71   int64_t carry2;  in fe_frombytes()  local
87   carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_frombytes()
426   int64_t carry2;  in fe_mul()  local
454   carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_mul()
596   int64_t carry2;  in fe_sq()  local
611   carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_sq()
847   int64_t carry2;  in fe_sq2()  local
873   carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_sq2()
3819   int64_t carry2;  in x25519_sc_reduce()  local
3969   carry2 = (s2 + (1 << 20)) >> 21;  in x25519_sc_reduce()
3970   s3 += carry2;  in x25519_sc_reduce()
3971   s2 -= carry2 << 21;  in x25519_sc_reduce()
4018   carry2 = s2 >> 21;  in x25519_sc_reduce()
4019   s3 += carry2;  in x25519_sc_reduce()
4020   s2 -= carry2 << 21;  in x25519_sc_reduce()
4063   carry2 = s2 >> 21;  in x25519_sc_reduce()
4064   s3 += carry2;  in x25519_sc_reduce()
4065   s2 -= carry2 << 21;  in x25519_sc_reduce()
4197   int64_t carry2;  in sc_muladd()  local
4256   carry2 = (s2 + (1 << 20)) >> 21;  in sc_muladd()
4257   s3 += carry2;  in sc_muladd()
4258   s2 -= carry2 << 21;  in sc_muladd()
4458   carry2 = (s2 + (1 << 20)) >> 21;  in sc_muladd()
4459   s3 += carry2;  in sc_muladd()
4460   s2 -= carry2 << 21;  in sc_muladd()
4507   carry2 = s2 >> 21;  in sc_muladd()
4508   s3 += carry2;  in sc_muladd()
4509   s2 -= carry2 << 21;  in sc_muladd()
4552   carry2 = s2 >> 21;  in sc_muladd()
4553   s3 += carry2;  in sc_muladd()
4554   s2 -= carry2 << 21;  in sc_muladd()
4765   int64_t carry2;  in fe_mul121666()  local
4781   carry2 = h2 + (1 << 25); h3 += carry2 >> 26; h2 -= carry2 & kTop38Bits;  in fe_mul121666()