805     int64_t carry2;  in fe_frombytes()  local
821     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_frombytes()
1183     int64_t carry2;  in fe_mul()  local
1211     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_mul()
1357     int64_t carry2;  in fe_sq()  local
1372     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_sq()
1666     int64_t carry2;  in fe_sq2()  local
1692     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_sq2()
4334     int64_t carry2;  in fe_mul121666()  local
4350     carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_mul121666()
4643     int64_t carry2;  in x25519_sc_reduce()  local
4793     carry2 = (s2 + (1 << 20)) >> 21;  in x25519_sc_reduce()
4794     s3  += carry2;  in x25519_sc_reduce()
4795     s2  -= carry2 * (1 << 21);  in x25519_sc_reduce()
4842     carry2 = s2 >> 21;  in x25519_sc_reduce()
4843     s3  += carry2;  in x25519_sc_reduce()
4844     s2  -= carry2 * (1 << 21);  in x25519_sc_reduce()
4887     carry2 = s2 >> 21;  in x25519_sc_reduce()
4888     s3  += carry2;  in x25519_sc_reduce()
4889     s2  -= carry2 * (1 << 21);  in x25519_sc_reduce()
5024     int64_t carry2;  in sc_muladd()  local
5074     carry2 = (s2 + (1 << 20)) >> 21;  in sc_muladd()
5075     s3  += carry2;  in sc_muladd()
5076     s2  -= carry2 * (1 << 21);  in sc_muladd()
5276     carry2 = (s2 + (1 << 20)) >> 21;  in sc_muladd()
5277     s3  += carry2;  in sc_muladd()
5278     s2  -= carry2 * (1 << 21);  in sc_muladd()
5325     carry2 = s2 >> 21;  in sc_muladd()
5326     s3  += carry2;  in sc_muladd()
5327     s2  -= carry2 * (1 << 21);  in sc_muladd()
5370     carry2 = s2 >> 21;  in sc_muladd()
5371     s3  += carry2;  in sc_muladd()
5372     s2  -= carry2 * (1 << 21);  in sc_muladd()