53 		j = 30 * (int)u;
57 			j -= k;
61 			tmp[39 - k - j] |= (unsigned char)w;
74  * that right-shifting a signed negative integer copies the sign bit
75  * (arithmetic right-shift). This is "implementation-defined behaviour",
84                     | ((-((uint32_t)(x) >> 31)) << (32 - (n))))
90  * Convert an integer from unsigned little-endian encoding to a sequence of
91  * 30-bit words in little-endian order. The final "partial" word is
102 	while (len -- > 0) {  in le8_to_le30()
111 			acc = b >> (30 - acc_len);  in le8_to_le30()
112 			acc_len -= 22;  in le8_to_le30()
119  * Convert an integer (30-bit words, little-endian) to unsigned
120  * little-endian encoding. The total encoding length is provided; all
131 	while (len -- > 0) {  in le30_to_le8()
137 			acc = w >> (8 - acc_len);  in le30_to_le8()
142 			acc_len -= 8;  in le30_to_le8()
149  * nine 30-bit words, for values up to 2^270-1. Result is encoded over
150  * 18 words of 30 bits each.
159 	 *   10376293531797946367 = 9 * (2^30-1)^2 + 9663676406  in mul9()
160 	 *   10376293531797946367 < 9663676407 * 2^30  in mul9()
162 	 * Thus, adding together 9 products of 30-bit integers, with  in mul9()
261 		cc = w >> 30;  in mul9()
267  * Square a 270-bit integer, represented as an array of nine 30-bit words.
268  * Result uses 18 words of 30 bits each.
332 		cc = w >> 30;  in square9()
357 		cc = w >> 30;  in reduce_final_f255()
367  * Perform a multiplication of two integers modulo 2^255-19.
368  * Operands are arrays of 9 words, each containing 30 bits of data, in
369  * little-endian order. Input value may be up to 2^256-1; on output, value
379 	 * Compute raw multiplication. All result words fit in 30 bits  in f255_mul()
381 	 * of two 256-bit integers must fit on 512 bits.  in f255_mul()
387 	 * Since the modulus is 2^255-19 and word 9 corresponds to  in f255_mul()
388 	 * offset 9*30 = 270, word 9+k must be added to word k with  in f255_mul()
392 	 * Keeping the carry on 32 bits helps with 32-bit architectures,  in f255_mul()
393 	 * and does not noticeably impact performance on 64-bit systems.  in f255_mul()
395 	cc = MUL15(t[8] >> 15, 19);  /* at most 19*(2^15-1) = 622573 */  in f255_mul()
402 		cc = (uint32_t)(w >> 30);  /* at most 622592 */  in f255_mul()
406 	 * Original product was up to (2^256-1)^2, i.e. a 512-bit integer.  in f255_mul()
420 		cc = z >> 30;  in f255_mul()
430  * Perform a squaring of an integer modulo 2^255-19.
431  * Operands are arrays of 9 words, each containing 30 bits of data, in
432  * little-endian order. Input value may be up to 2^256-1; on output, value
442 	 * Compute raw squaring. All result words fit in 30 bits  in f255_square()
444 	 * of a 256-bit integers must fit on 512 bits.  in f255_square()
459 		cc = (uint32_t)(w >> 30);  in f255_square()
468 		cc = z >> 30;  in f255_square()
480 	 * Since operand words fit on 30 bits, we can use 32-bit  in f255_add()
490 		cc = w >> 30;  in f255_add()
497 		cc = w >> 30;  in f255_add()
509 	 * We actually compute a - b + 2*p, so that the final value is  in f255_sub()
515 	cc = (uint32_t)-38;  in f255_sub()
517 		w = a[i] - b[i] + cc;  in f255_sub()
519 		cc = ARSH(w, 30);  in f255_sub()
526 		cc = w >> 30;  in f255_sub()
551 		cc = (uint32_t)(w >> 30);  in f255_mul_a24()
562 		cc = z >> 30;  in f255_mul_a24()
609 	ctl = -ctl;  in cswap()
637 	 * RFC 7748 mandates that the high bit of the last point byte must  in api_mul()
657 	memset(k, 0, (sizeof k) - kblen);  in api_mul()
658 	memcpy(k + (sizeof k) - kblen, kb, kblen);  in api_mul()
668 	for (i = 254; i >= 0; i --) {  in api_mul()
671 		kt = (k[31 - (i >> 3)] >> (i & 7)) & 1;  in api_mul()
728 	 * square-and-multiply algorithm; we mutualise most non-squarings  in api_mul()
745 	for (i = 14; i >= 0; i --) {  in api_mul()