86 		fmatt = (fma1lo >> 2) + (fma2lo >> 2) \
87 			+ ((v1) >> 2) + ((v2) >> 2); \
88 		(lo) = fmatt << 2; \
160 		size_t v;  in montymul()  local
165 		xu = x[u] << 2;  in montymul()
166 		f = MUL62_lo(d[0] + MUL62_lo(x[u], y[0]), m0i) << 2;  in montymul()
168 		FMA2(hi, lo, xu, y[0], f, m[0], d[0] << 2, 0);  in montymul()
171 		for (v = 1; v < num4; v += 4) {  in montymul()
172 			FMA2(hi, lo, xu, y[v + 0],  in montymul()
173 				f, m[v + 0], d[v + 0] << 2, r << 2);  in montymul()
175 			d[v - 1] = lo >> 2;  in montymul()
176 			FMA2(hi, lo, xu, y[v + 1],  in montymul()
177 				f, m[v + 1], d[v + 1] << 2, r << 2);  in montymul()
179 			d[v + 0] = lo >> 2;  in montymul()
180 			FMA2(hi, lo, xu, y[v + 2],  in montymul()
181 				f, m[v + 2], d[v + 2] << 2, r << 2);  in montymul()
183 			d[v + 1] = lo >> 2;  in montymul()
184 			FMA2(hi, lo, xu, y[v + 3],  in montymul()
185 				f, m[v + 3], d[v + 3] << 2, r << 2);  in montymul()
187 			d[v + 2] = lo >> 2;  in montymul()
189 		for (; v < num; v ++) {  in montymul()
190 			FMA2(hi, lo, xu, y[v], f, m[v], d[v] << 2, r << 2);  in montymul()
192 			d[v - 1] = lo >> 2;  in montymul()
208 	size_t u, v;  in frommonty()  local
213 		f = MUL62_lo(x[0], m0i) << 2;  in frommonty()
215 		for (v = 0; v < num; v ++) {  in frommonty()
218 			FMA1(hi, lo, f, m[v], x[v] << 2, cc);  in frommonty()
219 			cc = hi << 2;  in frommonty()
220 			if (v != 0) {  in frommonty()
221 				x[v - 1] = lo >> 2;  in frommonty()
224 		x[num - 1] = cc >> 2;  in frommonty()
253 	if (mw31num < 4 || (mw62num << 2) > twlen) {  in br_i62_modpow_opt()
273 	 * we replace x with x*2^z mod m, where z is the smallest multiple  in br_i62_modpow_opt()
274 	 * of the word size such that 2^z >= m. We want to reuse the 31-bit  in br_i62_modpow_opt()
295 	for (u = 0; u < mw31num; u += 2) {  in br_i62_modpow_opt()
296 		size_t v;  in br_i62_modpow_opt()  local
298 		v = u >> 1;  in br_i62_modpow_opt()
300 			m[v] = (uint64_t)m31[u + 1];  in br_i62_modpow_opt()
301 			x[v] = (uint64_t)x31[u + 1];  in br_i62_modpow_opt()
303 			m[v] = (uint64_t)m31[u + 1]  in br_i62_modpow_opt()
304 				+ ((uint64_t)m31[u + 2] << 31);  in br_i62_modpow_opt()
305 			x[v] = (uint64_t)x31[u + 1]  in br_i62_modpow_opt()
306 				+ ((uint64_t)x31[u + 2] << 31);  in br_i62_modpow_opt()
312 	 * window of size k bits, we need 2^k+1 temporaries (for k = 1,  in br_i62_modpow_opt()
313 	 * we use special code that uses only 2 temporaries).  in br_i62_modpow_opt()
325 	 * Compute m0i, which is equal to -(1/m0) mod 2^62. We were  in br_i62_modpow_opt()
327 	 * modulo 2^31; the single expression below is then sufficient.  in br_i62_modpow_opt()
330 	m0i = MUL62_lo(m0i, (uint64_t)2 + MUL62_lo(m0i, m[0]));  in br_i62_modpow_opt()
344 		for (u = 2; u < ((unsigned)1 << win_len); u ++) {  in br_i62_modpow_opt()
360 	for (u = 0; u < mw31num; u += 2) {  in br_i62_modpow_opt()
361 		size_t v;  in br_i62_modpow_opt()  local
363 		v = u >> 1;  in br_i62_modpow_opt()
365 			x[v] = (uint64_t)x31[u + 1];  in br_i62_modpow_opt()
367 			x[v] = (uint64_t)x31[u + 1]  in br_i62_modpow_opt()
368 				+ ((uint64_t)x31[u + 2] << 31);  in br_i62_modpow_opt()
420 				size_t v;  in br_i62_modpow_opt()  local
423 				for (v = 0; v < mw62num; v ++) {  in br_i62_modpow_opt()
424 					t2[v] |= mask & base[v];  in br_i62_modpow_opt()
450 	for (u = 0; u < mw31num; u += 2) {  in br_i62_modpow_opt()
456 			x31[u + 2] = (uint32_t)(zw >> 31);  in br_i62_modpow_opt()