1078   int64_t s12 = 2097151 & (load_4(s + 31) >> 4);  in x25519_sc_reduce()  local
1109   s12 += s23 * 470296;  in x25519_sc_reduce()
1118   s12 += s22 * 654183;  in x25519_sc_reduce()
1127   s12 -= s21 * 997805;  in x25519_sc_reduce()
1136   s12 += s20 * 136657;  in x25519_sc_reduce()
1145   s12 -= s19 * 683901;  in x25519_sc_reduce()
1165   carry12 = (s12 + (1 << 20)) >> 21;  in x25519_sc_reduce()
1167   s12 -= int64_lshift21(carry12);  in x25519_sc_reduce()
1182   s12 += carry11;  in x25519_sc_reduce()
1231   s0 += s12 * 666643;  in x25519_sc_reduce()
1232   s1 += s12 * 470296;  in x25519_sc_reduce()
1233   s2 += s12 * 654183;  in x25519_sc_reduce()
1234   s3 -= s12 * 997805;  in x25519_sc_reduce()
1235   s4 += s12 * 136657;  in x25519_sc_reduce()
1236   s5 -= s12 * 683901;  in x25519_sc_reduce()
1237   s12 = 0;  in x25519_sc_reduce()
1274   s12 += carry11;  in x25519_sc_reduce()
1277   s0 += s12 * 666643;  in x25519_sc_reduce()
1278   s1 += s12 * 470296;  in x25519_sc_reduce()
1279   s2 += s12 * 654183;  in x25519_sc_reduce()
1280   s3 -= s12 * 997805;  in x25519_sc_reduce()
1281   s4 += s12 * 136657;  in x25519_sc_reduce()
1282   s5 -= s12 * 683901;  in x25519_sc_reduce()
1283   s12 = 0;  in x25519_sc_reduce()
1319   s12 += carry11;  in x25519_sc_reduce()
1322   s0 += s12 * 666643;  in x25519_sc_reduce()
1323   s1 += s12 * 470296;  in x25519_sc_reduce()
1324   s2 += s12 * 654183;  in x25519_sc_reduce()
1325   s3 -= s12 * 997805;  in x25519_sc_reduce()
1326   s4 += s12 * 136657;  in x25519_sc_reduce()
1327   s5 -= s12 * 683901;  in x25519_sc_reduce()
1328   s12 = 0;  in x25519_sc_reduce()
1456   int64_t s12;  in sc_muladd()  local
1509   s12 = a1 * b11 + a2 * b10 + a3 * b9 + a4 * b8 + a5 * b7 + a6 * b6 + a7 * b5 +  in sc_muladd()
1544   carry12 = (s12 + (1 << 20)) >> 21;  in sc_muladd()
1546   s12 -= int64_lshift21(carry12);  in sc_muladd()
1579   s12 += carry11;  in sc_muladd()
1598   s12 += s23 * 470296;  in sc_muladd()
1607   s12 += s22 * 654183;  in sc_muladd()
1616   s12 -= s21 * 997805;  in sc_muladd()
1625   s12 += s20 * 136657;  in sc_muladd()
1634   s12 -= s19 * 683901;  in sc_muladd()
1654   carry12 = (s12 + (1 << 20)) >> 21;  in sc_muladd()
1656   s12 -= int64_lshift21(carry12);  in sc_muladd()
1671   s12 += carry11;  in sc_muladd()
1720   s0 += s12 * 666643;  in sc_muladd()
1721   s1 += s12 * 470296;  in sc_muladd()
1722   s2 += s12 * 654183;  in sc_muladd()
1723   s3 -= s12 * 997805;  in sc_muladd()
1724   s4 += s12 * 136657;  in sc_muladd()
1725   s5 -= s12 * 683901;  in sc_muladd()
1726   s12 = 0;  in sc_muladd()
1763   s12 += carry11;  in sc_muladd()
1766   s0 += s12 * 666643;  in sc_muladd()
1767   s1 += s12 * 470296;  in sc_muladd()
1768   s2 += s12 * 654183;  in sc_muladd()
1769   s3 -= s12 * 997805;  in sc_muladd()
1770   s4 += s12 * 136657;  in sc_muladd()
1771   s5 -= s12 * 683901;  in sc_muladd()
1772   s12 = 0;  in sc_muladd()
1808   s12 += carry11;  in sc_muladd()
1811   s0 += s12 * 666643;  in sc_muladd()
1812   s1 += s12 * 470296;  in sc_muladd()
1813   s2 += s12 * 654183;  in sc_muladd()
1814   s3 -= s12 * 997805;  in sc_muladd()
1815   s4 += s12 * 136657;  in sc_muladd()
1816   s5 -= s12 * 683901;  in sc_muladd()
1817   s12 = 0;  in sc_muladd()