69   int64_t carry0;  in fe_frombytes()  local
86   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_frombytes()
424   int64_t carry0;  in fe_mul()  local
440   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_mul()
479   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_mul()
594   int64_t carry0;  in fe_sq()  local
605   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_sq()
622   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_sq()
845   int64_t carry0;  in fe_sq2()  local
867   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_sq2()
884   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_sq2()
3817   int64_t carry0;  in x25519_sc_reduce()  local
3966   carry0 = (s0 + (1 << 20)) >> 21;  in x25519_sc_reduce()
3967   s1 += carry0;  in x25519_sc_reduce()
3968   s0 -= carry0 << 21;  in x25519_sc_reduce()
4012   carry0 = s0 >> 21;  in x25519_sc_reduce()
4013   s1 += carry0;  in x25519_sc_reduce()
4014   s0 -= carry0 << 21;  in x25519_sc_reduce()
4057   carry0 = s0 >> 21;  in x25519_sc_reduce()
4058   s1 += carry0;  in x25519_sc_reduce()
4059   s0 -= carry0 << 21;  in x25519_sc_reduce()
4195   int64_t carry0;  in sc_muladd()  local
4253   carry0 = (s0 + (1 << 20)) >> 21;  in sc_muladd()
4254   s1 += carry0;  in sc_muladd()
4255   s0 -= carry0 << 21;  in sc_muladd()
4455   carry0 = (s0 + (1 << 20)) >> 21;  in sc_muladd()
4456   s1 += carry0;  in sc_muladd()
4457   s0 -= carry0 << 21;  in sc_muladd()
4501   carry0 = s0 >> 21;  in sc_muladd()
4502   s1 += carry0;  in sc_muladd()
4503   s0 -= carry0 << 21;  in sc_muladd()
4546   carry0 = s0 >> 21;  in sc_muladd()
4547   s1 += carry0;  in sc_muladd()
4548   s0 -= carry0 << 21;  in sc_muladd()
4763   int64_t carry0;  in fe_mul121666()  local
4780   carry0 = h0 + (1 << 25); h1 += carry0 >> 26; h0 -= carry0 & kTop38Bits;  in fe_mul121666()