248 /* Computes result = in << c, returning carry. Can modify in place
254 	u64 carry = 0;  in vli_lshift()  local
260 		result[i] = (temp << shift) | carry;  in vli_lshift()
261 		carry = temp >> (64 - shift);  in vli_lshift()
264 	return carry;  in vli_lshift()
271 	u64 carry = 0;  in vli_rshift1()  local
277 		*vli = (temp >> 1) | carry;  in vli_rshift1()
278 		carry = temp << 63;  in vli_rshift1()
282 /* Computes result = left + right, returning carry. Can modify in place. */
286 	u64 carry = 0;  in vli_add()  local
292 		sum = left[i] + right[i] + carry;  in vli_add()
294 			carry = (sum < left[i]);  in vli_add()
299 	return carry;  in vli_add()
302 /* Computes result = left + right, returning carry. Can modify in place. */
306 	u64 carry = right;  in vli_uadd()  local
312 		sum = left[i] + carry;  in vli_uadd()
314 			carry = (sum < left[i]);  in vli_uadd()
316 			carry = !!carry;  in vli_uadd()
321 	return carry;  in vli_uadd()
454 		/* no carry */  in vli_umult()
509 	u64 carry;  in vli_mod_add()  local
511 	carry = vli_add(result, left, right, ndigits);  in vli_mod_add()
516 	if (carry || vli_cmp(result, mod, ndigits) >= 0)  in vli_mod_add()
586 	int carry; /* last bit that doesn't fit into q */  in vli_mmod_special2()  local
593 	/* q and carry are top bits */  in vli_mmod_special2()
596 	carry = vli_is_negative(r, ndigits);  in vli_mmod_special2()
597 	if (carry)  in vli_mmod_special2()
599 	for (i = 1; carry || !vli_is_zero(q, ndigits); i++) {  in vli_mmod_special2()
603 		if (carry)  in vli_mmod_special2()
607 		carry = vli_is_negative(qc, ndigits);  in vli_mmod_special2()
608 		if (carry)  in vli_mmod_special2()
634 	u64 carry = 0;  in vli_mmod_slow()  local
644 			mod_m[word_shift + i] = (mod[i] << bit_shift) | carry;  in vli_mmod_slow()
645 			carry = mod[i] >> (64 - bit_shift);  in vli_mmod_slow()
692 		u64 carry;  in vli_mmod_barrett()  local
694 		carry = vli_sub(r, r, mod, ndigits);  in vli_mmod_barrett()
695 		vli_usub(r + ndigits, r + ndigits, carry, ndigits);  in vli_mmod_barrett()
708 	int carry;  in vli_mmod_fast_192()  local
713 	carry = vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_192()
718 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_192()
722 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_192()
724 	while (carry || vli_cmp(curve_prime, result, ndigits) != 1)  in vli_mmod_fast_192()
725 		carry -= vli_sub(result, result, curve_prime, ndigits);  in vli_mmod_fast_192()
734 	int carry;  in vli_mmod_fast_256()  local
745 	carry = vli_lshift(tmp, tmp, 1, ndigits);  in vli_mmod_fast_256()
746 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
752 	carry += vli_lshift(tmp, tmp, 1, ndigits);  in vli_mmod_fast_256()
753 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
760 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
767 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_256()
774 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
781 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
788 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
795 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_256()
797 	if (carry < 0) {  in vli_mmod_fast_256()
799 			carry += vli_add(result, result, curve_prime, ndigits);  in vli_mmod_fast_256()
800 		} while (carry < 0);  in vli_mmod_fast_256()
802 		while (carry || vli_cmp(curve_prime, result, ndigits) != 1)  in vli_mmod_fast_256()
803 			carry -= vli_sub(result, result, curve_prime, ndigits);  in vli_mmod_fast_256()
817 	int carry;  in vli_mmod_fast_384()  local
830 	carry = vli_lshift(tmp, tmp, 1, ndigits);  in vli_mmod_fast_384()
831 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
840 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
849 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
858 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
867 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
876 	carry += vli_add(result, result, tmp, ndigits);  in vli_mmod_fast_384()
885 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_384()
894 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_384()
903 	carry -= vli_sub(result, result, tmp, ndigits);  in vli_mmod_fast_384()
905 	if (carry < 0) {  in vli_mmod_fast_384()
907 			carry += vli_add(result, result, curve_prime, ndigits);  in vli_mmod_fast_384()
908 		} while (carry < 0);  in vli_mmod_fast_384()
910 		while (carry || vli_cmp(curve_prime, result, ndigits) != 1)  in vli_mmod_fast_384()
911 			carry -= vli_sub(result, result, curve_prime, ndigits);  in vli_mmod_fast_384()
1035 	u64 carry;  in vli_mod_inv()  local
1050 		carry = 0;  in vli_mod_inv()
1056 				carry = vli_add(u, u, mod, ndigits);  in vli_mod_inv()
1059 			if (carry)  in vli_mod_inv()
1065 				carry = vli_add(v, v, mod, ndigits);  in vli_mod_inv()
1068 			if (carry)  in vli_mod_inv()
1079 				carry = vli_add(u, u, mod, ndigits);  in vli_mod_inv()
1082 			if (carry)  in vli_mod_inv()
1093 				carry = vli_add(v, v, mod, ndigits);  in vli_mod_inv()
1096 			if (carry)  in vli_mod_inv()
1157 		u64 carry = vli_add(x1, x1, curve_prime, ndigits);  in ecc_point_double_jacobian()  local
1160 		x1[ndigits - 1] |= carry << 63;  in ecc_point_double_jacobian()
1333 	int carry;  in ecc_point_mult()  local
1335 	carry = vli_add(sk[0], scalar, curve->n, ndigits);  in ecc_point_mult()
1337 	scalar = sk[!carry];  in ecc_point_mult()