415   s[31] ^= fe_isnegative(&x) << 7;  in x25519_ge_tobytes()
437   fe_mul_ttt(&h->X, &h->X, &u);  // x = uv^7  in x25519_ge_frombytes_vartime()
439   fe_pow22523(&h->X, &h->X);  // x = (uv^7)^((q-5)/8)  in x25519_ge_frombytes_vartime()
441   fe_mul_ttt(&h->X, &h->X, &u);  // x = uv^3(uv^7)^((q-5)/8)  in x25519_ge_frombytes_vartime()
454   if (fe_isnegative(&h->X) != (s[31] >> 7)) {  in x25519_ge_frombytes_vartime()
602     r[i] = 1 & (a[i >> 3] >> (i & 7));  in slide()
638   ge_cached Ai[8];  // A,3A,5A,7A,9A,11A,13A,15A  in ge_double_scalarmult_vartime()
670   x25519_ge_p3_to_cached(&Ai[7], &u);  in ge_double_scalarmult_vartime()
723   int64_t s3 = 2097151 & (load_4(s + 7) >> 7);  in x25519_sc_reduce()
731   int64_t s11 = 2097151 & (load_4(s + 28) >> 7);  in x25519_sc_reduce()
739   int64_t s19 = 2097151 & (load_4(s + 49) >> 7);  in x25519_sc_reduce()
1025   s[7] = (s2 >> 14) | (s3 << 7);  in x25519_sc_reduce()
1032   s[14] = s5 >> 7;  in x25519_sc_reduce()
1046   s[28] = (s10 >> 14) | (s11 << 7);  in x25519_sc_reduce()
1076   // https://tools.ietf.org/html/rfc8032#section-5.1.7 requires that s be in  in ED25519_verify()
1163   uint64_t x3 = ((uint64_t)UINT32_C(0x1db42) * (arg1[7]));  in fiat_25519_carry_scmul_121666()
1215   out1[7] = x33;  in fiat_25519_carry_scmul_121666()
1270     unsigned b = 1 & (e[pos / 8] >> (pos & 7));  in x25519_scalar_mult_generic()