92 	w = m & (a[4] ^ b[4]); a[4] ^= w; b[4] ^= w;  in f255_cswap()
105 	d[4] = a[4] + b[4];  in f255_add()
143 	d[4] = ((uint64_t)1 << 61) + a[4] - b[4] - cc;  in f255_sub()
150 	d[0] += 19 * (d[4] >> 51);  in f255_sub()
151 	d[4] &= MASK51;  in f255_sub()
200 	 * sum will be at most 5*(2^57-1) + 4*(2^51-1) (for t[5]),  in f255_mul()
213 	UMUL51(t[4], lo, a[3], b[0]); t[3] += lo;  in f255_mul()
214 	UMUL51(hi, lo, a[2], b[1]); t[3] += lo; t[4] += hi;  in f255_mul()
215 	UMUL51(hi, lo, a[1], b[2]); t[3] += lo; t[4] += hi;  in f255_mul()
216 	UMUL51(hi, lo, a[0], b[3]); t[3] += lo; t[4] += hi;  in f255_mul()
218 	UMUL51(t[5], lo, a[4], b[0]); t[4] += lo;  in f255_mul()
219 	UMUL51(hi, lo, a[3], b[1]); t[4] += lo; t[5] += hi;  in f255_mul()
220 	UMUL51(hi, lo, a[2], b[2]); t[4] += lo; t[5] += hi;  in f255_mul()
221 	UMUL51(hi, lo, a[1], b[3]); t[4] += lo; t[5] += hi;  in f255_mul()
222 	UMUL51(hi, lo, a[0], b[4]); t[4] += lo; t[5] += hi;  in f255_mul()
224 	UMUL51(t[6], lo, a[4], b[1]); t[5] += lo;  in f255_mul()
227 	UMUL51(hi, lo, a[1], b[4]); t[5] += lo; t[6] += hi;  in f255_mul()
229 	UMUL51(t[7], lo, a[4], b[2]); t[6] += lo;  in f255_mul()
231 	UMUL51(hi, lo, a[2], b[4]); t[6] += lo; t[7] += hi;  in f255_mul()
233 	UMUL51(t[8], lo, a[4], b[3]); t[7] += lo;  in f255_mul()
234 	UMUL51(hi, lo, a[3], b[4]); t[7] += lo; t[8] += hi;  in f255_mul()
236 	UMUL51(t[9], lo, a[4], b[4]); t[8] += lo;  in f255_mul()
251 	t[4] += 19 * t[9];  in f255_mul()
268 	w = t[4] + cc;  in f255_mul()
269 	d[4] = w & MASK51;  in f255_mul()
305 	w = a[4] * 15 + cc;  in f255_mul_a24()
306 	t[4] = w & MASK51;  in f255_mul_a24()
326 	w = t[4] * 8111 + cc;  in f255_mul_a24()
327 	d[4] = w & MASK51;  in f255_mul_a24()
359 	w = a[4] + cc;  in f255_final_reduce()
360 	t[4] = w & MASK51;  in f255_final_reduce()
372 	a[4] ^= cc & (a[4] ^ t[4]);  in f255_final_reduce()
380 	uint64_t x1[5], x2[5], z2[5], x3[5], z3[5];  in api_mul()  local
397 	 * x1[4] clears that bit.  in api_mul()
403 	x1[4] = (br_dec64le(&G[24]) >> 12) & MASK51;  in api_mul()
410 	memset(x2, 0, sizeof x2);  in api_mul()
411 	x2[0] = 1;  in api_mul()
414 	memcpy(z3, x2, sizeof x2);  in api_mul()
435 		f255_cswap(x2, x3, swap);  in api_mul()
451 		f255_add(a, x2, z2);  in api_mul()
457 		f255_sub(b, x2, z2);  in api_mul()
487 		f255_mul(x2, aa, bb);  in api_mul()
495 	f255_cswap(x2, x3, swap);  in api_mul()
524 	 * Compute x2/z2. We have 1/z2 in x3.  in api_mul()
526 	f255_mul(x2, x2, x3);  in api_mul()
527 	f255_final_reduce(x2);  in api_mul()
530 	 * Encode the final x2 value in little-endian. We first assemble  in api_mul()
533 	x2[0] |= x2[1] << 51;  in api_mul()
534 	x2[1] = (x2[1] >> 13) | (x2[2] << 38);  in api_mul()
535 	x2[2] = (x2[2] >> 26) | (x2[3] << 25);  in api_mul()
536 	x2[3] = (x2[3] >> 39) | (x2[4] << 12);  in api_mul()
537 	br_enc64le(G, x2[0]);  in api_mul()
538 	br_enc64le(G + 8, x2[1]);  in api_mul()
539 	br_enc64le(G + 16, x2[2]);  in api_mul()
540 	br_enc64le(G + 24, x2[3]);  in api_mul()