817     int64_t carry4;  in fe_frombytes()  local
832     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_frombytes()
1195     int64_t carry4;  in fe_mul()  local
1208     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_mul()
1235     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_mul()
1369     int64_t carry4;  in fe_sq()  local
1377     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_sq()
1388     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_sq()
1678     int64_t carry4;  in fe_sq2()  local
1697     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_sq2()
1708     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_sq2()
4346     int64_t carry4;  in fe_mul121666()  local
4361     carry4 = h4 + (1 << 25); h5 += carry4 >> 26; h4 -= carry4 & kTop38Bits;  in fe_mul121666()
4655     int64_t carry4;  in x25519_sc_reduce()  local
4806     carry4 = (s4 + (1 << 20)) >> 21;  in x25519_sc_reduce()
4807     s5  += carry4;  in x25519_sc_reduce()
4808     s4  -= carry4 * (1 << 21);  in x25519_sc_reduce()
4858     carry4 = s4 >> 21;  in x25519_sc_reduce()
4859     s5  += carry4;  in x25519_sc_reduce()
4860     s4  -= carry4 * (1 << 21);  in x25519_sc_reduce()
4903     carry4 = s4 >> 21;  in x25519_sc_reduce()
4904     s5  += carry4;  in x25519_sc_reduce()
4905     s4  -= carry4 * (1 << 21);  in x25519_sc_reduce()
5036     int64_t carry4;  in sc_muladd()  local
5087     carry4 = (s4 + (1 << 20)) >> 21;  in sc_muladd()
5088     s5  += carry4;  in sc_muladd()
5089     s4  -= carry4 * (1 << 21);  in sc_muladd()
5289     carry4 = (s4 + (1 << 20)) >> 21;  in sc_muladd()
5290     s5  += carry4;  in sc_muladd()
5291     s4  -= carry4 * (1 << 21);  in sc_muladd()
5341     carry4 = s4 >> 21;  in sc_muladd()
5342     s5  += carry4;  in sc_muladd()
5343     s4  -= carry4 * (1 << 21);  in sc_muladd()
5386     carry4 = s4 >> 21;  in sc_muladd()
5387     s5  += carry4;  in sc_muladd()
5388     s4  -= carry4 * (1 << 21);  in sc_muladd()