd()
1539   s9 += carry8;  in sc_muladd()
1575   carry9 = (s9 + (1 << 20)) >> 21;  in sc_muladd()
1577   s9 -= int64_lshift21(carry9);  in sc_muladd()
1613   s9 += s21 * 666643;  in sc_muladd()
1622   s9 += s20 * 470296;  in sc_muladd()
1631   s9 += s19 * 654183;  in sc_muladd()
1640   s9 -= s18 * 997805;  in sc_muladd()
1649   s9 += carry8;  in sc_muladd()
1667   carry9 = (s9 + (1 << 20)) >> 21;  in sc_muladd()
1669   s9 -= int64_lshift21(carry9);  in sc_muladd()
1684   s9 += s17 * 136657;  in sc_muladd()
1693   s9 -= s16 * 683901;  in sc_muladd()
1741   s9 += carry8;  in sc_muladd()
1759   carry9 = (s9 + (1 << 20)) >> 21;  in sc_muladd()
1761   s9 -= int64_lshift21(carry9);  in sc_muladd()
1799   s9 += carry8;  in sc_muladd()
1801   carry9 = s9 >> 21;  in sc_muladd()
1803   s9 -= int64_lshift21(carry9);  in sc_muladd()
1844   s9 += carry8;  in sc_muladd()
1846   carry9 = s9 >> 21;  in sc_muladd()
1848   s9 -= int64_lshift21(carry9);  in sc_muladd()
1876   s[23] = (s8 >> 16) | (s9 << 5);  in sc_muladd()
1877   s[24] = s9 >> 3;  in sc_muladd()
1878   s[25] = s9 >> 11;  in sc_muladd()
1879   s[26] = (s9 >> 19) | (s10 << 2);  in sc_muladd()