72  * A field element is encoded as five 64-bit integers, in basis 2^51.
73  * Limbs may be occasionally larger than 2^51, to save on carry
77 #define MASK51   (((uint64_t)1 << 51) - (uint64_t)1)
112  * limbs will fit on 51 bits, except the low limb, which may have
113  * value up to 2^51+19455.
133 	cc = -(w >> 51) & 0x3FF;  in f255_sub()
136 	cc = -(w >> 51) & 0x3FF;  in f255_sub()
139 	cc = -(w >> 51) & 0x3FF;  in f255_sub()
142 	cc = -(w >> 51) & 0x3FF;  in f255_sub()
150 	d[0] += 19 * (d[4] >> 51);  in f255_sub()
157  *   hi = floor((x * y) / (2^51))
158  *   lo = x * y mod 2^51
160  * Note that lo < 2^51, but "hi" may be larger, if the input operands are
168 		(hi) = (uint64_t)(umul_tmp >> 51); \
177 		(hi) = (umul_hi << 13) | (umul_lo >> 51); \
186  * On output, limb 0 is at most 2^51 + 155647, and other limbs fit
187  * on 51 bits each.
200 	 * sum will be at most 5*(2^57-1) + 4*(2^51-1) (for t[5]),  in f255_mul()
201 	 * i.e. less than 324*2^51.  in f255_mul()
242 	 * Since each t[i] is less than 324*2^51, the additions below  in f255_mul()
243 	 * will yield less than 6480*2^51 in each limb; this fits in  in f255_mul()
244 	 * 64 bits (6480*2^51 < 8192*2^51 = 2^64), hence there is  in f255_mul()
258 	cc = w >> 51;  in f255_mul()
261 	cc = w >> 51;  in f255_mul()
264 	cc = w >> 51;  in f255_mul()
267 	cc = w >> 51;  in f255_mul()
270 	cc = w >> 51;  in f255_mul()
295 	cc = w >> 51;  in f255_mul_a24()
298 	cc = w >> 51;  in f255_mul_a24()
301 	cc = w >> 51;  in f255_mul_a24()
304 	cc = w >> 51;  in f255_mul_a24()
307 	t[0] += 19 * (w >> 51);  in f255_mul_a24()
311 	 * t[0] is less than 2^51 + 19*8192, and other limbs are less  in f255_mul_a24()
312 	 * than 2^51; thus, there will be no overflow.  in f255_mul_a24()
316 	cc = w >> 51;  in f255_mul_a24()
319 	cc = w >> 51;  in f255_mul_a24()
322 	cc = w >> 51;  in f255_mul_a24()
325 	cc = w >> 51;  in f255_mul_a24()
328 	d[0] += 19 * (w >> 51);  in f255_mul_a24()
333  * On input, limbs must fit on 51 bits, except possibly the low limb,
334  * which may be slightly above 2^51.
349 	cc = w >> 51;  in f255_final_reduce()
352 	cc = w >> 51;  in f255_final_reduce()
355 	cc = w >> 51;  in f255_final_reduce()
358 	cc = w >> 51;  in f255_final_reduce()
361 	cc = w >> 51;  in f255_final_reduce()
533 	x2[0] |= x2[1] << 51;  in api_mul()