263 	uint64_t x, f, t0, t1, t2, t3, t4;  in f256_montymul()  local
288 	t2 = (uint64_t)z;  in f256_montymul()
291 	z = (unsigned __int128)t2 + (uint64_t)ff;  in f256_montymul()
292 	t2 = (uint64_t)z;  in f256_montymul()
308 		z = (unsigned __int128)b[2] * x + t2 + (z >> 64);  in f256_montymul()
311 		t2 = (uint64_t)z;  in f256_montymul()
325 		z = (z >> 64) + (unsigned __int128)t2 + (uint64_t)ff;  in f256_montymul()
326 		t2 = (uint64_t)z;  in f256_montymul()
354 	z = (unsigned __int128)t2 - (z >> 127);  in f256_montymul()
355 	t2 = (uint64_t)z;  in f256_montymul()
360 	d[2] = t2;  in f256_montymul()
365 	uint64_t x, f, t0, t1, t2, t3, t4;  in f256_montymul()
403 	t2 = zh;  in f256_montymul()
406 	k = _addcarry_u64(0, zl, t2, &zl);  in f256_montymul()
410 	t2 = zl;  in f256_montymul()
414 	k = _subborrow_u64(0, t2, f << 32, &t2);  in f256_montymul()
439 		k = _addcarry_u64(0, zl, t2, &t1);  in f256_montymul()
440 		(void)_addcarry_u64(k, zh, 0, &t2);  in f256_montymul()
443 		k = _addcarry_u64(0, zl, t2, &zl);  in f256_montymul()
445 		k = _addcarry_u64(0, zl, t3, &t2);  in f256_montymul()
457 		k = _addcarry_u64(k, t2, ffl, &t2);  in f256_montymul()
482 	k = _addcarry_u64(k, t2, -t4, &t2);  in f256_montymul()
487 	d[2] = t2;  in f256_montymul()
600 	uint64_t t0, t1, t2, t3, cc;  in f256_final_reduce()  local
613 	t2 = (uint64_t)z;  in f256_final_reduce()
620 	a[2] ^= cc & (a[2] ^ t2);  in f256_final_reduce()
625 	uint64_t t0, t1, t2, t3, m;  in f256_final_reduce()
630 	k = _addcarry_u64(k, a[2], -(uint64_t)1, &t2);  in f256_final_reduce()
636 	a[2] ^= m & (a[2] ^ t2);  in f256_final_reduce()
735 	uint64_t t1[4], t2[4], z;  in point_encode()  local
738 	f256_invert(t2, P->z);  in point_encode()
739 	f256_montysquare(t1, t2);  in point_encode()
740 	f256_montymul(t2, t2, t1);  in point_encode()
744 	f256_montymul(t2, P->y, t2);  in point_encode()
749 	f256_frommonty(t2, t2);  in point_encode()
751 	f256_final_reduce(t2);  in point_encode()
759 	br_enc64be(buf + 33, t2[3]);  in point_encode()
760 	br_enc64be(buf + 41, t2[2]);  in point_encode()
761 	br_enc64be(buf + 49, t2[1]);  in point_encode()
762 	br_enc64be(buf + 57, t2[0]);  in point_encode()
798 	uint64_t t1[4], t2[4], t3[4], t4[4];  in p256_double()  local
808 	f256_add(t2, P->x, t1);  in p256_double()
814 	f256_montymul(t3, t1, t2);  in p256_double()
823 	f256_montymul(t2, P->x, t3);  in p256_double()
824 	f256_add(t2, t2, t2);  in p256_double()
830 	f256_sub(P->x, P->x, t2);  in p256_double()
831 	f256_sub(P->x, P->x, t2);  in p256_double()
843 	f256_sub(t2, t2, P->x);  in p256_double()
844 	f256_montymul(P->y, t1, t2);  in p256_double()
899 	uint64_t t1[4], t2[4], t3[4], t4[4], t5[4], t6[4], t7[4], tt;  in p256_add()  local
914 	f256_montymul(t2, P2->x, t4);  in p256_add()
923 	f256_sub(t2, t2, t1);  in p256_add()
933 	f256_montysquare(t7, t2);  in p256_add()
935 	f256_montymul(t5, t7, t2);  in p256_add()
957 	f256_montymul(P1->z, t1, t2);  in p256_add()
1011 	uint64_t t1[4], t2[4], t3[4], t4[4], t5[4], t6[4], t7[4], tt;  in p256_add_mixed()  local
1024 	f256_montymul(t2, P2->x, t4);  in p256_add_mixed()
1033 	f256_sub(t2, t2, t1);  in p256_add_mixed()
1043 	f256_montysquare(t7, t2);  in p256_add_mixed()
1045 	f256_montymul(t5, t7, t2);  in p256_add_mixed()
1066 	f256_montymul(P1->z, P1->z, t2);  in p256_add_mixed()
1128 	uint64_t t1[4], t2[4], t3[4], t4[4], t5[4], t6[4], t7[4], tt, zz;
1147 	f256_montymul(t2, P2->x, t4);
1155 	f256_sub(t2, t2, t1);
1162 	f256_final_reduce(t2);
1164 	tt = t2[0] | t2[1] | t2[2] | t2[3] | t4[0] | t4[1] | t4[2] | t4[3];
1170 	f256_montysquare(t7, t2);
1172 	f256_montymul(t5, t7, t2);
1193 	f256_montymul(P1->z, P1->z, t2);
1207 	f256_montysquare(t2, P2->y);
1208 	f256_add(t2, t2, t2);
1209 	f256_add(t3, t2, t2);
1232 	f256_montysquare(t7, t2);