github.com/consensys/gnark-crypto@v0.14.0/ecc/bw6-756/fp/element_ops_purego.go (about)

     1  //go:build !amd64 || purego
     2  // +build !amd64 purego
     3  
     4  // Copyright 2020 ConsenSys Software Inc.
     5  //
     6  // Licensed under the Apache License, Version 2.0 (the "License");
     7  // you may not use this file except in compliance with the License.
     8  // You may obtain a copy of the License at
     9  //
    10  //     http://www.apache.org/licenses/LICENSE-2.0
    11  //
    12  // Unless required by applicable law or agreed to in writing, software
    13  // distributed under the License is distributed on an "AS IS" BASIS,
    14  // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    15  // See the License for the specific language governing permissions and
    16  // limitations under the License.
    17  
    18  // Code generated by consensys/gnark-crypto DO NOT EDIT
    19  
    20  package fp
    21  
    22  import "math/bits"
    23  
    24  // MulBy3 x *= 3 (mod q)
    25  func MulBy3(x *Element) {
    26  	_x := *x
    27  	x.Double(x).Add(x, &_x)
    28  }
    29  
    30  // MulBy5 x *= 5 (mod q)
    31  func MulBy5(x *Element) {
    32  	_x := *x
    33  	x.Double(x).Double(x).Add(x, &_x)
    34  }
    35  
    36  // MulBy13 x *= 13 (mod q)
    37  func MulBy13(x *Element) {
    38  	var y = Element{
    39  		18446744073709496521,
    40  		18279598932724285439,
    41  		16020160894313802039,
    42  		6734264120679796183,
    43  		592370298347718455,
    44  		6302256704987790972,
    45  		3197310980453914279,
    46  		2651858637075104463,
    47  		8565083029697102127,
    48  		15288469570225946050,
    49  		14519635472382186671,
    50  		448955992735434,
    51  	}
    52  	x.Mul(x, &y)
    53  }
    54  
    55  // Butterfly sets
    56  //
    57  //	a = a + b (mod q)
    58  //	b = a - b (mod q)
    59  func Butterfly(a, b *Element) {
    60  	_butterflyGeneric(a, b)
    61  }
    62  
    63  func fromMont(z *Element) {
    64  	_fromMontGeneric(z)
    65  }
    66  
    67  func reduce(z *Element) {
    68  	_reduceGeneric(z)
    69  }
    70  
    71  // Mul z = x * y (mod q)
    72  //
    73  // x and y must be less than q
    74  func (z *Element) Mul(x, y *Element) *Element {
    75  
    76  	// Implements CIOS multiplication -- section 2.3.2 of Tolga Acar's thesis
    77  	// https://www.microsoft.com/en-us/research/wp-content/uploads/1998/06/97Acar.pdf
    78  	//
    79  	// The algorithm:
    80  	//
    81  	// for i=0 to N-1
    82  	// 		C := 0
    83  	// 		for j=0 to N-1
    84  	// 			(C,t[j]) := t[j] + x[j]*y[i] + C
    85  	// 		(t[N+1],t[N]) := t[N] + C
    86  	//
    87  	// 		C := 0
    88  	// 		m := t[0]*q'[0] mod D
    89  	// 		(C,_) := t[0] + m*q[0]
    90  	// 		for j=1 to N-1
    91  	// 			(C,t[j-1]) := t[j] + m*q[j] + C
    92  	//
    93  	// 		(C,t[N-1]) := t[N] + C
    94  	// 		t[N] := t[N+1] + C
    95  	//
    96  	// → N is the number of machine words needed to store the modulus q
    97  	// → D is the word size. For example, on a 64-bit architecture D is 2	64
    98  	// → x[i], y[i], q[i] is the ith word of the numbers x,y,q
    99  	// → q'[0] is the lowest word of the number -q⁻¹ mod r. This quantity is pre-computed, as it does not depend on the inputs.
   100  	// → t is a temporary array of size N+2
   101  	// → C, S are machine words. A pair (C,S) refers to (hi-bits, lo-bits) of a two-word number
   102  	//
   103  	// As described here https://hackmd.io/@gnark/modular_multiplication we can get rid of one carry chain and simplify:
   104  	// (also described in https://eprint.iacr.org/2022/1400.pdf annex)
   105  	//
   106  	// for i=0 to N-1
   107  	// 		(A,t[0]) := t[0] + x[0]*y[i]
   108  	// 		m := t[0]*q'[0] mod W
   109  	// 		C,_ := t[0] + m*q[0]
   110  	// 		for j=1 to N-1
   111  	// 			(A,t[j])  := t[j] + x[j]*y[i] + A
   112  	// 			(C,t[j-1]) := t[j] + m*q[j] + C
   113  	//
   114  	// 		t[N-1] = C + A
   115  	//
   116  	// This optimization saves 5N + 2 additions in the algorithm, and can be used whenever the highest bit
   117  	// of the modulus is zero (and not all of the remaining bits are set).
   118  
   119  	var t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11 uint64
   120  	var u0, u1, u2, u3, u4, u5, u6, u7, u8, u9, u10, u11 uint64
   121  	{
   122  		var c0, c1, c2 uint64
   123  		v := x[0]
   124  		u0, t0 = bits.Mul64(v, y[0])
   125  		u1, t1 = bits.Mul64(v, y[1])
   126  		u2, t2 = bits.Mul64(v, y[2])
   127  		u3, t3 = bits.Mul64(v, y[3])
   128  		u4, t4 = bits.Mul64(v, y[4])
   129  		u5, t5 = bits.Mul64(v, y[5])
   130  		u6, t6 = bits.Mul64(v, y[6])
   131  		u7, t7 = bits.Mul64(v, y[7])
   132  		u8, t8 = bits.Mul64(v, y[8])
   133  		u9, t9 = bits.Mul64(v, y[9])
   134  		u10, t10 = bits.Mul64(v, y[10])
   135  		u11, t11 = bits.Mul64(v, y[11])
   136  		t1, c0 = bits.Add64(u0, t1, 0)
   137  		t2, c0 = bits.Add64(u1, t2, c0)
   138  		t3, c0 = bits.Add64(u2, t3, c0)
   139  		t4, c0 = bits.Add64(u3, t4, c0)
   140  		t5, c0 = bits.Add64(u4, t5, c0)
   141  		t6, c0 = bits.Add64(u5, t6, c0)
   142  		t7, c0 = bits.Add64(u6, t7, c0)
   143  		t8, c0 = bits.Add64(u7, t8, c0)
   144  		t9, c0 = bits.Add64(u8, t9, c0)
   145  		t10, c0 = bits.Add64(u9, t10, c0)
   146  		t11, c0 = bits.Add64(u10, t11, c0)
   147  		c2, _ = bits.Add64(u11, 0, c0)
   148  
   149  		m := qInvNeg * t0
   150  
   151  		u0, c1 = bits.Mul64(m, q0)
   152  		_, c0 = bits.Add64(t0, c1, 0)
   153  		u1, c1 = bits.Mul64(m, q1)
   154  		t0, c0 = bits.Add64(t1, c1, c0)
   155  		u2, c1 = bits.Mul64(m, q2)
   156  		t1, c0 = bits.Add64(t2, c1, c0)
   157  		u3, c1 = bits.Mul64(m, q3)
   158  		t2, c0 = bits.Add64(t3, c1, c0)
   159  		u4, c1 = bits.Mul64(m, q4)
   160  		t3, c0 = bits.Add64(t4, c1, c0)
   161  		u5, c1 = bits.Mul64(m, q5)
   162  		t4, c0 = bits.Add64(t5, c1, c0)
   163  		u6, c1 = bits.Mul64(m, q6)
   164  		t5, c0 = bits.Add64(t6, c1, c0)
   165  		u7, c1 = bits.Mul64(m, q7)
   166  		t6, c0 = bits.Add64(t7, c1, c0)
   167  		u8, c1 = bits.Mul64(m, q8)
   168  		t7, c0 = bits.Add64(t8, c1, c0)
   169  		u9, c1 = bits.Mul64(m, q9)
   170  		t8, c0 = bits.Add64(t9, c1, c0)
   171  		u10, c1 = bits.Mul64(m, q10)
   172  		t9, c0 = bits.Add64(t10, c1, c0)
   173  		u11, c1 = bits.Mul64(m, q11)
   174  
   175  		t10, c0 = bits.Add64(0, c1, c0)
   176  		u11, _ = bits.Add64(u11, 0, c0)
   177  		t0, c0 = bits.Add64(u0, t0, 0)
   178  		t1, c0 = bits.Add64(u1, t1, c0)
   179  		t2, c0 = bits.Add64(u2, t2, c0)
   180  		t3, c0 = bits.Add64(u3, t3, c0)
   181  		t4, c0 = bits.Add64(u4, t4, c0)
   182  		t5, c0 = bits.Add64(u5, t5, c0)
   183  		t6, c0 = bits.Add64(u6, t6, c0)
   184  		t7, c0 = bits.Add64(u7, t7, c0)
   185  		t8, c0 = bits.Add64(u8, t8, c0)
   186  		t9, c0 = bits.Add64(u9, t9, c0)
   187  		t10, c0 = bits.Add64(u10, t10, c0)
   188  		c2, _ = bits.Add64(c2, 0, c0)
   189  		t10, c0 = bits.Add64(t11, t10, 0)
   190  		t11, _ = bits.Add64(u11, c2, c0)
   191  
   192  	}
   193  	{
   194  		var c0, c1, c2 uint64
   195  		v := x[1]
   196  		u0, c1 = bits.Mul64(v, y[0])
   197  		t0, c0 = bits.Add64(c1, t0, 0)
   198  		u1, c1 = bits.Mul64(v, y[1])
   199  		t1, c0 = bits.Add64(c1, t1, c0)
   200  		u2, c1 = bits.Mul64(v, y[2])
   201  		t2, c0 = bits.Add64(c1, t2, c0)
   202  		u3, c1 = bits.Mul64(v, y[3])
   203  		t3, c0 = bits.Add64(c1, t3, c0)
   204  		u4, c1 = bits.Mul64(v, y[4])
   205  		t4, c0 = bits.Add64(c1, t4, c0)
   206  		u5, c1 = bits.Mul64(v, y[5])
   207  		t5, c0 = bits.Add64(c1, t5, c0)
   208  		u6, c1 = bits.Mul64(v, y[6])
   209  		t6, c0 = bits.Add64(c1, t6, c0)
   210  		u7, c1 = bits.Mul64(v, y[7])
   211  		t7, c0 = bits.Add64(c1, t7, c0)
   212  		u8, c1 = bits.Mul64(v, y[8])
   213  		t8, c0 = bits.Add64(c1, t8, c0)
   214  		u9, c1 = bits.Mul64(v, y[9])
   215  		t9, c0 = bits.Add64(c1, t9, c0)
   216  		u10, c1 = bits.Mul64(v, y[10])
   217  		t10, c0 = bits.Add64(c1, t10, c0)
   218  		u11, c1 = bits.Mul64(v, y[11])
   219  		t11, c0 = bits.Add64(c1, t11, c0)
   220  
   221  		c2, _ = bits.Add64(0, 0, c0)
   222  		t1, c0 = bits.Add64(u0, t1, 0)
   223  		t2, c0 = bits.Add64(u1, t2, c0)
   224  		t3, c0 = bits.Add64(u2, t3, c0)
   225  		t4, c0 = bits.Add64(u3, t4, c0)
   226  		t5, c0 = bits.Add64(u4, t5, c0)
   227  		t6, c0 = bits.Add64(u5, t6, c0)
   228  		t7, c0 = bits.Add64(u6, t7, c0)
   229  		t8, c0 = bits.Add64(u7, t8, c0)
   230  		t9, c0 = bits.Add64(u8, t9, c0)
   231  		t10, c0 = bits.Add64(u9, t10, c0)
   232  		t11, c0 = bits.Add64(u10, t11, c0)
   233  		c2, _ = bits.Add64(u11, c2, c0)
   234  
   235  		m := qInvNeg * t0
   236  
   237  		u0, c1 = bits.Mul64(m, q0)
   238  		_, c0 = bits.Add64(t0, c1, 0)
   239  		u1, c1 = bits.Mul64(m, q1)
   240  		t0, c0 = bits.Add64(t1, c1, c0)
   241  		u2, c1 = bits.Mul64(m, q2)
   242  		t1, c0 = bits.Add64(t2, c1, c0)
   243  		u3, c1 = bits.Mul64(m, q3)
   244  		t2, c0 = bits.Add64(t3, c1, c0)
   245  		u4, c1 = bits.Mul64(m, q4)
   246  		t3, c0 = bits.Add64(t4, c1, c0)
   247  		u5, c1 = bits.Mul64(m, q5)
   248  		t4, c0 = bits.Add64(t5, c1, c0)
   249  		u6, c1 = bits.Mul64(m, q6)
   250  		t5, c0 = bits.Add64(t6, c1, c0)
   251  		u7, c1 = bits.Mul64(m, q7)
   252  		t6, c0 = bits.Add64(t7, c1, c0)
   253  		u8, c1 = bits.Mul64(m, q8)
   254  		t7, c0 = bits.Add64(t8, c1, c0)
   255  		u9, c1 = bits.Mul64(m, q9)
   256  		t8, c0 = bits.Add64(t9, c1, c0)
   257  		u10, c1 = bits.Mul64(m, q10)
   258  		t9, c0 = bits.Add64(t10, c1, c0)
   259  		u11, c1 = bits.Mul64(m, q11)
   260  
   261  		t10, c0 = bits.Add64(0, c1, c0)
   262  		u11, _ = bits.Add64(u11, 0, c0)
   263  		t0, c0 = bits.Add64(u0, t0, 0)
   264  		t1, c0 = bits.Add64(u1, t1, c0)
   265  		t2, c0 = bits.Add64(u2, t2, c0)
   266  		t3, c0 = bits.Add64(u3, t3, c0)
   267  		t4, c0 = bits.Add64(u4, t4, c0)
   268  		t5, c0 = bits.Add64(u5, t5, c0)
   269  		t6, c0 = bits.Add64(u6, t6, c0)
   270  		t7, c0 = bits.Add64(u7, t7, c0)
   271  		t8, c0 = bits.Add64(u8, t8, c0)
   272  		t9, c0 = bits.Add64(u9, t9, c0)
   273  		t10, c0 = bits.Add64(u10, t10, c0)
   274  		c2, _ = bits.Add64(c2, 0, c0)
   275  		t10, c0 = bits.Add64(t11, t10, 0)
   276  		t11, _ = bits.Add64(u11, c2, c0)
   277  
   278  	}
   279  	{
   280  		var c0, c1, c2 uint64
   281  		v := x[2]
   282  		u0, c1 = bits.Mul64(v, y[0])
   283  		t0, c0 = bits.Add64(c1, t0, 0)
   284  		u1, c1 = bits.Mul64(v, y[1])
   285  		t1, c0 = bits.Add64(c1, t1, c0)
   286  		u2, c1 = bits.Mul64(v, y[2])
   287  		t2, c0 = bits.Add64(c1, t2, c0)
   288  		u3, c1 = bits.Mul64(v, y[3])
   289  		t3, c0 = bits.Add64(c1, t3, c0)
   290  		u4, c1 = bits.Mul64(v, y[4])
   291  		t4, c0 = bits.Add64(c1, t4, c0)
   292  		u5, c1 = bits.Mul64(v, y[5])
   293  		t5, c0 = bits.Add64(c1, t5, c0)
   294  		u6, c1 = bits.Mul64(v, y[6])
   295  		t6, c0 = bits.Add64(c1, t6, c0)
   296  		u7, c1 = bits.Mul64(v, y[7])
   297  		t7, c0 = bits.Add64(c1, t7, c0)
   298  		u8, c1 = bits.Mul64(v, y[8])
   299  		t8, c0 = bits.Add64(c1, t8, c0)
   300  		u9, c1 = bits.Mul64(v, y[9])
   301  		t9, c0 = bits.Add64(c1, t9, c0)
   302  		u10, c1 = bits.Mul64(v, y[10])
   303  		t10, c0 = bits.Add64(c1, t10, c0)
   304  		u11, c1 = bits.Mul64(v, y[11])
   305  		t11, c0 = bits.Add64(c1, t11, c0)
   306  
   307  		c2, _ = bits.Add64(0, 0, c0)
   308  		t1, c0 = bits.Add64(u0, t1, 0)
   309  		t2, c0 = bits.Add64(u1, t2, c0)
   310  		t3, c0 = bits.Add64(u2, t3, c0)
   311  		t4, c0 = bits.Add64(u3, t4, c0)
   312  		t5, c0 = bits.Add64(u4, t5, c0)
   313  		t6, c0 = bits.Add64(u5, t6, c0)
   314  		t7, c0 = bits.Add64(u6, t7, c0)
   315  		t8, c0 = bits.Add64(u7, t8, c0)
   316  		t9, c0 = bits.Add64(u8, t9, c0)
   317  		t10, c0 = bits.Add64(u9, t10, c0)
   318  		t11, c0 = bits.Add64(u10, t11, c0)
   319  		c2, _ = bits.Add64(u11, c2, c0)
   320  
   321  		m := qInvNeg * t0
   322  
   323  		u0, c1 = bits.Mul64(m, q0)
   324  		_, c0 = bits.Add64(t0, c1, 0)
   325  		u1, c1 = bits.Mul64(m, q1)
   326  		t0, c0 = bits.Add64(t1, c1, c0)
   327  		u2, c1 = bits.Mul64(m, q2)
   328  		t1, c0 = bits.Add64(t2, c1, c0)
   329  		u3, c1 = bits.Mul64(m, q3)
   330  		t2, c0 = bits.Add64(t3, c1, c0)
   331  		u4, c1 = bits.Mul64(m, q4)
   332  		t3, c0 = bits.Add64(t4, c1, c0)
   333  		u5, c1 = bits.Mul64(m, q5)
   334  		t4, c0 = bits.Add64(t5, c1, c0)
   335  		u6, c1 = bits.Mul64(m, q6)
   336  		t5, c0 = bits.Add64(t6, c1, c0)
   337  		u7, c1 = bits.Mul64(m, q7)
   338  		t6, c0 = bits.Add64(t7, c1, c0)
   339  		u8, c1 = bits.Mul64(m, q8)
   340  		t7, c0 = bits.Add64(t8, c1, c0)
   341  		u9, c1 = bits.Mul64(m, q9)
   342  		t8, c0 = bits.Add64(t9, c1, c0)
   343  		u10, c1 = bits.Mul64(m, q10)
   344  		t9, c0 = bits.Add64(t10, c1, c0)
   345  		u11, c1 = bits.Mul64(m, q11)
   346  
   347  		t10, c0 = bits.Add64(0, c1, c0)
   348  		u11, _ = bits.Add64(u11, 0, c0)
   349  		t0, c0 = bits.Add64(u0, t0, 0)
   350  		t1, c0 = bits.Add64(u1, t1, c0)
   351  		t2, c0 = bits.Add64(u2, t2, c0)
   352  		t3, c0 = bits.Add64(u3, t3, c0)
   353  		t4, c0 = bits.Add64(u4, t4, c0)
   354  		t5, c0 = bits.Add64(u5, t5, c0)
   355  		t6, c0 = bits.Add64(u6, t6, c0)
   356  		t7, c0 = bits.Add64(u7, t7, c0)
   357  		t8, c0 = bits.Add64(u8, t8, c0)
   358  		t9, c0 = bits.Add64(u9, t9, c0)
   359  		t10, c0 = bits.Add64(u10, t10, c0)
   360  		c2, _ = bits.Add64(c2, 0, c0)
   361  		t10, c0 = bits.Add64(t11, t10, 0)
   362  		t11, _ = bits.Add64(u11, c2, c0)
   363  
   364  	}
   365  	{
   366  		var c0, c1, c2 uint64
   367  		v := x[3]
   368  		u0, c1 = bits.Mul64(v, y[0])
   369  		t0, c0 = bits.Add64(c1, t0, 0)
   370  		u1, c1 = bits.Mul64(v, y[1])
   371  		t1, c0 = bits.Add64(c1, t1, c0)
   372  		u2, c1 = bits.Mul64(v, y[2])
   373  		t2, c0 = bits.Add64(c1, t2, c0)
   374  		u3, c1 = bits.Mul64(v, y[3])
   375  		t3, c0 = bits.Add64(c1, t3, c0)
   376  		u4, c1 = bits.Mul64(v, y[4])
   377  		t4, c0 = bits.Add64(c1, t4, c0)
   378  		u5, c1 = bits.Mul64(v, y[5])
   379  		t5, c0 = bits.Add64(c1, t5, c0)
   380  		u6, c1 = bits.Mul64(v, y[6])
   381  		t6, c0 = bits.Add64(c1, t6, c0)
   382  		u7, c1 = bits.Mul64(v, y[7])
   383  		t7, c0 = bits.Add64(c1, t7, c0)
   384  		u8, c1 = bits.Mul64(v, y[8])
   385  		t8, c0 = bits.Add64(c1, t8, c0)
   386  		u9, c1 = bits.Mul64(v, y[9])
   387  		t9, c0 = bits.Add64(c1, t9, c0)
   388  		u10, c1 = bits.Mul64(v, y[10])
   389  		t10, c0 = bits.Add64(c1, t10, c0)
   390  		u11, c1 = bits.Mul64(v, y[11])
   391  		t11, c0 = bits.Add64(c1, t11, c0)
   392  
   393  		c2, _ = bits.Add64(0, 0, c0)
   394  		t1, c0 = bits.Add64(u0, t1, 0)
   395  		t2, c0 = bits.Add64(u1, t2, c0)
   396  		t3, c0 = bits.Add64(u2, t3, c0)
   397  		t4, c0 = bits.Add64(u3, t4, c0)
   398  		t5, c0 = bits.Add64(u4, t5, c0)
   399  		t6, c0 = bits.Add64(u5, t6, c0)
   400  		t7, c0 = bits.Add64(u6, t7, c0)
   401  		t8, c0 = bits.Add64(u7, t8, c0)
   402  		t9, c0 = bits.Add64(u8, t9, c0)
   403  		t10, c0 = bits.Add64(u9, t10, c0)
   404  		t11, c0 = bits.Add64(u10, t11, c0)
   405  		c2, _ = bits.Add64(u11, c2, c0)
   406  
   407  		m := qInvNeg * t0
   408  
   409  		u0, c1 = bits.Mul64(m, q0)
   410  		_, c0 = bits.Add64(t0, c1, 0)
   411  		u1, c1 = bits.Mul64(m, q1)
   412  		t0, c0 = bits.Add64(t1, c1, c0)
   413  		u2, c1 = bits.Mul64(m, q2)
   414  		t1, c0 = bits.Add64(t2, c1, c0)
   415  		u3, c1 = bits.Mul64(m, q3)
   416  		t2, c0 = bits.Add64(t3, c1, c0)
   417  		u4, c1 = bits.Mul64(m, q4)
   418  		t3, c0 = bits.Add64(t4, c1, c0)
   419  		u5, c1 = bits.Mul64(m, q5)
   420  		t4, c0 = bits.Add64(t5, c1, c0)
   421  		u6, c1 = bits.Mul64(m, q6)
   422  		t5, c0 = bits.Add64(t6, c1, c0)
   423  		u7, c1 = bits.Mul64(m, q7)
   424  		t6, c0 = bits.Add64(t7, c1, c0)
   425  		u8, c1 = bits.Mul64(m, q8)
   426  		t7, c0 = bits.Add64(t8, c1, c0)
   427  		u9, c1 = bits.Mul64(m, q9)
   428  		t8, c0 = bits.Add64(t9, c1, c0)
   429  		u10, c1 = bits.Mul64(m, q10)
   430  		t9, c0 = bits.Add64(t10, c1, c0)
   431  		u11, c1 = bits.Mul64(m, q11)
   432  
   433  		t10, c0 = bits.Add64(0, c1, c0)
   434  		u11, _ = bits.Add64(u11, 0, c0)
   435  		t0, c0 = bits.Add64(u0, t0, 0)
   436  		t1, c0 = bits.Add64(u1, t1, c0)
   437  		t2, c0 = bits.Add64(u2, t2, c0)
   438  		t3, c0 = bits.Add64(u3, t3, c0)
   439  		t4, c0 = bits.Add64(u4, t4, c0)
   440  		t5, c0 = bits.Add64(u5, t5, c0)
   441  		t6, c0 = bits.Add64(u6, t6, c0)
   442  		t7, c0 = bits.Add64(u7, t7, c0)
   443  		t8, c0 = bits.Add64(u8, t8, c0)
   444  		t9, c0 = bits.Add64(u9, t9, c0)
   445  		t10, c0 = bits.Add64(u10, t10, c0)
   446  		c2, _ = bits.Add64(c2, 0, c0)
   447  		t10, c0 = bits.Add64(t11, t10, 0)
   448  		t11, _ = bits.Add64(u11, c2, c0)
   449  
   450  	}
   451  	{
   452  		var c0, c1, c2 uint64
   453  		v := x[4]
   454  		u0, c1 = bits.Mul64(v, y[0])
   455  		t0, c0 = bits.Add64(c1, t0, 0)
   456  		u1, c1 = bits.Mul64(v, y[1])
   457  		t1, c0 = bits.Add64(c1, t1, c0)
   458  		u2, c1 = bits.Mul64(v, y[2])
   459  		t2, c0 = bits.Add64(c1, t2, c0)
   460  		u3, c1 = bits.Mul64(v, y[3])
   461  		t3, c0 = bits.Add64(c1, t3, c0)
   462  		u4, c1 = bits.Mul64(v, y[4])
   463  		t4, c0 = bits.Add64(c1, t4, c0)
   464  		u5, c1 = bits.Mul64(v, y[5])
   465  		t5, c0 = bits.Add64(c1, t5, c0)
   466  		u6, c1 = bits.Mul64(v, y[6])
   467  		t6, c0 = bits.Add64(c1, t6, c0)
   468  		u7, c1 = bits.Mul64(v, y[7])
   469  		t7, c0 = bits.Add64(c1, t7, c0)
   470  		u8, c1 = bits.Mul64(v, y[8])
   471  		t8, c0 = bits.Add64(c1, t8, c0)
   472  		u9, c1 = bits.Mul64(v, y[9])
   473  		t9, c0 = bits.Add64(c1, t9, c0)
   474  		u10, c1 = bits.Mul64(v, y[10])
   475  		t10, c0 = bits.Add64(c1, t10, c0)
   476  		u11, c1 = bits.Mul64(v, y[11])
   477  		t11, c0 = bits.Add64(c1, t11, c0)
   478  
   479  		c2, _ = bits.Add64(0, 0, c0)
   480  		t1, c0 = bits.Add64(u0, t1, 0)
   481  		t2, c0 = bits.Add64(u1, t2, c0)
   482  		t3, c0 = bits.Add64(u2, t3, c0)
   483  		t4, c0 = bits.Add64(u3, t4, c0)
   484  		t5, c0 = bits.Add64(u4, t5, c0)
   485  		t6, c0 = bits.Add64(u5, t6, c0)
   486  		t7, c0 = bits.Add64(u6, t7, c0)
   487  		t8, c0 = bits.Add64(u7, t8, c0)
   488  		t9, c0 = bits.Add64(u8, t9, c0)
   489  		t10, c0 = bits.Add64(u9, t10, c0)
   490  		t11, c0 = bits.Add64(u10, t11, c0)
   491  		c2, _ = bits.Add64(u11, c2, c0)
   492  
   493  		m := qInvNeg * t0
   494  
   495  		u0, c1 = bits.Mul64(m, q0)
   496  		_, c0 = bits.Add64(t0, c1, 0)
   497  		u1, c1 = bits.Mul64(m, q1)
   498  		t0, c0 = bits.Add64(t1, c1, c0)
   499  		u2, c1 = bits.Mul64(m, q2)
   500  		t1, c0 = bits.Add64(t2, c1, c0)
   501  		u3, c1 = bits.Mul64(m, q3)
   502  		t2, c0 = bits.Add64(t3, c1, c0)
   503  		u4, c1 = bits.Mul64(m, q4)
   504  		t3, c0 = bits.Add64(t4, c1, c0)
   505  		u5, c1 = bits.Mul64(m, q5)
   506  		t4, c0 = bits.Add64(t5, c1, c0)
   507  		u6, c1 = bits.Mul64(m, q6)
   508  		t5, c0 = bits.Add64(t6, c1, c0)
   509  		u7, c1 = bits.Mul64(m, q7)
   510  		t6, c0 = bits.Add64(t7, c1, c0)
   511  		u8, c1 = bits.Mul64(m, q8)
   512  		t7, c0 = bits.Add64(t8, c1, c0)
   513  		u9, c1 = bits.Mul64(m, q9)
   514  		t8, c0 = bits.Add64(t9, c1, c0)
   515  		u10, c1 = bits.Mul64(m, q10)
   516  		t9, c0 = bits.Add64(t10, c1, c0)
   517  		u11, c1 = bits.Mul64(m, q11)
   518  
   519  		t10, c0 = bits.Add64(0, c1, c0)
   520  		u11, _ = bits.Add64(u11, 0, c0)
   521  		t0, c0 = bits.Add64(u0, t0, 0)
   522  		t1, c0 = bits.Add64(u1, t1, c0)
   523  		t2, c0 = bits.Add64(u2, t2, c0)
   524  		t3, c0 = bits.Add64(u3, t3, c0)
   525  		t4, c0 = bits.Add64(u4, t4, c0)
   526  		t5, c0 = bits.Add64(u5, t5, c0)
   527  		t6, c0 = bits.Add64(u6, t6, c0)
   528  		t7, c0 = bits.Add64(u7, t7, c0)
   529  		t8, c0 = bits.Add64(u8, t8, c0)
   530  		t9, c0 = bits.Add64(u9, t9, c0)
   531  		t10, c0 = bits.Add64(u10, t10, c0)
   532  		c2, _ = bits.Add64(c2, 0, c0)
   533  		t10, c0 = bits.Add64(t11, t10, 0)
   534  		t11, _ = bits.Add64(u11, c2, c0)
   535  
   536  	}
   537  	{
   538  		var c0, c1, c2 uint64
   539  		v := x[5]
   540  		u0, c1 = bits.Mul64(v, y[0])
   541  		t0, c0 = bits.Add64(c1, t0, 0)
   542  		u1, c1 = bits.Mul64(v, y[1])
   543  		t1, c0 = bits.Add64(c1, t1, c0)
   544  		u2, c1 = bits.Mul64(v, y[2])
   545  		t2, c0 = bits.Add64(c1, t2, c0)
   546  		u3, c1 = bits.Mul64(v, y[3])
   547  		t3, c0 = bits.Add64(c1, t3, c0)
   548  		u4, c1 = bits.Mul64(v, y[4])
   549  		t4, c0 = bits.Add64(c1, t4, c0)
   550  		u5, c1 = bits.Mul64(v, y[5])
   551  		t5, c0 = bits.Add64(c1, t5, c0)
   552  		u6, c1 = bits.Mul64(v, y[6])
   553  		t6, c0 = bits.Add64(c1, t6, c0)
   554  		u7, c1 = bits.Mul64(v, y[7])
   555  		t7, c0 = bits.Add64(c1, t7, c0)
   556  		u8, c1 = bits.Mul64(v, y[8])
   557  		t8, c0 = bits.Add64(c1, t8, c0)
   558  		u9, c1 = bits.Mul64(v, y[9])
   559  		t9, c0 = bits.Add64(c1, t9, c0)
   560  		u10, c1 = bits.Mul64(v, y[10])
   561  		t10, c0 = bits.Add64(c1, t10, c0)
   562  		u11, c1 = bits.Mul64(v, y[11])
   563  		t11, c0 = bits.Add64(c1, t11, c0)
   564  
   565  		c2, _ = bits.Add64(0, 0, c0)
   566  		t1, c0 = bits.Add64(u0, t1, 0)
   567  		t2, c0 = bits.Add64(u1, t2, c0)
   568  		t3, c0 = bits.Add64(u2, t3, c0)
   569  		t4, c0 = bits.Add64(u3, t4, c0)
   570  		t5, c0 = bits.Add64(u4, t5, c0)
   571  		t6, c0 = bits.Add64(u5, t6, c0)
   572  		t7, c0 = bits.Add64(u6, t7, c0)
   573  		t8, c0 = bits.Add64(u7, t8, c0)
   574  		t9, c0 = bits.Add64(u8, t9, c0)
   575  		t10, c0 = bits.Add64(u9, t10, c0)
   576  		t11, c0 = bits.Add64(u10, t11, c0)
   577  		c2, _ = bits.Add64(u11, c2, c0)
   578  
   579  		m := qInvNeg * t0
   580  
   581  		u0, c1 = bits.Mul64(m, q0)
   582  		_, c0 = bits.Add64(t0, c1, 0)
   583  		u1, c1 = bits.Mul64(m, q1)
   584  		t0, c0 = bits.Add64(t1, c1, c0)
   585  		u2, c1 = bits.Mul64(m, q2)
   586  		t1, c0 = bits.Add64(t2, c1, c0)
   587  		u3, c1 = bits.Mul64(m, q3)
   588  		t2, c0 = bits.Add64(t3, c1, c0)
   589  		u4, c1 = bits.Mul64(m, q4)
   590  		t3, c0 = bits.Add64(t4, c1, c0)
   591  		u5, c1 = bits.Mul64(m, q5)
   592  		t4, c0 = bits.Add64(t5, c1, c0)
   593  		u6, c1 = bits.Mul64(m, q6)
   594  		t5, c0 = bits.Add64(t6, c1, c0)
   595  		u7, c1 = bits.Mul64(m, q7)
   596  		t6, c0 = bits.Add64(t7, c1, c0)
   597  		u8, c1 = bits.Mul64(m, q8)
   598  		t7, c0 = bits.Add64(t8, c1, c0)
   599  		u9, c1 = bits.Mul64(m, q9)
   600  		t8, c0 = bits.Add64(t9, c1, c0)
   601  		u10, c1 = bits.Mul64(m, q10)
   602  		t9, c0 = bits.Add64(t10, c1, c0)
   603  		u11, c1 = bits.Mul64(m, q11)
   604  
   605  		t10, c0 = bits.Add64(0, c1, c0)
   606  		u11, _ = bits.Add64(u11, 0, c0)
   607  		t0, c0 = bits.Add64(u0, t0, 0)
   608  		t1, c0 = bits.Add64(u1, t1, c0)
   609  		t2, c0 = bits.Add64(u2, t2, c0)
   610  		t3, c0 = bits.Add64(u3, t3, c0)
   611  		t4, c0 = bits.Add64(u4, t4, c0)
   612  		t5, c0 = bits.Add64(u5, t5, c0)
   613  		t6, c0 = bits.Add64(u6, t6, c0)
   614  		t7, c0 = bits.Add64(u7, t7, c0)
   615  		t8, c0 = bits.Add64(u8, t8, c0)
   616  		t9, c0 = bits.Add64(u9, t9, c0)
   617  		t10, c0 = bits.Add64(u10, t10, c0)
   618  		c2, _ = bits.Add64(c2, 0, c0)
   619  		t10, c0 = bits.Add64(t11, t10, 0)
   620  		t11, _ = bits.Add64(u11, c2, c0)
   621  
   622  	}
   623  	{
   624  		var c0, c1, c2 uint64
   625  		v := x[6]
   626  		u0, c1 = bits.Mul64(v, y[0])
   627  		t0, c0 = bits.Add64(c1, t0, 0)
   628  		u1, c1 = bits.Mul64(v, y[1])
   629  		t1, c0 = bits.Add64(c1, t1, c0)
   630  		u2, c1 = bits.Mul64(v, y[2])
   631  		t2, c0 = bits.Add64(c1, t2, c0)
   632  		u3, c1 = bits.Mul64(v, y[3])
   633  		t3, c0 = bits.Add64(c1, t3, c0)
   634  		u4, c1 = bits.Mul64(v, y[4])
   635  		t4, c0 = bits.Add64(c1, t4, c0)
   636  		u5, c1 = bits.Mul64(v, y[5])
   637  		t5, c0 = bits.Add64(c1, t5, c0)
   638  		u6, c1 = bits.Mul64(v, y[6])
   639  		t6, c0 = bits.Add64(c1, t6, c0)
   640  		u7, c1 = bits.Mul64(v, y[7])
   641  		t7, c0 = bits.Add64(c1, t7, c0)
   642  		u8, c1 = bits.Mul64(v, y[8])
   643  		t8, c0 = bits.Add64(c1, t8, c0)
   644  		u9, c1 = bits.Mul64(v, y[9])
   645  		t9, c0 = bits.Add64(c1, t9, c0)
   646  		u10, c1 = bits.Mul64(v, y[10])
   647  		t10, c0 = bits.Add64(c1, t10, c0)
   648  		u11, c1 = bits.Mul64(v, y[11])
   649  		t11, c0 = bits.Add64(c1, t11, c0)
   650  
   651  		c2, _ = bits.Add64(0, 0, c0)
   652  		t1, c0 = bits.Add64(u0, t1, 0)
   653  		t2, c0 = bits.Add64(u1, t2, c0)
   654  		t3, c0 = bits.Add64(u2, t3, c0)
   655  		t4, c0 = bits.Add64(u3, t4, c0)
   656  		t5, c0 = bits.Add64(u4, t5, c0)
   657  		t6, c0 = bits.Add64(u5, t6, c0)
   658  		t7, c0 = bits.Add64(u6, t7, c0)
   659  		t8, c0 = bits.Add64(u7, t8, c0)
   660  		t9, c0 = bits.Add64(u8, t9, c0)
   661  		t10, c0 = bits.Add64(u9, t10, c0)
   662  		t11, c0 = bits.Add64(u10, t11, c0)
   663  		c2, _ = bits.Add64(u11, c2, c0)
   664  
   665  		m := qInvNeg * t0
   666  
   667  		u0, c1 = bits.Mul64(m, q0)
   668  		_, c0 = bits.Add64(t0, c1, 0)
   669  		u1, c1 = bits.Mul64(m, q1)
   670  		t0, c0 = bits.Add64(t1, c1, c0)
   671  		u2, c1 = bits.Mul64(m, q2)
   672  		t1, c0 = bits.Add64(t2, c1, c0)
   673  		u3, c1 = bits.Mul64(m, q3)
   674  		t2, c0 = bits.Add64(t3, c1, c0)
   675  		u4, c1 = bits.Mul64(m, q4)
   676  		t3, c0 = bits.Add64(t4, c1, c0)
   677  		u5, c1 = bits.Mul64(m, q5)
   678  		t4, c0 = bits.Add64(t5, c1, c0)
   679  		u6, c1 = bits.Mul64(m, q6)
   680  		t5, c0 = bits.Add64(t6, c1, c0)
   681  		u7, c1 = bits.Mul64(m, q7)
   682  		t6, c0 = bits.Add64(t7, c1, c0)
   683  		u8, c1 = bits.Mul64(m, q8)
   684  		t7, c0 = bits.Add64(t8, c1, c0)
   685  		u9, c1 = bits.Mul64(m, q9)
   686  		t8, c0 = bits.Add64(t9, c1, c0)
   687  		u10, c1 = bits.Mul64(m, q10)
   688  		t9, c0 = bits.Add64(t10, c1, c0)
   689  		u11, c1 = bits.Mul64(m, q11)
   690  
   691  		t10, c0 = bits.Add64(0, c1, c0)
   692  		u11, _ = bits.Add64(u11, 0, c0)
   693  		t0, c0 = bits.Add64(u0, t0, 0)
   694  		t1, c0 = bits.Add64(u1, t1, c0)
   695  		t2, c0 = bits.Add64(u2, t2, c0)
   696  		t3, c0 = bits.Add64(u3, t3, c0)
   697  		t4, c0 = bits.Add64(u4, t4, c0)
   698  		t5, c0 = bits.Add64(u5, t5, c0)
   699  		t6, c0 = bits.Add64(u6, t6, c0)
   700  		t7, c0 = bits.Add64(u7, t7, c0)
   701  		t8, c0 = bits.Add64(u8, t8, c0)
   702  		t9, c0 = bits.Add64(u9, t9, c0)
   703  		t10, c0 = bits.Add64(u10, t10, c0)
   704  		c2, _ = bits.Add64(c2, 0, c0)
   705  		t10, c0 = bits.Add64(t11, t10, 0)
   706  		t11, _ = bits.Add64(u11, c2, c0)
   707  
   708  	}
   709  	{
   710  		var c0, c1, c2 uint64
   711  		v := x[7]
   712  		u0, c1 = bits.Mul64(v, y[0])
   713  		t0, c0 = bits.Add64(c1, t0, 0)
   714  		u1, c1 = bits.Mul64(v, y[1])
   715  		t1, c0 = bits.Add64(c1, t1, c0)
   716  		u2, c1 = bits.Mul64(v, y[2])
   717  		t2, c0 = bits.Add64(c1, t2, c0)
   718  		u3, c1 = bits.Mul64(v, y[3])
   719  		t3, c0 = bits.Add64(c1, t3, c0)
   720  		u4, c1 = bits.Mul64(v, y[4])
   721  		t4, c0 = bits.Add64(c1, t4, c0)
   722  		u5, c1 = bits.Mul64(v, y[5])
   723  		t5, c0 = bits.Add64(c1, t5, c0)
   724  		u6, c1 = bits.Mul64(v, y[6])
   725  		t6, c0 = bits.Add64(c1, t6, c0)
   726  		u7, c1 = bits.Mul64(v, y[7])
   727  		t7, c0 = bits.Add64(c1, t7, c0)
   728  		u8, c1 = bits.Mul64(v, y[8])
   729  		t8, c0 = bits.Add64(c1, t8, c0)
   730  		u9, c1 = bits.Mul64(v, y[9])
   731  		t9, c0 = bits.Add64(c1, t9, c0)
   732  		u10, c1 = bits.Mul64(v, y[10])
   733  		t10, c0 = bits.Add64(c1, t10, c0)
   734  		u11, c1 = bits.Mul64(v, y[11])
   735  		t11, c0 = bits.Add64(c1, t11, c0)
   736  
   737  		c2, _ = bits.Add64(0, 0, c0)
   738  		t1, c0 = bits.Add64(u0, t1, 0)
   739  		t2, c0 = bits.Add64(u1, t2, c0)
   740  		t3, c0 = bits.Add64(u2, t3, c0)
   741  		t4, c0 = bits.Add64(u3, t4, c0)
   742  		t5, c0 = bits.Add64(u4, t5, c0)
   743  		t6, c0 = bits.Add64(u5, t6, c0)
   744  		t7, c0 = bits.Add64(u6, t7, c0)
   745  		t8, c0 = bits.Add64(u7, t8, c0)
   746  		t9, c0 = bits.Add64(u8, t9, c0)
   747  		t10, c0 = bits.Add64(u9, t10, c0)
   748  		t11, c0 = bits.Add64(u10, t11, c0)
   749  		c2, _ = bits.Add64(u11, c2, c0)
   750  
   751  		m := qInvNeg * t0
   752  
   753  		u0, c1 = bits.Mul64(m, q0)
   754  		_, c0 = bits.Add64(t0, c1, 0)
   755  		u1, c1 = bits.Mul64(m, q1)
   756  		t0, c0 = bits.Add64(t1, c1, c0)
   757  		u2, c1 = bits.Mul64(m, q2)
   758  		t1, c0 = bits.Add64(t2, c1, c0)
   759  		u3, c1 = bits.Mul64(m, q3)
   760  		t2, c0 = bits.Add64(t3, c1, c0)
   761  		u4, c1 = bits.Mul64(m, q4)
   762  		t3, c0 = bits.Add64(t4, c1, c0)
   763  		u5, c1 = bits.Mul64(m, q5)
   764  		t4, c0 = bits.Add64(t5, c1, c0)
   765  		u6, c1 = bits.Mul64(m, q6)
   766  		t5, c0 = bits.Add64(t6, c1, c0)
   767  		u7, c1 = bits.Mul64(m, q7)
   768  		t6, c0 = bits.Add64(t7, c1, c0)
   769  		u8, c1 = bits.Mul64(m, q8)
   770  		t7, c0 = bits.Add64(t8, c1, c0)
   771  		u9, c1 = bits.Mul64(m, q9)
   772  		t8, c0 = bits.Add64(t9, c1, c0)
   773  		u10, c1 = bits.Mul64(m, q10)
   774  		t9, c0 = bits.Add64(t10, c1, c0)
   775  		u11, c1 = bits.Mul64(m, q11)
   776  
   777  		t10, c0 = bits.Add64(0, c1, c0)
   778  		u11, _ = bits.Add64(u11, 0, c0)
   779  		t0, c0 = bits.Add64(u0, t0, 0)
   780  		t1, c0 = bits.Add64(u1, t1, c0)
   781  		t2, c0 = bits.Add64(u2, t2, c0)
   782  		t3, c0 = bits.Add64(u3, t3, c0)
   783  		t4, c0 = bits.Add64(u4, t4, c0)
   784  		t5, c0 = bits.Add64(u5, t5, c0)
   785  		t6, c0 = bits.Add64(u6, t6, c0)
   786  		t7, c0 = bits.Add64(u7, t7, c0)
   787  		t8, c0 = bits.Add64(u8, t8, c0)
   788  		t9, c0 = bits.Add64(u9, t9, c0)
   789  		t10, c0 = bits.Add64(u10, t10, c0)
   790  		c2, _ = bits.Add64(c2, 0, c0)
   791  		t10, c0 = bits.Add64(t11, t10, 0)
   792  		t11, _ = bits.Add64(u11, c2, c0)
   793  
   794  	}
   795  	{
   796  		var c0, c1, c2 uint64
   797  		v := x[8]
   798  		u0, c1 = bits.Mul64(v, y[0])
   799  		t0, c0 = bits.Add64(c1, t0, 0)
   800  		u1, c1 = bits.Mul64(v, y[1])
   801  		t1, c0 = bits.Add64(c1, t1, c0)
   802  		u2, c1 = bits.Mul64(v, y[2])
   803  		t2, c0 = bits.Add64(c1, t2, c0)
   804  		u3, c1 = bits.Mul64(v, y[3])
   805  		t3, c0 = bits.Add64(c1, t3, c0)
   806  		u4, c1 = bits.Mul64(v, y[4])
   807  		t4, c0 = bits.Add64(c1, t4, c0)
   808  		u5, c1 = bits.Mul64(v, y[5])
   809  		t5, c0 = bits.Add64(c1, t5, c0)
   810  		u6, c1 = bits.Mul64(v, y[6])
   811  		t6, c0 = bits.Add64(c1, t6, c0)
   812  		u7, c1 = bits.Mul64(v, y[7])
   813  		t7, c0 = bits.Add64(c1, t7, c0)
   814  		u8, c1 = bits.Mul64(v, y[8])
   815  		t8, c0 = bits.Add64(c1, t8, c0)
   816  		u9, c1 = bits.Mul64(v, y[9])
   817  		t9, c0 = bits.Add64(c1, t9, c0)
   818  		u10, c1 = bits.Mul64(v, y[10])
   819  		t10, c0 = bits.Add64(c1, t10, c0)
   820  		u11, c1 = bits.Mul64(v, y[11])
   821  		t11, c0 = bits.Add64(c1, t11, c0)
   822  
   823  		c2, _ = bits.Add64(0, 0, c0)
   824  		t1, c0 = bits.Add64(u0, t1, 0)
   825  		t2, c0 = bits.Add64(u1, t2, c0)
   826  		t3, c0 = bits.Add64(u2, t3, c0)
   827  		t4, c0 = bits.Add64(u3, t4, c0)
   828  		t5, c0 = bits.Add64(u4, t5, c0)
   829  		t6, c0 = bits.Add64(u5, t6, c0)
   830  		t7, c0 = bits.Add64(u6, t7, c0)
   831  		t8, c0 = bits.Add64(u7, t8, c0)
   832  		t9, c0 = bits.Add64(u8, t9, c0)
   833  		t10, c0 = bits.Add64(u9, t10, c0)
   834  		t11, c0 = bits.Add64(u10, t11, c0)
   835  		c2, _ = bits.Add64(u11, c2, c0)
   836  
   837  		m := qInvNeg * t0
   838  
   839  		u0, c1 = bits.Mul64(m, q0)
   840  		_, c0 = bits.Add64(t0, c1, 0)
   841  		u1, c1 = bits.Mul64(m, q1)
   842  		t0, c0 = bits.Add64(t1, c1, c0)
   843  		u2, c1 = bits.Mul64(m, q2)
   844  		t1, c0 = bits.Add64(t2, c1, c0)
   845  		u3, c1 = bits.Mul64(m, q3)
   846  		t2, c0 = bits.Add64(t3, c1, c0)
   847  		u4, c1 = bits.Mul64(m, q4)
   848  		t3, c0 = bits.Add64(t4, c1, c0)
   849  		u5, c1 = bits.Mul64(m, q5)
   850  		t4, c0 = bits.Add64(t5, c1, c0)
   851  		u6, c1 = bits.Mul64(m, q6)
   852  		t5, c0 = bits.Add64(t6, c1, c0)
   853  		u7, c1 = bits.Mul64(m, q7)
   854  		t6, c0 = bits.Add64(t7, c1, c0)
   855  		u8, c1 = bits.Mul64(m, q8)
   856  		t7, c0 = bits.Add64(t8, c1, c0)
   857  		u9, c1 = bits.Mul64(m, q9)
   858  		t8, c0 = bits.Add64(t9, c1, c0)
   859  		u10, c1 = bits.Mul64(m, q10)
   860  		t9, c0 = bits.Add64(t10, c1, c0)
   861  		u11, c1 = bits.Mul64(m, q11)
   862  
   863  		t10, c0 = bits.Add64(0, c1, c0)
   864  		u11, _ = bits.Add64(u11, 0, c0)
   865  		t0, c0 = bits.Add64(u0, t0, 0)
   866  		t1, c0 = bits.Add64(u1, t1, c0)
   867  		t2, c0 = bits.Add64(u2, t2, c0)
   868  		t3, c0 = bits.Add64(u3, t3, c0)
   869  		t4, c0 = bits.Add64(u4, t4, c0)
   870  		t5, c0 = bits.Add64(u5, t5, c0)
   871  		t6, c0 = bits.Add64(u6, t6, c0)
   872  		t7, c0 = bits.Add64(u7, t7, c0)
   873  		t8, c0 = bits.Add64(u8, t8, c0)
   874  		t9, c0 = bits.Add64(u9, t9, c0)
   875  		t10, c0 = bits.Add64(u10, t10, c0)
   876  		c2, _ = bits.Add64(c2, 0, c0)
   877  		t10, c0 = bits.Add64(t11, t10, 0)
   878  		t11, _ = bits.Add64(u11, c2, c0)
   879  
   880  	}
   881  	{
   882  		var c0, c1, c2 uint64
   883  		v := x[9]
   884  		u0, c1 = bits.Mul64(v, y[0])
   885  		t0, c0 = bits.Add64(c1, t0, 0)
   886  		u1, c1 = bits.Mul64(v, y[1])
   887  		t1, c0 = bits.Add64(c1, t1, c0)
   888  		u2, c1 = bits.Mul64(v, y[2])
   889  		t2, c0 = bits.Add64(c1, t2, c0)
   890  		u3, c1 = bits.Mul64(v, y[3])
   891  		t3, c0 = bits.Add64(c1, t3, c0)
   892  		u4, c1 = bits.Mul64(v, y[4])
   893  		t4, c0 = bits.Add64(c1, t4, c0)
   894  		u5, c1 = bits.Mul64(v, y[5])
   895  		t5, c0 = bits.Add64(c1, t5, c0)
   896  		u6, c1 = bits.Mul64(v, y[6])
   897  		t6, c0 = bits.Add64(c1, t6, c0)
   898  		u7, c1 = bits.Mul64(v, y[7])
   899  		t7, c0 = bits.Add64(c1, t7, c0)
   900  		u8, c1 = bits.Mul64(v, y[8])
   901  		t8, c0 = bits.Add64(c1, t8, c0)
   902  		u9, c1 = bits.Mul64(v, y[9])
   903  		t9, c0 = bits.Add64(c1, t9, c0)
   904  		u10, c1 = bits.Mul64(v, y[10])
   905  		t10, c0 = bits.Add64(c1, t10, c0)
   906  		u11, c1 = bits.Mul64(v, y[11])
   907  		t11, c0 = bits.Add64(c1, t11, c0)
   908  
   909  		c2, _ = bits.Add64(0, 0, c0)
   910  		t1, c0 = bits.Add64(u0, t1, 0)
   911  		t2, c0 = bits.Add64(u1, t2, c0)
   912  		t3, c0 = bits.Add64(u2, t3, c0)
   913  		t4, c0 = bits.Add64(u3, t4, c0)
   914  		t5, c0 = bits.Add64(u4, t5, c0)
   915  		t6, c0 = bits.Add64(u5, t6, c0)
   916  		t7, c0 = bits.Add64(u6, t7, c0)
   917  		t8, c0 = bits.Add64(u7, t8, c0)
   918  		t9, c0 = bits.Add64(u8, t9, c0)
   919  		t10, c0 = bits.Add64(u9, t10, c0)
   920  		t11, c0 = bits.Add64(u10, t11, c0)
   921  		c2, _ = bits.Add64(u11, c2, c0)
   922  
   923  		m := qInvNeg * t0
   924  
   925  		u0, c1 = bits.Mul64(m, q0)
   926  		_, c0 = bits.Add64(t0, c1, 0)
   927  		u1, c1 = bits.Mul64(m, q1)
   928  		t0, c0 = bits.Add64(t1, c1, c0)
   929  		u2, c1 = bits.Mul64(m, q2)
   930  		t1, c0 = bits.Add64(t2, c1, c0)
   931  		u3, c1 = bits.Mul64(m, q3)
   932  		t2, c0 = bits.Add64(t3, c1, c0)
   933  		u4, c1 = bits.Mul64(m, q4)
   934  		t3, c0 = bits.Add64(t4, c1, c0)
   935  		u5, c1 = bits.Mul64(m, q5)
   936  		t4, c0 = bits.Add64(t5, c1, c0)
   937  		u6, c1 = bits.Mul64(m, q6)
   938  		t5, c0 = bits.Add64(t6, c1, c0)
   939  		u7, c1 = bits.Mul64(m, q7)
   940  		t6, c0 = bits.Add64(t7, c1, c0)
   941  		u8, c1 = bits.Mul64(m, q8)
   942  		t7, c0 = bits.Add64(t8, c1, c0)
   943  		u9, c1 = bits.Mul64(m, q9)
   944  		t8, c0 = bits.Add64(t9, c1, c0)
   945  		u10, c1 = bits.Mul64(m, q10)
   946  		t9, c0 = bits.Add64(t10, c1, c0)
   947  		u11, c1 = bits.Mul64(m, q11)
   948  
   949  		t10, c0 = bits.Add64(0, c1, c0)
   950  		u11, _ = bits.Add64(u11, 0, c0)
   951  		t0, c0 = bits.Add64(u0, t0, 0)
   952  		t1, c0 = bits.Add64(u1, t1, c0)
   953  		t2, c0 = bits.Add64(u2, t2, c0)
   954  		t3, c0 = bits.Add64(u3, t3, c0)
   955  		t4, c0 = bits.Add64(u4, t4, c0)
   956  		t5, c0 = bits.Add64(u5, t5, c0)
   957  		t6, c0 = bits.Add64(u6, t6, c0)
   958  		t7, c0 = bits.Add64(u7, t7, c0)
   959  		t8, c0 = bits.Add64(u8, t8, c0)
   960  		t9, c0 = bits.Add64(u9, t9, c0)
   961  		t10, c0 = bits.Add64(u10, t10, c0)
   962  		c2, _ = bits.Add64(c2, 0, c0)
   963  		t10, c0 = bits.Add64(t11, t10, 0)
   964  		t11, _ = bits.Add64(u11, c2, c0)
   965  
   966  	}
   967  	{
   968  		var c0, c1, c2 uint64
   969  		v := x[10]
   970  		u0, c1 = bits.Mul64(v, y[0])
   971  		t0, c0 = bits.Add64(c1, t0, 0)
   972  		u1, c1 = bits.Mul64(v, y[1])
   973  		t1, c0 = bits.Add64(c1, t1, c0)
   974  		u2, c1 = bits.Mul64(v, y[2])
   975  		t2, c0 = bits.Add64(c1, t2, c0)
   976  		u3, c1 = bits.Mul64(v, y[3])
   977  		t3, c0 = bits.Add64(c1, t3, c0)
   978  		u4, c1 = bits.Mul64(v, y[4])
   979  		t4, c0 = bits.Add64(c1, t4, c0)
   980  		u5, c1 = bits.Mul64(v, y[5])
   981  		t5, c0 = bits.Add64(c1, t5, c0)
   982  		u6, c1 = bits.Mul64(v, y[6])
   983  		t6, c0 = bits.Add64(c1, t6, c0)
   984  		u7, c1 = bits.Mul64(v, y[7])
   985  		t7, c0 = bits.Add64(c1, t7, c0)
   986  		u8, c1 = bits.Mul64(v, y[8])
   987  		t8, c0 = bits.Add64(c1, t8, c0)
   988  		u9, c1 = bits.Mul64(v, y[9])
   989  		t9, c0 = bits.Add64(c1, t9, c0)
   990  		u10, c1 = bits.Mul64(v, y[10])
   991  		t10, c0 = bits.Add64(c1, t10, c0)
   992  		u11, c1 = bits.Mul64(v, y[11])
   993  		t11, c0 = bits.Add64(c1, t11, c0)
   994  
   995  		c2, _ = bits.Add64(0, 0, c0)
   996  		t1, c0 = bits.Add64(u0, t1, 0)
   997  		t2, c0 = bits.Add64(u1, t2, c0)
   998  		t3, c0 = bits.Add64(u2, t3, c0)
   999  		t4, c0 = bits.Add64(u3, t4, c0)
  1000  		t5, c0 = bits.Add64(u4, t5, c0)
  1001  		t6, c0 = bits.Add64(u5, t6, c0)
  1002  		t7, c0 = bits.Add64(u6, t7, c0)
  1003  		t8, c0 = bits.Add64(u7, t8, c0)
  1004  		t9, c0 = bits.Add64(u8, t9, c0)
  1005  		t10, c0 = bits.Add64(u9, t10, c0)
  1006  		t11, c0 = bits.Add64(u10, t11, c0)
  1007  		c2, _ = bits.Add64(u11, c2, c0)
  1008  
  1009  		m := qInvNeg * t0
  1010  
  1011  		u0, c1 = bits.Mul64(m, q0)
  1012  		_, c0 = bits.Add64(t0, c1, 0)
  1013  		u1, c1 = bits.Mul64(m, q1)
  1014  		t0, c0 = bits.Add64(t1, c1, c0)
  1015  		u2, c1 = bits.Mul64(m, q2)
  1016  		t1, c0 = bits.Add64(t2, c1, c0)
  1017  		u3, c1 = bits.Mul64(m, q3)
  1018  		t2, c0 = bits.Add64(t3, c1, c0)
  1019  		u4, c1 = bits.Mul64(m, q4)
  1020  		t3, c0 = bits.Add64(t4, c1, c0)
  1021  		u5, c1 = bits.Mul64(m, q5)
  1022  		t4, c0 = bits.Add64(t5, c1, c0)
  1023  		u6, c1 = bits.Mul64(m, q6)
  1024  		t5, c0 = bits.Add64(t6, c1, c0)
  1025  		u7, c1 = bits.Mul64(m, q7)
  1026  		t6, c0 = bits.Add64(t7, c1, c0)
  1027  		u8, c1 = bits.Mul64(m, q8)
  1028  		t7, c0 = bits.Add64(t8, c1, c0)
  1029  		u9, c1 = bits.Mul64(m, q9)
  1030  		t8, c0 = bits.Add64(t9, c1, c0)
  1031  		u10, c1 = bits.Mul64(m, q10)
  1032  		t9, c0 = bits.Add64(t10, c1, c0)
  1033  		u11, c1 = bits.Mul64(m, q11)
  1034  
  1035  		t10, c0 = bits.Add64(0, c1, c0)
  1036  		u11, _ = bits.Add64(u11, 0, c0)
  1037  		t0, c0 = bits.Add64(u0, t0, 0)
  1038  		t1, c0 = bits.Add64(u1, t1, c0)
  1039  		t2, c0 = bits.Add64(u2, t2, c0)
  1040  		t3, c0 = bits.Add64(u3, t3, c0)
  1041  		t4, c0 = bits.Add64(u4, t4, c0)
  1042  		t5, c0 = bits.Add64(u5, t5, c0)
  1043  		t6, c0 = bits.Add64(u6, t6, c0)
  1044  		t7, c0 = bits.Add64(u7, t7, c0)
  1045  		t8, c0 = bits.Add64(u8, t8, c0)
  1046  		t9, c0 = bits.Add64(u9, t9, c0)
  1047  		t10, c0 = bits.Add64(u10, t10, c0)
  1048  		c2, _ = bits.Add64(c2, 0, c0)
  1049  		t10, c0 = bits.Add64(t11, t10, 0)
  1050  		t11, _ = bits.Add64(u11, c2, c0)
  1051  
  1052  	}
  1053  	{
  1054  		var c0, c1, c2 uint64
  1055  		v := x[11]
  1056  		u0, c1 = bits.Mul64(v, y[0])
  1057  		t0, c0 = bits.Add64(c1, t0, 0)
  1058  		u1, c1 = bits.Mul64(v, y[1])
  1059  		t1, c0 = bits.Add64(c1, t1, c0)
  1060  		u2, c1 = bits.Mul64(v, y[2])
  1061  		t2, c0 = bits.Add64(c1, t2, c0)
  1062  		u3, c1 = bits.Mul64(v, y[3])
  1063  		t3, c0 = bits.Add64(c1, t3, c0)
  1064  		u4, c1 = bits.Mul64(v, y[4])
  1065  		t4, c0 = bits.Add64(c1, t4, c0)
  1066  		u5, c1 = bits.Mul64(v, y[5])
  1067  		t5, c0 = bits.Add64(c1, t5, c0)
  1068  		u6, c1 = bits.Mul64(v, y[6])
  1069  		t6, c0 = bits.Add64(c1, t6, c0)
  1070  		u7, c1 = bits.Mul64(v, y[7])
  1071  		t7, c0 = bits.Add64(c1, t7, c0)
  1072  		u8, c1 = bits.Mul64(v, y[8])
  1073  		t8, c0 = bits.Add64(c1, t8, c0)
  1074  		u9, c1 = bits.Mul64(v, y[9])
  1075  		t9, c0 = bits.Add64(c1, t9, c0)
  1076  		u10, c1 = bits.Mul64(v, y[10])
  1077  		t10, c0 = bits.Add64(c1, t10, c0)
  1078  		u11, c1 = bits.Mul64(v, y[11])
  1079  		t11, c0 = bits.Add64(c1, t11, c0)
  1080  
  1081  		c2, _ = bits.Add64(0, 0, c0)
  1082  		t1, c0 = bits.Add64(u0, t1, 0)
  1083  		t2, c0 = bits.Add64(u1, t2, c0)
  1084  		t3, c0 = bits.Add64(u2, t3, c0)
  1085  		t4, c0 = bits.Add64(u3, t4, c0)
  1086  		t5, c0 = bits.Add64(u4, t5, c0)
  1087  		t6, c0 = bits.Add64(u5, t6, c0)
  1088  		t7, c0 = bits.Add64(u6, t7, c0)
  1089  		t8, c0 = bits.Add64(u7, t8, c0)
  1090  		t9, c0 = bits.Add64(u8, t9, c0)
  1091  		t10, c0 = bits.Add64(u9, t10, c0)
  1092  		t11, c0 = bits.Add64(u10, t11, c0)
  1093  		c2, _ = bits.Add64(u11, c2, c0)
  1094  
  1095  		m := qInvNeg * t0
  1096  
  1097  		u0, c1 = bits.Mul64(m, q0)
  1098  		_, c0 = bits.Add64(t0, c1, 0)
  1099  		u1, c1 = bits.Mul64(m, q1)
  1100  		t0, c0 = bits.Add64(t1, c1, c0)
  1101  		u2, c1 = bits.Mul64(m, q2)
  1102  		t1, c0 = bits.Add64(t2, c1, c0)
  1103  		u3, c1 = bits.Mul64(m, q3)
  1104  		t2, c0 = bits.Add64(t3, c1, c0)
  1105  		u4, c1 = bits.Mul64(m, q4)
  1106  		t3, c0 = bits.Add64(t4, c1, c0)
  1107  		u5, c1 = bits.Mul64(m, q5)
  1108  		t4, c0 = bits.Add64(t5, c1, c0)
  1109  		u6, c1 = bits.Mul64(m, q6)
  1110  		t5, c0 = bits.Add64(t6, c1, c0)
  1111  		u7, c1 = bits.Mul64(m, q7)
  1112  		t6, c0 = bits.Add64(t7, c1, c0)
  1113  		u8, c1 = bits.Mul64(m, q8)
  1114  		t7, c0 = bits.Add64(t8, c1, c0)
  1115  		u9, c1 = bits.Mul64(m, q9)
  1116  		t8, c0 = bits.Add64(t9, c1, c0)
  1117  		u10, c1 = bits.Mul64(m, q10)
  1118  		t9, c0 = bits.Add64(t10, c1, c0)
  1119  		u11, c1 = bits.Mul64(m, q11)
  1120  
  1121  		t10, c0 = bits.Add64(0, c1, c0)
  1122  		u11, _ = bits.Add64(u11, 0, c0)
  1123  		t0, c0 = bits.Add64(u0, t0, 0)
  1124  		t1, c0 = bits.Add64(u1, t1, c0)
  1125  		t2, c0 = bits.Add64(u2, t2, c0)
  1126  		t3, c0 = bits.Add64(u3, t3, c0)
  1127  		t4, c0 = bits.Add64(u4, t4, c0)
  1128  		t5, c0 = bits.Add64(u5, t5, c0)
  1129  		t6, c0 = bits.Add64(u6, t6, c0)
  1130  		t7, c0 = bits.Add64(u7, t7, c0)
  1131  		t8, c0 = bits.Add64(u8, t8, c0)
  1132  		t9, c0 = bits.Add64(u9, t9, c0)
  1133  		t10, c0 = bits.Add64(u10, t10, c0)
  1134  		c2, _ = bits.Add64(c2, 0, c0)
  1135  		t10, c0 = bits.Add64(t11, t10, 0)
  1136  		t11, _ = bits.Add64(u11, c2, c0)
  1137  
  1138  	}
  1139  	z[0] = t0
  1140  	z[1] = t1
  1141  	z[2] = t2
  1142  	z[3] = t3
  1143  	z[4] = t4
  1144  	z[5] = t5
  1145  	z[6] = t6
  1146  	z[7] = t7
  1147  	z[8] = t8
  1148  	z[9] = t9
  1149  	z[10] = t10
  1150  	z[11] = t11
  1151  
  1152  	// if z ⩾ q → z -= q
  1153  	if !z.smallerThanModulus() {
  1154  		var b uint64
  1155  		z[0], b = bits.Sub64(z[0], q0, 0)
  1156  		z[1], b = bits.Sub64(z[1], q1, b)
  1157  		z[2], b = bits.Sub64(z[2], q2, b)
  1158  		z[3], b = bits.Sub64(z[3], q3, b)
  1159  		z[4], b = bits.Sub64(z[4], q4, b)
  1160  		z[5], b = bits.Sub64(z[5], q5, b)
  1161  		z[6], b = bits.Sub64(z[6], q6, b)
  1162  		z[7], b = bits.Sub64(z[7], q7, b)
  1163  		z[8], b = bits.Sub64(z[8], q8, b)
  1164  		z[9], b = bits.Sub64(z[9], q9, b)
  1165  		z[10], b = bits.Sub64(z[10], q10, b)
  1166  		z[11], _ = bits.Sub64(z[11], q11, b)
  1167  	}
  1168  	return z
  1169  }
  1170  
  1171  // Square z = x * x (mod q)
  1172  //
  1173  // x must be less than q
  1174  func (z *Element) Square(x *Element) *Element {
  1175  	// see Mul for algorithm documentation
  1176  
  1177  	var t0, t1, t2, t3, t4, t5, t6, t7, t8, t9, t10, t11 uint64
  1178  	var u0, u1, u2, u3, u4, u5, u6, u7, u8, u9, u10, u11 uint64
  1179  	{
  1180  		var c0, c1, c2 uint64
  1181  		v := x[0]
  1182  		u0, t0 = bits.Mul64(v, x[0])
  1183  		u1, t1 = bits.Mul64(v, x[1])
  1184  		u2, t2 = bits.Mul64(v, x[2])
  1185  		u3, t3 = bits.Mul64(v, x[3])
  1186  		u4, t4 = bits.Mul64(v, x[4])
  1187  		u5, t5 = bits.Mul64(v, x[5])
  1188  		u6, t6 = bits.Mul64(v, x[6])
  1189  		u7, t7 = bits.Mul64(v, x[7])
  1190  		u8, t8 = bits.Mul64(v, x[8])
  1191  		u9, t9 = bits.Mul64(v, x[9])
  1192  		u10, t10 = bits.Mul64(v, x[10])
  1193  		u11, t11 = bits.Mul64(v, x[11])
  1194  		t1, c0 = bits.Add64(u0, t1, 0)
  1195  		t2, c0 = bits.Add64(u1, t2, c0)
  1196  		t3, c0 = bits.Add64(u2, t3, c0)
  1197  		t4, c0 = bits.Add64(u3, t4, c0)
  1198  		t5, c0 = bits.Add64(u4, t5, c0)
  1199  		t6, c0 = bits.Add64(u5, t6, c0)
  1200  		t7, c0 = bits.Add64(u6, t7, c0)
  1201  		t8, c0 = bits.Add64(u7, t8, c0)
  1202  		t9, c0 = bits.Add64(u8, t9, c0)
  1203  		t10, c0 = bits.Add64(u9, t10, c0)
  1204  		t11, c0 = bits.Add64(u10, t11, c0)
  1205  		c2, _ = bits.Add64(u11, 0, c0)
  1206  
  1207  		m := qInvNeg * t0
  1208  
  1209  		u0, c1 = bits.Mul64(m, q0)
  1210  		_, c0 = bits.Add64(t0, c1, 0)
  1211  		u1, c1 = bits.Mul64(m, q1)
  1212  		t0, c0 = bits.Add64(t1, c1, c0)
  1213  		u2, c1 = bits.Mul64(m, q2)
  1214  		t1, c0 = bits.Add64(t2, c1, c0)
  1215  		u3, c1 = bits.Mul64(m, q3)
  1216  		t2, c0 = bits.Add64(t3, c1, c0)
  1217  		u4, c1 = bits.Mul64(m, q4)
  1218  		t3, c0 = bits.Add64(t4, c1, c0)
  1219  		u5, c1 = bits.Mul64(m, q5)
  1220  		t4, c0 = bits.Add64(t5, c1, c0)
  1221  		u6, c1 = bits.Mul64(m, q6)
  1222  		t5, c0 = bits.Add64(t6, c1, c0)
  1223  		u7, c1 = bits.Mul64(m, q7)
  1224  		t6, c0 = bits.Add64(t7, c1, c0)
  1225  		u8, c1 = bits.Mul64(m, q8)
  1226  		t7, c0 = bits.Add64(t8, c1, c0)
  1227  		u9, c1 = bits.Mul64(m, q9)
  1228  		t8, c0 = bits.Add64(t9, c1, c0)
  1229  		u10, c1 = bits.Mul64(m, q10)
  1230  		t9, c0 = bits.Add64(t10, c1, c0)
  1231  		u11, c1 = bits.Mul64(m, q11)
  1232  
  1233  		t10, c0 = bits.Add64(0, c1, c0)
  1234  		u11, _ = bits.Add64(u11, 0, c0)
  1235  		t0, c0 = bits.Add64(u0, t0, 0)
  1236  		t1, c0 = bits.Add64(u1, t1, c0)
  1237  		t2, c0 = bits.Add64(u2, t2, c0)
  1238  		t3, c0 = bits.Add64(u3, t3, c0)
  1239  		t4, c0 = bits.Add64(u4, t4, c0)
  1240  		t5, c0 = bits.Add64(u5, t5, c0)
  1241  		t6, c0 = bits.Add64(u6, t6, c0)
  1242  		t7, c0 = bits.Add64(u7, t7, c0)
  1243  		t8, c0 = bits.Add64(u8, t8, c0)
  1244  		t9, c0 = bits.Add64(u9, t9, c0)
  1245  		t10, c0 = bits.Add64(u10, t10, c0)
  1246  		c2, _ = bits.Add64(c2, 0, c0)
  1247  		t10, c0 = bits.Add64(t11, t10, 0)
  1248  		t11, _ = bits.Add64(u11, c2, c0)
  1249  
  1250  	}
  1251  	{
  1252  		var c0, c1, c2 uint64
  1253  		v := x[1]
  1254  		u0, c1 = bits.Mul64(v, x[0])
  1255  		t0, c0 = bits.Add64(c1, t0, 0)
  1256  		u1, c1 = bits.Mul64(v, x[1])
  1257  		t1, c0 = bits.Add64(c1, t1, c0)
  1258  		u2, c1 = bits.Mul64(v, x[2])
  1259  		t2, c0 = bits.Add64(c1, t2, c0)
  1260  		u3, c1 = bits.Mul64(v, x[3])
  1261  		t3, c0 = bits.Add64(c1, t3, c0)
  1262  		u4, c1 = bits.Mul64(v, x[4])
  1263  		t4, c0 = bits.Add64(c1, t4, c0)
  1264  		u5, c1 = bits.Mul64(v, x[5])
  1265  		t5, c0 = bits.Add64(c1, t5, c0)
  1266  		u6, c1 = bits.Mul64(v, x[6])
  1267  		t6, c0 = bits.Add64(c1, t6, c0)
  1268  		u7, c1 = bits.Mul64(v, x[7])
  1269  		t7, c0 = bits.Add64(c1, t7, c0)
  1270  		u8, c1 = bits.Mul64(v, x[8])
  1271  		t8, c0 = bits.Add64(c1, t8, c0)
  1272  		u9, c1 = bits.Mul64(v, x[9])
  1273  		t9, c0 = bits.Add64(c1, t9, c0)
  1274  		u10, c1 = bits.Mul64(v, x[10])
  1275  		t10, c0 = bits.Add64(c1, t10, c0)
  1276  		u11, c1 = bits.Mul64(v, x[11])
  1277  		t11, c0 = bits.Add64(c1, t11, c0)
  1278  
  1279  		c2, _ = bits.Add64(0, 0, c0)
  1280  		t1, c0 = bits.Add64(u0, t1, 0)
  1281  		t2, c0 = bits.Add64(u1, t2, c0)
  1282  		t3, c0 = bits.Add64(u2, t3, c0)
  1283  		t4, c0 = bits.Add64(u3, t4, c0)
  1284  		t5, c0 = bits.Add64(u4, t5, c0)
  1285  		t6, c0 = bits.Add64(u5, t6, c0)
  1286  		t7, c0 = bits.Add64(u6, t7, c0)
  1287  		t8, c0 = bits.Add64(u7, t8, c0)
  1288  		t9, c0 = bits.Add64(u8, t9, c0)
  1289  		t10, c0 = bits.Add64(u9, t10, c0)
  1290  		t11, c0 = bits.Add64(u10, t11, c0)
  1291  		c2, _ = bits.Add64(u11, c2, c0)
  1292  
  1293  		m := qInvNeg * t0
  1294  
  1295  		u0, c1 = bits.Mul64(m, q0)
  1296  		_, c0 = bits.Add64(t0, c1, 0)
  1297  		u1, c1 = bits.Mul64(m, q1)
  1298  		t0, c0 = bits.Add64(t1, c1, c0)
  1299  		u2, c1 = bits.Mul64(m, q2)
  1300  		t1, c0 = bits.Add64(t2, c1, c0)
  1301  		u3, c1 = bits.Mul64(m, q3)
  1302  		t2, c0 = bits.Add64(t3, c1, c0)
  1303  		u4, c1 = bits.Mul64(m, q4)
  1304  		t3, c0 = bits.Add64(t4, c1, c0)
  1305  		u5, c1 = bits.Mul64(m, q5)
  1306  		t4, c0 = bits.Add64(t5, c1, c0)
  1307  		u6, c1 = bits.Mul64(m, q6)
  1308  		t5, c0 = bits.Add64(t6, c1, c0)
  1309  		u7, c1 = bits.Mul64(m, q7)
  1310  		t6, c0 = bits.Add64(t7, c1, c0)
  1311  		u8, c1 = bits.Mul64(m, q8)
  1312  		t7, c0 = bits.Add64(t8, c1, c0)
  1313  		u9, c1 = bits.Mul64(m, q9)
  1314  		t8, c0 = bits.Add64(t9, c1, c0)
  1315  		u10, c1 = bits.Mul64(m, q10)
  1316  		t9, c0 = bits.Add64(t10, c1, c0)
  1317  		u11, c1 = bits.Mul64(m, q11)
  1318  
  1319  		t10, c0 = bits.Add64(0, c1, c0)
  1320  		u11, _ = bits.Add64(u11, 0, c0)
  1321  		t0, c0 = bits.Add64(u0, t0, 0)
  1322  		t1, c0 = bits.Add64(u1, t1, c0)
  1323  		t2, c0 = bits.Add64(u2, t2, c0)
  1324  		t3, c0 = bits.Add64(u3, t3, c0)
  1325  		t4, c0 = bits.Add64(u4, t4, c0)
  1326  		t5, c0 = bits.Add64(u5, t5, c0)
  1327  		t6, c0 = bits.Add64(u6, t6, c0)
  1328  		t7, c0 = bits.Add64(u7, t7, c0)
  1329  		t8, c0 = bits.Add64(u8, t8, c0)
  1330  		t9, c0 = bits.Add64(u9, t9, c0)
  1331  		t10, c0 = bits.Add64(u10, t10, c0)
  1332  		c2, _ = bits.Add64(c2, 0, c0)
  1333  		t10, c0 = bits.Add64(t11, t10, 0)
  1334  		t11, _ = bits.Add64(u11, c2, c0)
  1335  
  1336  	}
  1337  	{
  1338  		var c0, c1, c2 uint64
  1339  		v := x[2]
  1340  		u0, c1 = bits.Mul64(v, x[0])
  1341  		t0, c0 = bits.Add64(c1, t0, 0)
  1342  		u1, c1 = bits.Mul64(v, x[1])
  1343  		t1, c0 = bits.Add64(c1, t1, c0)
  1344  		u2, c1 = bits.Mul64(v, x[2])
  1345  		t2, c0 = bits.Add64(c1, t2, c0)
  1346  		u3, c1 = bits.Mul64(v, x[3])
  1347  		t3, c0 = bits.Add64(c1, t3, c0)
  1348  		u4, c1 = bits.Mul64(v, x[4])
  1349  		t4, c0 = bits.Add64(c1, t4, c0)
  1350  		u5, c1 = bits.Mul64(v, x[5])
  1351  		t5, c0 = bits.Add64(c1, t5, c0)
  1352  		u6, c1 = bits.Mul64(v, x[6])
  1353  		t6, c0 = bits.Add64(c1, t6, c0)
  1354  		u7, c1 = bits.Mul64(v, x[7])
  1355  		t7, c0 = bits.Add64(c1, t7, c0)
  1356  		u8, c1 = bits.Mul64(v, x[8])
  1357  		t8, c0 = bits.Add64(c1, t8, c0)
  1358  		u9, c1 = bits.Mul64(v, x[9])
  1359  		t9, c0 = bits.Add64(c1, t9, c0)
  1360  		u10, c1 = bits.Mul64(v, x[10])
  1361  		t10, c0 = bits.Add64(c1, t10, c0)
  1362  		u11, c1 = bits.Mul64(v, x[11])
  1363  		t11, c0 = bits.Add64(c1, t11, c0)
  1364  
  1365  		c2, _ = bits.Add64(0, 0, c0)
  1366  		t1, c0 = bits.Add64(u0, t1, 0)
  1367  		t2, c0 = bits.Add64(u1, t2, c0)
  1368  		t3, c0 = bits.Add64(u2, t3, c0)
  1369  		t4, c0 = bits.Add64(u3, t4, c0)
  1370  		t5, c0 = bits.Add64(u4, t5, c0)
  1371  		t6, c0 = bits.Add64(u5, t6, c0)
  1372  		t7, c0 = bits.Add64(u6, t7, c0)
  1373  		t8, c0 = bits.Add64(u7, t8, c0)
  1374  		t9, c0 = bits.Add64(u8, t9, c0)
  1375  		t10, c0 = bits.Add64(u9, t10, c0)
  1376  		t11, c0 = bits.Add64(u10, t11, c0)
  1377  		c2, _ = bits.Add64(u11, c2, c0)
  1378  
  1379  		m := qInvNeg * t0
  1380  
  1381  		u0, c1 = bits.Mul64(m, q0)
  1382  		_, c0 = bits.Add64(t0, c1, 0)
  1383  		u1, c1 = bits.Mul64(m, q1)
  1384  		t0, c0 = bits.Add64(t1, c1, c0)
  1385  		u2, c1 = bits.Mul64(m, q2)
  1386  		t1, c0 = bits.Add64(t2, c1, c0)
  1387  		u3, c1 = bits.Mul64(m, q3)
  1388  		t2, c0 = bits.Add64(t3, c1, c0)
  1389  		u4, c1 = bits.Mul64(m, q4)
  1390  		t3, c0 = bits.Add64(t4, c1, c0)
  1391  		u5, c1 = bits.Mul64(m, q5)
  1392  		t4, c0 = bits.Add64(t5, c1, c0)
  1393  		u6, c1 = bits.Mul64(m, q6)
  1394  		t5, c0 = bits.Add64(t6, c1, c0)
  1395  		u7, c1 = bits.Mul64(m, q7)
  1396  		t6, c0 = bits.Add64(t7, c1, c0)
  1397  		u8, c1 = bits.Mul64(m, q8)
  1398  		t7, c0 = bits.Add64(t8, c1, c0)
  1399  		u9, c1 = bits.Mul64(m, q9)
  1400  		t8, c0 = bits.Add64(t9, c1, c0)
  1401  		u10, c1 = bits.Mul64(m, q10)
  1402  		t9, c0 = bits.Add64(t10, c1, c0)
  1403  		u11, c1 = bits.Mul64(m, q11)
  1404  
  1405  		t10, c0 = bits.Add64(0, c1, c0)
  1406  		u11, _ = bits.Add64(u11, 0, c0)
  1407  		t0, c0 = bits.Add64(u0, t0, 0)
  1408  		t1, c0 = bits.Add64(u1, t1, c0)
  1409  		t2, c0 = bits.Add64(u2, t2, c0)
  1410  		t3, c0 = bits.Add64(u3, t3, c0)
  1411  		t4, c0 = bits.Add64(u4, t4, c0)
  1412  		t5, c0 = bits.Add64(u5, t5, c0)
  1413  		t6, c0 = bits.Add64(u6, t6, c0)
  1414  		t7, c0 = bits.Add64(u7, t7, c0)
  1415  		t8, c0 = bits.Add64(u8, t8, c0)
  1416  		t9, c0 = bits.Add64(u9, t9, c0)
  1417  		t10, c0 = bits.Add64(u10, t10, c0)
  1418  		c2, _ = bits.Add64(c2, 0, c0)
  1419  		t10, c0 = bits.Add64(t11, t10, 0)
  1420  		t11, _ = bits.Add64(u11, c2, c0)
  1421  
  1422  	}
  1423  	{
  1424  		var c0, c1, c2 uint64
  1425  		v := x[3]
  1426  		u0, c1 = bits.Mul64(v, x[0])
  1427  		t0, c0 = bits.Add64(c1, t0, 0)
  1428  		u1, c1 = bits.Mul64(v, x[1])
  1429  		t1, c0 = bits.Add64(c1, t1, c0)
  1430  		u2, c1 = bits.Mul64(v, x[2])
  1431  		t2, c0 = bits.Add64(c1, t2, c0)
  1432  		u3, c1 = bits.Mul64(v, x[3])
  1433  		t3, c0 = bits.Add64(c1, t3, c0)
  1434  		u4, c1 = bits.Mul64(v, x[4])
  1435  		t4, c0 = bits.Add64(c1, t4, c0)
  1436  		u5, c1 = bits.Mul64(v, x[5])
  1437  		t5, c0 = bits.Add64(c1, t5, c0)
  1438  		u6, c1 = bits.Mul64(v, x[6])
  1439  		t6, c0 = bits.Add64(c1, t6, c0)
  1440  		u7, c1 = bits.Mul64(v, x[7])
  1441  		t7, c0 = bits.Add64(c1, t7, c0)
  1442  		u8, c1 = bits.Mul64(v, x[8])
  1443  		t8, c0 = bits.Add64(c1, t8, c0)
  1444  		u9, c1 = bits.Mul64(v, x[9])
  1445  		t9, c0 = bits.Add64(c1, t9, c0)
  1446  		u10, c1 = bits.Mul64(v, x[10])
  1447  		t10, c0 = bits.Add64(c1, t10, c0)
  1448  		u11, c1 = bits.Mul64(v, x[11])
  1449  		t11, c0 = bits.Add64(c1, t11, c0)
  1450  
  1451  		c2, _ = bits.Add64(0, 0, c0)
  1452  		t1, c0 = bits.Add64(u0, t1, 0)
  1453  		t2, c0 = bits.Add64(u1, t2, c0)
  1454  		t3, c0 = bits.Add64(u2, t3, c0)
  1455  		t4, c0 = bits.Add64(u3, t4, c0)
  1456  		t5, c0 = bits.Add64(u4, t5, c0)
  1457  		t6, c0 = bits.Add64(u5, t6, c0)
  1458  		t7, c0 = bits.Add64(u6, t7, c0)
  1459  		t8, c0 = bits.Add64(u7, t8, c0)
  1460  		t9, c0 = bits.Add64(u8, t9, c0)
  1461  		t10, c0 = bits.Add64(u9, t10, c0)
  1462  		t11, c0 = bits.Add64(u10, t11, c0)
  1463  		c2, _ = bits.Add64(u11, c2, c0)
  1464  
  1465  		m := qInvNeg * t0
  1466  
  1467  		u0, c1 = bits.Mul64(m, q0)
  1468  		_, c0 = bits.Add64(t0, c1, 0)
  1469  		u1, c1 = bits.Mul64(m, q1)
  1470  		t0, c0 = bits.Add64(t1, c1, c0)
  1471  		u2, c1 = bits.Mul64(m, q2)
  1472  		t1, c0 = bits.Add64(t2, c1, c0)
  1473  		u3, c1 = bits.Mul64(m, q3)
  1474  		t2, c0 = bits.Add64(t3, c1, c0)
  1475  		u4, c1 = bits.Mul64(m, q4)
  1476  		t3, c0 = bits.Add64(t4, c1, c0)
  1477  		u5, c1 = bits.Mul64(m, q5)
  1478  		t4, c0 = bits.Add64(t5, c1, c0)
  1479  		u6, c1 = bits.Mul64(m, q6)
  1480  		t5, c0 = bits.Add64(t6, c1, c0)
  1481  		u7, c1 = bits.Mul64(m, q7)
  1482  		t6, c0 = bits.Add64(t7, c1, c0)
  1483  		u8, c1 = bits.Mul64(m, q8)
  1484  		t7, c0 = bits.Add64(t8, c1, c0)
  1485  		u9, c1 = bits.Mul64(m, q9)
  1486  		t8, c0 = bits.Add64(t9, c1, c0)
  1487  		u10, c1 = bits.Mul64(m, q10)
  1488  		t9, c0 = bits.Add64(t10, c1, c0)
  1489  		u11, c1 = bits.Mul64(m, q11)
  1490  
  1491  		t10, c0 = bits.Add64(0, c1, c0)
  1492  		u11, _ = bits.Add64(u11, 0, c0)
  1493  		t0, c0 = bits.Add64(u0, t0, 0)
  1494  		t1, c0 = bits.Add64(u1, t1, c0)
  1495  		t2, c0 = bits.Add64(u2, t2, c0)
  1496  		t3, c0 = bits.Add64(u3, t3, c0)
  1497  		t4, c0 = bits.Add64(u4, t4, c0)
  1498  		t5, c0 = bits.Add64(u5, t5, c0)
  1499  		t6, c0 = bits.Add64(u6, t6, c0)
  1500  		t7, c0 = bits.Add64(u7, t7, c0)
  1501  		t8, c0 = bits.Add64(u8, t8, c0)
  1502  		t9, c0 = bits.Add64(u9, t9, c0)
  1503  		t10, c0 = bits.Add64(u10, t10, c0)
  1504  		c2, _ = bits.Add64(c2, 0, c0)
  1505  		t10, c0 = bits.Add64(t11, t10, 0)
  1506  		t11, _ = bits.Add64(u11, c2, c0)
  1507  
  1508  	}
  1509  	{
  1510  		var c0, c1, c2 uint64
  1511  		v := x[4]
  1512  		u0, c1 = bits.Mul64(v, x[0])
  1513  		t0, c0 = bits.Add64(c1, t0, 0)
  1514  		u1, c1 = bits.Mul64(v, x[1])
  1515  		t1, c0 = bits.Add64(c1, t1, c0)
  1516  		u2, c1 = bits.Mul64(v, x[2])
  1517  		t2, c0 = bits.Add64(c1, t2, c0)
  1518  		u3, c1 = bits.Mul64(v, x[3])
  1519  		t3, c0 = bits.Add64(c1, t3, c0)
  1520  		u4, c1 = bits.Mul64(v, x[4])
  1521  		t4, c0 = bits.Add64(c1, t4, c0)
  1522  		u5, c1 = bits.Mul64(v, x[5])
  1523  		t5, c0 = bits.Add64(c1, t5, c0)
  1524  		u6, c1 = bits.Mul64(v, x[6])
  1525  		t6, c0 = bits.Add64(c1, t6, c0)
  1526  		u7, c1 = bits.Mul64(v, x[7])
  1527  		t7, c0 = bits.Add64(c1, t7, c0)
  1528  		u8, c1 = bits.Mul64(v, x[8])
  1529  		t8, c0 = bits.Add64(c1, t8, c0)
  1530  		u9, c1 = bits.Mul64(v, x[9])
  1531  		t9, c0 = bits.Add64(c1, t9, c0)
  1532  		u10, c1 = bits.Mul64(v, x[10])
  1533  		t10, c0 = bits.Add64(c1, t10, c0)
  1534  		u11, c1 = bits.Mul64(v, x[11])
  1535  		t11, c0 = bits.Add64(c1, t11, c0)
  1536  
  1537  		c2, _ = bits.Add64(0, 0, c0)
  1538  		t1, c0 = bits.Add64(u0, t1, 0)
  1539  		t2, c0 = bits.Add64(u1, t2, c0)
  1540  		t3, c0 = bits.Add64(u2, t3, c0)
  1541  		t4, c0 = bits.Add64(u3, t4, c0)
  1542  		t5, c0 = bits.Add64(u4, t5, c0)
  1543  		t6, c0 = bits.Add64(u5, t6, c0)
  1544  		t7, c0 = bits.Add64(u6, t7, c0)
  1545  		t8, c0 = bits.Add64(u7, t8, c0)
  1546  		t9, c0 = bits.Add64(u8, t9, c0)
  1547  		t10, c0 = bits.Add64(u9, t10, c0)
  1548  		t11, c0 = bits.Add64(u10, t11, c0)
  1549  		c2, _ = bits.Add64(u11, c2, c0)
  1550  
  1551  		m := qInvNeg * t0
  1552  
  1553  		u0, c1 = bits.Mul64(m, q0)
  1554  		_, c0 = bits.Add64(t0, c1, 0)
  1555  		u1, c1 = bits.Mul64(m, q1)
  1556  		t0, c0 = bits.Add64(t1, c1, c0)
  1557  		u2, c1 = bits.Mul64(m, q2)
  1558  		t1, c0 = bits.Add64(t2, c1, c0)
  1559  		u3, c1 = bits.Mul64(m, q3)
  1560  		t2, c0 = bits.Add64(t3, c1, c0)
  1561  		u4, c1 = bits.Mul64(m, q4)
  1562  		t3, c0 = bits.Add64(t4, c1, c0)
  1563  		u5, c1 = bits.Mul64(m, q5)
  1564  		t4, c0 = bits.Add64(t5, c1, c0)
  1565  		u6, c1 = bits.Mul64(m, q6)
  1566  		t5, c0 = bits.Add64(t6, c1, c0)
  1567  		u7, c1 = bits.Mul64(m, q7)
  1568  		t6, c0 = bits.Add64(t7, c1, c0)
  1569  		u8, c1 = bits.Mul64(m, q8)
  1570  		t7, c0 = bits.Add64(t8, c1, c0)
  1571  		u9, c1 = bits.Mul64(m, q9)
  1572  		t8, c0 = bits.Add64(t9, c1, c0)
  1573  		u10, c1 = bits.Mul64(m, q10)
  1574  		t9, c0 = bits.Add64(t10, c1, c0)
  1575  		u11, c1 = bits.Mul64(m, q11)
  1576  
  1577  		t10, c0 = bits.Add64(0, c1, c0)
  1578  		u11, _ = bits.Add64(u11, 0, c0)
  1579  		t0, c0 = bits.Add64(u0, t0, 0)
  1580  		t1, c0 = bits.Add64(u1, t1, c0)
  1581  		t2, c0 = bits.Add64(u2, t2, c0)
  1582  		t3, c0 = bits.Add64(u3, t3, c0)
  1583  		t4, c0 = bits.Add64(u4, t4, c0)
  1584  		t5, c0 = bits.Add64(u5, t5, c0)
  1585  		t6, c0 = bits.Add64(u6, t6, c0)
  1586  		t7, c0 = bits.Add64(u7, t7, c0)
  1587  		t8, c0 = bits.Add64(u8, t8, c0)
  1588  		t9, c0 = bits.Add64(u9, t9, c0)
  1589  		t10, c0 = bits.Add64(u10, t10, c0)
  1590  		c2, _ = bits.Add64(c2, 0, c0)
  1591  		t10, c0 = bits.Add64(t11, t10, 0)
  1592  		t11, _ = bits.Add64(u11, c2, c0)
  1593  
  1594  	}
  1595  	{
  1596  		var c0, c1, c2 uint64
  1597  		v := x[5]
  1598  		u0, c1 = bits.Mul64(v, x[0])
  1599  		t0, c0 = bits.Add64(c1, t0, 0)
  1600  		u1, c1 = bits.Mul64(v, x[1])
  1601  		t1, c0 = bits.Add64(c1, t1, c0)
  1602  		u2, c1 = bits.Mul64(v, x[2])
  1603  		t2, c0 = bits.Add64(c1, t2, c0)
  1604  		u3, c1 = bits.Mul64(v, x[3])
  1605  		t3, c0 = bits.Add64(c1, t3, c0)
  1606  		u4, c1 = bits.Mul64(v, x[4])
  1607  		t4, c0 = bits.Add64(c1, t4, c0)
  1608  		u5, c1 = bits.Mul64(v, x[5])
  1609  		t5, c0 = bits.Add64(c1, t5, c0)
  1610  		u6, c1 = bits.Mul64(v, x[6])
  1611  		t6, c0 = bits.Add64(c1, t6, c0)
  1612  		u7, c1 = bits.Mul64(v, x[7])
  1613  		t7, c0 = bits.Add64(c1, t7, c0)
  1614  		u8, c1 = bits.Mul64(v, x[8])
  1615  		t8, c0 = bits.Add64(c1, t8, c0)
  1616  		u9, c1 = bits.Mul64(v, x[9])
  1617  		t9, c0 = bits.Add64(c1, t9, c0)
  1618  		u10, c1 = bits.Mul64(v, x[10])
  1619  		t10, c0 = bits.Add64(c1, t10, c0)
  1620  		u11, c1 = bits.Mul64(v, x[11])
  1621  		t11, c0 = bits.Add64(c1, t11, c0)
  1622  
  1623  		c2, _ = bits.Add64(0, 0, c0)
  1624  		t1, c0 = bits.Add64(u0, t1, 0)
  1625  		t2, c0 = bits.Add64(u1, t2, c0)
  1626  		t3, c0 = bits.Add64(u2, t3, c0)
  1627  		t4, c0 = bits.Add64(u3, t4, c0)
  1628  		t5, c0 = bits.Add64(u4, t5, c0)
  1629  		t6, c0 = bits.Add64(u5, t6, c0)
  1630  		t7, c0 = bits.Add64(u6, t7, c0)
  1631  		t8, c0 = bits.Add64(u7, t8, c0)
  1632  		t9, c0 = bits.Add64(u8, t9, c0)
  1633  		t10, c0 = bits.Add64(u9, t10, c0)
  1634  		t11, c0 = bits.Add64(u10, t11, c0)
  1635  		c2, _ = bits.Add64(u11, c2, c0)
  1636  
  1637  		m := qInvNeg * t0
  1638  
  1639  		u0, c1 = bits.Mul64(m, q0)
  1640  		_, c0 = bits.Add64(t0, c1, 0)
  1641  		u1, c1 = bits.Mul64(m, q1)
  1642  		t0, c0 = bits.Add64(t1, c1, c0)
  1643  		u2, c1 = bits.Mul64(m, q2)
  1644  		t1, c0 = bits.Add64(t2, c1, c0)
  1645  		u3, c1 = bits.Mul64(m, q3)
  1646  		t2, c0 = bits.Add64(t3, c1, c0)
  1647  		u4, c1 = bits.Mul64(m, q4)
  1648  		t3, c0 = bits.Add64(t4, c1, c0)
  1649  		u5, c1 = bits.Mul64(m, q5)
  1650  		t4, c0 = bits.Add64(t5, c1, c0)
  1651  		u6, c1 = bits.Mul64(m, q6)
  1652  		t5, c0 = bits.Add64(t6, c1, c0)
  1653  		u7, c1 = bits.Mul64(m, q7)
  1654  		t6, c0 = bits.Add64(t7, c1, c0)
  1655  		u8, c1 = bits.Mul64(m, q8)
  1656  		t7, c0 = bits.Add64(t8, c1, c0)
  1657  		u9, c1 = bits.Mul64(m, q9)
  1658  		t8, c0 = bits.Add64(t9, c1, c0)
  1659  		u10, c1 = bits.Mul64(m, q10)
  1660  		t9, c0 = bits.Add64(t10, c1, c0)
  1661  		u11, c1 = bits.Mul64(m, q11)
  1662  
  1663  		t10, c0 = bits.Add64(0, c1, c0)
  1664  		u11, _ = bits.Add64(u11, 0, c0)
  1665  		t0, c0 = bits.Add64(u0, t0, 0)
  1666  		t1, c0 = bits.Add64(u1, t1, c0)
  1667  		t2, c0 = bits.Add64(u2, t2, c0)
  1668  		t3, c0 = bits.Add64(u3, t3, c0)
  1669  		t4, c0 = bits.Add64(u4, t4, c0)
  1670  		t5, c0 = bits.Add64(u5, t5, c0)
  1671  		t6, c0 = bits.Add64(u6, t6, c0)
  1672  		t7, c0 = bits.Add64(u7, t7, c0)
  1673  		t8, c0 = bits.Add64(u8, t8, c0)
  1674  		t9, c0 = bits.Add64(u9, t9, c0)
  1675  		t10, c0 = bits.Add64(u10, t10, c0)
  1676  		c2, _ = bits.Add64(c2, 0, c0)
  1677  		t10, c0 = bits.Add64(t11, t10, 0)
  1678  		t11, _ = bits.Add64(u11, c2, c0)
  1679  
  1680  	}
  1681  	{
  1682  		var c0, c1, c2 uint64
  1683  		v := x[6]
  1684  		u0, c1 = bits.Mul64(v, x[0])
  1685  		t0, c0 = bits.Add64(c1, t0, 0)
  1686  		u1, c1 = bits.Mul64(v, x[1])
  1687  		t1, c0 = bits.Add64(c1, t1, c0)
  1688  		u2, c1 = bits.Mul64(v, x[2])
  1689  		t2, c0 = bits.Add64(c1, t2, c0)
  1690  		u3, c1 = bits.Mul64(v, x[3])
  1691  		t3, c0 = bits.Add64(c1, t3, c0)
  1692  		u4, c1 = bits.Mul64(v, x[4])
  1693  		t4, c0 = bits.Add64(c1, t4, c0)
  1694  		u5, c1 = bits.Mul64(v, x[5])
  1695  		t5, c0 = bits.Add64(c1, t5, c0)
  1696  		u6, c1 = bits.Mul64(v, x[6])
  1697  		t6, c0 = bits.Add64(c1, t6, c0)
  1698  		u7, c1 = bits.Mul64(v, x[7])
  1699  		t7, c0 = bits.Add64(c1, t7, c0)
  1700  		u8, c1 = bits.Mul64(v, x[8])
  1701  		t8, c0 = bits.Add64(c1, t8, c0)
  1702  		u9, c1 = bits.Mul64(v, x[9])
  1703  		t9, c0 = bits.Add64(c1, t9, c0)
  1704  		u10, c1 = bits.Mul64(v, x[10])
  1705  		t10, c0 = bits.Add64(c1, t10, c0)
  1706  		u11, c1 = bits.Mul64(v, x[11])
  1707  		t11, c0 = bits.Add64(c1, t11, c0)
  1708  
  1709  		c2, _ = bits.Add64(0, 0, c0)
  1710  		t1, c0 = bits.Add64(u0, t1, 0)
  1711  		t2, c0 = bits.Add64(u1, t2, c0)
  1712  		t3, c0 = bits.Add64(u2, t3, c0)
  1713  		t4, c0 = bits.Add64(u3, t4, c0)
  1714  		t5, c0 = bits.Add64(u4, t5, c0)
  1715  		t6, c0 = bits.Add64(u5, t6, c0)
  1716  		t7, c0 = bits.Add64(u6, t7, c0)
  1717  		t8, c0 = bits.Add64(u7, t8, c0)
  1718  		t9, c0 = bits.Add64(u8, t9, c0)
  1719  		t10, c0 = bits.Add64(u9, t10, c0)
  1720  		t11, c0 = bits.Add64(u10, t11, c0)
  1721  		c2, _ = bits.Add64(u11, c2, c0)
  1722  
  1723  		m := qInvNeg * t0
  1724  
  1725  		u0, c1 = bits.Mul64(m, q0)
  1726  		_, c0 = bits.Add64(t0, c1, 0)
  1727  		u1, c1 = bits.Mul64(m, q1)
  1728  		t0, c0 = bits.Add64(t1, c1, c0)
  1729  		u2, c1 = bits.Mul64(m, q2)
  1730  		t1, c0 = bits.Add64(t2, c1, c0)
  1731  		u3, c1 = bits.Mul64(m, q3)
  1732  		t2, c0 = bits.Add64(t3, c1, c0)
  1733  		u4, c1 = bits.Mul64(m, q4)
  1734  		t3, c0 = bits.Add64(t4, c1, c0)
  1735  		u5, c1 = bits.Mul64(m, q5)
  1736  		t4, c0 = bits.Add64(t5, c1, c0)
  1737  		u6, c1 = bits.Mul64(m, q6)
  1738  		t5, c0 = bits.Add64(t6, c1, c0)
  1739  		u7, c1 = bits.Mul64(m, q7)
  1740  		t6, c0 = bits.Add64(t7, c1, c0)
  1741  		u8, c1 = bits.Mul64(m, q8)
  1742  		t7, c0 = bits.Add64(t8, c1, c0)
  1743  		u9, c1 = bits.Mul64(m, q9)
  1744  		t8, c0 = bits.Add64(t9, c1, c0)
  1745  		u10, c1 = bits.Mul64(m, q10)
  1746  		t9, c0 = bits.Add64(t10, c1, c0)
  1747  		u11, c1 = bits.Mul64(m, q11)
  1748  
  1749  		t10, c0 = bits.Add64(0, c1, c0)
  1750  		u11, _ = bits.Add64(u11, 0, c0)
  1751  		t0, c0 = bits.Add64(u0, t0, 0)
  1752  		t1, c0 = bits.Add64(u1, t1, c0)
  1753  		t2, c0 = bits.Add64(u2, t2, c0)
  1754  		t3, c0 = bits.Add64(u3, t3, c0)
  1755  		t4, c0 = bits.Add64(u4, t4, c0)
  1756  		t5, c0 = bits.Add64(u5, t5, c0)
  1757  		t6, c0 = bits.Add64(u6, t6, c0)
  1758  		t7, c0 = bits.Add64(u7, t7, c0)
  1759  		t8, c0 = bits.Add64(u8, t8, c0)
  1760  		t9, c0 = bits.Add64(u9, t9, c0)
  1761  		t10, c0 = bits.Add64(u10, t10, c0)
  1762  		c2, _ = bits.Add64(c2, 0, c0)
  1763  		t10, c0 = bits.Add64(t11, t10, 0)
  1764  		t11, _ = bits.Add64(u11, c2, c0)
  1765  
  1766  	}
  1767  	{
  1768  		var c0, c1, c2 uint64
  1769  		v := x[7]
  1770  		u0, c1 = bits.Mul64(v, x[0])
  1771  		t0, c0 = bits.Add64(c1, t0, 0)
  1772  		u1, c1 = bits.Mul64(v, x[1])
  1773  		t1, c0 = bits.Add64(c1, t1, c0)
  1774  		u2, c1 = bits.Mul64(v, x[2])
  1775  		t2, c0 = bits.Add64(c1, t2, c0)
  1776  		u3, c1 = bits.Mul64(v, x[3])
  1777  		t3, c0 = bits.Add64(c1, t3, c0)
  1778  		u4, c1 = bits.Mul64(v, x[4])
  1779  		t4, c0 = bits.Add64(c1, t4, c0)
  1780  		u5, c1 = bits.Mul64(v, x[5])
  1781  		t5, c0 = bits.Add64(c1, t5, c0)
  1782  		u6, c1 = bits.Mul64(v, x[6])
  1783  		t6, c0 = bits.Add64(c1, t6, c0)
  1784  		u7, c1 = bits.Mul64(v, x[7])
  1785  		t7, c0 = bits.Add64(c1, t7, c0)
  1786  		u8, c1 = bits.Mul64(v, x[8])
  1787  		t8, c0 = bits.Add64(c1, t8, c0)
  1788  		u9, c1 = bits.Mul64(v, x[9])
  1789  		t9, c0 = bits.Add64(c1, t9, c0)
  1790  		u10, c1 = bits.Mul64(v, x[10])
  1791  		t10, c0 = bits.Add64(c1, t10, c0)
  1792  		u11, c1 = bits.Mul64(v, x[11])
  1793  		t11, c0 = bits.Add64(c1, t11, c0)
  1794  
  1795  		c2, _ = bits.Add64(0, 0, c0)
  1796  		t1, c0 = bits.Add64(u0, t1, 0)
  1797  		t2, c0 = bits.Add64(u1, t2, c0)
  1798  		t3, c0 = bits.Add64(u2, t3, c0)
  1799  		t4, c0 = bits.Add64(u3, t4, c0)
  1800  		t5, c0 = bits.Add64(u4, t5, c0)
  1801  		t6, c0 = bits.Add64(u5, t6, c0)
  1802  		t7, c0 = bits.Add64(u6, t7, c0)
  1803  		t8, c0 = bits.Add64(u7, t8, c0)
  1804  		t9, c0 = bits.Add64(u8, t9, c0)
  1805  		t10, c0 = bits.Add64(u9, t10, c0)
  1806  		t11, c0 = bits.Add64(u10, t11, c0)
  1807  		c2, _ = bits.Add64(u11, c2, c0)
  1808  
  1809  		m := qInvNeg * t0
  1810  
  1811  		u0, c1 = bits.Mul64(m, q0)
  1812  		_, c0 = bits.Add64(t0, c1, 0)
  1813  		u1, c1 = bits.Mul64(m, q1)
  1814  		t0, c0 = bits.Add64(t1, c1, c0)
  1815  		u2, c1 = bits.Mul64(m, q2)
  1816  		t1, c0 = bits.Add64(t2, c1, c0)
  1817  		u3, c1 = bits.Mul64(m, q3)
  1818  		t2, c0 = bits.Add64(t3, c1, c0)
  1819  		u4, c1 = bits.Mul64(m, q4)
  1820  		t3, c0 = bits.Add64(t4, c1, c0)
  1821  		u5, c1 = bits.Mul64(m, q5)
  1822  		t4, c0 = bits.Add64(t5, c1, c0)
  1823  		u6, c1 = bits.Mul64(m, q6)
  1824  		t5, c0 = bits.Add64(t6, c1, c0)
  1825  		u7, c1 = bits.Mul64(m, q7)
  1826  		t6, c0 = bits.Add64(t7, c1, c0)
  1827  		u8, c1 = bits.Mul64(m, q8)
  1828  		t7, c0 = bits.Add64(t8, c1, c0)
  1829  		u9, c1 = bits.Mul64(m, q9)
  1830  		t8, c0 = bits.Add64(t9, c1, c0)
  1831  		u10, c1 = bits.Mul64(m, q10)
  1832  		t9, c0 = bits.Add64(t10, c1, c0)
  1833  		u11, c1 = bits.Mul64(m, q11)
  1834  
  1835  		t10, c0 = bits.Add64(0, c1, c0)
  1836  		u11, _ = bits.Add64(u11, 0, c0)
  1837  		t0, c0 = bits.Add64(u0, t0, 0)
  1838  		t1, c0 = bits.Add64(u1, t1, c0)
  1839  		t2, c0 = bits.Add64(u2, t2, c0)
  1840  		t3, c0 = bits.Add64(u3, t3, c0)
  1841  		t4, c0 = bits.Add64(u4, t4, c0)
  1842  		t5, c0 = bits.Add64(u5, t5, c0)
  1843  		t6, c0 = bits.Add64(u6, t6, c0)
  1844  		t7, c0 = bits.Add64(u7, t7, c0)
  1845  		t8, c0 = bits.Add64(u8, t8, c0)
  1846  		t9, c0 = bits.Add64(u9, t9, c0)
  1847  		t10, c0 = bits.Add64(u10, t10, c0)
  1848  		c2, _ = bits.Add64(c2, 0, c0)
  1849  		t10, c0 = bits.Add64(t11, t10, 0)
  1850  		t11, _ = bits.Add64(u11, c2, c0)
  1851  
  1852  	}
  1853  	{
  1854  		var c0, c1, c2 uint64
  1855  		v := x[8]
  1856  		u0, c1 = bits.Mul64(v, x[0])
  1857  		t0, c0 = bits.Add64(c1, t0, 0)
  1858  		u1, c1 = bits.Mul64(v, x[1])
  1859  		t1, c0 = bits.Add64(c1, t1, c0)
  1860  		u2, c1 = bits.Mul64(v, x[2])
  1861  		t2, c0 = bits.Add64(c1, t2, c0)
  1862  		u3, c1 = bits.Mul64(v, x[3])
  1863  		t3, c0 = bits.Add64(c1, t3, c0)
  1864  		u4, c1 = bits.Mul64(v, x[4])
  1865  		t4, c0 = bits.Add64(c1, t4, c0)
  1866  		u5, c1 = bits.Mul64(v, x[5])
  1867  		t5, c0 = bits.Add64(c1, t5, c0)
  1868  		u6, c1 = bits.Mul64(v, x[6])
  1869  		t6, c0 = bits.Add64(c1, t6, c0)
  1870  		u7, c1 = bits.Mul64(v, x[7])
  1871  		t7, c0 = bits.Add64(c1, t7, c0)
  1872  		u8, c1 = bits.Mul64(v, x[8])
  1873  		t8, c0 = bits.Add64(c1, t8, c0)
  1874  		u9, c1 = bits.Mul64(v, x[9])
  1875  		t9, c0 = bits.Add64(c1, t9, c0)
  1876  		u10, c1 = bits.Mul64(v, x[10])
  1877  		t10, c0 = bits.Add64(c1, t10, c0)
  1878  		u11, c1 = bits.Mul64(v, x[11])
  1879  		t11, c0 = bits.Add64(c1, t11, c0)
  1880  
  1881  		c2, _ = bits.Add64(0, 0, c0)
  1882  		t1, c0 = bits.Add64(u0, t1, 0)
  1883  		t2, c0 = bits.Add64(u1, t2, c0)
  1884  		t3, c0 = bits.Add64(u2, t3, c0)
  1885  		t4, c0 = bits.Add64(u3, t4, c0)
  1886  		t5, c0 = bits.Add64(u4, t5, c0)
  1887  		t6, c0 = bits.Add64(u5, t6, c0)
  1888  		t7, c0 = bits.Add64(u6, t7, c0)
  1889  		t8, c0 = bits.Add64(u7, t8, c0)
  1890  		t9, c0 = bits.Add64(u8, t9, c0)
  1891  		t10, c0 = bits.Add64(u9, t10, c0)
  1892  		t11, c0 = bits.Add64(u10, t11, c0)
  1893  		c2, _ = bits.Add64(u11, c2, c0)
  1894  
  1895  		m := qInvNeg * t0
  1896  
  1897  		u0, c1 = bits.Mul64(m, q0)
  1898  		_, c0 = bits.Add64(t0, c1, 0)
  1899  		u1, c1 = bits.Mul64(m, q1)
  1900  		t0, c0 = bits.Add64(t1, c1, c0)
  1901  		u2, c1 = bits.Mul64(m, q2)
  1902  		t1, c0 = bits.Add64(t2, c1, c0)
  1903  		u3, c1 = bits.Mul64(m, q3)
  1904  		t2, c0 = bits.Add64(t3, c1, c0)
  1905  		u4, c1 = bits.Mul64(m, q4)
  1906  		t3, c0 = bits.Add64(t4, c1, c0)
  1907  		u5, c1 = bits.Mul64(m, q5)
  1908  		t4, c0 = bits.Add64(t5, c1, c0)
  1909  		u6, c1 = bits.Mul64(m, q6)
  1910  		t5, c0 = bits.Add64(t6, c1, c0)
  1911  		u7, c1 = bits.Mul64(m, q7)
  1912  		t6, c0 = bits.Add64(t7, c1, c0)
  1913  		u8, c1 = bits.Mul64(m, q8)
  1914  		t7, c0 = bits.Add64(t8, c1, c0)
  1915  		u9, c1 = bits.Mul64(m, q9)
  1916  		t8, c0 = bits.Add64(t9, c1, c0)
  1917  		u10, c1 = bits.Mul64(m, q10)
  1918  		t9, c0 = bits.Add64(t10, c1, c0)
  1919  		u11, c1 = bits.Mul64(m, q11)
  1920  
  1921  		t10, c0 = bits.Add64(0, c1, c0)
  1922  		u11, _ = bits.Add64(u11, 0, c0)
  1923  		t0, c0 = bits.Add64(u0, t0, 0)
  1924  		t1, c0 = bits.Add64(u1, t1, c0)
  1925  		t2, c0 = bits.Add64(u2, t2, c0)
  1926  		t3, c0 = bits.Add64(u3, t3, c0)
  1927  		t4, c0 = bits.Add64(u4, t4, c0)
  1928  		t5, c0 = bits.Add64(u5, t5, c0)
  1929  		t6, c0 = bits.Add64(u6, t6, c0)
  1930  		t7, c0 = bits.Add64(u7, t7, c0)
  1931  		t8, c0 = bits.Add64(u8, t8, c0)
  1932  		t9, c0 = bits.Add64(u9, t9, c0)
  1933  		t10, c0 = bits.Add64(u10, t10, c0)
  1934  		c2, _ = bits.Add64(c2, 0, c0)
  1935  		t10, c0 = bits.Add64(t11, t10, 0)
  1936  		t11, _ = bits.Add64(u11, c2, c0)
  1937  
  1938  	}
  1939  	{
  1940  		var c0, c1, c2 uint64
  1941  		v := x[9]
  1942  		u0, c1 = bits.Mul64(v, x[0])
  1943  		t0, c0 = bits.Add64(c1, t0, 0)
  1944  		u1, c1 = bits.Mul64(v, x[1])
  1945  		t1, c0 = bits.Add64(c1, t1, c0)
  1946  		u2, c1 = bits.Mul64(v, x[2])
  1947  		t2, c0 = bits.Add64(c1, t2, c0)
  1948  		u3, c1 = bits.Mul64(v, x[3])
  1949  		t3, c0 = bits.Add64(c1, t3, c0)
  1950  		u4, c1 = bits.Mul64(v, x[4])
  1951  		t4, c0 = bits.Add64(c1, t4, c0)
  1952  		u5, c1 = bits.Mul64(v, x[5])
  1953  		t5, c0 = bits.Add64(c1, t5, c0)
  1954  		u6, c1 = bits.Mul64(v, x[6])
  1955  		t6, c0 = bits.Add64(c1, t6, c0)
  1956  		u7, c1 = bits.Mul64(v, x[7])
  1957  		t7, c0 = bits.Add64(c1, t7, c0)
  1958  		u8, c1 = bits.Mul64(v, x[8])
  1959  		t8, c0 = bits.Add64(c1, t8, c0)
  1960  		u9, c1 = bits.Mul64(v, x[9])
  1961  		t9, c0 = bits.Add64(c1, t9, c0)
  1962  		u10, c1 = bits.Mul64(v, x[10])
  1963  		t10, c0 = bits.Add64(c1, t10, c0)
  1964  		u11, c1 = bits.Mul64(v, x[11])
  1965  		t11, c0 = bits.Add64(c1, t11, c0)
  1966  
  1967  		c2, _ = bits.Add64(0, 0, c0)
  1968  		t1, c0 = bits.Add64(u0, t1, 0)
  1969  		t2, c0 = bits.Add64(u1, t2, c0)
  1970  		t3, c0 = bits.Add64(u2, t3, c0)
  1971  		t4, c0 = bits.Add64(u3, t4, c0)
  1972  		t5, c0 = bits.Add64(u4, t5, c0)
  1973  		t6, c0 = bits.Add64(u5, t6, c0)
  1974  		t7, c0 = bits.Add64(u6, t7, c0)
  1975  		t8, c0 = bits.Add64(u7, t8, c0)
  1976  		t9, c0 = bits.Add64(u8, t9, c0)
  1977  		t10, c0 = bits.Add64(u9, t10, c0)
  1978  		t11, c0 = bits.Add64(u10, t11, c0)
  1979  		c2, _ = bits.Add64(u11, c2, c0)
  1980  
  1981  		m := qInvNeg * t0
  1982  
  1983  		u0, c1 = bits.Mul64(m, q0)
  1984  		_, c0 = bits.Add64(t0, c1, 0)
  1985  		u1, c1 = bits.Mul64(m, q1)
  1986  		t0, c0 = bits.Add64(t1, c1, c0)
  1987  		u2, c1 = bits.Mul64(m, q2)
  1988  		t1, c0 = bits.Add64(t2, c1, c0)
  1989  		u3, c1 = bits.Mul64(m, q3)
  1990  		t2, c0 = bits.Add64(t3, c1, c0)
  1991  		u4, c1 = bits.Mul64(m, q4)
  1992  		t3, c0 = bits.Add64(t4, c1, c0)
  1993  		u5, c1 = bits.Mul64(m, q5)
  1994  		t4, c0 = bits.Add64(t5, c1, c0)
  1995  		u6, c1 = bits.Mul64(m, q6)
  1996  		t5, c0 = bits.Add64(t6, c1, c0)
  1997  		u7, c1 = bits.Mul64(m, q7)
  1998  		t6, c0 = bits.Add64(t7, c1, c0)
  1999  		u8, c1 = bits.Mul64(m, q8)
  2000  		t7, c0 = bits.Add64(t8, c1, c0)
  2001  		u9, c1 = bits.Mul64(m, q9)
  2002  		t8, c0 = bits.Add64(t9, c1, c0)
  2003  		u10, c1 = bits.Mul64(m, q10)
  2004  		t9, c0 = bits.Add64(t10, c1, c0)
  2005  		u11, c1 = bits.Mul64(m, q11)
  2006  
  2007  		t10, c0 = bits.Add64(0, c1, c0)
  2008  		u11, _ = bits.Add64(u11, 0, c0)
  2009  		t0, c0 = bits.Add64(u0, t0, 0)
  2010  		t1, c0 = bits.Add64(u1, t1, c0)
  2011  		t2, c0 = bits.Add64(u2, t2, c0)
  2012  		t3, c0 = bits.Add64(u3, t3, c0)
  2013  		t4, c0 = bits.Add64(u4, t4, c0)
  2014  		t5, c0 = bits.Add64(u5, t5, c0)
  2015  		t6, c0 = bits.Add64(u6, t6, c0)
  2016  		t7, c0 = bits.Add64(u7, t7, c0)
  2017  		t8, c0 = bits.Add64(u8, t8, c0)
  2018  		t9, c0 = bits.Add64(u9, t9, c0)
  2019  		t10, c0 = bits.Add64(u10, t10, c0)
  2020  		c2, _ = bits.Add64(c2, 0, c0)
  2021  		t10, c0 = bits.Add64(t11, t10, 0)
  2022  		t11, _ = bits.Add64(u11, c2, c0)
  2023  
  2024  	}
  2025  	{
  2026  		var c0, c1, c2 uint64
  2027  		v := x[10]
  2028  		u0, c1 = bits.Mul64(v, x[0])
  2029  		t0, c0 = bits.Add64(c1, t0, 0)
  2030  		u1, c1 = bits.Mul64(v, x[1])
  2031  		t1, c0 = bits.Add64(c1, t1, c0)
  2032  		u2, c1 = bits.Mul64(v, x[2])
  2033  		t2, c0 = bits.Add64(c1, t2, c0)
  2034  		u3, c1 = bits.Mul64(v, x[3])
  2035  		t3, c0 = bits.Add64(c1, t3, c0)
  2036  		u4, c1 = bits.Mul64(v, x[4])
  2037  		t4, c0 = bits.Add64(c1, t4, c0)
  2038  		u5, c1 = bits.Mul64(v, x[5])
  2039  		t5, c0 = bits.Add64(c1, t5, c0)
  2040  		u6, c1 = bits.Mul64(v, x[6])
  2041  		t6, c0 = bits.Add64(c1, t6, c0)
  2042  		u7, c1 = bits.Mul64(v, x[7])
  2043  		t7, c0 = bits.Add64(c1, t7, c0)
  2044  		u8, c1 = bits.Mul64(v, x[8])
  2045  		t8, c0 = bits.Add64(c1, t8, c0)
  2046  		u9, c1 = bits.Mul64(v, x[9])
  2047  		t9, c0 = bits.Add64(c1, t9, c0)
  2048  		u10, c1 = bits.Mul64(v, x[10])
  2049  		t10, c0 = bits.Add64(c1, t10, c0)
  2050  		u11, c1 = bits.Mul64(v, x[11])
  2051  		t11, c0 = bits.Add64(c1, t11, c0)
  2052  
  2053  		c2, _ = bits.Add64(0, 0, c0)
  2054  		t1, c0 = bits.Add64(u0, t1, 0)
  2055  		t2, c0 = bits.Add64(u1, t2, c0)
  2056  		t3, c0 = bits.Add64(u2, t3, c0)
  2057  		t4, c0 = bits.Add64(u3, t4, c0)
  2058  		t5, c0 = bits.Add64(u4, t5, c0)
  2059  		t6, c0 = bits.Add64(u5, t6, c0)
  2060  		t7, c0 = bits.Add64(u6, t7, c0)
  2061  		t8, c0 = bits.Add64(u7, t8, c0)
  2062  		t9, c0 = bits.Add64(u8, t9, c0)
  2063  		t10, c0 = bits.Add64(u9, t10, c0)
  2064  		t11, c0 = bits.Add64(u10, t11, c0)
  2065  		c2, _ = bits.Add64(u11, c2, c0)
  2066  
  2067  		m := qInvNeg * t0
  2068  
  2069  		u0, c1 = bits.Mul64(m, q0)
  2070  		_, c0 = bits.Add64(t0, c1, 0)
  2071  		u1, c1 = bits.Mul64(m, q1)
  2072  		t0, c0 = bits.Add64(t1, c1, c0)
  2073  		u2, c1 = bits.Mul64(m, q2)
  2074  		t1, c0 = bits.Add64(t2, c1, c0)
  2075  		u3, c1 = bits.Mul64(m, q3)
  2076  		t2, c0 = bits.Add64(t3, c1, c0)
  2077  		u4, c1 = bits.Mul64(m, q4)
  2078  		t3, c0 = bits.Add64(t4, c1, c0)
  2079  		u5, c1 = bits.Mul64(m, q5)
  2080  		t4, c0 = bits.Add64(t5, c1, c0)
  2081  		u6, c1 = bits.Mul64(m, q6)
  2082  		t5, c0 = bits.Add64(t6, c1, c0)
  2083  		u7, c1 = bits.Mul64(m, q7)
  2084  		t6, c0 = bits.Add64(t7, c1, c0)
  2085  		u8, c1 = bits.Mul64(m, q8)
  2086  		t7, c0 = bits.Add64(t8, c1, c0)
  2087  		u9, c1 = bits.Mul64(m, q9)
  2088  		t8, c0 = bits.Add64(t9, c1, c0)
  2089  		u10, c1 = bits.Mul64(m, q10)
  2090  		t9, c0 = bits.Add64(t10, c1, c0)
  2091  		u11, c1 = bits.Mul64(m, q11)
  2092  
  2093  		t10, c0 = bits.Add64(0, c1, c0)
  2094  		u11, _ = bits.Add64(u11, 0, c0)
  2095  		t0, c0 = bits.Add64(u0, t0, 0)
  2096  		t1, c0 = bits.Add64(u1, t1, c0)
  2097  		t2, c0 = bits.Add64(u2, t2, c0)
  2098  		t3, c0 = bits.Add64(u3, t3, c0)
  2099  		t4, c0 = bits.Add64(u4, t4, c0)
  2100  		t5, c0 = bits.Add64(u5, t5, c0)
  2101  		t6, c0 = bits.Add64(u6, t6, c0)
  2102  		t7, c0 = bits.Add64(u7, t7, c0)
  2103  		t8, c0 = bits.Add64(u8, t8, c0)
  2104  		t9, c0 = bits.Add64(u9, t9, c0)
  2105  		t10, c0 = bits.Add64(u10, t10, c0)
  2106  		c2, _ = bits.Add64(c2, 0, c0)
  2107  		t10, c0 = bits.Add64(t11, t10, 0)
  2108  		t11, _ = bits.Add64(u11, c2, c0)
  2109  
  2110  	}
  2111  	{
  2112  		var c0, c1, c2 uint64
  2113  		v := x[11]
  2114  		u0, c1 = bits.Mul64(v, x[0])
  2115  		t0, c0 = bits.Add64(c1, t0, 0)
  2116  		u1, c1 = bits.Mul64(v, x[1])
  2117  		t1, c0 = bits.Add64(c1, t1, c0)
  2118  		u2, c1 = bits.Mul64(v, x[2])
  2119  		t2, c0 = bits.Add64(c1, t2, c0)
  2120  		u3, c1 = bits.Mul64(v, x[3])
  2121  		t3, c0 = bits.Add64(c1, t3, c0)
  2122  		u4, c1 = bits.Mul64(v, x[4])
  2123  		t4, c0 = bits.Add64(c1, t4, c0)
  2124  		u5, c1 = bits.Mul64(v, x[5])
  2125  		t5, c0 = bits.Add64(c1, t5, c0)
  2126  		u6, c1 = bits.Mul64(v, x[6])
  2127  		t6, c0 = bits.Add64(c1, t6, c0)
  2128  		u7, c1 = bits.Mul64(v, x[7])
  2129  		t7, c0 = bits.Add64(c1, t7, c0)
  2130  		u8, c1 = bits.Mul64(v, x[8])
  2131  		t8, c0 = bits.Add64(c1, t8, c0)
  2132  		u9, c1 = bits.Mul64(v, x[9])
  2133  		t9, c0 = bits.Add64(c1, t9, c0)
  2134  		u10, c1 = bits.Mul64(v, x[10])
  2135  		t10, c0 = bits.Add64(c1, t10, c0)
  2136  		u11, c1 = bits.Mul64(v, x[11])
  2137  		t11, c0 = bits.Add64(c1, t11, c0)
  2138  
  2139  		c2, _ = bits.Add64(0, 0, c0)
  2140  		t1, c0 = bits.Add64(u0, t1, 0)
  2141  		t2, c0 = bits.Add64(u1, t2, c0)
  2142  		t3, c0 = bits.Add64(u2, t3, c0)
  2143  		t4, c0 = bits.Add64(u3, t4, c0)
  2144  		t5, c0 = bits.Add64(u4, t5, c0)
  2145  		t6, c0 = bits.Add64(u5, t6, c0)
  2146  		t7, c0 = bits.Add64(u6, t7, c0)
  2147  		t8, c0 = bits.Add64(u7, t8, c0)
  2148  		t9, c0 = bits.Add64(u8, t9, c0)
  2149  		t10, c0 = bits.Add64(u9, t10, c0)
  2150  		t11, c0 = bits.Add64(u10, t11, c0)
  2151  		c2, _ = bits.Add64(u11, c2, c0)
  2152  
  2153  		m := qInvNeg * t0
  2154  
  2155  		u0, c1 = bits.Mul64(m, q0)
  2156  		_, c0 = bits.Add64(t0, c1, 0)
  2157  		u1, c1 = bits.Mul64(m, q1)
  2158  		t0, c0 = bits.Add64(t1, c1, c0)
  2159  		u2, c1 = bits.Mul64(m, q2)
  2160  		t1, c0 = bits.Add64(t2, c1, c0)
  2161  		u3, c1 = bits.Mul64(m, q3)
  2162  		t2, c0 = bits.Add64(t3, c1, c0)
  2163  		u4, c1 = bits.Mul64(m, q4)
  2164  		t3, c0 = bits.Add64(t4, c1, c0)
  2165  		u5, c1 = bits.Mul64(m, q5)
  2166  		t4, c0 = bits.Add64(t5, c1, c0)
  2167  		u6, c1 = bits.Mul64(m, q6)
  2168  		t5, c0 = bits.Add64(t6, c1, c0)
  2169  		u7, c1 = bits.Mul64(m, q7)
  2170  		t6, c0 = bits.Add64(t7, c1, c0)
  2171  		u8, c1 = bits.Mul64(m, q8)
  2172  		t7, c0 = bits.Add64(t8, c1, c0)
  2173  		u9, c1 = bits.Mul64(m, q9)
  2174  		t8, c0 = bits.Add64(t9, c1, c0)
  2175  		u10, c1 = bits.Mul64(m, q10)
  2176  		t9, c0 = bits.Add64(t10, c1, c0)
  2177  		u11, c1 = bits.Mul64(m, q11)
  2178  
  2179  		t10, c0 = bits.Add64(0, c1, c0)
  2180  		u11, _ = bits.Add64(u11, 0, c0)
  2181  		t0, c0 = bits.Add64(u0, t0, 0)
  2182  		t1, c0 = bits.Add64(u1, t1, c0)
  2183  		t2, c0 = bits.Add64(u2, t2, c0)
  2184  		t3, c0 = bits.Add64(u3, t3, c0)
  2185  		t4, c0 = bits.Add64(u4, t4, c0)
  2186  		t5, c0 = bits.Add64(u5, t5, c0)
  2187  		t6, c0 = bits.Add64(u6, t6, c0)
  2188  		t7, c0 = bits.Add64(u7, t7, c0)
  2189  		t8, c0 = bits.Add64(u8, t8, c0)
  2190  		t9, c0 = bits.Add64(u9, t9, c0)
  2191  		t10, c0 = bits.Add64(u10, t10, c0)
  2192  		c2, _ = bits.Add64(c2, 0, c0)
  2193  		t10, c0 = bits.Add64(t11, t10, 0)
  2194  		t11, _ = bits.Add64(u11, c2, c0)
  2195  
  2196  	}
  2197  	z[0] = t0
  2198  	z[1] = t1
  2199  	z[2] = t2
  2200  	z[3] = t3
  2201  	z[4] = t4
  2202  	z[5] = t5
  2203  	z[6] = t6
  2204  	z[7] = t7
  2205  	z[8] = t8
  2206  	z[9] = t9
  2207  	z[10] = t10
  2208  	z[11] = t11
  2209  
  2210  	// if z ⩾ q → z -= q
  2211  	if !z.smallerThanModulus() {
  2212  		var b uint64
  2213  		z[0], b = bits.Sub64(z[0], q0, 0)
  2214  		z[1], b = bits.Sub64(z[1], q1, b)
  2215  		z[2], b = bits.Sub64(z[2], q2, b)
  2216  		z[3], b = bits.Sub64(z[3], q3, b)
  2217  		z[4], b = bits.Sub64(z[4], q4, b)
  2218  		z[5], b = bits.Sub64(z[5], q5, b)
  2219  		z[6], b = bits.Sub64(z[6], q6, b)
  2220  		z[7], b = bits.Sub64(z[7], q7, b)
  2221  		z[8], b = bits.Sub64(z[8], q8, b)
  2222  		z[9], b = bits.Sub64(z[9], q9, b)
  2223  		z[10], b = bits.Sub64(z[10], q10, b)
  2224  		z[11], _ = bits.Sub64(z[11], q11, b)
  2225  	}
  2226  	return z
  2227  }