815     int64_t carry2;  in fe_frombytes()  local
831     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_frombytes()
1193     int64_t carry2;  in fe_mul()  local
1221     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_mul()
1367     int64_t carry2;  in fe_sq()  local
1382     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_sq()
1676     int64_t carry2;  in fe_sq2()  local
1702     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_sq2()
4344     int64_t carry2;  in fe_mul121666()  local
4360     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_mul121666()
4653     int64_t carry2;  in x25519_sc_reduce()  local
4803     carry2 = (s2 + (1 << 20)) >> 21;  in x25519_sc_reduce()
4804     s3  += carry2;  in x25519_sc_reduce()
4805     s2  -= carry2 * (1 << 21);  in x25519_sc_reduce()
4852     carry2 = s2 >> 21;  in x25519_sc_reduce()
4853     s3  += carry2;  in x25519_sc_reduce()
4854     s2  -= carry2 * (1 << 21);  in x25519_sc_reduce()
4897     carry2 = s2 >> 21;  in x25519_sc_reduce()
4898     s3  += carry2;  in x25519_sc_reduce()
4899     s2  -= carry2 * (1 << 21);  in x25519_sc_reduce()
5034     int64_t carry2;  in sc_muladd()  local
5084     carry2 = (s2 + (1 << 20)) >> 21;  in sc_muladd()
5085     s3  += carry2;  in sc_muladd()
5086     s2  -= carry2 * (1 << 21);  in sc_muladd()
5286     carry2 = (s2 + (1 << 20)) >> 21;  in sc_muladd()
5287     s3  += carry2;  in sc_muladd()
5288     s2  -= carry2 * (1 << 21);  in sc_muladd()
5335     carry2 = s2 >> 21;  in sc_muladd()
5336     s3  += carry2;  in sc_muladd()
5337     s2  -= carry2 * (1 << 21);  in sc_muladd()
5380     carry2 = s2 >> 21;  in sc_muladd()
5381     s3  += carry2;  in sc_muladd()
5382     s2  -= carry2 * (1 << 21);  in sc_muladd()